Security bugfix in lxc-sshd template: add ro to the init-script

I re-checked in detail, the execution of lxc-start is unproblematic since the init script is run inside the container.
But the execution of lxc-create -t sshd for the next container can be exploited.

Please correct in my bug report:

>>>
... So harm could be done to the host system at the next execution of lxc-create -t sshd.
<<<

For your re-test:

1) add "echo I am `id` on `hostname`" to the template lxc-sshd

2) exploit:
root@agiadm:/usr/lib/lxc/templates# lxc-create -n ssh2 -t sshd

No config file specified, using the default config
I am uid=0(root) gid=0(root) Gruppen=0(root) on agiadm
...
'sshd' template installed
'ssh2' created

3) no problem:
root@agiadm:/usr/lib/lxc/templates# lxc-start -n ssh2
I am uid=0(root) gid=0(root) Gruppen=0(root) on ssh2
/usr/lib/lxc/lxc-init ist /usr/lib/lxc/lxc-init

Please be aware that the sshd template creates config files inside /var/lib/lxc/*/config that include the incorrect mount-configuration:
> lxc.mount.entry=/usr/lib/lxc/templates/lxc-sshd sbin/init none bind 0 0

These configs have to be patched besides the template itself.

This bug was fixed in the package lxc - 1.0.0~alpha1-0ubuntu14.1

---------------
lxc (1.0.0~alpha1-0ubuntu14.1) saucy-security; urgency=low

  * SECURITY UPDATE: privilege escalation via sshd template (LP: #1261045)
    - debian/patches/CVE-2013-6441.patch: don't bind-mount /sbin/init
      read-write in templates/lxc-sshd.in.
    - CVE-2013-6441
 -- Marc Deslauriers <email address hidden> Thu, 16 Jan 2014 08:55:20 -0500