summaryrefslogtreecommitdiff
path: root/man/systemd.exec.xml
diff options
context:
space:
mode:
authorDjalal Harouni <tixxdz@opendz.org>2016-10-07 20:38:05 +0200
committerDjalal Harouni <tixxdz@opendz.org>2016-10-12 13:39:49 +0200
commit2cd0a735470894bd2d25147442285744764633a1 (patch)
treeced267bfca1489c3f5334838321f8e8589c1079f /man/systemd.exec.xml
parent3ae33295f00be5e2836f009bf1991b0caddf80b7 (diff)
core:sandbox: remove CAP_SYS_RAWIO on PrivateDevices=yes
The rawio system calls were filtered, but CAP_SYS_RAWIO allows to access raw data through /proc, ioctl and some other exotic system calls...
Diffstat (limited to 'man/systemd.exec.xml')
-rw-r--r--man/systemd.exec.xml4
1 files changed, 2 insertions, 2 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 3bea4976b3..c46c0f6dd8 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -946,8 +946,8 @@
<filename>/dev/port</filename> and others. This is useful to securely turn off physical device access by the
executed process. Defaults to false. Enabling this option will install a system call filter to block low-level
I/O system calls that are grouped in the <varname>@raw-io</varname> set, will also remove
- <constant>CAP_MKNOD</constant> from the capability bounding set for the unit (see above), and set
- <varname>DevicePolicy=closed</varname> (see
+ <constant>CAP_MKNOD</constant> and <constant>CAP_SYS_RAWIO</constant> from the capability bounding set for
+ the unit (see above), and set <varname>DevicePolicy=closed</varname> (see
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details). Note that using this setting will disconnect propagation of mounts from the service to the host
(propagation in the opposite direction continues to work). This means that this setting may not be used for