summaryrefslogtreecommitdiff
path: root/src/core
diff options
context:
space:
mode:
authorDjalal Harouni <tixxdz@opendz.org>2016-10-07 20:38:05 +0200
committerDjalal Harouni <tixxdz@opendz.org>2016-10-12 13:39:49 +0200
commit2cd0a735470894bd2d25147442285744764633a1 (patch)
treeced267bfca1489c3f5334838321f8e8589c1079f /src/core
parent3ae33295f00be5e2836f009bf1991b0caddf80b7 (diff)
core:sandbox: remove CAP_SYS_RAWIO on PrivateDevices=yes
The rawio system calls were filtered, but CAP_SYS_RAWIO allows to access raw data through /proc, ioctl and some other exotic system calls...
Diffstat (limited to 'src/core')
-rw-r--r--src/core/unit.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/core/unit.c b/src/core/unit.c
index 71f95c0b96..67668bdc48 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -3399,7 +3399,7 @@ int unit_patch_contexts(Unit *u) {
ec->no_new_privileges = true;
if (ec->private_devices)
- ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_MKNOD);
+ ec->capability_bounding_set &= ~((UINT64_C(1) << CAP_MKNOD) | (UINT64_C(1) << CAP_SYS_RAWIO));
if (ec->protect_kernel_modules)
ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYS_MODULE);