diff options
| author | Lennart Poettering <lennart@poettering.net> | 2019-11-20 12:23:17 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2019-11-20 12:30:04 +0100 |
| commit | 4e677599607d582367151280aa5d922f80fd962e (patch) | |
| tree | ca0918d496a7734e08e4268f3bdde61b0537e034 /test | |
| parent | e884e000714c2db006384058a63788ffcce8c8b8 (diff) | |
| download | systemd-4e677599607d582367151280aa5d922f80fd962e.tar.gz | |
core: be more lenient when checking whether sandboxing is necessary
In some containers unshare() is made unavailable entirely. Let's deal
with this that more gracefully and disable our sandboxing of services
then, so that we work in a container, under the assumption the container
manager is then responsible for sandboxing if we can't do it ourselves.
Previously, we'd insist on sandboxing as soon as any form of BindPath=
is used. With this change we only insist on it if we have a setting like
that where source and destination differ, i.e. there's a mapping
established that actually rearranges things, and thus would result in
systematically different behaviour if skipped (as opposed to mappings
that just make stuff read-only/writable that otherwise arent').
(Let's also update a test that intended to test for this behaviour with
a more specific configuration that still triggers the behaviour with
this change in place)
Fixes: #13955
(For testing purposes unshare() can easily be blocked with
systemd-nspawn --system-call-filter=~unshare.)
Diffstat (limited to 'test')
| -rw-r--r-- | test/test-execute/exec-readonlypaths-with-bindpaths.service | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/test/test-execute/exec-readonlypaths-with-bindpaths.service b/test/test-execute/exec-readonlypaths-with-bindpaths.service index ea9211395d..438c7de704 100644 --- a/test/test-execute/exec-readonlypaths-with-bindpaths.service +++ b/test/test-execute/exec-readonlypaths-with-bindpaths.service @@ -3,7 +3,6 @@ Description=Test for ReadOnlyPaths= [Service] ReadOnlyPaths=/etc -/i-dont-exist /usr -# From 6c47cd7d3bf35c8158a0737f34fe2c5dc95e72d6, RuntimeDirectory= implies BindPaths=. -RuntimeDirectory=foo +BindPaths=/etc:/tmp/etc2 ExecStart=/bin/sh -x -c 'test ! -w /etc && test ! -w /usr && test ! -e /i-dont-exist && test -w /var' Type=oneshot |