SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: Fix time namespace in RestrictNamespaces=

Browse Source 
RestrictNamespaces= would accept "time" but would not actually apply
seccomp filters e.g. systemd-run -p RestrictNamespaces=time unshare -T true
should fail but it succeeded.

This commit actually enables time namespace seccomp filtering.
This commit is contained in:
Ryan Wilson
2024-12-10 20:55:26 +01:00
committed by Mike Yuan
parent 641714cb30
commit 219a6dbbf3
4 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/units/TEST-07-PID1.exec-context.sh
+4
View File
@@ -415,3 +415,7 @@ fi
(! systemd-run --wait --pipe -p RootDirectory=/tmp/root this-shouldnt-exist)
(! systemd-run --wait --pipe -p RootDirectory=/tmp/root /foo)
(! systemd-run --wait --pipe --service-type=oneshot -p ExecStartPre=-/foo/bar/baz -p ExecStart=-/foo/bar/baz -p RootDirectory=/tmp/root -- "- foo")
# RestrictNamespaces=
systemd-run --wait --pipe unshare -T true
(! systemd-run --wait --pipe -p RestrictNamespaces=~time unshare -T true)