shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 00:51:24 +03:00
Code
49,443 Commits 4 Branches 390 Tags 551 MiB
450918d111
Commit Graph

1 Commits

Author SHA1 Message Date
Topi Miettinen
ddc155b2fd New directives NoExecPaths= ExecPaths= 
Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC`
mount flag for the file system tree. This can be used to implement file system
W^X policies, and for example with allow-listing mode (NoExecPaths=/) a
compromised service would not be able to execute a shell, if that was not
explicitly allowed.

Example:
[Service]
NoExecPaths=/
ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib

Closes: #17942.
 2021-01-29 12:40:52 +00:00