diff options
| author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2017-12-19 16:07:04 +0900 |
|---|---|---|
| committer | Yu Watanabe <watanabe.yu+github@gmail.com> | 2017-12-19 16:07:04 +0900 |
| commit | 5af1644314ccab01854e9173f97865013c16b3dd (patch) | |
| tree | d1b3f0eadb65a374c911bf2179d3e2a3b45615d2 /man | |
| parent | 69b528832a8ee3606bf8f30164c681a0872f7a2a (diff) | |
| download | systemd-5af1644314ccab01854e9173f97865013c16b3dd.tar.gz systemd-5af1644314ccab01854e9173f97865013c16b3dd.tar.bz2 systemd-5af1644314ccab01854e9173f97865013c16b3dd.zip | |
man: note that `systemctl show` does not overridden value
Fixes #7694.
Diffstat (limited to 'man')
| -rw-r--r-- | man/systemd.exec.xml | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index b0135e42fe..2f62f1cd6b 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -376,13 +376,14 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting> <listitem><para>Takes a boolean argument. If true, ensures that the service process and all its children can never gain new privileges through <function>execve()</function> (e.g. via setuid or setgid bits, or filesystem capabilities). This is the simplest and most effective way to ensure that a process and its children can never - elevate privileges again. Defaults to false, but certain settings force <varname>NoNewPrivileges=yes</varname>, - ignoring the value of this setting. This is the case when <varname>SystemCallFilter=</varname>, + elevate privileges again. Defaults to false, but certain settings override this and ignore the value of this + setting. This is the case when <varname>SystemCallFilter=</varname>, <varname>SystemCallArchitectures=</varname>, <varname>RestrictAddressFamilies=</varname>, <varname>RestrictNamespaces=</varname>, <varname>PrivateDevices=</varname>, <varname>ProtectKernelTunables=</varname>, <varname>ProtectKernelModules=</varname>, <varname>MemoryDenyWriteExecute=</varname>, <varname>RestrictRealtime=</varname>, or - <varname>LockPersonality=</varname> are specified. Also see + <varname>LockPersonality=</varname> are specified. Note that even if this setting is overridden by them, + <command>systemctl show</command> shows the original value of this setting. Also see <ulink url="https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html">No New Privileges Flag</ulink>. </para></listitem> </varlistentry> |