From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <legion@altlinux.ru>
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
 sa.local.altlinux.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
 autolearn_force=no version=3.4.1
Date: Thu, 18 Jun 2020 00:50:44 +0200
From: Alexey Gladkov <legion@altlinux.ru>
To: Mikhail Novosyolov <mikhailnov@altlinux.org>
Message-ID: <20200617225044.koizztylssdxe27b@comp-core-i7-2640m-0182e6>
References: <cover.1576183643.git.legion@altlinux.org>
 <47512e07a05fdc1ebf794e304eade1c4c13605fb.1576183643.git.legion@altlinux.org>
 <62997b7b-169b-931c-b714-af85f1e54148@rosalinux.ru>
 <5ced8fdb-0dc3-e61d-2bcf-2af8a5da33af@rosalinux.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <5ced8fdb-0dc3-e61d-2bcf-2af8a5da33af@rosalinux.ru>
Cc: devel@lists.altlinux.org
Subject: Re: [devel] [PATCH hasher-priv v1 2/3] Add systemd and sysvinit
 service files
X-BeenThere: devel@lists.altlinux.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: ALT Linux Team development discussions <devel@lists.altlinux.org>
List-Id: ALT Linux Team development discussions <devel.lists.altlinux.org>
List-Unsubscribe: <https://lists.altlinux.org/mailman/options/devel>,
 <mailto:devel-request@lists.altlinux.org?subject=unsubscribe>
List-Archive: <http://lists.altlinux.org/pipermail/devel>
List-Post: <mailto:devel@lists.altlinux.org>
List-Help: <mailto:devel-request@lists.altlinux.org?subject=help>
List-Subscribe: <https://lists.altlinux.org/mailman/listinfo/devel>,
 <mailto:devel-request@lists.altlinux.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Jun 2020 22:50:51 -0000
Archived-At: <http://lore.altlinux.org/devel/20200617225044.koizztylssdxe27b@comp-core-i7-2640m-0182e6/>
List-Archive: <http://lore.altlinux.org/devel/>
List-Post: <mailto:devel@altlinux.org>

On Thu, Jun 18, 2020 at 01:38:36AM +0300, Mikhail Novosyolov wrote:
> 18.06.2020 01:31, Mikhail Novosyolov пишет:
> > 13.12.2019 14:42, Alex Gladkov пишет:
> >> diff --git a/hasher-priv/hasher-privd.service b/hasher-priv/hasher-privd.service
> >> new file mode 100644
> >> index 0000000..e5ed9ac
> >> --- /dev/null
> >> +++ b/hasher-priv/hasher-privd.service
> >> @@ -0,0 +1,11 @@
> >> +[Unit]
> >> +Description=A privileged helper for the hasher project
> >> +ConditionVirtualization=!container
> > А если контейнеру выданы нужные привелегии/capabilities, то почему нельзя? Может, лучше ConditionCapability=?
> 
> ...или вообще без таких проверок условий, не смог запуститься - написал ошибку в явном виде
> 
> P.S. Какие capabilities нужны, чтобы hsh работал в systemd-nspawn?

Так как hasher может создавать namespace, то нужен CAP_SYS_ADMIN.

-- 
Rgrds, legion