diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2018-12-18 15:05:48 +0100 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2019-03-19 10:58:49 +0100 |
| commit | 11dce8e29b2786a57cab2bfb4b1a39221cf7f2db (patch) | |
| tree | 55450a9bad2914e6c9354fd3426267faa786fbeb | |
| parent | 928df2c251501f9a693cfd292a8a05c45d1963e2 (diff) | |
| download | systemd-11dce8e29b2786a57cab2bfb4b1a39221cf7f2db.tar.gz systemd-11dce8e29b2786a57cab2bfb4b1a39221cf7f2db.tar.bz2 systemd-11dce8e29b2786a57cab2bfb4b1a39221cf7f2db.zip | |
Revert "Revert "units: lock down logind with fs namespacing options""
This reverts commit 28f38a76345b7548700d2337dd8b9a8c3f5b0643.
The revert was done because Ubuntu CI was completely broken with it. Let's see
if it fares better now.
| -rw-r--r-- | units/systemd-logind.service.in | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index a864f66c68..9c8938ec4a 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -21,19 +21,27 @@ After=dbus.socket [Service] BusName=org.freedesktop.login1 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG CAP_LINUX_IMMUTABLE +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG CAP_LINUX_IMMUTABLE ExecStart=@rootlibexecdir@/systemd-logind FileDescriptorStoreMax=512 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes +PrivateTmp=yes +ProtectControlGroups=yes +ProtectHome=yes ProtectHostname=yes +ProtectKernelModules=yes +ProtectSystem=strict +ReadWritePaths=/etc /run Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK RestrictNamespaces=yes RestrictRealtime=yes +RuntimeDirectory=systemd/sessions systemd/seats systemd/users systemd/inhibit systemd/shutdown +RuntimeDirectoryPreserve=yes SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service |