systemd

shaba/systemd

Fork 0

mirror of https://github.com/systemd/systemd.git synced 2024-11-02 02:21:44 +03:00

Commit Graph

Author	SHA1	Message	Date
Yu Watanabe	69b0740785	test-execute: add tests with user/group daemon The nobody user/group may not synthesized by systemd. To run tests the functionalities in such situation, this adds tests by user/group by daemon, as it is expected to exists all environments.	2018-03-02 16:42:53 +09:00
Yu Watanabe	038a373651	test-execute: always use /bin/sh	2017-10-12 13:26:39 +09:00
Ronny Chevalier	19c0b0b9a5	core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN The manpage of seccomp specify that using seccomp with SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence, without NoNewPrivilege set, it is impossible to use a SystemCall* directive with a User directive set in system mode. Now, NoNewPrivileges is set if we are in user mode, or if we are in system mode and we don't have CAP_SYS_ADMIN, and SystemCall* directives are used.	2016-02-28 14:44:26 +01:00

Author

SHA1

Message

Date

Yu Watanabe

69b0740785

test-execute: add tests with user/group daemon

The nobody user/group may not synthesized by systemd.
To run tests the functionalities in such situation, this adds tests
by user/group by daemon, as it is expected to exists all environments.

2018-03-02 16:42:53 +09:00

Yu Watanabe

038a373651

test-execute: always use /bin/sh

2017-10-12 13:26:39 +09:00

Ronny Chevalier

19c0b0b9a5

core: set NoNewPrivileges for seccomp if we don't have CAP_SYS_ADMIN

The manpage of seccomp specify that using seccomp with
SECCOMP_SET_MODE_FILTER will return EACCES if the caller do not have
CAP_SYS_ADMIN set, or if the no_new_privileges bit is not set. Hence,
without NoNewPrivilege set, it is impossible to use a SystemCall*
directive with a User directive set in system mode.

Now, NoNewPrivileges is set if we are in user mode, or if we are in
system mode and we don't have CAP_SYS_ADMIN, and SystemCall*
directives are used.

2016-02-28 14:44:26 +01:00

3 Commits