diff options
| author | Djalal Harouni <tixxdz@opendz.org> | 2016-11-06 23:31:55 +0100 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2016-11-08 21:57:32 -0500 |
| commit | af964954c6a44bd664efe89052ced9584a966baa (patch) | |
| tree | e54b31af3547951962576bf0486765284cc6b489 /src/core/execute.c | |
| parent | d85a0f802851e79efdb09acaa1ce517f7127ad28 (diff) | |
core: on DynamicUser= make sure that protecting sensitive paths is enforced (#4596)
This adds a variable that is always set to false to make sure that
protect paths inside sandbox are always enforced and not ignored. The only
case when it is set to true is on DynamicUser=no and RootDirectory=/chroot
is set. This allows users to use more our sandbox features inside RootDirectory=
The only exception is ProtectSystem=full|strict and when DynamicUser=yes
is implied. Currently RootDirectory= is not fully compatible with these
due to two reasons:
* /chroot/usr|etc has to be present on ProtectSystem=full
* /chroot// has to be a mount point on ProtectSystem=strict.
Diffstat (limited to 'src/core/execute.c')
| -rw-r--r-- | src/core/execute.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/core/execute.c b/src/core/execute.c index 8015aa2cb9..f666f7c6ce 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2034,6 +2034,7 @@ static int apply_mount_namespace(Unit *u, const ExecContext *context, char *tmp = NULL, *var = NULL; const char *root_dir = NULL; NameSpaceInfo ns_info = { + .ignore_protect_paths = false, .private_dev = context->private_devices, .protect_control_groups = context->protect_control_groups, .protect_kernel_tunables = context->protect_kernel_tunables, @@ -2060,6 +2061,14 @@ static int apply_mount_namespace(Unit *u, const ExecContext *context, if (params->flags & EXEC_APPLY_CHROOT) root_dir = context->root_directory; + /* + * If DynamicUser=no and RootDirectory= is set then lets pass a relaxed + * sandbox info, otherwise enforce it, don't ignore protected paths and + * fail if we are enable to apply the sandbox inside the mount namespace. + */ + if (!context->dynamic_user && root_dir) + ns_info.ignore_protect_paths = true; + r = setup_namespace(root_dir, &ns_info, rw, context->read_only_paths, context->inaccessible_paths, |