shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-06 08:26:52 +03:00
Code

nspawn: prohibit access to the kernel log buffer by default

Browse Source 
Unless CAP_SYSLOG is explicitly passed block all access to kmg
This commit is contained in:
Lennart Poettering 2015-05-21 20:48:39 +02:00
parent 4c6d20dece
commit 5ba7a26847
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/nspawn/nspawn.c
View File

@ -2941,6 +2941,7 @@ static int setup_seccomp(void) {
{ CAP_SYS_MODULE, SCMP_SYS(init_module) }, { CAP_SYS_MODULE, SCMP_SYS(init_module) },
{ CAP_SYS_MODULE, SCMP_SYS(finit_module) }, { CAP_SYS_MODULE, SCMP_SYS(finit_module) },
{ CAP_SYS_MODULE, SCMP_SYS(delete_module) }, { CAP_SYS_MODULE, SCMP_SYS(delete_module) },
{ CAP_SYSLOG, SCMP_SYS(syslog) },
}; };
scmp_filter_ctx seccomp; scmp_filter_ctx seccomp;