shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-01-03 05:18:09 +03:00
Code

Revert "units: add SecureBits"

Browse Source 
This reverts commit 6a716208b3.

Apparently this doesn't work.

http://lists.freedesktop.org/archives/systemd-devel/2015-February/028212.html
This commit is contained in:
Lennart Poettering 2015-02-11 18:28:06 +01:00
parent e203dc1076
commit a24111cea6
13 changed files with 0 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
units/systemd-hostnamed.service.in
View File

@ -14,7 +14,6 @@ Documentation=http://www.freedesktop.org/wiki/Software/systemd/hostnamed
ExecStart=@rootlibexecdir@/systemd-hostnamed ExecStart=@rootlibexecdir@/systemd-hostnamed
BusName=org.freedesktop.hostname1 BusName=org.freedesktop.hostname1
CapabilityBoundingSet=CAP_SYS_ADMIN CapabilityBoundingSet=CAP_SYS_ADMIN
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes

1
units/systemd-importd.service.in
View File

@ -14,7 +14,6 @@ ExecStart=@rootlibexecdir@/systemd-importd
BusName=org.freedesktop.import1 BusName=org.freedesktop.import1
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP
NoNewPrivileges=yes NoNewPrivileges=yes
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
PrivateTmp=yes PrivateTmp=yes
ProtectSystem=full ProtectSystem=full

1
units/systemd-journal-gatewayd.service.in
View File

@ -11,7 +11,6 @@ Requires=systemd-journal-gatewayd.socket
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-journal-gatewayd ExecStart=@rootlibexecdir@/systemd-journal-gatewayd
SecureBits=noroot noroot-locked
User=systemd-journal-gateway User=systemd-journal-gateway
Group=systemd-journal-gateway Group=systemd-journal-gateway
SupplementaryGroups=systemd-journal SupplementaryGroups=systemd-journal

1
units/systemd-journal-remote.service.in
View File

@ -13,7 +13,6 @@ Requires=systemd-journal-remote.socket
ExecStart=@rootlibexecdir@/systemd-journal-remote \ ExecStart=@rootlibexecdir@/systemd-journal-remote \
--listen-https=-3 \ --listen-https=-3 \
--output=/var/log/journal/remote/ --output=/var/log/journal/remote/
SecureBits=noroot noroot-locked
User=systemd-journal-remote User=systemd-journal-remote
Group=systemd-journal-remote Group=systemd-journal-remote
PrivateTmp=yes PrivateTmp=yes

1
units/systemd-journal-upload.service.in
View File

@ -12,7 +12,6 @@ After=network.target
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-journal-upload \ ExecStart=@rootlibexecdir@/systemd-journal-upload \
--save-state --save-state
SecureBits=noroot noroot-locked
User=systemd-journal-upload User=systemd-journal-upload
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes

1
units/systemd-journald.service.in
View File

@ -22,7 +22,6 @@ RestartSec=0
NotifyAccess=all NotifyAccess=all
StandardOutput=null StandardOutput=null
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
FileDescriptorStoreMax=1024 FileDescriptorStoreMax=1024

1
units/systemd-localed.service.in
View File

@ -14,7 +14,6 @@ Documentation=http://www.freedesktop.org/wiki/Software/systemd/localed
ExecStart=@rootlibexecdir@/systemd-localed ExecStart=@rootlibexecdir@/systemd-localed
BusName=org.freedesktop.locale1 BusName=org.freedesktop.locale1
CapabilityBoundingSet= CapabilityBoundingSet=
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes

1
units/systemd-logind.service.in
View File

@ -24,7 +24,6 @@ Restart=always
RestartSec=0 RestartSec=0
BusName=org.freedesktop.login1 BusName=org.freedesktop.login1
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
# Increase the default a bit in order to allow many simultaneous # Increase the default a bit in order to allow many simultaneous

1
units/systemd-machined.service.in
View File

@ -16,7 +16,6 @@ After=machine.slice
ExecStart=@rootlibexecdir@/systemd-machined ExecStart=@rootlibexecdir@/systemd-machined
BusName=org.freedesktop.machine1 BusName=org.freedesktop.machine1
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes

1
units/systemd-networkd.service.in
View File

@ -23,7 +23,6 @@ Restart=on-failure
RestartSec=0 RestartSec=0
ExecStart=@rootlibexecdir@/systemd-networkd ExecStart=@rootlibexecdir@/systemd-networkd
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
SecureBits=noroot noroot-locked
ProtectSystem=full ProtectSystem=full
ProtectHome=yes ProtectHome=yes
WatchdogSec=1min WatchdogSec=1min

1
units/systemd-resolved.service.in
View File

@ -21,7 +21,6 @@ Restart=always
RestartSec=0 RestartSec=0
ExecStart=@rootlibexecdir@/systemd-resolved ExecStart=@rootlibexecdir@/systemd-resolved
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
SecureBits=noroot noroot-locked
ProtectSystem=full ProtectSystem=full
ProtectHome=yes ProtectHome=yes
WatchdogSec=1min WatchdogSec=1min

1
units/systemd-timedated.service.in
View File

@ -14,7 +14,6 @@ Documentation=http://www.freedesktop.org/wiki/Software/systemd/timedated
ExecStart=@rootlibexecdir@/systemd-timedated ExecStart=@rootlibexecdir@/systemd-timedated
BusName=org.freedesktop.timedate1 BusName=org.freedesktop.timedate1
CapabilityBoundingSet=CAP_SYS_TIME CapabilityBoundingSet=CAP_SYS_TIME
SecureBits=noroot noroot-locked
WatchdogSec=1min WatchdogSec=1min
PrivateTmp=yes PrivateTmp=yes
ProtectSystem=yes ProtectSystem=yes

1
units/systemd-timesyncd.service.in
View File

@ -23,7 +23,6 @@ Restart=always
RestartSec=0 RestartSec=0
ExecStart=@rootlibexecdir@/systemd-timesyncd ExecStart=@rootlibexecdir@/systemd-timesyncd
CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
SecureBits=noroot noroot-locked
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes
ProtectSystem=full ProtectSystem=full