summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--man/systemd.exec.xml7
-rw-r--r--src/core/unit.c3
2 files changed, 8 insertions, 2 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index f1bcf9b7bd..90d36f9b57 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -908,8 +908,11 @@
<filename>/dev/sda</filename>. This is
useful to securely turn off physical
device access by the executed
- process. Defaults to
- false.</para></listitem>
+ process. Defaults to false. Note that
+ enabling this option implies that
+ <constant>CAP_MKNOD</constant> is
+ removed from the capability bounding
+ set for the unit.</para></listitem>
</varlistentry>
<varlistentry>
diff --git a/src/core/unit.c b/src/core/unit.c
index 4fb0d9caaa..20b139d31b 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2830,6 +2830,9 @@ int unit_exec_context_patch_defaults(Unit *u, ExecContext *c) {
!set_isempty(c->address_families)))
c->no_new_privileges = true;
+ if (c->private_devices)
+ c->capability_bounding_set_drop |= (uint64_t) 1ULL << (uint64_t) CAP_MKNOD;
+
return 0;
}