shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-10-20 11:33:35 +03:00
Code Activity

core:sandbox: remove CAP_SYS_RAWIO on PrivateDevices=yes

Browse Source 
The rawio system calls were filtered, but CAP_SYS_RAWIO allows to access raw
data through /proc, ioctl and some other exotic system calls...
This commit is contained in:
Djalal Harouni
2016-10-07 20:38:05 +02:00
parent 3ae33295f0
commit 2cd0a73547
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
man/systemd.exec.xml
View File

@@ -946,8 +946,8 @@
<filename>/dev/port</filename> and others. This is useful to securely turn off physical device access by the <filename>/dev/port</filename> and others. This is useful to securely turn off physical device access by the
executed process. Defaults to false. Enabling this option will install a system call filter to block low-level executed process. Defaults to false. Enabling this option will install a system call filter to block low-level
I/O system calls that are grouped in the <varname>@raw-io</varname> set, will also remove I/O system calls that are grouped in the <varname>@raw-io</varname> set, will also remove
<constant>CAP_MKNOD</constant> from the capability bounding set for the unit (see above), and set <constant>CAP_MKNOD</constant> and <constant>CAP_SYS_RAWIO</constant> from the capability bounding set for
<varname>DevicePolicy=closed</varname> (see the unit (see above), and set <varname>DevicePolicy=closed</varname> (see
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details). Note that using this setting will disconnect propagation of mounts from the service to the host for details). Note that using this setting will disconnect propagation of mounts from the service to the host
(propagation in the opposite direction continues to work). This means that this setting may not be used for (propagation in the opposite direction continues to work). This means that this setting may not be used for

2
src/core/unit.c
View File

@@ -3399,7 +3399,7 @@ int unit_patch_contexts(Unit *u) {
ec->no_new_privileges = true; ec->no_new_privileges = true;
if (ec->private_devices) if (ec->private_devices)
ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_MKNOD); ec->capability_bounding_set &= ~((UINT64_C(1) << CAP_MKNOD) | (UINT64_C(1) << CAP_SYS_RAWIO));
if (ec->protect_kernel_modules) if (ec->protect_kernel_modules)
ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYS_MODULE); ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYS_MODULE);