summaryrefslogtreecommitdiff
path: root/src/core/namespace.c
Commit message (Expand)AuthorAgeFilesLines
* namespace: keep selinuxfs mounted read-write with ProtectKernelTunables (#5741)Nicolas Iooss2017-07-311-0/+1
* core: open /proc/self/mountinfo early to allow mounts over /proc (#5985)Timothée Ravier2017-05-191-3/+13
* namespace: Apply MountAPIVFS= only when a Root directory is setDjalal Harouni2017-03-051-8/+15
* namespace: create base-filesystem directories if RootImage= or RootDirectory=...Djalal Harouni2017-03-051-0/+5
* Fix missing space in comments (#5439)AsciiWolf2017-02-241-1/+1
* core,nspawn,dissect: make nspawn's .roothash file search reusableLennart Poettering2017-02-071-1/+16
* core: add RootImage= setting for using a specific image file as root director...Lennart Poettering2017-02-071-2/+42
* core: add a per-unit setting MountAPIVFS= for mounting /dev, /proc, /sys in c...Lennart Poettering2017-02-071-12/+99
* core: fix minor memleak in namespace.cLennart Poettering2017-02-071-5/+12
* core: add ability to define arbitrary bind mounts for servicesLennart Poettering2016-12-141-11/+116
* namespace: instead of chasing mount symlinks a priori, do so as-we-goLennart Poettering2016-12-141-52/+34
* core: rename BindMount structure → MountEntryLennart Poettering2016-12-141-74/+74
* namespace: add explicit read-only flagLennart Poettering2016-12-141-8/+17
* namespace: reindent protect_system_strict_table[] as wellLennart Poettering2016-12-131-7/+7
* fs-util: add flags parameter to chase_symlinks()Lennart Poettering2016-12-011-1/+1
* tree-wide: stop using canonicalize_file_name(), use chase_symlinks() insteadLennart Poettering2016-12-011-2/+2
* namespace: clarify that /proc/apm is obsolete, but leave it blockedLennart Poettering2016-11-171-1/+1
* namespace: reindent namespace tablesLennart Poettering2016-11-171-30/+30
* namespace: simplify, optimize and extend handling of mounts for namespaceLennart Poettering2016-11-171-173/+159
* core:namespace: count and free failed paths inside chase_all_symlinks() (#4619)Djalal Harouni2016-11-101-14/+18
* core: on DynamicUser= make sure that protecting sensitive paths is enforced (...Djalal Harouni2016-11-081-18/+29
* nspawn: slight simplificationZbigniew Jędrzejewski-Szmek2016-11-071-11/+7
* nspawn: avoid one strdup by using free_and_replaceZbigniew Jędrzejewski-Szmek2016-11-071-2/+3
* core: make RootDirectory= and ProtectKernelModules= workDjalal Harouni2016-11-071-56/+86
* tree-wide: drop NULL sentinel from strjoinZbigniew Jędrzejewski-Szmek2016-10-231-1/+1
* core:sandbox: lets make /lib/modules/ inaccessible on ProtectKernelModules=Djalal Harouni2016-10-121-17/+37
* core:namespace: simplify ProtectHome= implementationDjalal Harouni2016-09-251-22/+53
* core: simplify ProtectSystem= implementationDjalal Harouni2016-09-251-58/+113
* core:sandbox: add more /proc/* entries to ProtectKernelTunables=Djalal Harouni2016-09-251-0/+11
* core:namespace: simplify mount calculationDjalal Harouni2016-09-251-12/+34
* core:namespace: put paths protected by ProtectKernelTunables= inDjalal Harouni2016-09-251-19/+35
* core:namespace: minor improvements to append_mounts()Djalal Harouni2016-09-251-4/+4
* namespace: drop all mounts outside of the new root directoryLennart Poettering2016-09-251-0/+26
* namespace: don't make the root directory of a namespace a mount if it already...Lennart Poettering2016-09-251-3/+8
* namespace: chase symlinks for mounts to set up in userspaceLennart Poettering2016-09-251-42/+76
* namespace: invoke unshare() only after checking all parametersLennart Poettering2016-09-251-3/+3
* core: introduce ProtectSystem=strictLennart Poettering2016-09-251-9/+47
* namespace: add some debug logging when enforcing InaccessiblePaths=Lennart Poettering2016-09-251-3/+4
* namespace: rework how ReadWritePaths= is appliedLennart Poettering2016-09-251-23/+43
* namespace: when enforcing fs namespace restrictions suppress redundant mountsLennart Poettering2016-09-251-0/+39
* namespace: simplify mount_path_compare() a bitLennart Poettering2016-09-251-11/+9
* namespace: make sure InaccessibleDirectories= masks all mounts further downLennart Poettering2016-09-251-4/+40
* core: add two new service settings ProtectKernelTunables= and ProtectControlG...Lennart Poettering2016-09-251-4/+32
* Merge pull request #3764 from poettering/assorted-stuff-2Martin Pitt2016-07-221-1/+1
|\
| * namespace: add a (void) castLennart Poettering2016-07-201-1/+1
* | namespace: fix wrong return value from mount(2) (#3758)Topi Miettinen2016-07-201-1/+2
|/
* namespace: minor improvementsLennart Poettering2016-07-201-8/+5
* doc,core: Read{Write,Only}Paths= and InaccessiblePaths=Alessandro Puccetti2016-07-191-9/+9
* namespace: unify limit behavior on non-directory pathsAlessandro Puccetti2016-07-191-8/+23
* namespace: Make private /dev noexec and readonly (#3263)topimiettinen2016-05-151-3/+7
View Lorry Controller Status