Mailinglist Archive: opensuse-buildservice (256 mails)

[Dinar Valeev <dinarv@xxxxxxxxx>]

On Mon, Aug 1, 2011 at 7:25 AM, Bernhard M. Wiedemann
<bernhardout@xxxxxxxx> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 07/28/2011 12:33 PM, Bernhard M. Wiedemann wrote:
> > On 07/28/2011 11:59 AM, Dinar Valeev wrote:
> > > /usr/lib/build/lxc.conf :
> >
> > > # allow to create any device nodes - but not access
> > > lxc.cgroup.devices.allow = c *:* m
> > > lxc.cgroup.devices.allow = b *:* m
> > > # /dev/pts/*
> > > lxc.cgroup.devices.allow = c 136:* rw
> > > lxc.tty = 1
> > > > Is this secure?
> >
> > I understood the lxc config format to have "rw" for read+write access
> > to devices but the top two lines only have the "m" flag to allow only
> > mknod - unluckily man lxc.conf does not tell.
> > The lower two lines _could_ allow access to the host's pseudo
> > terminals. Not sure how dangerous that is.
>
> I did some more researching.
> The first lines are secure:
>
> lxc-start -n build-root -- /bin/mknod /tmp/devnode c 199 199
> lxc-start -n build-root -- /bin/cat /tmp/devnode
> /bin/cat: /tmp/devnode: Operation not permitted
>
> the pts devs did get to the host, so could be problematic, but this
> stopped when I added to lxc.conf:
> lxc.pts = 1024
>
> but since I am not much into LXC, this might break other things.
>
>
>
> I also noticed that when building with LXC, the live log stops early after
> copying packages...
> reordering...
>
> and when you click "Start Refresh" you see that a new log was started at:
> processing specfile /.build-srcdir/binutils.spec

That's weird I haven't notice that. AFAIK, log should be collected
through screen log.
And there is not so much differences for lxc/kvm/chroot. I'll check that.

> Ciao
> Bernhard M.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (GNU/Linux)
> Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk42OMMACgkQSTYLOx37oWTZggCg2MTFImB9kG6Uy7nsuyFzWAai
> YEgAnAgySnMP0kj2JY7rhh+/289mEInd
> =cecq
> -----END PGP SIGNATURE-----
> --
> To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
> For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx
-- 
To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx