From c33bdec826338ce0b6da5c29101499cd139d6c1a Mon Sep 17 00:00:00 2001 From: Petar Koretic Date: Thu, 30 Oct 2014 12:41:49 +0000 Subject: [PATCH] openwrt: add common configuration file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This adds OpenWrt common config file. Signed-off-by: Petar Koretic CC: Luka Perkov Acked-by: Stéphane Graber --- config/templates/Makefile.am | 1 + config/templates/openwrt.common.conf.in | 56 +++++++++++++++++++++++++ configure.ac | 1 + 3 files changed, 58 insertions(+) create mode 100644 config/templates/openwrt.common.conf.in diff --git a/config/templates/Makefile.am b/config/templates/Makefile.am index 82ca8be1bf..fdbf9d298a 100644 --- a/config/templates/Makefile.am +++ b/config/templates/Makefile.am @@ -28,4 +28,5 @@ templatesconfig_DATA = \ ubuntu.common.conf \ ubuntu.lucid.conf \ ubuntu.userns.conf \ + openwrt.common.conf \ userns.conf diff --git a/config/templates/openwrt.common.conf.in b/config/templates/openwrt.common.conf.in new file mode 100644 index 0000000000..05918f0570 --- /dev/null +++ b/config/templates/openwrt.common.conf.in @@ -0,0 +1,56 @@ +# Default mount entries +lxc.mount.entry = proc proc proc nodev,noexec,nosuid 0 0 +lxc.mount.entry = sysfs sys sysfs defaults 0 0 + +# Default console settings +lxc.devttydir = lxc +lxc.tty = 4 +lxc.pts = 1024 + +# Default capabilities +lxc.cap.drop = mac_admin +lxc.cap.drop = mac_override +lxc.cap.drop = sys_admin +lxc.cap.drop = sys_module +lxc.cap.drop = sys_nice +lxc.cap.drop = sys_pacct +lxc.cap.drop = sys_ptrace +lxc.cap.drop = sys_rawio +lxc.cap.drop = sys_resource +lxc.cap.drop = sys_time +lxc.cap.drop = sys_tty_config +lxc.cap.drop = syslog +lxc.cap.drop = wake_alarm + +# Default cgroups - all denied except those whitelisted +lxc.cgroup.devices.deny = a +## /dev/null and zero +lxc.cgroup.devices.allow = c 1:3 rwm +lxc.cgroup.devices.allow = c 1:5 rwm +## consoles +lxc.cgroup.devices.allow = c 5:0 rwm +lxc.cgroup.devices.allow = c 5:1 rwm +## /dev/{,u}random +lxc.cgroup.devices.allow = c 1:8 rwm +lxc.cgroup.devices.allow = c 1:9 rwm +## /dev/pts/* +lxc.cgroup.devices.allow = c 5:2 rwm +lxc.cgroup.devices.allow = c 136:* rwm +## rtc +lxc.cgroup.devices.allow = c 254:0 rm +## fuse +lxc.cgroup.devices.allow = c 10:229 rwm +## tun +lxc.cgroup.devices.allow = c 10:200 rwm +## dev/tty0 +lxc.cgroup.devices.allow = c 4:0 rwm +## dev/tty1 +lxc.cgroup.devices.allow = c 4:1 rwm + +## To use loop devices, copy the following line to the container's +## configuration file (uncommented). +#lxc.cgroup.devices.allow = b 7:* rwm + +# Blacklist some syscalls which are not safe in privileged +# containers +lxc.seccomp = /usr/share/lxc/config/common.seccomp diff --git a/configure.ac b/configure.ac index 5f9774b641..1d9634ec20 100644 --- a/configure.ac +++ b/configure.ac @@ -646,6 +646,7 @@ AC_CONFIG_FILES([ config/templates/ubuntu.common.conf config/templates/ubuntu.lucid.conf config/templates/ubuntu.userns.conf + config/templates/openwrt.common.conf config/templates/userns.conf config/yum/Makefile config/sysconfig/Makefile