summaryrefslogtreecommitdiff
path: root/src/core/namespace.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-08-22 18:43:59 +0200
committerDjalal Harouni <tixxdz@opendz.org>2016-09-25 10:18:48 +0200
commit59eeb84ba65483c5543d1bc840c2ac75642ef638 (patch)
tree2195a40c7daf3575a8a7500bc8a82412056688ab /src/core/namespace.c
parent72246c2a654ead7f7ee6e7799161e2e46dc0b84b (diff)
core: add two new service settings ProtectKernelTunables= and ProtectControlGroups=
If enabled, these will block write access to /sys, /proc/sys and /proc/sys/fs/cgroup.
Diffstat (limited to 'src/core/namespace.c')
-rw-r--r--src/core/namespace.c36
1 files changed, 32 insertions, 4 deletions
diff --git a/src/core/namespace.c b/src/core/namespace.c
index 52a2505d94..f2768aeb28 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -53,7 +53,7 @@ typedef enum MountMode {
PRIVATE_TMP,
PRIVATE_VAR_TMP,
PRIVATE_DEV,
- READWRITE
+ READWRITE,
} MountMode;
typedef struct BindMount {
@@ -366,6 +366,8 @@ int setup_namespace(
const char* tmp_dir,
const char* var_tmp_dir,
bool private_dev,
+ bool protect_sysctl,
+ bool protect_cgroups,
ProtectHome protect_home,
ProtectSystem protect_system,
unsigned long mount_flags) {
@@ -385,6 +387,8 @@ int setup_namespace(
strv_length(read_only_paths) +
strv_length(inaccessible_paths) +
private_dev +
+ (protect_sysctl ? 3 : 0) +
+ (protect_cgroups != protect_sysctl) +
(protect_home != PROTECT_HOME_NO ? 3 : 0) +
(protect_system != PROTECT_SYSTEM_NO ? 2 : 0) +
(protect_system == PROTECT_SYSTEM_FULL ? 1 : 0);
@@ -421,6 +425,27 @@ int setup_namespace(
m++;
}
+ if (protect_sysctl) {
+ m->path = prefix_roota(root_directory, "/proc/sys");
+ m->mode = READONLY;
+ m++;
+
+ m->path = prefix_roota(root_directory, "/proc/sysrq-trigger");
+ m->mode = READONLY;
+ m->ignore = true; /* Not always compiled into the kernel */
+ m++;
+
+ m->path = prefix_roota(root_directory, "/sys");
+ m->mode = READONLY;
+ m++;
+ }
+
+ if (protect_cgroups != protect_sysctl) {
+ m->path = prefix_roota(root_directory, "/sys/fs/cgroup");
+ m->mode = protect_cgroups ? READONLY : READWRITE;
+ m++;
+ }
+
if (protect_home != PROTECT_HOME_NO) {
const char *home_dir, *run_user_dir, *root_dir;
@@ -505,9 +530,12 @@ int setup_namespace(
fail:
if (n > 0) {
- for (m = mounts; m < mounts + n; ++m)
- if (m->done)
- (void) umount2(m->path, MNT_DETACH);
+ for (m = mounts; m < mounts + n; ++m) {
+ if (!m->done)
+ continue;
+
+ (void) umount2(m->path, MNT_DETACH);
+ }
}
return r;