SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #34656 from yuwata/private-users

Browse Source 
core: drop implicit support of PrivateUsers=off
This commit is contained in:
Lennart Poettering
2024-10-09 10:39:30 +02:00
committed by GitHub
parent 0d5ca13026 2e8a581b9c
commit 1c62c2da43
6 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+1 -1
View File
@@ -1967,7 +1967,7 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<term><varname>PrivateUsers=</varname></term>
<listitem><para>Takes a boolean argument or one of <literal>self</literal> or
<literal>identity</literal>. Defaults to off. If enabled, sets up a new user namespace for the
<literal>identity</literal>. Defaults to false. If enabled, sets up a new user namespace for the
executed processes and configures a user and group mapping. If set to a true value or
<literal>self</literal>, a minimal user and group mapping is configured that maps the
<literal>root</literal> user and group as well as the unit's own user and group to themselves and
src/core/dbus-execute.c
+4 -4
View File
@@ -1023,7 +1023,7 @@ static int property_get_private_tmp(
sd_bus_error *error) {
PrivateTmp *p = ASSERT_PTR(userdata);
int b = *p != PRIVATE_TMP_OFF;
int b = *p != PRIVATE_TMP_NO;
return sd_bus_message_append_basic(reply, 'b', &b);
}
@@ -1038,7 +1038,7 @@ static int property_get_private_users(
sd_bus_error *error) {
PrivateUsers *p = ASSERT_PTR(userdata);
int b = *p != PRIVATE_USERS_OFF;
int b = *p != PRIVATE_USERS_NO;
return sd_bus_message_append_basic(reply, 'b', &b);
}
@@ -1847,7 +1847,7 @@ int bus_exec_context_set_transient_property(
return r;
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
c->private_tmp = v ? PRIVATE_TMP_CONNECTED : PRIVATE_TMP_OFF;
c->private_tmp = v ? PRIVATE_TMP_CONNECTED : PRIVATE_TMP_NO;
(void) unit_write_settingf(u, flags, name, "%s=%s", name, yes_no(v));
}
@@ -1882,7 +1882,7 @@ int bus_exec_context_set_transient_property(
return r;
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
c->private_users = v ? PRIVATE_USERS_SELF : PRIVATE_USERS_OFF;
c->private_users = v ? PRIVATE_USERS_SELF : PRIVATE_USERS_NO;
(void) unit_write_settingf(u, flags, name, "%s=%s", name, yes_no(v));
}
src/core/exec-invoke.c
+5 -5
View File
@@ -2096,7 +2096,7 @@ static int setup_private_users(PrivateUsers private_users, uid_t ouid, gid_t ogi
* For unprivileged users (i.e. without capabilities), the root to root mapping is excluded. As such, it
* does not need CAP_SETUID to write the single line mapping to itself. */
if (private_users == PRIVATE_USERS_OFF)
if (private_users == PRIVATE_USERS_NO)
return 0;
if (private_users == PRIVATE_USERS_IDENTITY) {
@@ -3851,8 +3851,8 @@ static bool exec_context_need_unprivileged_private_users(
if (params->runtime_scope != RUNTIME_SCOPE_USER)
return false;
return context->private_users != PRIVATE_USERS_OFF ||
context->private_tmp != PRIVATE_TMP_OFF ||
return context->private_users != PRIVATE_USERS_NO ||
context->private_tmp != PRIVATE_TMP_NO ||
context->private_devices ||
context->private_network ||
context->network_namespace_path ||
@@ -4762,13 +4762,13 @@ int exec_invoke(
* Users with CAP_SYS_ADMIN can set up user namespaces last because they will be able to
* set up all of the other namespaces (i.e. network, mount, UTS) without a user namespace. */
PrivateUsers pu = context->private_users;
if (pu == PRIVATE_USERS_OFF)
if (pu == PRIVATE_USERS_NO)
pu = PRIVATE_USERS_SELF;
r = setup_private_users(pu, saved_uid, saved_gid, uid, gid);
/* If it was requested explicitly and we can't set it up, fail early. Otherwise, continue and let
* the actual requested operations fail (or silently continue). */
if (r < 0 && context->private_users != PRIVATE_USERS_OFF) {
if (r < 0 && context->private_users != PRIVATE_USERS_NO) {
*exit_status = EXIT_USER;
return log_exec_error_errno(context, params, r, "Failed to set up user namespacing for unprivileged user: %m");
}
src/core/namespace.c
+2 -2
View File
@@ -3221,7 +3221,7 @@ static const char* const proc_subset_table[_PROC_SUBSET_MAX] = {
DEFINE_STRING_TABLE_LOOKUP(proc_subset, ProcSubset);
static const char* const private_tmp_table[_PRIVATE_TMP_MAX] = {
[PRIVATE_TMP_OFF] = "off",
[PRIVATE_TMP_NO] = "no",
[PRIVATE_TMP_CONNECTED] = "connected",
[PRIVATE_TMP_DISCONNECTED] = "disconnected",
};
@@ -3229,7 +3229,7 @@ static const char* const private_tmp_table[_PRIVATE_TMP_MAX] = {
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(private_tmp, PrivateTmp, PRIVATE_TMP_CONNECTED);
static const char* const private_users_table[_PRIVATE_USERS_MAX] = {
[PRIVATE_USERS_OFF] = "off",
[PRIVATE_USERS_NO] = "no",
[PRIVATE_USERS_SELF] = "self",
[PRIVATE_USERS_IDENTITY] = "identity",
};
src/core/namespace.h
+2 -2
View File
@@ -54,7 +54,7 @@ typedef enum ProcSubset {
} ProcSubset;
typedef enum PrivateTmp {
PRIVATE_TMP_OFF,
PRIVATE_TMP_NO,
PRIVATE_TMP_CONNECTED, /* Bind mounted from the host's filesystem */
PRIVATE_TMP_DISCONNECTED, /* A completely private tmpfs, invisible from the host */
_PRIVATE_TMP_MAX,
@@ -62,7 +62,7 @@ typedef enum PrivateTmp {
} PrivateTmp;
typedef enum PrivateUsers {
PRIVATE_USERS_OFF,
PRIVATE_USERS_NO,
PRIVATE_USERS_SELF,
PRIVATE_USERS_IDENTITY,
_PRIVATE_USERS_MAX,
src/core/unit.c
+1 -1
View File
@@ -4305,7 +4305,7 @@ int unit_patch_contexts(Unit *u) {
/* With DynamicUser= we want private directories, so if the user hasn't manually
* selected PrivateTmp=, enable it, but to a fully private (disconnected) tmpfs
* instance. */
if (ec->private_tmp == PRIVATE_TMP_OFF)
if (ec->private_tmp == PRIVATE_TMP_NO)
ec->private_tmp = PRIVATE_TMP_DISCONNECTED;
ec->remove_ipc = true;
ec->protect_system = PROTECT_SYSTEM_STRICT;