diff options
| author | Luca Boccassi <luca.boccassi@microsoft.com> | 2021-11-21 17:05:28 +0000 |
|---|---|---|
| committer | Luca Boccassi <luca.boccassi@microsoft.com> | 2021-11-30 16:49:58 +0000 |
| commit | 61aea456c12c54f49c4a76259af130e576130ce9 (patch) | |
| tree | 2949292609f07bcdea764ec98b1a7e5d7cd5e1dc /units/systemd-coredump@.service.in | |
| parent | 67f7675f477d369506eeb17ef2d5b365f83ac84a (diff) | |
| download | systemd-61aea456c12c54f49c4a76259af130e576130ce9.tar.gz | |
coredump: analyze object with libdwelf in forked process
Parsing objects is risky as data could be malformed or malicious,
so avoid doing that from the main systemd-coredump process and
instead fork another process, and set it to avoid generating
core files itself.
Diffstat (limited to 'units/systemd-coredump@.service.in')
| -rw-r--r-- | units/systemd-coredump@.service.in | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 6bf2817a8c..15bfb243b4 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -35,11 +35,10 @@ ProtectKernelTunables=yes ProtectKernelLogs=yes ProtectSystem=strict RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes RestrictRealtime=yes RestrictSUIDSGID=yes RuntimeMaxSec=5min StateDirectory=systemd/coredump SystemCallArchitectures=native SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service +SystemCallFilter=@system-service @mount |