summaryrefslogtreecommitdiff
path: root/src/core
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2014-03-18 17:58:19 +0100
committerLennart Poettering <lennart@poettering.net>2014-03-18 17:58:19 +0100
commitf1660f96f59dad860d39f148c3a747050d112763 (patch)
tree6a56a7202c056b889acdd51fe3eccc0d155dceae /src/core
parent45aee6d67ad62a651720f22e67273a692014f948 (diff)
core: drop CAP_MKNOD when PrivateDevices= is set
Diffstat (limited to 'src/core')
-rw-r--r--src/core/unit.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/core/unit.c b/src/core/unit.c
index 4fb0d9caaa..20b139d31b 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2830,6 +2830,9 @@ int unit_exec_context_patch_defaults(Unit *u, ExecContext *c) {
!set_isempty(c->address_families)))
c->no_new_privileges = true;
+ if (c->private_devices)
+ c->capability_bounding_set_drop |= (uint64_t) 1ULL << (uint64_t) CAP_MKNOD;
+
return 0;
}