Lennart Poettering 6818c54ca6 core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309) ... ReadOnlyPaths=, ProtectHome=, InaccessiblePaths= and ProtectSystem= are about restricting access and little more, hence they should be disabled if PermissionsStartOnly= is used or ExecStart= lines are prefixed with a "+". Do that. (Note that we will still create namespaces and stuff, since that's about a lot more than just permissions. We'll simply disable the effect of the four options mentioned above, but nothing else mount related.) This also adds a test for this, to ensure this works as intended. No documentation updates, as the documentation are already vague enough to support the new behaviour ("If true, the permission-related execution options…"). We could clarify this further, but I think we might want to extend the switches' behaviour a bit more in future, hence leave it at this for now. Fixes: #5308		2017-02-12 00:44:46 -05:00
..
exec-capabilityambientset-merge-nfsnobody.service
exec-capabilityambientset-merge.service
exec-capabilityambientset-nfsnobody.service
exec-capabilityambientset.service
exec-capabilityboundingset-invert.service
exec-capabilityboundingset-merge.service
exec-capabilityboundingset-reset.service
exec-capabilityboundingset-simple.service
exec-dynamicuser-fixeduser-one-supplementarygroup.service
exec-dynamicuser-fixeduser.service
exec-dynamicuser-supplementarygroups.service
exec-environment-empty.service
exec-environment-multiple.service
exec-environment.service
exec-environmentfile.service
exec-group-nfsnobody.service
exec-group.service
exec-ignoresigpipe-no.service
exec-ignoresigpipe-yes.service
exec-inaccessiblepaths-mount-propagation.service
exec-ioschedulingclass-best-effort.service
exec-ioschedulingclass-idle.service
exec-ioschedulingclass-none.service
exec-ioschedulingclass-realtime.service
exec-oomscoreadjust-negative.service
exec-oomscoreadjust-positive.service
exec-passenvironment-absent.service
exec-passenvironment-empty.service
exec-passenvironment-repeated.service
exec-passenvironment.service
exec-personality-aarch64.service
exec-personality-ppc64.service
exec-personality-ppc64le.service
exec-personality-s390.service
exec-personality-x86-64.service
exec-personality-x86.service
exec-privatedevices-no-capability-mknod.service
exec-privatedevices-no-capability-sys-rawio.service
exec-privatedevices-no.service
exec-privatedevices-yes-capability-mknod.service
exec-privatedevices-yes-capability-sys-rawio.service
exec-privatedevices-yes.service
exec-privatenetwork-yes.service
exec-privatetmp-no.service
exec-privatetmp-yes.service
exec-protectkernelmodules-no-capabilities.service
exec-protectkernelmodules-yes-capabilities.service
exec-protectkernelmodules-yes-mount-propagation.service
exec-read-only-path-succeed.service	core: skip ReadOnlyPaths= and other permission-related mounts on PermissionsStartOnly= (#5309)	2017-02-12 00:44:46 -05:00
exec-readonlypaths-mount-propagation.service
exec-readonlypaths.service
exec-readwritepaths-mount-propagation.service
exec-restrict-namespaces-mnt-blacklist.service
exec-restrict-namespaces-mnt.service
exec-restrict-namespaces-no.service
exec-restrict-namespaces-yes.service
exec-runtimedirectory-mode.service
exec-runtimedirectory-owner-nfsnobody.service
exec-runtimedirectory-owner.service
exec-runtimedirectory.service
exec-spec-interpolation.service
exec-supplementarygroups-multiple-groups-default-group-user.service
exec-supplementarygroups-multiple-groups-withgid.service
exec-supplementarygroups-multiple-groups-withuid.service
exec-supplementarygroups-single-group-user.service
exec-supplementarygroups-single-group.service
exec-supplementarygroups.service
exec-systemcallerrornumber.service
exec-systemcallfilter-failing2.service
exec-systemcallfilter-failing.service
exec-systemcallfilter-not-failing2.service
exec-systemcallfilter-not-failing.service
exec-systemcallfilter-system-user-nfsnobody.service
exec-systemcallfilter-system-user.service
exec-umask-0177.service
exec-umask-default.service
exec-user-nfsnobody.service
exec-user.service
exec-workingdirectory.service