templates: deny writes to host's clock (v2)

Don't allow write to /dev/rtc0, and remove sys_time.

Thanks, Christoph.

v2: drop sys_time, sys_module, mac_admin and mac_override in
all templates.

Reported-by: Christoph Mitasch <cmitasch@thomas-krenn.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
allow lxc-init to log when rootfs not given

On Mon, 29 Apr 2013 14:44:47 -0500
Serge Hallyn <serge.hallyn@ubuntu.com> wrote:

> Quoting Dwight Engen (dwight.engen@oracle.com):
> > So I did this, only to realize that lxc-init is passing "none" for
> > the file anyway, so it currently doesn't intend to log. This makes
> > me think that passing NULL for lxcpath is the right thing to do in
> > this patch. If you want me to make it so lxc-init can log, I can do
> > that but I think it should be in a different change :)
>
> That actually would be very useful, but as you say that's a different
> feature - thanks.

... and here is said change.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>