diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2013-03-20 01:38:28 -0400 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2013-03-20 14:08:41 -0400 |
| commit | d34cd374905a40e65769351a2808b741b5418bf1 (patch) | |
| tree | 5dbd6761c13de63a6d5b1c0733d82990abb46aef /src/shared/util.h | |
| parent | 1f048a6b6bcc30d2e157711b3d231d7a944e6ffb (diff) | |
Make PrivateTmp dirs also inaccessible from the outside
Currently, PrivateTmp=yes means that the service cannot see the /tmp
shared by rest of the system and is isolated from other services using
PrivateTmp, but users can access and modify /tmp as seen by the
service.
Move the private /tmp and /var/tmp directories into a 0077-mode
directory. This way unpriviledged users on the system cannot see (or
modify) /tmp as seen by the service.
Diffstat (limited to 'src/shared/util.h')
| -rw-r--r-- | src/shared/util.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/shared/util.h b/src/shared/util.h index 4be0b61773..7c032b6b62 100644 --- a/src/shared/util.h +++ b/src/shared/util.h @@ -579,7 +579,7 @@ int on_ac_power(void); int search_and_fopen(const char *path, const char *mode, const char **search, FILE **_f); int search_and_fopen_nulstr(const char *path, const char *mode, const char *search, FILE **_f); -int create_tmp_dir(char template[], mode_t mask, bool need_sticky, char** dir_name); +int create_tmp_dir(char template[], char** dir_name); #define FOREACH_LINE(line, f, on_error) \ for (;;) \ |