summaryrefslogtreecommitdiff
path: root/src/core/namespace.c
AgeCommit message (Expand)Author
2017-02-24Fix missing space in comments (#5439)AsciiWolf
2017-02-07core,nspawn,dissect: make nspawn's .roothash file search reusableLennart Poettering
2017-02-07core: add RootImage= setting for using a specific image file as root director...Lennart Poettering
2017-02-07core: add a per-unit setting MountAPIVFS= for mounting /dev, /proc, /sys in c...Lennart Poettering
2017-02-07core: fix minor memleak in namespace.cLennart Poettering
2016-12-14core: add ability to define arbitrary bind mounts for servicesLennart Poettering
2016-12-14namespace: instead of chasing mount symlinks a priori, do so as-we-goLennart Poettering
2016-12-14core: rename BindMount structure → MountEntryLennart Poettering
2016-12-14namespace: add explicit read-only flagLennart Poettering
2016-12-13namespace: reindent protect_system_strict_table[] as wellLennart Poettering
2016-12-01fs-util: add flags parameter to chase_symlinks()Lennart Poettering
2016-12-01tree-wide: stop using canonicalize_file_name(), use chase_symlinks() insteadLennart Poettering
2016-11-17namespace: clarify that /proc/apm is obsolete, but leave it blockedLennart Poettering
2016-11-17namespace: reindent namespace tablesLennart Poettering
2016-11-17namespace: simplify, optimize and extend handling of mounts for namespaceLennart Poettering
2016-11-10core:namespace: count and free failed paths inside chase_all_symlinks() (#4619)Djalal Harouni
2016-11-08core: on DynamicUser= make sure that protecting sensitive paths is enforced (...Djalal Harouni
2016-11-07nspawn: slight simplificationZbigniew Jędrzejewski-Szmek
2016-11-07nspawn: avoid one strdup by using free_and_replaceZbigniew Jędrzejewski-Szmek
2016-11-07core: make RootDirectory= and ProtectKernelModules= workDjalal Harouni
2016-10-23tree-wide: drop NULL sentinel from strjoinZbigniew Jędrzejewski-Szmek
2016-10-12core:sandbox: lets make /lib/modules/ inaccessible on ProtectKernelModules=Djalal Harouni
2016-09-25core:namespace: simplify ProtectHome= implementationDjalal Harouni
2016-09-25core: simplify ProtectSystem= implementationDjalal Harouni
2016-09-25core:sandbox: add more /proc/* entries to ProtectKernelTunables=Djalal Harouni
2016-09-25core:namespace: simplify mount calculationDjalal Harouni
2016-09-25core:namespace: put paths protected by ProtectKernelTunables= inDjalal Harouni
2016-09-25core:namespace: minor improvements to append_mounts()Djalal Harouni
2016-09-25namespace: drop all mounts outside of the new root directoryLennart Poettering
2016-09-25namespace: don't make the root directory of a namespace a mount if it already...Lennart Poettering
2016-09-25namespace: chase symlinks for mounts to set up in userspaceLennart Poettering
2016-09-25namespace: invoke unshare() only after checking all parametersLennart Poettering
2016-09-25core: introduce ProtectSystem=strictLennart Poettering
2016-09-25namespace: add some debug logging when enforcing InaccessiblePaths=Lennart Poettering
2016-09-25namespace: rework how ReadWritePaths= is appliedLennart Poettering
2016-09-25namespace: when enforcing fs namespace restrictions suppress redundant mountsLennart Poettering
2016-09-25namespace: simplify mount_path_compare() a bitLennart Poettering
2016-09-25namespace: make sure InaccessibleDirectories= masks all mounts further downLennart Poettering
2016-09-25core: add two new service settings ProtectKernelTunables= and ProtectControlG...Lennart Poettering
2016-07-22Merge pull request #3764 from poettering/assorted-stuff-2Martin Pitt
2016-07-20namespace: fix wrong return value from mount(2) (#3758)Topi Miettinen
2016-07-20namespace: add a (void) castLennart Poettering
2016-07-20namespace: minor improvementsLennart Poettering
2016-07-19doc,core: Read{Write,Only}Paths= and InaccessiblePaths=Alessandro Puccetti
2016-07-19namespace: unify limit behavior on non-directory pathsAlessandro Puccetti
2016-05-15namespace: Make private /dev noexec and readonly (#3263)topimiettinen
2016-05-14namespace: unmount old /dev under our new private /dev (#3254)topimiettinen
2016-02-11Remove kdbus custom endpoint supportDaniel Mack
2016-02-10tree-wide: remove Emacs lines from all filesDaniel Mack
2015-10-27util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering