mirror of
https://github.com/systemd/systemd.git
synced 2024-12-25 01:34:28 +03:00
nspawn: add new --drop-capability= switch
This commit is contained in:
parent
1b5995b039
commit
420c7379fb
@ -303,6 +303,16 @@
|
||||
CAP_AUDIT_CONTROL.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><option>--drop-capability=</option></term>
|
||||
|
||||
<listitem><para>Specify one or more
|
||||
additional capabilities to drop for
|
||||
the container. This allows running the
|
||||
container with fewer capabilities than
|
||||
the default (see above).</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><option>--link-journal=</option></term>
|
||||
|
||||
|
@ -127,6 +127,7 @@ static int help(void) {
|
||||
" --read-only Mount the root directory read-only\n"
|
||||
" --capability=CAP In addition to the default, retain specified\n"
|
||||
" capability\n"
|
||||
" --drop-capability=CAP Drop the specified capability from the default set\n"
|
||||
" --link-journal=MODE Link up guest journal, one of no, auto, guest, host\n"
|
||||
" -j Equivalent to --link-journal=host\n"
|
||||
" --bind=PATH[:PATH] Bind mount a file or directory from the host into\n"
|
||||
@ -145,6 +146,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
ARG_UUID,
|
||||
ARG_READ_ONLY,
|
||||
ARG_CAPABILITY,
|
||||
ARG_DROP_CAPABILITY,
|
||||
ARG_LINK_JOURNAL,
|
||||
ARG_BIND,
|
||||
ARG_BIND_RO
|
||||
@ -160,6 +162,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
{ "uuid", required_argument, NULL, ARG_UUID },
|
||||
{ "read-only", no_argument, NULL, ARG_READ_ONLY },
|
||||
{ "capability", required_argument, NULL, ARG_CAPABILITY },
|
||||
{ "drop-capability", required_argument, NULL, ARG_DROP_CAPABILITY },
|
||||
{ "link-journal", required_argument, NULL, ARG_LINK_JOURNAL },
|
||||
{ "bind", required_argument, NULL, ARG_BIND },
|
||||
{ "bind-ro", required_argument, NULL, ARG_BIND_RO },
|
||||
@ -243,7 +246,8 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
arg_read_only = true;
|
||||
break;
|
||||
|
||||
case ARG_CAPABILITY: {
|
||||
case ARG_CAPABILITY:
|
||||
case ARG_DROP_CAPABILITY: {
|
||||
char *state, *word;
|
||||
size_t length;
|
||||
|
||||
@ -262,7 +266,11 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
}
|
||||
|
||||
free(t);
|
||||
arg_retain |= 1ULL << (uint64_t) cap;
|
||||
|
||||
if (c == ARG_CAPABILITY)
|
||||
arg_retain |= 1ULL << (uint64_t) cap;
|
||||
else
|
||||
arg_retain &= ~(1ULL << (uint64_t) cap);
|
||||
}
|
||||
|
||||
break;
|
||||
|
Loading…
Reference in New Issue
Block a user