From 42eccfec6e47a5436bd143ee357d2a2da620c2f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 17 May 2023 09:52:17 +0200 Subject: man: say that ProtectClock= also affects reads Fixes #26413: the docs said that the filter prevents writes, but it just a filter at the system call level, and some of those calls are used for writing and reading. This is confusing esp. when a higher level library call like ntp_gettime() is denied. I don't think it's realistic that we'll make the filter smarter in the near future, so let's change the docs to describe the implementation. Also, split out the advice part into a separate paragraph. --- man/systemd.exec.xml | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) (limited to 'man') diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 795e26e792..a96e5c22d0 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1826,17 +1826,22 @@ BindReadOnlyPaths=/var/lib/systemd ProtectClock= - Takes a boolean argument. If set, writes to the hardware clock or system clock will be denied. - It is recommended to turn this on for most services that do not need modify the clock. Defaults to off. Enabling - this option removes CAP_SYS_TIME and CAP_WAKE_ALARM from the - capability bounding set for this unit, installs a system call filter to block calls that can set the - clock, and DeviceAllow=char-rtc r is implied. This ensures /dev/rtc0, - /dev/rtc1, etc. are made read-only to the service. See + Takes a boolean argument. If set, writes to the hardware clock or system clock will + be denied. Defaults to off. Enabling this option removes CAP_SYS_TIME and + CAP_WAKE_ALARM from the capability bounding set for this unit, installs a system + call filter to block calls that can set the clock, and DeviceAllow=char-rtc r is + implied. Note that the system calls are blocked altogether, the filter does not take into account + that some of the calls can be used to read the clock state with some parameter combinations. + Effectively, /dev/rtc0, /dev/rtc1, etc. are made read-only + to the service. See systemd.resource-control5 - for the details about DeviceAllow=. If this setting is on, but the unit - doesn't have the CAP_SYS_ADMIN capability (e.g. services for which + for the details about DeviceAllow=. If this setting is on, but the unit doesn't + have the CAP_SYS_ADMIN capability (e.g. services for which User= is set), NoNewPrivileges=yes is implied. + It is recommended to turn this on for most services that do not need modify the clock or check + its state. + -- cgit v1.2.1 From 2f76f1cfaee2f775df8b367cb77aed751af45956 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 17 May 2023 11:12:32 +0200 Subject: man: explain allowed values for /sys/power/{disk,state} Also fix the grammar: "neither" can only be used with two values, and here we have an inderminate number >= 1. Fixes #26460. --- man/systemd-sleep.conf.xml | 55 ++++++++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 24 deletions(-) (limited to 'man') diff --git a/man/systemd-sleep.conf.xml b/man/systemd-sleep.conf.xml index f8f1694b57..bdc4c3c193 100644 --- a/man/systemd-sleep.conf.xml +++ b/man/systemd-sleep.conf.xml @@ -138,21 +138,24 @@ HibernateMode= HybridSleepMode= - The string to be written to - /sys/power/disk by, - respectively, + The string to be written to /sys/power/disk by, respectively, systemd-suspend.service8, - systemd-hibernate.service8, or + systemd-hibernate.service8, + or systemd-hybrid-sleep.service8. - More than one value can be specified by separating - multiple values with whitespace. They will be tried - in turn, until one is written without error. If - neither succeeds, the operation will be aborted. - - - systemd-suspend-then-hibernate.service8 - uses the value of SuspendMode= when suspending and the value of HibernateMode= when hibernating. - + More than one value can be specified by separating multiple values with whitespace. They will be + tried in turn, until one is written without error. If none of the writes succeed, the operation will + be aborted. + + The allowed set of values is determined by the kernel and is shown in the file itself (use + cat /sys/power/disk to display). See the + kernel documentation for more details. + + + systemd-suspend-then-hibernate.service8 + uses the value of SuspendMode= when suspending and the value of + HibernateMode= when hibernating. @@ -160,21 +163,25 @@ HibernateState= HybridSleepState= - The string to be written to - /sys/power/state by, - respectively, + The string to be written to /sys/power/state by, respectively, systemd-suspend.service8, - systemd-hibernate.service8, or + systemd-hibernate.service8, + or systemd-hybrid-sleep.service8. - More than one value can be specified by separating - multiple values with whitespace. They will be tried - in turn, until one is written without error. If - neither succeeds, the operation will be aborted. + More than one value can be specified by separating multiple values with whitespace. They will be + tried in turn, until one is written without error. If none of the writes succeed, the operation will + be aborted. - systemd-suspend-then-hibernate.service8 - uses the value of SuspendState= when suspending and the value of HibernateState= when hibernating. - + The allowed set of values is determined by the kernel and is shown in the file itself (use + cat /sys/power/state to display). See the + kernel documentation for more details. + + + systemd-suspend-then-hibernate.service8 + uses the value of SuspendState= when suspending and the value of + HibernateState= when hibernating. -- cgit v1.2.1 From f90360eb7417e083650034ad819790df0c389bd1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 17 May 2023 11:16:56 +0200 Subject: man/tmpfiles: fix off-by-one in example Reported and diagnosed by gitterman. Fixes #26617. --- man/tmpfiles.d.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'man') diff --git a/man/tmpfiles.d.xml b/man/tmpfiles.d.xml index a105b8af39..f691eef25d 100644 --- a/man/tmpfiles.d.xml +++ b/man/tmpfiles.d.xml @@ -647,7 +647,7 @@ w- /proc/sys/vm/swappiness - - - - 10 For example: # Files created and modified, and directories accessed more than # an hour ago in "/tmp/foo/bar", are subject to time-based cleanup. -d /tmp/foo/bar - - - - bmA:1h - +d /tmp/foo/bar - - - bmA:1h - Note that while the aging algorithm is run an exclusive BSD file lock (see flock2) is -- cgit v1.2.1