diff options
| author | Topi Miettinen <toiwoton@gmail.com> | 2021-06-12 09:35:06 +0300 |
|---|---|---|
| committer | Yu Watanabe <watanabe.yu+github@gmail.com> | 2021-06-15 00:33:22 +0900 |
| commit | 1753d3021564671fba3d3196a84da657d15fb632 (patch) | |
| tree | f441d14e2c10e07e3adcccb8152cc3c1077bdb48 /man/systemd.exec.xml | |
| parent | 2fbb5df8e9d41886fd77b1015ac86b3423025be7 (diff) | |
| download | systemd-1753d3021564671fba3d3196a84da657d15fb632.tar.gz | |
Revert "Mount all fs nosuid when NoNewPrivileges=yes"
This reverts commit d8e3c31bd8e307c8defc759424298175aa0f7001.
A poorly documented fact is that SELinux unfortunately uses nosuid mount flag
to specify that also a fundamental feature of SELinux, domain transitions, must
not be allowed either. While this could be mitigated case by case by changing
the SELinux policy to use `nosuid_transition`, such mitigations would probably
have to be added everywhere if systemd used automatic nosuid mount flags when
`NoNewPrivileges=yes` would be implied. This isn't very desirable from SELinux
policy point of view since also untrusted mounts in service's mount namespaces
could start triggering domain transitions.
Alternatively there could be directives to override this behavior globally or
for each service (for example, new directives `SUIDPaths=`/`NoSUIDPaths=` or
more generic mount flag applicators), but since there's little value of the
commit by itself (setting NNP already disables most setuid functionality), it's
simpler to revert the commit. Such new directives could be used to implement
the original goal.
Diffstat (limited to 'man/systemd.exec.xml')
| -rw-r--r-- | man/systemd.exec.xml | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 96d18dd93b..893b56d93a 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -675,10 +675,9 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting> <varname>SystemCallArchitectures=</varname>, <varname>SystemCallFilter=</varname>, or <varname>SystemCallLog=</varname> are specified. Note that even if this setting is overridden - by them, <command>systemctl show</command> shows the original value of this setting. In case the - service will be run in a new mount namespace anyway, all file systems are mounted with MS_NOSUID - flag. Also see <ulink url="https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html"> - No New Privileges Flag</ulink>.</para></listitem> + by them, <command>systemctl show</command> shows the original value of this setting. Also see + <ulink url="https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html">No New + Privileges Flag</ulink>.</para></listitem> </varlistentry> <varlistentry> |