shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2024-12-22 13:33:56 +03:00
Code

journal: limit caps we pass to journald

Browse Source
This commit is contained in:
Lennart Poettering 2012-02-09 02:06:13 +01:00
parent cea6691857
commit ccd07a083e
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -16,6 +16,8 @@ CHANGES WITH 41:
understood to set system wide environment variables
dynamically at boot.
* We now limit the set of capabilities of systemd-journald.
Contributions from: Benjamin Franzke, Kay Sievers, Lennart
Poettering, Michael Olbrich, Michal Schmidt, Tom Gundersen,
William Douglas

2
units/systemd-journald.service.in
View File

@ -18,7 +18,7 @@ After=syslog.socket
ExecStart=@rootlibexecdir@/systemd-journald
NotifyAccess=all
StandardOutput=null
#CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SETUID CAP_SETGID CAP_DAC_OVERRIDE
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER
# Increase the default a bit in order to allow many simultaneous
# services being run since we keep one fd open per service.