infra
/
cfg
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nut: Do not run as privileged container 

The only privilege NUT needs is access to the USB device nodes.  Using a
device CGroup rule to allow this is significantly better than disabling
all restrictions.  Especially since I discovered that `--privileged`
implies `--security-opt label=disable`, effectively disabling SELinux
confinement of the container.
master
Dustin 2024-01-14 19:17:49 -06:00
parent 74508faf27
commit be1042cda7
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
templates/nut/nut-server.container
View File

@ -16,8 +16,8 @@ Volume=/etc/ups:/etc/ups:ro
Volume=/dev:/dev:rw Volume=/dev:/dev:rw
ReadOnly=true ReadOnly=true
VolatileTmp=true VolatileTmp=true
PodmanArgs=--privileged
Network=host Network=host
PodmanArgs=--device-cgroup-rule 'c 189:* rw'
[Service] [Service]
ExecReload=podman exec systemd-%N upsd -c reload ExecReload=podman exec systemd-%N upsd -c reload