1
0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00
Commit Graph

7 Commits

Author SHA1 Message Date
Martin Pitt
2f9df7c96a units: add nosuid and nodev options to tmp.mount (#3575)
This makes privilege escalation attacks harder by putting traps and exploits
into /tmp.

https://bugs.debian.org/826377
2016-06-22 12:32:59 +02:00
frankheckenbach
a11fe93e04 tmp.mount.hm4: After swap.target (#3087)
fix issue #2930
2016-04-22 14:21:30 +02:00
Lennart Poettering
2a2e1b36a0 core: remove SmackFileSystemRootLabel= again
Apparently, util-linux' mount command implicitly drops the smack-related
options anyway before passing them to the kernel, if the kernel doesn't
know SMACK, hence there's no point in duplicating this in systemd.

Fixes #1696
2015-11-12 12:50:59 +01:00
Lennart Poettering
7cb48925dc core: rename SmackFileSystemRoot= to SmackFileSystemRootLabel=
That way it's in sync with the other SMACK label settings.

https://github.com/systemd/systemd/pull/1664#issuecomment-150891270
2015-10-26 01:24:39 +01:00
Sangjung Woo
5dfcb8d200 units: add 'SmackFileSystemRoot=*' option into tmp.mount
If SMACK is enabled, 'smackfsroot=*' option should be specified when
/tmp is mounted since many non-root processes use /tmp for temporary
usage. If not, /tmp is labeled as '_' and smack denial occurs when
writing.

In order to do that, 'SmackFileSystemRoot=*' is newly added into
tmp.mount.
2015-10-24 20:54:21 +09:00
Kay Sievers
29a3f0d4c5 Revert "units: add 'smackfsroot=*' option into tmp.mount when SMACK is enabled"
This reverts commit 409c2a13fd.

It breaks the bootup of systems which enable smack at compile time, but have no
smack enabled in the kernel. This needs a different solution.
2015-10-18 12:21:21 +02:00
Sangjung Woo
409c2a13fd units: add 'smackfsroot=*' option into tmp.mount when SMACK is enabled
If SMACK is enabled, 'smackfsroot=*' option should be specified in
tmp.mount file since many non-root processes use /tmp for temporary
usage. If not, /tmp is labeled as '_' and smack denial occurs when
writing.
2015-10-15 14:02:44 +09:00