summaryrefslogtreecommitdiff
path: root/src/core/namespace.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2014-06-03 23:41:44 +0200
committerLennart Poettering <lennart@poettering.net>2014-06-03 23:57:51 +0200
commit417116f23432073162ebfcb286a7800846482eed (patch)
tree8e6076d15760c8079deb32eff461e0cc3168fa61 /src/core/namespace.c
parent85b5673b337048fa881a5afb1d00d1a7b95950fb (diff)
core: add new ReadOnlySystem= and ProtectedHome= settings for service units
ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
Diffstat (limited to 'src/core/namespace.c')
-rw-r--r--src/core/namespace.c26
1 files changed, 25 insertions, 1 deletions
diff --git a/src/core/namespace.c b/src/core/namespace.c
index 9f15211cb6..de09e9f2c3 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -331,6 +331,8 @@ int setup_namespace(
char* tmp_dir,
char* var_tmp_dir,
bool private_dev,
+ ProtectedHome protected_home,
+ bool read_only_system,
unsigned mount_flags) {
BindMount *m, *mounts = NULL;
@@ -347,7 +349,9 @@ int setup_namespace(
strv_length(read_write_dirs) +
strv_length(read_only_dirs) +
strv_length(inaccessible_dirs) +
- private_dev;
+ private_dev +
+ (protected_home != PROTECTED_HOME_NO ? 2 : 0) +
+ (read_only_system ? 2 : 0);
if (n > 0) {
m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
@@ -381,6 +385,18 @@ int setup_namespace(
m++;
}
+ if (protected_home != PROTECTED_HOME_NO) {
+ r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user"), protected_home == PROTECTED_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
+ if (r < 0)
+ return r;
+ }
+
+ if (read_only_system) {
+ r = append_mounts(&m, STRV_MAKE("/usr", "-/boot"), READONLY);
+ if (r < 0)
+ return r;
+ }
+
assert(mounts + n == m);
qsort(mounts, n, sizeof(BindMount), mount_path_compare);
@@ -581,3 +597,11 @@ fail:
return r;
}
+
+static const char *const protected_home_table[_PROTECTED_HOME_MAX] = {
+ [PROTECTED_HOME_NO] = "no",
+ [PROTECTED_HOME_YES] = "yes",
+ [PROTECTED_HOME_READ_ONLY] = "read-only",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(protected_home, ProtectedHome);