shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-01-09 01:18:19 +03:00
Code

core: add RestrictAddressFamilies=none to deny all address families

Browse Source 
Closes #15753.
This commit is contained in:
Yu Watanabe 2021-04-17 13:04:28 +09:00 committed by Luca Boccassi
parent 8441993621
commit 4e6c50a5d4
3 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
man/systemd.exec.xml
View File

@ -1777,11 +1777,13 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<term><varname>RestrictAddressFamilies=</varname></term>
<listitem><para>Restricts the set of socket address families accessible to the processes of this
unit. Takes a space-separated list of address family names to allow-list, such as
<constant>AF_UNIX</constant>, <constant>AF_INET</constant> or <constant>AF_INET6</constant>. When
prefixed with <constant>~</constant> the listed address families will be applied as deny list,
otherwise as allow list. Note that this restricts access to the <citerefentry
project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry>
unit. Takes <literal>none</literal>, or a space-separated list of address family names to
allow-list, such as <constant>AF_UNIX</constant>, <constant>AF_INET</constant> or
<constant>AF_INET6</constant>. When <literal>none</literal> is specified, then all address
families will be denied. When prefixed with <literal>~</literal> the listed address
families will be applied as deny list, otherwise as allow list. Note that this restricts access
to the
<citerefentry project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry>
system call only. Sockets passed into the process by other means (for example, by using socket
activation with socket units, see
<citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>)

9
src/core/dbus-execute.c
View File

@ -2379,8 +2379,8 @@ int bus_exec_context_set_transient_property(
return 1;
} else if (streq(name, "RestrictAddressFamilies")) {
int allow_list;
_cleanup_strv_free_ char **l = NULL;
int allow_list;
r = sd_bus_message_enter_container(message, 'r', "bas");
if (r < 0)
@ -2403,10 +2403,11 @@ int bus_exec_context_set_transient_property(
char **s;
if (strv_isempty(l)) {
c->address_families_allow_list = false;
c->address_families_allow_list = allow_list;
c->address_families = set_free(c->address_families);
unit_write_settingf(u, flags, name, "RestrictAddressFamilies=");
unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s",
allow_list ? "none" : "");
return 1;
}
@ -2430,7 +2431,7 @@ int bus_exec_context_set_transient_property(
if (r < 0)
return r;
} else
(void) set_remove(c->address_families, INT_TO_PTR(af));
set_remove(c->address_families, INT_TO_PTR(af));
}
joined = strv_join(l, " ");

7
src/core/load-fragment.c
View File

@ -3437,6 +3437,13 @@ int config_parse_address_families(
return 0;
}
if (streq(rvalue, "none")) {
/* Forbid all address families. */
c->address_families = set_free(c->address_families);
c->address_families_allow_list = true;
return 0;
}
if (rvalue[0] == '~') {
invert = true;
rvalue++;