summaryrefslogtreecommitdiff
path: root/units/systemd-machined.service.in
AgeCommit message (Collapse)Author
2016-06-21units: machined needs mount-related syscalls for its namespacing operationsLennart Poettering
Specifically "machinectl shell" (or its OpenShell() bus call) is implemented by entering the file system namespace of the container and opening a TTY there. In order to enter the file system namespace, chroot() is required, which is filtered by SystemCallFilter='s @mount group. Hence, let's make this work again and drop @mount from the filter list.
2016-06-13units: tighten system call filters a bitLennart Poettering
Take away kernel keyring access, CPU emulation system calls and various debug system calls from the various daemons we have.
2016-06-09units: add a basic SystemCallFilter (#3471)Topi Miettinen
Add a line SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace for daemons shipped by systemd. As an exception, systemd-timesyncd needs @clock system calls and systemd-localed is not privileged. ptrace(2) is blocked to prevent seccomp escapes.
2016-06-08units: enable MemoryDenyWriteExecute (#3459)Topi Miettinen
Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-04-25machined: add CAP_MKNOD to capabilities to run with (#3116)Lennart Poettering
Container images from Debian or suchlike contain device nodes in /dev. Let's make sure we can clone them properly, hence pass CAP_MKNOD to machined. Fixes: #2867 #465
2015-09-29units: increase watchdog timeout to 3min for all our servicesLennart Poettering
Apparently, disk IO issues are more frequent than we hope, and 1min waiting for disk IO happens, so let's increase the watchdog timeout a bit, for all our services. See #1353 for an example where this triggers.
2015-07-27units: add more caps to machinedLennart Poettering
Otherwise copying full directory trees between container and host won't work, as we cannot access some fiels and cannot adjust the ownership properly on the destination. Of course, adding these many caps to the daemon kinda defeats the purpose of the caps lock-down... but well... Fixes #433
2015-02-17machined: move logic for bind mounting into containers from machinectl to ↵Lennart Poettering
machined This extends the bus interface, adding BindMountMachine() for bind mounting directories from the host into the container.
2015-02-11Revert "units: add SecureBits"Lennart Poettering
This reverts commit 6a716208b346b742053cfd01e76f76fb27c4ea47. Apparently this doesn't work. http://lists.freedesktop.org/archives/systemd-devel/2015-February/028212.html
2015-02-11units: add SecureBitsTopi Miettinen
No setuid programs are expected to be executed, so add SecureBits=noroot noroot-locked to unit files.
2014-12-19machined/machinectl: add logic to show list of available imagesLennart Poettering
This adds a new bus call to machined that enumerates /var/lib/container and returns all trees stored in it, distuingishing three types: - GPT disk images, which are files suffixed with ".gpt" - directory trees - btrfs subvolumes
2014-07-03machinectl: show /etc/os-release information of container in status outputLennart Poettering
2014-06-19units: add missing caps so that GetAddresses() can workLennart Poettering
2014-06-06units: fix minor typoLennart Poettering
2014-06-04core: rename ReadOnlySystem= to ProtectSystem= and add a third value for ↵Lennart Poettering
also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
2014-06-03core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering
ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
2014-03-19core: enable PrivateNetwork= for a number of our long running services where ↵Lennart Poettering
this is useful
2014-03-19units: make use of PrivateTmp=yes and PrivateDevices=yes for all our ↵Lennart Poettering
long-running daemons
2013-12-23units: systemd-machined now exits on idle and we shouldn't try to restart it ↵Lennart Poettering
then
2013-12-11event: hook up sd-event with the service watchdog logicLennart Poettering
Adds a new call sd_event_set_watchdog() that can be used to hook up the event loop with the watchdog supervision logic of systemd. If enabled and $WATCHDOG_USEC is set the event loop will ping the invoking systemd daemon right after coming back from epoll_wait() but not more often than $WATCHDOG_USEC/4. The epoll_wait() will sleep no longer than $WATCHDOG_USEC/4*3, to make sure the service manager is called in time. This means that setting WatchdogSec= in a .service file and calling sd_event_set_watchdog() in your daemon is enough to hook it up with the watchdog logic.
2013-07-19machined: run machined at minimal capabilitiesLennart Poettering
2013-07-19units: add references to bus API documentation to logind+machinedLennart Poettering
2013-07-02machined: split out machine registration stuff from logindLennart Poettering
Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.