summaryrefslogtreecommitdiff
AgeCommit message (Expand)Author
2016-09-25core: Use @raw-io syscall group to filter I/O syscalls when PrivateDevices= i...Djalal Harouni
2016-09-25core:namespace: simplify ProtectHome= implementationDjalal Harouni
2016-09-25core: simplify ProtectSystem= implementationDjalal Harouni
2016-09-25core:sandbox: add more /proc/* entries to ProtectKernelTunables=Djalal Harouni
2016-09-25doc: explicitly document that /dev/mem and /dev/port are blocked by PrivateDe...Djalal Harouni
2016-09-25doc: documentation fixes for ReadWritePaths= and ProtectKernelTunables=Djalal Harouni
2016-09-25core:namespace: simplify mount calculationDjalal Harouni
2016-09-25core:namespace: put paths protected by ProtectKernelTunables= inDjalal Harouni
2016-09-25core:namespace: minor improvements to append_mounts()Djalal Harouni
2016-09-25execute: move SMACK setup code into its own functionLennart Poettering
2016-09-25namespace: drop all mounts outside of the new root directoryLennart Poettering
2016-09-25main: minor simplificationLennart Poettering
2016-09-25Update TODOLennart Poettering
2016-09-25execute: filter low-level I/O syscalls if PrivateDevices= is setLennart Poettering
2016-09-25NEWS: update news about systemd-udevd.serviceLennart Poettering
2016-09-25units: further lock down our long-running servicesLennart Poettering
2016-09-25units: permit importd to mount stuffLennart Poettering
2016-09-25man: shorten the exit status table a bitLennart Poettering
2016-09-25man: the exit code/signal is stored in $EXIT_CODE, not $EXIT_STATUSLennart Poettering
2016-09-25man: rework documentation for ReadOnlyPaths= and related settingsLennart Poettering
2016-09-25man: in user-facing documentaiton don't reference C function namesLennart Poettering
2016-09-25namespace: don't make the root directory of a namespace a mount if it already...Lennart Poettering
2016-09-25namespace: chase symlinks for mounts to set up in userspaceLennart Poettering
2016-09-25namespace: invoke unshare() only after checking all parametersLennart Poettering
2016-09-25execute: drop group priviliges only after setting up namespaceLennart Poettering
2016-09-25nspawn: let's mount /proc/sysrq-trigger read-only by defaultLennart Poettering
2016-09-25core: imply ProtectHome=read-only and ProtectSystem=strict if DynamicUser=1Lennart Poettering
2016-09-25core: introduce ProtectSystem=strictLennart Poettering
2016-09-25namespace: add some debug logging when enforcing InaccessiblePaths=Lennart Poettering
2016-09-25namespace: rework how ReadWritePaths= is appliedLennart Poettering
2016-09-25namespace: when enforcing fs namespace restrictions suppress redundant mountsLennart Poettering
2016-09-25namespace: simplify mount_path_compare() a bitLennart Poettering
2016-09-25execute: if RuntimeDirectory= is set, it should be writableLennart Poettering
2016-09-25execute: move suppression of HOME=/ and SHELL=/bin/nologin into user-util.cLennart Poettering
2016-09-25execute: split out creation of runtime dirs into its own functionsLennart Poettering
2016-09-25namespace: make sure InaccessibleDirectories= masks all mounts further downLennart Poettering
2016-09-25core: add two new service settings ProtectKernelTunables= and ProtectControlG...Lennart Poettering
2016-09-25core: enforce seccomp for secondary archs too, for all rulesLennart Poettering
2016-09-24Merge pull request #4194 from bboozzoo/bboozzoo/nss-rootlibZbigniew Jędrzejewski-Szmek
2016-09-24Merge pull request #4182 from jkoelker/routetableZbigniew Jędrzejewski-Szmek
2016-09-24networkd: do not drop config for pending interfaces (#4187)Martin Pitt
2016-09-24build-sys: get rid of move-to-rootlibdirMaciek Borzecki
2016-09-24kernel-install: allow plugins to terminate the procedure (#4174)Zbigniew Jędrzejewski-Szmek
2016-09-24Merge pull request #4207 from fbuihuu/fix-journal-hmac-calculationZbigniew Jędrzejewski-Szmek
2016-09-24sysctl: configure kernel parameters in the order they occur in each sysctl co...HATAYAMA Daisuke
2016-09-24nspawn: decouple --boot from CLONE_NEWIPC (#4180)Luca Bruno
2016-09-23journal: fix HMAC calculation when appending a data objectFranck Bui
2016-09-23journal: warn when we fail to append a tag to a journalFranck Bui
2016-09-23l10n: update Czech translation (#4203)AsciiWolf
2016-09-22machine: Disable more output when quiet flag is set (#4196)Wilhelm Schuster
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-11-23 17:21:18 +0000