Mailinglist Archive: opensuse-buildservice (256 mails)

< Previous Next >
Re: [opensuse-buildservice] HowTo build with LXC for OBS
  • From: "Bernhard M. Wiedemann" <bernhardout@xxxxxxxx>
  • Date: Mon, 01 Aug 2011 07:25:23 +0200
  • Message-id: <>
Hash: SHA1

On 07/28/2011 12:33 PM, Bernhard M. Wiedemann wrote:
On 07/28/2011 11:59 AM, Dinar Valeev wrote:
/usr/lib/build/lxc.conf :

# allow to create any device nodes - but not access
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
# /dev/pts/*
lxc.cgroup.devices.allow = c 136:* rw
lxc.tty = 1
Is this secure?

I understood the lxc config format to have "rw" for read+write access
to devices but the top two lines only have the "m" flag to allow only
mknod - unluckily man lxc.conf does not tell.
The lower two lines _could_ allow access to the host's pseudo
terminals. Not sure how dangerous that is.

I did some more researching.
The first lines are secure:

lxc-start -n build-root -- /bin/mknod /tmp/devnode c 199 199
lxc-start -n build-root -- /bin/cat /tmp/devnode
/bin/cat: /tmp/devnode: Operation not permitted

the pts devs did get to the host, so could be problematic, but this
stopped when I added to lxc.conf:
lxc.pts = 1024

but since I am not much into LXC, this might break other things.

I also noticed that when building with LXC, the live log stops early after
copying packages...

and when you click "Start Refresh" you see that a new log was started at:
processing specfile /.build-srcdir/binutils.spec

Bernhard M.
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with SUSE -

To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-buildservice+help@xxxxxxxxxxxx

< Previous Next >
List Navigation
Follow Ups