playbook: allow unprivileged CLONE_NEWUSER

/reviewed-on nexedi/slapos.package!115

playbook: allow unprivileged CLONE_NEWUSER
/reviewed-on nexedi/slapos.package!115
36aaa727 · Julien Muchembled · Thomas Gambier · 280c9763 · 36aaa727
Commit 36aaa727 authored Mar 04, 2020 by Julien Muchembled Committed by Thomas Gambier Mar 06, 2020
Show whitespace changes
Inline Side-by-side

Showing with 6 additions and 0 deletions

playbook/roles/vifib-server/tasks/main.yml playbook/roles/vifib-server/tasks/main.yml +6 -0

No files found.
--- a/playbook/roles/vifib-server/tasks/main.yml
+++ b/playbook/roles/vifib-server/tasks/main.yml
 ---

+  - stat: path=/proc/sys/kernel/unprivileged_userns_clone
+    register: unprivileged_userns_clone
+  - name: Allow unprivileged CLONE_NEWUSER
+    sysctl: name="kernel.unprivileged_userns_clone" value=1 sysctl_set=yes reload=no
+    when: unprivileged_userns_clone.stat.exists
+
  - name: Set kernel.panic for force reboot after kernel panic
    sysctl: name="kernel.panic" value=120 sysctl_set=yes state=present reload=yes