shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-19 22:50:17 +03:00
Code

main: don't set no_new_privs when using SystemCallArchitectures= system-wide

Browse Source 
After all, we want to allow userspace to get new privs...
This commit is contained in:
Lennart Poettering 2014-02-17 01:14:14 +01:00
parent 37c47eb709
commit 8a8bf3c045
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/core/main.c
View File

@ -1191,6 +1191,12 @@ static int enforce_syscall_archs(Set *archs) {
}
}
r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
if (r < 0) {
log_error("Failed to unset NO_NEW_PRIVS: %s", strerror(-r));
goto finish;
}
r = seccomp_load(seccomp);
if (r < 0)
log_error("Failed to add install architecture seccomp: %s", strerror(-r));