shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-11 05:17:44 +03:00
Code

man: Document that RestrictAddressFamilies= doesn't work on s390/s390x/...

Browse Source 
We already say that it doesn't work on i386, but there are more archs
like that apparently.
This commit is contained in:
Lennart Poettering 2017-02-03 18:33:04 +01:00
parent ad8f1479b4
commit 142bd808a1
1 changed files with 21 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
man/systemd.exec.xml
View File

@ -1508,40 +1508,29 @@
<varlistentry> <varlistentry>
<term><varname>RestrictAddressFamilies=</varname></term> <term><varname>RestrictAddressFamilies=</varname></term>
<listitem><para>Restricts the set of socket address families <listitem><para>Restricts the set of socket address families accessible to the processes of this unit. Takes a
accessible to the processes of this unit. Takes a space-separated list of address family names to whitelist, such as <constant>AF_UNIX</constant>,
space-separated list of address family names to whitelist, <constant>AF_INET</constant> or <constant>AF_INET6</constant>. When prefixed with <constant>~</constant> the
such as listed address families will be applied as blacklist, otherwise as whitelist. Note that this restricts access
<constant>AF_UNIX</constant>, to the <citerefentry
<constant>AF_INET</constant> or project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call
<constant>AF_INET6</constant>. When only. Sockets passed into the process by other means (for example, by using socket activation with socket
prefixed with <constant>~</constant> the listed address units, see <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
families will be applied as blacklist, otherwise as whitelist. are unaffected. Also, sockets created with <function>socketpair()</function> (which creates connected AF_UNIX
Note that this restricts access to the sockets only) are unaffected. Note that this option has no effect on 32-bit x86, s390, s390x, mips, mips-le,
<citerefentry project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry> ppc, ppc-le, pcc64, ppc64-le and is ignored (but works correctly on other architectures, including x86-64). If
system call only. Sockets passed into the process by other running in user mode, or in system mode, but without the <constant>CAP_SYS_ADMIN</constant> capability
means (for example, by using socket activation with socket (e.g. setting <varname>User=nobody</varname>), <varname>NoNewPrivileges=yes</varname> is implied. By default,
units, see no restrictions apply, all address families are accessible to processes. If assigned the empty string, any
<citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>) previous address familiy restriction changes are undone. This setting does not affect commands prefixed with
are unaffected. Also, sockets created with <literal>+</literal>.</para>
<function>socketpair()</function> (which creates connected
AF_UNIX sockets only) are unaffected. Note that this option
has no effect on 32-bit x86 and is ignored (but works
correctly on x86-64). If running in user mode, or in system
mode, but without the <constant>CAP_SYS_ADMIN</constant>
capability (e.g. setting <varname>User=nobody</varname>),
<varname>NoNewPrivileges=yes</varname> is implied. By
default, no restriction applies, all address families are
accessible to processes. If assigned the empty string, any
previous list changes are undone.</para>
<para>Use this option to limit exposure of processes to remote <para>Use this option to limit exposure of processes to remote access, in particular via exotic and sensitive
systems, in particular via exotic network protocols. Note that network protocols, such as <constant>AF_PACKET</constant>. Note that in most cases, the local
in most cases, the local <constant>AF_UNIX</constant> address <constant>AF_UNIX</constant> address family should be included in the configured whitelist as it is frequently
family should be included in the configured whitelist as it is used for local communication, including for
frequently used for local communication, including for
<citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry> <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry>
logging. This does not affect commands prefixed with <literal>+</literal>.</para></listitem> logging.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>