From fa229d09281d435153b4cfd138a2a62fa66d889b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 4 Jul 2014 03:10:09 +0200 Subject: units: conditionalize configfs and debugfs with CAP_SYS_RAWIO We really don't want these in containers as they provide a too lowlevel look on the system. Conditionalize them with CAP_SYS_RAWIO since that's required to access /proc/kcore, /dev/kmem and similar, which feel similar in style. Also, npsawn containers lack that capability. --- units/sys-kernel-debug.mount | 1 + 1 file changed, 1 insertion(+) (limited to 'units/sys-kernel-debug.mount') diff --git a/units/sys-kernel-debug.mount b/units/sys-kernel-debug.mount index 5369728a9f..1e94387bac 100644 --- a/units/sys-kernel-debug.mount +++ b/units/sys-kernel-debug.mount @@ -11,6 +11,7 @@ Documentation=https://www.kernel.org/doc/Documentation/filesystems/debugfs.txt Documentation=http://www.freedesktop.org/wiki/Software/systemd/APIFileSystems DefaultDependencies=no ConditionPathExists=/sys/kernel/debug +ConditionCapability=CAP_SYS_RAWIO Before=sysinit.target [Mount] -- cgit v1.2.3-54-g00ecf