← Back to branch summary

~serge-hallyn/ubuntu/quantal/lxc/lxc-fixapi

« back to all changes in this revision

Viewing changes to README

  • Committer: Package Import Robot
  • Author(s): Serge Hallyn, Stéphane Graber, Serge Hallyn
  • Date: 2012-08-08 10:43:06 UTC
  • Revision ID: package-import@ubuntu.com-20120808104306-2s7xdim4rvt0e2k6
Tags: 0.8.0~rc1-4ubuntu22
[ Stéphane Graber ]
* Fix call to echo in lxc-start-ephemeral that was literally showing
  '$LXC_BASE' instead of the variable's value.

[ Serge Hallyn ]
* Introduce support for seccomp.

Show diffs side-by-side

added added

removed removed

Lines of Context:
README
52
52
 
53
53
AUTHOR
54
54
       Daniel Lezcano <daniel.lezcano@free.fr>
 
55
 
 
56
Seccomp with LXC
 
57
----------------
 
58
 
 
59
To restrict a container with seccomp, you must specify a profile which is
 
60
basically a whitelist of system calls it may execute.  In the container
 
61
config file, add a line like
 
62
 
 
63
lxc.seccomp = /var/lib/lxc/q1/seccomp.full
 
64
 
 
65
I created a usable (but basically worthless) seccomp.full file using
 
66
 
 
67
cat > seccomp.full << EOF
 
68
1
 
69
whitelist
 
70
EOF
 
71
for i in `seq 0 300`; do
 
72
        echo $i >> secomp.full
 
73
done
 
74
for i in `seq 1024 1079`; do
 
75
        echo $i >> seccomp.full
 
76
done
 
77
 
 
78
 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Fri, 27 Jul 2012 15:47:02 +0600