diff options
| author | Lennart Poettering <lennart@poettering.net> | 2014-02-26 02:28:52 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2014-02-26 02:28:52 +0100 |
| commit | f513e420c8b1a1d4c13092cd378f048b69793497 (patch) | |
| tree | 8bc6f9e42cec765ca4bc7f1b769177e9a3fb1016 /src/core | |
| parent | 9c423fbf2a11bf9c936017c0f1e06ea2e4e82a40 (diff) | |
exec: imply NoNewPriviliges= only when seccomp filters are used in user mode
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/execute.c | 7 | ||||
| -rw-r--r-- | src/core/unit.c | 8 |
2 files changed, 13 insertions, 2 deletions
diff --git a/src/core/execute.c b/src/core/execute.c index fff25c2b23..9de6e8726f 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -1706,7 +1706,8 @@ int exec_spawn(ExecCommand *command, } #ifdef HAVE_SECCOMP - if (context->address_families) { + if (context->address_families_whitelist || + !set_isempty(context->address_families)) { err = apply_address_families(context); if (err < 0) { r = EXIT_ADDRESS_FAMILIES; @@ -1714,7 +1715,9 @@ int exec_spawn(ExecCommand *command, } } - if (context->syscall_filter || context->syscall_archs) { + if (context->syscall_whitelist || + !set_isempty(context->syscall_filter) || + !set_isempty(context->syscall_archs)) { err = apply_seccomp(context); if (err < 0) { r = EXIT_SECCOMP; diff --git a/src/core/unit.c b/src/core/unit.c index 9d54147adb..05470739d2 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -2817,6 +2817,14 @@ int unit_exec_context_patch_defaults(Unit *u, ExecContext *c) { return r; } + if (u->manager->running_as == SYSTEMD_USER && + (c->syscall_whitelist || + !set_isempty(c->syscall_filter) || + !set_isempty(c->syscall_archs) || + c->address_families_whitelist || + !set_isempty(c->address_families))) + c->no_new_privileges = true; + return 0; } |