35 lines
1.3 KiB
Plaintext
Executable File
35 lines
1.3 KiB
Plaintext
Executable File
# LXC Container Configuration for a Sorcery-Go Sanctum
|
|
# File: /var/lib/lxc/<sanctum-name>/config
|
|
#
|
|
# A Sanctum must be "privileged" enough to handle mount syscalls for
|
|
# OverlayFS (used by the Cauldron sandbox), but restricted enough to
|
|
# protect the host from a misbehaving spell script.
|
|
#
|
|
# Security is enforced by eBPF (not AppArmor). The Tomb Guard LSM hook
|
|
# intercepts writes to /var/lib/sorcery-go/tomb/** at the kernel level.
|
|
|
|
# Core Isolation
|
|
lxc.include = /usr/share/lxc/config/common.conf
|
|
lxc.arch = x86_64
|
|
|
|
# eBPF handles MAC enforcement — set AppArmor to unconfined.
|
|
# The eBPF Tomb Guard LSM hook provides equivalent protection with
|
|
# better performance and runtime-agnostic enforcement.
|
|
lxc.apparmor.profile = unconfined
|
|
lxc.cap.drop =
|
|
lxc.mount.auto = proc:rw sys:rw cgroup:rw
|
|
lxc.autodev = 1
|
|
|
|
# Grant access to Fuse/Loop if you use them for disk-image spells
|
|
lxc.cgroup2.devices.allow = c 10:229 rwm
|
|
|
|
# Bind-mount the project source into the Sanctum (dev workflow)
|
|
# lxc.mount.entry = /home/you/sorcery-go var/lib/sorcery/go_src none bind,create=dir 0 0
|
|
|
|
# Read-only bind of the Tomb (enforced by eBPF at kernel level)
|
|
lxc.mount.entry = /var/lib/sorcery-go/tomb var/lib/sorcery-go/tomb none bind,ro,create=dir 0 0
|
|
|
|
# Network — restrict to the Coven's Ley-Line bridge
|
|
lxc.net.0.type = veth
|
|
lxc.net.0.link = br0
|
|
lxc.net.0.flags = up |