[libvirt] [PATCH 2 of 2] Use cgroup functions to set resource limits on LXC domains

Dan Smith danms at us.ibm.com
Thu Oct 16 21:00:24 UTC 2008

DB> So if that source code comment is correct, all we need todo is set
DB> a deny-all rule in that intermediate 'lxc' cgroup, and then
DB> containers will not be able to get access back, even if they have

Even if I make the per-driver group have a deny-all policy, I can
still add arbitrary items to devices.allow and gain access from a
subgroup.  So, I think we're going to need to restrict CAP_SYS_ADMIN
if we really want isolation, but I'm not sure what else that is likely
to break.

Dan Smith
IBM Linux Technology Center
Open Hypervisor Team
email: danms at us.ibm.com

More information about the libvir-list mailing list