summaryrefslogtreecommitdiff
path: root/src/shared/bus-unit-util.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2016-08-03 18:44:51 +0200
committerLennart Poettering <lennart@poettering.net>2016-08-03 20:42:04 +0200
commitd251207d555a1a0d97924980e49b0ba563b9fc67 (patch)
tree799335696454ff21312882fca3f4fbed23d5ff88 /src/shared/bus-unit-util.c
parent7f5da8bd4fb1ba49ba40195a74ca76bb5d4d1f81 (diff)
core: add new PrivateUsers= option to service execution
This setting adds minimal user namespacing support to a service. When set the invoked processes will run in their own user namespace. Only a trivial mapping will be set up: the root user/group is mapped to root, and the user/group of the service will be mapped to itself, everything else is mapped to nobody. If this setting is used the service runs with no capabilities on the host, but configurable capabilities within the service. This setting is particularly useful in conjunction with RootDirectory= as the need to synchronize /etc/passwd and /etc/group between the host and the service OS tree is reduced, as only three UID/GIDs need to match: root, nobody and the user of the service itself. But even outside the RootDirectory= case this setting is useful to substantially reduce the attack surface of a service. Example command to test this: systemd-run -p PrivateUsers=1 -p User=foobar -t /bin/sh This runs a shell as user "foobar". When typing "ps" only processes owned by "root", by "foobar", and by "nobody" should be visible.
Diffstat (limited to 'src/shared/bus-unit-util.c')
-rw-r--r--src/shared/bus-unit-util.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/shared/bus-unit-util.c b/src/shared/bus-unit-util.c
index 14bf8ad627..9d8061b539 100644
--- a/src/shared/bus-unit-util.c
+++ b/src/shared/bus-unit-util.c
@@ -202,7 +202,7 @@ int bus_append_unit_property_assignment(sd_bus_message *m, const char *assignmen
"CPUAccounting", "MemoryAccounting", "IOAccounting", "BlockIOAccounting", "TasksAccounting",
"SendSIGHUP", "SendSIGKILL", "WakeSystem", "DefaultDependencies",
"IgnoreSIGPIPE", "TTYVHangup", "TTYReset", "RemainAfterExit",
- "PrivateTmp", "PrivateDevices", "PrivateNetwork", "NoNewPrivileges",
+ "PrivateTmp", "PrivateDevices", "PrivateNetwork", "PrivateUsers", "NoNewPrivileges",
"SyslogLevelPrefix", "Delegate", "RemainAfterElapse", "MemoryDenyWriteExecute",
"RestrictRealtime", "DynamicUser")) {