Is is possible to enable sys_boot lxc cap?

[kiorky]

Is is possible not to drop sys_boot lxc cap ?

This allow upstart and other /sbin/init based containers to support 'shutdown' and 'reboot' from within
See and #1960 & #2276

cc @regilero

[kiorky]

Basically and obiously, sys_cap_boot is called there and on a container, do not touch to the host....

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/kernel/reboot.c?id=refs/tags/v3.12-rc6#n223

[kiorky]

And implementation of the restart is there : https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/kernel/pid_namespace.c#n281

[jpetazzo]

Good news; according to @jpoimboe:

A quick search of the lxc utils code shows that it does a reboot
capability check similar to what libvirt does (I think). So it looks
like you should be able to always keep CAP_SYS_BOOT and rely on the
underlying container backend to decide whether to drop it.

Green light on this, then!

[kiorky]

It is better, nevertheless to have this kind of safeguard at a kernel level, did you suceeded in getting back in touch with rhel ppl ?

[jpetazzo]

Josh Poimboeuf is one of the RH guys (specifically, working on libvirt-lxc integration :-))

[jpetazzo]

Oh wait, it looks like the reboot capability check isn't present in 0.7.5 (which is the version currently recommended to run Docker, since it ships with Ubuntu 12.04 LTS); it was added only in 0.8 it seems.

This is the check in latest version:
https://github.com/lxc/lxc/blob/cbef6c52bea93130abd8920c4b4dd1780548ac7b/src/lxc/start.c#L441

It's in 0.8:
https://github.com/lxc/lxc/blob/lxc-0.8.0/src/lxc/start.c#L434

But not 0.7.5:
https://github.com/lxc/lxc/blob/lxc-0.7.5/src/lxc/start.c

So back to square one. Maybe Docker could do the capability check somehow... That requires some extra steps.

[jpoimboe]

Oops, sorry @jpetazzo. Though my statement is still always true for libvirt-lxc ;-)

The capability check and drop could be done in dockerinit. In fact my docker libvirt branch (which I'm currently working on rebasing to 0.7-rc4) already drops capabilities from dockerinit, so it's halfway there at least.

[jpetazzo]

Any reason why it should be done in dockerinit vs. at "runtime detection" (as is done for other things)?
(Just inquiring.)

[jpoimboe]

I think the reboot capability checking has to be done from within a container. Here's an lxc tools comment describing it:

/*
 * reboot(LINUX_REBOOT_CMD_CAD_ON) will return -EINVAL
 * in a child pid namespace if container reboot support exists.
 * Otherwise, it will either succeed or return -EPERM.
 */

[jpetazzo]

Right, makes sense. So dockerinit!