From 86204ae145e38a4557981a92ce91a8ce4318e181 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 21 May 2021 22:04:33 +0200 Subject: [PATCH] units: make sure importd has CAP_LINUX_IMMUTABLE flag Since d8f9686c0f1f276c0a687d9bd69f3adf33f15a95 we use the chattr +i flag for marking containers in directories as reead-only. But to do so we need the cap for it, hence grant it. Fixes: #19115 --- units/systemd-importd.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/units/systemd-importd.service.in b/units/systemd-importd.service.in index da31b2dc20..080cc646a9 100644 --- a/units/systemd-importd.service.in +++ b/units/systemd-importd.service.in @@ -16,7 +16,7 @@ Documentation=man:org.freedesktop.import1(5) ExecStart={{ROOTLIBEXECDIR}}/systemd-importd BusName=org.freedesktop.import1 KillMode=mixed -CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE +CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE CAP_LINUX_IMMUTABLE NoNewPrivileges=yes MemoryDenyWriteExecute=yes ProtectHostname=yes