diff options
| author | Lennart Poettering <lennart@poettering.net> | 2014-06-05 10:03:26 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2014-06-05 10:03:26 +0200 |
| commit | 5331194c120520579eede9dba4bd9c3329629601 (patch) | |
| tree | 1bdda4ab9e6c10b93faeca70cb855ae2e3caa2f9 | |
| parent | 3900e5fdff688dc3c273f177d9d913b7389d5561 (diff) | |
| download | systemd-5331194c120520579eede9dba4bd9c3329629601.tar.gz | |
core: don't include /boot in effect of ProtectSystem=
This would otherwise unconditionally trigger any /boot autofs mount,
which we probably should avoid.
ProtectSystem= will now only cover /usr and (optionally) /etc, both of
which cannot be autofs anyway.
ProtectHome will continue to cover /run/user and /home. The former
cannot be autofs either. /home could be, however is frequently enough
used (unlikey /boot) so that it isn't too problematic to simply trigger
it unconditionally via ProtectHome=.
| -rw-r--r-- | man/systemd.exec.xml | 3 | ||||
| -rw-r--r-- | src/core/namespace.c | 4 |
2 files changed, 3 insertions, 4 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index d426ac0899..c5bb55c556 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -941,8 +941,7 @@ argument or <literal>full</literal>. If true, mounts the <filename>/usr</filename> - and <filename>/boot</filename> - directories read-only for processes + directory read-only for processes invoked by this unit. If set to <literal>full</literal> the <filename>/etc</filename> is mounted diff --git a/src/core/namespace.c b/src/core/namespace.c index 080c086fd4..b6deab7081 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -357,7 +357,7 @@ int setup_namespace( strv_length(inaccessible_dirs) + private_dev + (protect_home != PROTECT_HOME_NO ? 2 : 0) + - (protect_system != PROTECT_SYSTEM_NO ? 2 : 0) + + (protect_system != PROTECT_SYSTEM_NO ? 1 : 0) + (protect_system == PROTECT_SYSTEM_FULL ? 1 : 0); if (n > 0) { @@ -399,7 +399,7 @@ int setup_namespace( } if (protect_system != PROTECT_SYSTEM_NO) { - r = append_mounts(&m, protect_system == PROTECT_SYSTEM_FULL ? STRV_MAKE("/usr", "/etc", "-/boot") : STRV_MAKE("/usr", "-/boot"), READONLY); + r = append_mounts(&m, protect_system == PROTECT_SYSTEM_FULL ? STRV_MAKE("/usr", "/etc") : STRV_MAKE("/usr"), READONLY); if (r < 0) return r; } |