Context
In my "quest" to get LXC to run on Raspbian I may be forced to disable loading the seccomp configuration at container startup, by commenting it out in /usr/share/lxc/config/debian.common.conf
:
# Blacklist some syscalls which are not safe in privileged
# containers
# lxc.seccomp = /usr/share/lxc/config/common.seccomp
As (a.t.m.) only than the container starts (otherwise an error is raised)..
Turning off such a basic security setting that is so heavily tied to containerization/sandboxing is, to some extend, defeating the purpose of LXC. From a security/stability point of view I would very much like to keep blacklisting most of the system calls when running the LXC containers (as configured by LXC defaults in /usr/share/lxc/config/common.seccomp
):
2
blacklist
[all]
kexec_load errno 1
open_by_handle_at errno 1
init_module errno 1
finit_module errno 1
delete_module errno 1
Questions
Does not 'loading seccomp rules for LXC containers' yield:
- significant * security issues?
- any other technical (application or stability) issues?
*Assuming I am the only one using the "mother" system and its LXC containers (otherwise it would be evident..)