From f513e420c8b1a1d4c13092cd378f048b69793497 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 26 Feb 2014 02:28:52 +0100 Subject: exec: imply NoNewPriviliges= only when seccomp filters are used in user mode --- src/core/unit.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/core/unit.c') diff --git a/src/core/unit.c b/src/core/unit.c index 9d54147adb..05470739d2 100644 --- a/src/core/unit.c +++ b/src/core/unit.c @@ -2817,6 +2817,14 @@ int unit_exec_context_patch_defaults(Unit *u, ExecContext *c) { return r; } + if (u->manager->running_as == SYSTEMD_USER && + (c->syscall_whitelist || + !set_isempty(c->syscall_filter) || + !set_isempty(c->syscall_archs) || + c->address_families_whitelist || + !set_isempty(c->address_families))) + c->no_new_privileges = true; + return 0; } -- cgit v1.2.3-54-g00ecf