|
|
@@ -67,7 +67,11 @@ lxc.cgroup.devices.allow = c 10:200 rwm
|
|
|
|
|
|
|
|
|
# standard mount point
|
|
|
+# WARNING: procfs is a known attack vector and should probably be disabled
|
|
|
+# if your userspace allows it. eg. see http://blog.zx2c4.com/749
|
|
|
lxc.mount.entry = proc {{$ROOTFS}}/proc proc nosuid,nodev,noexec 0 0
|
|
|
+# WARNING: sysfs is a known attack vector and should probably be disabled
|
|
|
+# if your userspace allows it. eg. see http://bit.ly/T9CkqJ
|
|
|
lxc.mount.entry = sysfs {{$ROOTFS}}/sys sysfs nosuid,nodev,noexec 0 0
|
|
|
lxc.mount.entry = devpts {{$ROOTFS}}/dev/pts devpts newinstance,ptmxmode=0666,nosuid,noexec 0 0
|
|
|
#lxc.mount.entry = varrun {{$ROOTFS}}/var/run tmpfs mode=755,size=4096k,nosuid,nodev,noexec 0 0
|
|
|
@@ -86,6 +90,9 @@ lxc.mount.entry = {{$realPath}} {{$ROOTFS}}/{{$virtualPath}} none bind,rw 0 0
|
|
|
{{end}}
|
|
|
|
|
|
# drop linux capabilities (apply mainly to the user root in the container)
|
|
|
+# (Note: 'lxc.cap.keep' is coming soon and should replace this under the
|
|
|
+# security principle 'deny all unless explicitly permitted', see
|
|
|
+# http://sourceforge.net/mailarchive/message.php?msg_id=31054627 )
|
|
|
lxc.cap.drop = audit_control audit_write mac_admin mac_override mknod setfcap setpcap sys_admin sys_boot sys_module sys_nice sys_pacct sys_rawio sys_resource sys_time sys_tty_config
|
|
|
|
|
|
# limits
|
Guillaume J. Charmes