433
edits
Changes
Jump to navigation
Jump to search
Line 15:
Line 15: − − == Kernel restrictions == − − Currently there are a few places in the kernel which test for action preformed being allowed for capable users only: − − * Reading of <code>/proc/$pid/map_files</code> entries is guarded by <code>CAP_SYS_ADMIN</code>. This data is intensively used by CRIU on the dump. − * Restoring memory maps with <code>prctl</code> may require <code>CAP_SYS_RESOURCE</code> on old CRIU versions which don't use <code>PR_SET_MM_MAP</code> interface. − * Upon CRIU start it might try to load net-diag modules which require <code>CAP_SYS_MODULE</code>.
not needed anymore
CRIU has security issues when working with [[Userns|user namespaces]] and [[selinux]]
CRIU has security issues when working with [[Userns|user namespaces]] and [[selinux]]
== Code example ==
== Code example ==