diff options
| author | Topi Miettinen <toiwoton@gmail.com> | 2022-09-25 20:47:53 +0300 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2022-09-26 11:40:28 +0200 |
| commit | 75723d31a678bdd6b9d0160834e54dc09e3dedd1 (patch) | |
| tree | 794bfad1d990e14a62a20a7658774189928ed4d7 /units | |
| parent | eb8817db6e69d30fd881ffd95ba173722ebe771d (diff) | |
| download | systemd-75723d31a678bdd6b9d0160834e54dc09e3dedd1.tar.gz | |
units: udev: partially emulate ProtectClock=
Drop CAP_SYS_TIME and CAP_WAKE_ALARM capabilities and block clock-related
system calls. Update TODO.
Diffstat (limited to 'units')
| -rw-r--r-- | units/systemd-udevd.service.in | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index 3579de4a68..e9dbe85ef4 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -16,6 +16,7 @@ Before=sysinit.target ConditionPathIsReadWrite=/sys [Service] +CapabilityBoundingSet=~CAP_SYS_TIME CAP_WAKE_ALARM Delegate=pids Type=notify # Note that udev will reset the value internally for its workers @@ -34,6 +35,7 @@ RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 RestrictRealtime=yes RestrictSUIDSGID=yes SystemCallFilter=@system-service @module @raw-io bpf +SystemCallFilter=~@clock SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes |