summaryrefslogtreecommitdiff
path: root/src/modules-load
diff options
context:
space:
mode:
authorIsmo Puustinen <ismo.puustinen@intel.com>2015-12-31 14:54:44 +0200
committerIsmo Puustinen <ismo.puustinen@intel.com>2016-01-12 12:14:50 +0200
commit755d4b67a471ed1a3472b8536cb51315d4e4e3c1 (patch)
tree8a0d604514b069463816768a326fb4a6f4f947d7 /src/modules-load
parenta103496ca585e22bb5e386e3238b468d133f5659 (diff)
capabilities: added support for ambient capabilities.
This patch adds support for ambient capabilities in service files. The idea with ambient capabilities is that the execed processes can run with non-root user and get some inherited capabilities, without having any need to add the capabilities to the executable file. You need at least Linux 4.3 to use ambient capabilities. SecureBit keep-caps is automatically added when you use ambient capabilities and wish to change the user. An example system service file might look like this: [Unit] Description=Service for testing caps [Service] ExecStart=/usr/bin/sleep 10000 User=nobody AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW After starting the service it has these capabilities: CapInh: 0000000000003000 CapPrm: 0000000000003000 CapEff: 0000000000003000 CapBnd: 0000003fffffffff CapAmb: 0000000000003000
Diffstat (limited to 'src/modules-load')
0 files changed, 0 insertions, 0 deletions