how to do not allow to mount /cgroup inside container?
krzysztof.taraszka at gnuhosting.net
Tue Aug 25 13:12:05 PDT 2009
2009/8/25 Serge E. Hallyn <serue at us.ibm.com>
> Quoting Krzysztof Taraszka (krzysztof.taraszka at gnuhosting.net):
> > 2009/8/25 Serge E. Hallyn <serue at us.ibm.com>
> > > Quoting Daniel Lezcano (daniel.lezcano at free.fr):
> > > > Krzysztof Taraszka wrote:
> > > >> Hi,
> > > >>
> > > >> I was looking for possibility to secure lxc container to do not
> > > 'root
> > > >> container user' from changing limits from cgroup. Right now without
> > > STACK64
> > > >> or SELinux he can do this easily.
> > > >> I read the
> > >
> > > >> and decided to use STACK64 kernel mechanism.
> > > >> Well... mounting cgroup inside container fails (great!, i am looked
> > > that
> > > >> ;)) but networking fails too (interface bring up, sshd bring up,
> > > connection
> > > >> beetween host and container is, but 'mtr', 'ping' even 'apt-get
> > > >> fails and I do not know why). I secure my container exactly like in
> > > >> cookbook.
> > >
> > > Yeah, smack's use of cipso can make things tricky, and it's possible
> > > have changed a bit recently. Although I'm currently running smack in
> > > everyday s390 kernel to test checkpointing of its labels, and
> > > is working fine.
> > > Can you give me a few details - what distro, smack policy, and precise
> > > kernel
> > > version are you using, for starters?
> > >
> > debian lenny amd64,
> > kernel 220.127.116.11
> > lxc-tools from git
> > lxc1amd64:~# cat /etc/smackaccesses
> > debian _ rwa
> > _ debian rwa
> > _ host rwax
> > host _ rwax
> Ok, I think what you want to do is use /smack/netlabel as shown around line
> 425 in linux-2.6/Documentation/Smack.txt. I haven't played with it yet,
> but will tomorrow if you don't get a chance. So basically I think you
> be able to do:
> echo 127.0.0.1 -CIPSO > /smack/netlabel
> echo 0.0.0.0/0 @ > /smack/netlabel
> to open up the network.
> Does that work?
Anyway - are you going to update your cookbook on the ibm webpage?
More information about the Containers