X-Git-Url: https://git.stderr.nl/gitweb?a=blobdiff_plain;f=var%2Flib%2Flxc%2Ftemplate%2Fconfig;h=0509ae6e49d6b90e50a783e19adbdf1d8ed25fa2;hb=a08ca92cb5112693560c9b2d8454f49d56a23230;hp=315bbb417c9a866b9b5b6c025787d28aafae326a;hpb=cca087cba91626731d458a22770d473037f9ffd2;p=matthijs%2Fservers%2Ftika.git

diff --git a/var/lib/lxc/template/config b/var/lib/lxc/template/config
index 315bbb4..0509ae6 100644
--- a/var/lib/lxc/template/config
+++ b/var/lib/lxc/template/config
@@ -2,7 +2,7 @@
 lxc.utsname = template
 
 # Use this root filesystem
-lxc.rootfs = /var/lib/lxc/template/rootfs
+lxc.rootfs = /containers/template
 
 # Log console output
 lxc.console = /var/log/lxc/template.lxc
@@ -49,6 +49,21 @@ lxc.cgroup.devices.allow = c 5:2 rwm
 # rtc
 lxc.cgroup.devices.allow = c 254:0 rwm
 
-# mounts point
-lxc.mount.entry=proc /var/lib/lxc/template/rootfs/proc proc nodev,noexec,nosuid 0 0
-lxc.mount.entry=sysfs /var/lib/lxc/template/rootfs/sys sysfs defaults  0 0
+# mounts (note that the second item in each list is the mount point, relative
+# to the rootfs)
+lxc.mount.entry=proc proc proc nodev,noexec,nosuid 0 0
+lxc.mount.entry=sysfs sys sysfs defaults  0 0
+
+# Disallow module (un)loading
+lxc.cap.drop = sys_module
+# Disallow doing raw io
+lxc.cap.drop = sys_rawio
+# Disallow changing the clock
+lxc.cap.drop = sys_time
+# Disallow changing network settings
+lxc.cap.drop = net_admin
+# Disallow changing auditing settings
+lxc.cap.drop = audit_control
+# Disallow various admin tasks (probably has side-effects)
+lxc.cap.drop = sys_admin
+# sys_boot is always dropped by lxc-start