From 42d61dedcf279b4926d8fd4b600e2d37aa284933 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 12 May 2016 20:14:46 +0200 Subject: update TODO --- TODO | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/TODO b/TODO index 792d63b3e3..fac9ccf0ed 100644 --- a/TODO +++ b/TODO @@ -33,6 +33,22 @@ Janitorial Clean-ups: Features: +* make sure bash completion uses journalctl --fields to get fields list + +* use phyical_memory() to allow MemoryLimit= configuration based on available system memory + +* ProtectKernelLogs= (drops CAP_SYSLOG, add seccomp for syslog() syscall, and DeviceAllow to /dev/kmsg) in service files + +* ProtectClock= (drops CAP_SYS_TIMES, adds seecomp filters for settimeofday, adjtimex), sets DeviceAllow o /dev/rtc + +* ProtectMount= (drop mount/umount/pivot_root from seccomp, disallow fuse via DeviceAllow, imply Mountflags=slave) + +* ProtectDevices= should also take iopl/ioperm/pciaccess away + +* ProtectKeyRing= to take keyring calls away + +* RestrictNamespaces= or so in services (taking away the ability to create namespaces, with setns, unshare, clone) + * IAID field must move from [Link] to [DHCP] section in .network files * make sure the ratelimit object can deal with USEC_INFINITY as way to turn off things -- cgit v1.2.3-54-g00ecf