systemd/test/test-execute/exec-systemcallfilter-system-user.service

[Unit]
Description=Test for SystemCallFilter in system mode with User set

[Service]
ExecStart=/bin/echo "Foo bar"
Type=oneshot
User=nobody
SystemCallFilter=~read write open execve ioperm
SystemCallFilter=ioctl
SystemCallFilter=read write open execve
SystemCallFilter=~ioperm
core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN The manpage of seccomp specify that using seccomp with SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence, without NoNewPrivilege set, it is impossible to use a SystemCall* directive with a User directive set in system mode. Now, NoNewPrivileges is set if we are in user mode, or if we are in system mode and we don't have CAP_SYS_ADMIN, and SystemCall* directives are used. 2016-01-30 19:26:39 +03:00			`[Unit]`
			`Description=Test for SystemCallFilter in system mode with User set`

			`[Service]`
			`ExecStart=/bin/echo "Foo bar"`
			`Type=oneshot`
			`User=nobody`
			`SystemCallFilter=~read write open execve ioperm`
			`SystemCallFilter=ioctl`
			`SystemCallFilter=read write open execve`
			`SystemCallFilter=~ioperm`