From 42eccfec6e47a5436bd143ee357d2a2da620c2f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 17 May 2023 09:52:17 +0200 Subject: man: say that ProtectClock= also affects reads Fixes #26413: the docs said that the filter prevents writes, but it just a filter at the system call level, and some of those calls are used for writing and reading. This is confusing esp. when a higher level library call like ntp_gettime() is denied. I don't think it's realistic that we'll make the filter smarter in the near future, so let's change the docs to describe the implementation. Also, split out the advice part into a separate paragraph. --- man/systemd.exec.xml | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) (limited to 'man') diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 795e26e792..a96e5c22d0 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1826,17 +1826,22 @@ BindReadOnlyPaths=/var/lib/systemd ProtectClock= - Takes a boolean argument. If set, writes to the hardware clock or system clock will be denied. - It is recommended to turn this on for most services that do not need modify the clock. Defaults to off. Enabling - this option removes CAP_SYS_TIME and CAP_WAKE_ALARM from the - capability bounding set for this unit, installs a system call filter to block calls that can set the - clock, and DeviceAllow=char-rtc r is implied. This ensures /dev/rtc0, - /dev/rtc1, etc. are made read-only to the service. See + Takes a boolean argument. If set, writes to the hardware clock or system clock will + be denied. Defaults to off. Enabling this option removes CAP_SYS_TIME and + CAP_WAKE_ALARM from the capability bounding set for this unit, installs a system + call filter to block calls that can set the clock, and DeviceAllow=char-rtc r is + implied. Note that the system calls are blocked altogether, the filter does not take into account + that some of the calls can be used to read the clock state with some parameter combinations. + Effectively, /dev/rtc0, /dev/rtc1, etc. are made read-only + to the service. See systemd.resource-control5 - for the details about DeviceAllow=. If this setting is on, but the unit - doesn't have the CAP_SYS_ADMIN capability (e.g. services for which + for the details about DeviceAllow=. If this setting is on, but the unit doesn't + have the CAP_SYS_ADMIN capability (e.g. services for which User= is set), NoNewPrivileges=yes is implied. + It is recommended to turn this on for most services that do not need modify the clock or check + its state. + -- cgit v1.2.1