summaryrefslogtreecommitdiff
path: root/src/shared/bus-unit-util.c
diff options
context:
space:
mode:
authorDjalal Harouni <tixxdz@opendz.org>2016-10-12 13:31:21 +0200
committerDjalal Harouni <tixxdz@opendz.org>2016-10-12 13:31:21 +0200
commit502d704e5ed2d288069471f4e3611115cde107d6 (patch)
tree4f477c49d4ce8b979479735bcc4f4043b2df111b /src/shared/bus-unit-util.c
parent18e51a022c632344c4a48ba6ccb3475fad2a2c3b (diff)
core:sandbox: Add ProtectKernelModules= option
This is useful to turn off explicit module load and unload operations on modular kernels. This option removes CAP_SYS_MODULE from the capability bounding set for the unit, and installs a system call filter to block module system calls. This option will not prevent the kernel from loading modules using the module auto-load feature which is a system wide operation.
Diffstat (limited to 'src/shared/bus-unit-util.c')
-rw-r--r--src/shared/bus-unit-util.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/shared/bus-unit-util.c b/src/shared/bus-unit-util.c
index a550a370b5..f639e0e832 100644
--- a/src/shared/bus-unit-util.c
+++ b/src/shared/bus-unit-util.c
@@ -204,7 +204,8 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
"IgnoreSIGPIPE", "TTYVHangup", "TTYReset", "RemainAfterExit",
"PrivateTmp", "PrivateDevices", "PrivateNetwork", "PrivateUsers", "NoNewPrivileges",
"SyslogLevelPrefix", "Delegate", "RemainAfterElapse", "MemoryDenyWriteExecute",
- "RestrictRealtime", "DynamicUser", "RemoveIPC", "ProtectKernelTunables", "ProtectControlGroups")) {
+ "RestrictRealtime", "DynamicUser", "RemoveIPC", "ProtectKernelTunables",
+ "ProtectKernelModules", "ProtectControlGroups")) {
r = parse_boolean(eq);
if (r < 0)