Mailinglist Archive: opensuse-buildservice (256 mails)

< Previous Next >
Re: [opensuse-buildservice] HowTo build with LXC for OBS
  • From: Dinar Valeev <dinarv@xxxxxxxxx>
  • Date: Mon, 1 Aug 2011 10:53:16 +0200
  • Message-id: <CADqALGQeL-ijzyVsTMRkLyXSuVWy3vYTtPgFG=v5Yt+HzuTuzA@mail.gmail.com>
On Mon, Aug 1, 2011 at 7:25 AM, Bernhard M. Wiedemann
<bernhardout@xxxxxxxx> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/28/2011 12:33 PM, Bernhard M. Wiedemann wrote:
On 07/28/2011 11:59 AM, Dinar Valeev wrote:
/usr/lib/build/lxc.conf :

# allow to create any device nodes - but not access
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
# /dev/pts/*
lxc.cgroup.devices.allow = c 136:* rw
lxc.tty = 1
Is this secure?

I understood the lxc config format to have "rw" for read+write access
to devices but the top two lines only have the "m" flag to allow only
mknod - unluckily man lxc.conf does not tell.
The lower two lines _could_ allow access to the host's pseudo
terminals. Not sure how dangerous that is.

I did some more researching.
The first lines are secure:

lxc-start -n build-root -- /bin/mknod /tmp/devnode c 199 199
lxc-start -n build-root -- /bin/cat /tmp/devnode
/bin/cat: /tmp/devnode: Operation not permitted

the pts devs did get to the host, so could be problematic, but this
stopped when I added to lxc.conf:
lxc.pts = 1024

but since I am not much into LXC, this might break other things.



I also noticed that when building with LXC, the live log stops early after
copying packages...
reordering...

and when you click "Start Refresh" you see that a new log was started at:
processing specfile /.build-srcdir/binutils.spec

That's weird I haven't notice that. AFAIK, log should be collected
through screen log.
And there is not so much differences for lxc/kvm/chroot. I'll check that.

Ciao
Bernhard M.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAk42OMMACgkQSTYLOx37oWTZggCg2MTFImB9kG6Uy7nsuyFzWAai
YEgAnAgySnMP0kj2JY7rhh+/289mEInd
=cecq
-----END PGP SIGNATURE-----
--
To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx


--
To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx

< Previous Next >
List Navigation