shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-07 18:27:04 +03:00
Code
28,250 Commits 3 Branches 391 Tags 551 MiB
c7fb922d62
Commit Graph

11 Commits

Author SHA1 Message Date
Lennart Poettering
c7fb922d62 units: switch on ProtectSystem=strict for our long running services 
Let's step up the protection a notch
 2017-02-09 16:12:03 +01:00
Lennart Poettering
7f396e5f66 units: set SystemCallArchitectures=native on all our long-running services 2017-02-09 16:12:03 +01:00
Martin Pitt
5f004d1e32 networkd: allow networkd to start in early boot 
With the previous improvements, networkd.service's "After=dbus.service" can now
be dropped. That ordering effectively forced networkd.service to run in late
boot only (dbus.service was rejected to run in early boot in
https://bugs.freedesktop.org/show_bug.cgi?id=98254).

Fixes #4504
 2016-11-23 17:05:11 +01:00
Lennart Poettering
0c28d51ac8 units: further lock down our long-running services 
Let's make this an excercise in dogfooding: let's turn on more security
features for all our long-running services.

Specifically:

- Turn on RestrictRealtime=yes for all of them

- Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of
  them

- Turn on RestrictAddressFamilies= for all of them, but different sets of
  address families for each

Also, always order settings in the unit files, that the various sandboxing
features are close together.

Add a couple of missing, older settings for a numbre of unit files.

Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively
turning of networking from udev rule commands. Since this might break stuff
(that is already broken I'd argue) this is documented in NEWS.
 2016-09-25 10:52:57 +02:00
Lennart Poettering
4e069746fe units: tighten system call filters a bit 
Take away kernel keyring access, CPU emulation system calls and various debug
system calls from the various daemons we have.
 2016-06-13 16:25:54 +02:00
Topi Miettinen
40093ce5dd units: add a basic SystemCallFilter (#3471) 
Add a line
SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace
for daemons shipped by systemd. As an exception, systemd-timesyncd
needs @clock system calls and systemd-localed is not privileged.
ptrace(2) is blocked to prevent seccomp escapes.
 2016-06-09 09:32:04 +02:00
Topi Miettinen
40652ca479 units: enable MemoryDenyWriteExecute (#3459) 
Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute.

Closes: #3459
 2016-06-08 14:23:37 +02:00
Lennart Poettering
c2fc2c2560 units: increase watchdog timeout to 3min for all our services 
Apparently, disk IO issues are more frequent than we hope, and 1min
waiting for disk IO happens, so let's increase the watchdog timeout a
bit, for all our services.

See #1353 for an example where this triggers.
 2015-09-29 21:55:51 +02:00
Tom Gundersen
d2d1e36bee units: order networkd after sysctl 
This way networkd will correctly and race-freely inherit the default settings
applied by sysctl.

Suggested in issue #468.
 2015-07-23 21:04:58 +02:00
Kay Sievers
1b09f548c7 turn kdbus support into a runtime option 
./configure --enable/disable-kdbus can be used to set the default
behavior regarding kdbus.

If no kdbus kernel support is available, dbus-dameon will be used.

With --enable-kdbus, the kernel command line option "kdbus=0" can
be used to disable kdbus.

With --disable-kdbus, the kernel command line option "kdbus=1" is
required to enable kdbus support.
 2015-06-17 18:01:49 +02:00
Tom Gundersen
b5acb956d1 units: make networkd pull in its own .busname unit 
The daemon requires the busname unit to operate (on kdbus systems),
since it contains the policy that allows it to acquire its service
name.

This fixes https://bugs.freedesktop.org/show_bug.cgi?id=90287
 2015-05-15 22:59:43 +02:00