core: Fix time namespace in RestrictNamespaces=

RestrictNamespaces= would accept "time" but would not actually apply
seccomp filters e.g. systemd-run -p RestrictNamespaces=time unshare -T true
should fail but it succeeded.

This commit actually enables time namespace seccomp filtering.
This commit is contained in:
Ryan Wilson
2024-12-10 20:55:26 +01:00
committed by Mike Yuan
parent 641714cb30
commit 219a6dbbf3
4 changed files with 16 additions and 11 deletions
+1 -1
View File
@@ -295,7 +295,7 @@ TEST(restrict_namespace) {
s = mfree(s);
assert_se(namespace_flags_to_string(NAMESPACE_FLAGS_ALL, &s) == 0);
ASSERT_STREQ(s, "cgroup ipc net mnt pid user uts");
ASSERT_STREQ(s, "cgroup ipc net mnt pid user uts time");
assert_se(namespace_flags_from_string(s, &ul) == 0 && ul == NAMESPACE_FLAGS_ALL);
s = mfree(s);