summaryrefslogtreecommitdiff
path: root/src/core
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2014-02-26 02:28:52 +0100
committerLennart Poettering <lennart@poettering.net>2014-02-26 02:28:52 +0100
commitf513e420c8b1a1d4c13092cd378f048b69793497 (patch)
tree8bc6f9e42cec765ca4bc7f1b769177e9a3fb1016 /src/core
parent9c423fbf2a11bf9c936017c0f1e06ea2e4e82a40 (diff)
exec: imply NoNewPriviliges= only when seccomp filters are used in user mode
Diffstat (limited to 'src/core')
-rw-r--r--src/core/execute.c7
-rw-r--r--src/core/unit.c8
2 files changed, 13 insertions, 2 deletions
diff --git a/src/core/execute.c b/src/core/execute.c
index fff25c2b23..9de6e8726f 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1706,7 +1706,8 @@ int exec_spawn(ExecCommand *command,
}
#ifdef HAVE_SECCOMP
- if (context->address_families) {
+ if (context->address_families_whitelist ||
+ !set_isempty(context->address_families)) {
err = apply_address_families(context);
if (err < 0) {
r = EXIT_ADDRESS_FAMILIES;
@@ -1714,7 +1715,9 @@ int exec_spawn(ExecCommand *command,
}
}
- if (context->syscall_filter || context->syscall_archs) {
+ if (context->syscall_whitelist ||
+ !set_isempty(context->syscall_filter) ||
+ !set_isempty(context->syscall_archs)) {
err = apply_seccomp(context);
if (err < 0) {
r = EXIT_SECCOMP;
diff --git a/src/core/unit.c b/src/core/unit.c
index 9d54147adb..05470739d2 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2817,6 +2817,14 @@ int unit_exec_context_patch_defaults(Unit *u, ExecContext *c) {
return r;
}
+ if (u->manager->running_as == SYSTEMD_USER &&
+ (c->syscall_whitelist ||
+ !set_isempty(c->syscall_filter) ||
+ !set_isempty(c->syscall_archs) ||
+ c->address_families_whitelist ||
+ !set_isempty(c->address_families)))
+ c->no_new_privileges = true;
+
return 0;
}