diff options
| -rw-r--r-- | man/systemd.exec.xml | 37 | ||||
| -rw-r--r-- | src/core/load-fragment.c | 6 | ||||
| -rw-r--r-- | src/core/unit.c | 9 |
3 files changed, 31 insertions, 21 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index b1cd685cc0..69ee4fc5e8 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -719,29 +719,38 @@ for details. Takes a whitespace separated list of capability names as read by - <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>. + <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>, + e.g. <literal>CAP_SYS_ADMIN + CAP_DAC_OVERRIDE + CAP_SYS_PTRACE</literal>. Capabilities listed will be included in the bounding set, all others are removed. If the list of capabilities - is prefixed with ~ all but the listed - capabilities will be included, the - effect of the assignment - inverted. Note that this option also - effects the respective capabilities in - the effective, permitted and - inheritable capability sets, on top of - what <varname>Capabilities=</varname> + is prefixed with <literal>~</literal> + all but the listed capabilities will + be included, the effect of the + assignment inverted. Note that this + option also affects the respective + capabilities in the effective, + permitted and inheritable capability + sets, on top of what + <varname>Capabilities=</varname> does. If this option is not used the capability bounding set is not modified on process execution, hence no limits on the capabilities of the process are enforced. This option may appear more than once in which case - the bounding sets are merged. If the empty - string is assigned to this option the - bounding set is reset, and all prior - settings have no - effect.</para></listitem> + the bounding sets are merged. If the + empty string is assigned to this + option the bounding set is reset to + the empty capability set, and all + prior settings have no effect. If set + to <literal>~</literal> (without any + further argument) the bounding set is + reset to the full set of available + capabilities, also undoing any + previous settings.</para></listitem> </varlistentry> <varlistentry> diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c index 2204c67a4b..6d90428af0 100644 --- a/src/core/load-fragment.c +++ b/src/core/load-fragment.c @@ -889,12 +889,6 @@ int config_parse_bounding_set( assert(rvalue); assert(data); - if (isempty(rvalue)) { - /* An empty assignment resets */ - *capability_bounding_set_drop = 0; - return 0; - } - if (rvalue[0] == '~') { invert = true; rvalue++; diff --git a/src/core/unit.c b/src/core/unit.c index a1249dc093..d43558e6df 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -2645,7 +2645,14 @@ int unit_kill(Unit *u, KillWho w, int signo, DBusError *error) { return UNIT_VTABLE(u)->kill(u, w, signo, error); } -int unit_kill_common(Unit *u, KillWho who, int signo, pid_t main_pid, pid_t control_pid, DBusError *error) { +int unit_kill_common( + Unit *u, + KillWho who, + int signo, + pid_t main_pid, + pid_t control_pid, + DBusError *error) { + int r = 0; if (who == KILL_MAIN && main_pid <= 0) { |