mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-08-29 19:19:52 +00:00
Code Issues Releases Wiki Activity

Add setpcap capabilty to be able to drop the sys_boot capabilty.

Browse Source 
From: Daniel Lezcano <dlezcano@fr.ibm.com>

Previously, we dropped the CAP_SYS_BOOT capabilty. Unfortunatly if we are
non root user, we are not able to do that. So I had the CAP_SETPCAP to
lxc-execute and lxc-start command line to remove this capabilty.

Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com>
This commit is contained in:
dlezcano 2008-11-13 16:53:23 +00:00
parent 0652697525
commit 0780e34389
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lxc.spec.in
View File

@ -123,7 +123,10 @@ if [ $RES != 0 ]; then
echo -e "\t* and reinstall the lxc package *"
echo -e "\t****************************************************"
else
setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep %{_bindir}/lxc-execute && setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep %{_bindir}/lxc-start && setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep %{_bindir}/lxc-restart
setcap cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep %{_bindir}/lxc-execute && \
setcap cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep %{_bindir}/lxc-start && \
setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep %{_bindir}/lxc-restart && \
setcap cap_sys_admin=ep %{_bindir}/lxc-init
fi

5
src/lxc/Makefile.am
View File

@ -116,9 +116,10 @@ lxc_version_LDADD = liblxc.la
install-exec-local:
-@export PATH=$$PATH:/sbin:/usr/sbin && \
setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep $(bindir)/lxc-execute && \
setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep $(bindir)/lxc-start && \
setcap cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep $(bindir)/lxc-execute && \
setcap cap_setpcap,cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep $(bindir)/lxc-start && \
setcap cap_net_admin,cap_net_raw,cap_sys_admin,cap_dac_override=ep $(bindir)/lxc-restart && \
setcap cap_sys_admin=ep $(bindir)/lxc-init && \
mkdir -p $(prefix)/var/lxc && \
chmod ugo+rw $(prefix)/var/lxc || \
(echo && echo && \