diff options
| author | Lennart Poettering <lennart@poettering.net> | 2016-07-27 13:30:58 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2016-08-04 23:08:05 +0200 |
| commit | d47f681b285b1dfb7ce68200205bfe8b835657a2 (patch) | |
| tree | 316b1f351af43333a695654d2f4cf5b5675f8e9e /TODO | |
| parent | 2129011e92feee93383b450bb2d20008786b90a0 (diff) | |
update TODO
Diffstat (limited to 'TODO')
| -rw-r--r-- | TODO | 10 |
1 files changed, 0 insertions, 10 deletions
@@ -35,27 +35,17 @@ Features: * RemoveIPC= in unit files for removing POSIX/SysV IPC objects -* Set SERVICE_RESULT= as env var while running ExecStop= - * Introduce ProtectSystem=strict for making the entire OS hierarchy read-only except for a select few * nspawn: start UID allocation loop from hash of container name -* in the DynamicUser=1 nss module, also map "nobody" and "root" statically - -* pid1: log about all processes we kill with with SIGKILL or in abandoned scopes, as this should normally not happen - * nspawn: support that /proc, /sys/, /dev are pre-mounted -* nspawn: mount esp, so that bootctl can work - * define gpt header bits to select volatility mode * nspawn: mount loopback filesystems with "discard" -* Make TasksMax= take percentages, taken relative to the pids_max sysctl and pids.max cgroup limit - * ProtectKernelLogs= (drops CAP_SYSLOG, add seccomp for syslog() syscall, and DeviceAllow to /dev/kmsg) in service files * ProtectClock= (drops CAP_SYS_TIMES, adds seecomp filters for settimeofday, adjtimex), sets DeviceAllow o /dev/rtc |