# Blacklist some syscalls which are not safe in privileged # containers # lxc.seccomp = /usr/share/lxc/config/common.seccomp
As (a.t.m.) only than the container starts (otherwise an error is raised)..
Turning off such a basic security setting that is so heavily tied to containerization/sandboxing is, to some extend, defeating the purpose of LXC. From a security/stability point of view I would very much like to keep blacklisting most of the system calls when running the LXC containers (as configured by LXC defaults in
2 blacklist [all] kexec_load errno 1 open_by_handle_at errno 1 init_module errno 1 finit_module errno 1 delete_module errno 1
Does not 'loading seccomp rules for LXC containers' yield:
- significant * security issues?
- any other technical (application or stability) issues?
*Assuming I am the only one using the "mother" system and its LXC containers (otherwise it would be evident..)