From f513e420c8b1a1d4c13092cd378f048b69793497 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 26 Feb 2014 02:28:52 +0100
Subject: exec: imply NoNewPriviliges= only when seccomp filters are used in
 user mode

---
 src/core/execute.c | 7 +++++--
 src/core/unit.c    | 8 ++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

(limited to 'src/core')

diff --git a/src/core/execute.c b/src/core/execute.c
index fff25c2b23..9de6e8726f 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1706,7 +1706,8 @@ int exec_spawn(ExecCommand *command,
                                 }
 
 #ifdef HAVE_SECCOMP
-                        if (context->address_families) {
+                        if (context->address_families_whitelist ||
+                            !set_isempty(context->address_families)) {
                                 err = apply_address_families(context);
                                 if (err < 0) {
                                         r = EXIT_ADDRESS_FAMILIES;
@@ -1714,7 +1715,9 @@ int exec_spawn(ExecCommand *command,
                                 }
                         }
 
-                        if (context->syscall_filter || context->syscall_archs) {
+                        if (context->syscall_whitelist ||
+                            !set_isempty(context->syscall_filter) ||
+                            !set_isempty(context->syscall_archs)) {
                                 err = apply_seccomp(context);
                                 if (err < 0) {
                                         r = EXIT_SECCOMP;
diff --git a/src/core/unit.c b/src/core/unit.c
index 9d54147adb..05470739d2 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2817,6 +2817,14 @@ int unit_exec_context_patch_defaults(Unit *u, ExecContext *c) {
                         return r;
         }
 
+        if (u->manager->running_as == SYSTEMD_USER &&
+            (c->syscall_whitelist ||
+             !set_isempty(c->syscall_filter) ||
+             !set_isempty(c->syscall_archs) ||
+             c->address_families_whitelist ||
+             !set_isempty(c->address_families)))
+                c->no_new_privileges = true;
+
         return 0;
 }
 
-- 
cgit v1.2.3-54-g00ecf