diff options
| author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2018-05-11 00:17:38 +0900 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2018-05-10 22:50:31 -0700 |
| commit | 46657f637cc7875c9afbab5f138b59e1fb1c7e3c (patch) | |
| tree | bd18c9b59991c4057486b8d8522851d9bc3b7970 /units | |
| parent | b6887d7ae470cf6dfa9ba1b33840628362d9d0fc (diff) | |
| download | systemd-46657f637cc7875c9afbab5f138b59e1fb1c7e3c.tar.gz | |
units: set RestrictNamespaces=yes to networkd and resolved
Closes #8949.
Diffstat (limited to 'units')
| -rw-r--r-- | units/systemd-networkd.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-resolved.service.in | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 63ee735415..d05b334722 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -33,6 +33,7 @@ ProtectControlGroups=yes ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index c4c7f1feef..a939f7259c 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -37,6 +37,7 @@ ProtectKernelTunables=yes ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native |