diff options
| author | Lennart Poettering <lennart@poettering.net> | 2016-10-13 18:36:29 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-10-13 18:36:29 +0200 |
| commit | 8bfdf29b2492f7df721d20455ee10b2fd158395b (patch) | |
| tree | cf83f461afa4925386f5d7467d3480d01c79e5c6 /src/core/unit.c | |
| parent | f5df066d1d28920e49cf03d5950330138ea4f236 (diff) | |
| parent | 4982dbcc300d4599aa6ac143e922d6fbee31a860 (diff) | |
Merge pull request #4243 from endocode/djalal/sandbox-first-protection-kernelmodules-v1
core:sandbox: Add ProtectKernelModules= and some fixes
Diffstat (limited to 'src/core/unit.c')
| -rw-r--r-- | src/core/unit.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/core/unit.c b/src/core/unit.c index 690f7f7dd9..67668bdc48 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -3399,7 +3399,10 @@ int unit_patch_contexts(Unit *u) { ec->no_new_privileges = true; if (ec->private_devices) - ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_MKNOD); + ec->capability_bounding_set &= ~((UINT64_C(1) << CAP_MKNOD) | (UINT64_C(1) << CAP_SYS_RAWIO)); + + if (ec->protect_kernel_modules) + ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYS_MODULE); if (ec->dynamic_user) { if (!ec->user) { |