systemd

shaba/systemd

Fork 0

mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00

Commit Graph

Author	SHA1	Message	Date
Topi Miettinen	ddc155b2fd	New directives NoExecPaths= ExecPaths= Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC` mount flag for the file system tree. This can be used to implement file system W^X policies, and for example with allow-listing mode (NoExecPaths=/) a compromised service would not be able to execute a shell, if that was not explicitly allowed. Example: [Service] NoExecPaths=/ ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib Closes: #17942.	2021-01-29 12:40:52 +00:00

Author

SHA1

Message

Date

Topi Miettinen

ddc155b2fd

New directives NoExecPaths= ExecPaths=

Implement directives `NoExecPaths=` and `ExecPaths=` to control `MS_NOEXEC`
mount flag for the file system tree. This can be used to implement file system
W^X policies, and for example with allow-listing mode (NoExecPaths=/) a
compromised service would not be able to execute a shell, if that was not
explicitly allowed.

Example:
[Service]
NoExecPaths=/
ExecPaths=/usr/bin/daemon /usr/lib64 /usr/lib

Closes: #17942.

2021-01-29 12:40:52 +00:00

1 Commits