summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorJuho Son <juho80.son@samsung.com>2014-09-11 16:06:38 +0900
committerLennart Poettering <lennart@poettering.net>2014-10-22 19:12:06 +0200
commitf2a474aea8f82fa9b695515d4590f4f3398358a7 (patch)
tree07d64968bdfdd40c581c131e2a35c15ebe8e2ecf /src
parentfc1ae82cae69d8dbbd9e7a31938810a486fac782 (diff)
journald: add CAP_MAC_OVERRIDE in journald for SMACK issue
systemd-journald check the cgroup id to support rate limit option for every messages. so journald should be available to access cgroup node in each process send messages to journald. In system using SMACK, cgroup node in proc is assigned execute label as each process's execute label. so if journald don't want to denied for every process, journald should have all of access rule for all process's label. It's too heavy. so we could give special smack label for journald te get all accesses's permission. '^' label. When assign '^' execute smack label to systemd-journald, systemd-journald need to add CAP_MAC_OVERRIDE capability to get that smack privilege. so I want to notice this information and set default capability to journald whether system use SMACK or not. because that capability affect to only smack enabled kernel
Diffstat (limited to 'src')
0 files changed, 0 insertions, 0 deletions