summaryrefslogtreecommitdiff
path: root/man/systemd.exec.xml
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2014-01-20 19:54:51 +0100
committerLennart Poettering <lennart@poettering.net>2014-01-20 21:28:37 +0100
commit7f112f50fea585411ea2d493b3582bea77eb4d6e (patch)
tree2c670344aa6be9fff8bf4538d2e188bf280ecde3 /man/systemd.exec.xml
parent3540c7f88fd4b860d3d6d0e931ddb7cd91bc559a (diff)
exec: introduce PrivateDevices= switch to provide services with a private /dev
Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that sets up a private /dev with only the API pseudo-devices like /dev/null, /dev/zero, /dev/random, but not any physical devices in them.
Diffstat (limited to 'man/systemd.exec.xml')
-rw-r--r--man/systemd.exec.xml18
1 files changed, 18 insertions, 0 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 610c821dc0..7eaf52bc5b 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -895,6 +895,24 @@
</varlistentry>
<varlistentry>
+ <term><varname>PrivateDevices=</varname></term>
+
+ <listitem><para>Takes a boolean
+ argument. If true, sets up a new /dev
+ namespace for the executed processes
+ and only adds API pseudo devices such
+ as <filename>/dev/null</filename>,
+ <filename>/dev/zero</filename> or
+ <filename>/dev/random</filename> to
+ it, but no physical devices such as
+ <filename>/dev/sda</filename>. This is
+ useful to securely turn off physical
+ device access by the executed
+ process. Defaults to
+ false.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><varname>MountFlags=</varname></term>
<listitem><para>Takes a mount