diff options
| author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2016-10-06 22:40:53 +0900 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2016-10-06 15:40:53 +0200 |
| commit | 94f42fe3a68129fc5d30fc0ee2094c3052ea782b (patch) | |
| tree | 78a319bbb407c530e060b2aabf69e381fdecb4b2 | |
| parent | 8ffce876def94ef999018077560bbc51ef76a7f1 (diff) | |
units: systemd-udevd: add AF_INET and AF_INET6 to RestrictAddressFamilies= (#4296)
The udev builtin command `net_setup_link` requires AF_INET and AF_INET6.
Fixes #4293.
| -rw-r--r-- | NEWS | 14 | ||||
| -rw-r--r-- | units/systemd-udevd.service.in | 2 |
2 files changed, 1 insertions, 15 deletions
@@ -21,20 +21,6 @@ CHANGES WITH 232 in spe ProtectKernelTunables=yes, ProtectControlGroups=yes, RestrictAddressFamilies=. - In particular, systemd-udevd.service is now run in a Seccomp-based - sandbox that prohibits access to AF_INET and AF_INET6 sockets and - thus access to the network. This might break code that runs from udev - rules that tries to talk to the network. Doing that is generally a - bad idea and unsafe due to a variety of reasons. It's also racy as - device management would race against network configuration. It is - recommended to rework such rules to use the SYSTEMD_WANTS property on - the relevant devices to pull in a proper systemd service (which can - be sandboxed differently and ordered correctly after the network - having come up). If that's not possible consider reverting this - sandboxing feature locally by removing the RestrictAddressFamilies= - setting from the systemd-udevd.service unit file, or adding AF_INET - and AF_INET6 to it. - * Support for dynamically creating users for the lifetime of a service has been added. If DynamicUser=yes is specified, user and group IDs will be allocated from the range 61184..65519 for the lifetime of the diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index cb2d8ba775..46d637883b 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -27,4 +27,4 @@ TasksMax=infinity MountFlags=slave MemoryDenyWriteExecute=yes RestrictRealtime=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 |