diff options
| author | Lennart Poettering <lennart@poettering.net> | 2016-09-19 21:29:06 +0200 |
|---|---|---|
| committer | Djalal Harouni <tixxdz@opendz.org> | 2016-09-25 10:52:57 +0200 |
| commit | 1ecdba149bab8346b611e2ccacfe66e58a7b863c (patch) | |
| tree | 08ab7d32af4f30c8482b991aafbfacc68e618bd3 | |
| parent | 0c28d51ac84973904e5f780b024adf8108e69fa1 (diff) | |
NEWS: update news about systemd-udevd.service
| -rw-r--r-- | NEWS | 14 |
1 files changed, 14 insertions, 0 deletions
@@ -137,6 +137,20 @@ CHANGES WITH 232 in spe $SYSTEMD_NSPAWN_SHARE_NS_UTS may be used to control the unsharing of individual namespaces. + * systemd-udevd.service is now run in a Seccomp-based sandbox that + prohibits access to AF_INET and AF_INET6 sockets and thus access to + the network. This might break code that runs from udev rules that + tries to talk to the network. Doing that is generally a bad idea and + unsafe due to a variety of reasons. It's also racy as device + management would race against network configuration. It is + recommended to rework such rules to use the SYSTEMD_WANTS property on + the relevant devices to pull in a proper systemd service (which can + be sandboxed differently and ordered correctly after the network + having come up). If that's not possible consider reverting this + sandboxing feature locally by removing the RestrictAddressFamilies= + setting from the systemd-udevd.service unit file, or adding AF_INET + and AF_INET6 to it. + CHANGES WITH 231: * In service units the various ExecXYZ= settings have been extended |