summaryrefslogtreecommitdiff
path: root/man
diff options
context:
space:
mode:
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2016-10-22 23:41:45 -0400
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2016-10-24 23:45:57 -0400
commit74388c2d11acd9b638e33e09c7a99a9bc2c6292b (patch)
tree6ea558640fe1c4b1a79abaef032e80ca85bc4798 /man
parent9b232d3241fcfbf60affab69fa51213e36133db5 (diff)
man: document the default value of NoNewPrivileges=
Fixes #4329.
Diffstat (limited to 'man')
-rw-r--r--man/systemd.exec.xml23
1 files changed, 16 insertions, 7 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index dbe4594730..6a26f3c133 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -1234,13 +1234,22 @@
<varlistentry>
<term><varname>NoNewPrivileges=</varname></term>
- <listitem><para>Takes a boolean argument. If true, ensures
- that the service process and all its children can never gain
- new privileges. This option is more powerful than the
- respective secure bits flags (see above), as it also prohibits
- UID changes of any kind. This is the simplest, most effective
- way to ensure that a process and its children can never
- elevate privileges again.</para></listitem>
+ <listitem><para>Takes a boolean argument. If true, ensures that the service
+ process and all its children can never gain new privileges. This option is more
+ powerful than the respective secure bits flags (see above), as it also prohibits
+ UID changes of any kind. This is the simplest and most effective way to ensure that
+ a process and its children can never elevate privileges again. Defaults to false,
+ but in the user manager instance certain settings force
+ <varname>NoNewPrivileges=yes</varname>, ignoring the value of this setting.
+ Those is the case when <varname>SystemCallFilter=</varname>,
+ <varname>SystemCallArchitectures=</varname>,
+ <varname>RestrictAddressFamilies=</varname>,
+ <varname>PrivateDevices=</varname>,
+ <varname>ProtectKernelTunables=</varname>,
+ <varname>ProtectKernelModules=</varname>,
+ <varname>MemoryDenyWriteExecute=</varname>, or
+ <varname>RestrictRealtime=</varname> are specified.
+ </para></listitem>
</varlistentry>
<varlistentry>