2 Commits

Author	SHA1	Message	Date
Zbigniew Jędrzejewski-Szmek	22d3cfe54c	tests: add spdx license header to test unit/link/network/conf files ... Those are all consumed by our parser, so they all support comments. I was considering whether they should have a license header at all, but in the end I decided to add it because those files are often created by copying parts of real unit files. And if the real ones have a license, then those might as well. It's easier to add it than to make an exception.	2021-10-18 09:04:45 +02:00
Topi Miettinen	ddc155b2fd	New directives NoExecPaths= ExecPaths= ... Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC` mount flag for the file system tree. This can be used to implement file system W^X policies, and for example with allow-listing mode (NoExecPaths=/) a compromised service would not be able to execute a shell, if that was not explicitly allowed. Example: [Service] NoExecPaths=/ ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib Closes: #17942.	2021-01-29 12:40:52 +00:00