core: Add DelegateNamespaces= (#36532)
This commit is contained in:
Daan De Meyer
@@ -3358,6 +3358,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t RestrictNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t DelegateNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly (bas) RestrictFileSystems = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly a(ssbt) BindPaths = [...];
|
||||
@@ -3963,6 +3965,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
|
||||
|
||||
<!--property RestrictNamespaces is not documented!-->
|
||||
|
||||
<!--property DelegateNamespaces is not documented!-->
|
||||
|
||||
<!--property RestrictFileSystems is not documented!-->
|
||||
|
||||
<!--property BindPaths is not documented!-->
|
||||
@@ -4685,6 +4689,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="DelegateNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictFileSystems"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="BindPaths"/>
|
||||
@@ -5559,6 +5565,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t RestrictNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t DelegateNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly (bas) RestrictFileSystems = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly a(ssbt) BindPaths = [...];
|
||||
@@ -6176,6 +6184,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
|
||||
|
||||
<!--property RestrictNamespaces is not documented!-->
|
||||
|
||||
<!--property DelegateNamespaces is not documented!-->
|
||||
|
||||
<!--property RestrictFileSystems is not documented!-->
|
||||
|
||||
<!--property BindPaths is not documented!-->
|
||||
@@ -6870,6 +6880,8 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2esocket {
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="DelegateNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictFileSystems"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="BindPaths"/>
|
||||
@@ -7576,6 +7588,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t RestrictNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t DelegateNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly (bas) RestrictFileSystems = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly a(ssbt) BindPaths = [...];
|
||||
@@ -8123,6 +8137,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
|
||||
|
||||
<!--property RestrictNamespaces is not documented!-->
|
||||
|
||||
<!--property DelegateNamespaces is not documented!-->
|
||||
|
||||
<!--property RestrictFileSystems is not documented!-->
|
||||
|
||||
<!--property BindPaths is not documented!-->
|
||||
@@ -8733,6 +8749,8 @@ node /org/freedesktop/systemd1/unit/home_2emount {
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="DelegateNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictFileSystems"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="BindPaths"/>
|
||||
@@ -9566,6 +9584,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t RestrictNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly t DelegateNamespaces = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly (bas) RestrictFileSystems = ...;
|
||||
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
|
||||
readonly a(ssbt) BindPaths = [...];
|
||||
@@ -10095,6 +10115,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
|
||||
|
||||
<!--property RestrictNamespaces is not documented!-->
|
||||
|
||||
<!--property DelegateNamespaces is not documented!-->
|
||||
|
||||
<!--property RestrictFileSystems is not documented!-->
|
||||
|
||||
<!--property BindPaths is not documented!-->
|
||||
@@ -10687,6 +10709,8 @@ node /org/freedesktop/systemd1/unit/dev_2dsda3_2eswap {
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="DelegateNamespaces"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="RestrictFileSystems"/>
|
||||
|
||||
<variablelist class="dbus-property" generated="True" extra-ref="BindPaths"/>
|
||||
@@ -12385,7 +12409,9 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
|
||||
<varname>ProtectControlGroupsEx</varname>,
|
||||
<varname>PrivateUsersEx</varname>, and
|
||||
<varname>PrivatePIDs</varname> were added in version 257.</para>
|
||||
<para><varname>ProtectHostnameEx</varname> and <function>RemoveSubGroup()</function> were added in version 258.</para>
|
||||
<para><varname>ProtectHostnameEx</varname>,
|
||||
<varname>DelegateNamespaces</varname>, and
|
||||
<function>RemoveSubGroup()</function> were added in version 258.</para>
|
||||
</refsect2>
|
||||
<refsect2>
|
||||
<title>Socket Unit Objects</title>
|
||||
@@ -12429,7 +12455,9 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
|
||||
<varname>ManagedOOMMemoryPressureDurationUSec</varname>,
|
||||
<varname>ProtectControlGroupsEx</varname>, and
|
||||
<varname>PrivatePIDs</varname> were added in version 257.</para>
|
||||
<para><varname>ProtectHostnameEx</varname> and <function>RemoveSubgroup()</function> were added in version 258.</para>
|
||||
<para><varname>ProtectHostnameEx</varname>,
|
||||
<varname>DelegateNamespaces</varname>, and
|
||||
<function>RemoveSubgroup()</function> were added in version 258.</para>
|
||||
</refsect2>
|
||||
<refsect2>
|
||||
<title>Mount Unit Objects</title>
|
||||
@@ -12471,6 +12499,7 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
|
||||
<varname>ProtectControlGroupsEx</varname>, and
|
||||
<varname>PrivatePIDs</varname> were added in version 257.</para>
|
||||
<para><varname>ProtectHostnameEx</varname>,
|
||||
<varname>DelegateNamespaces</varname>,
|
||||
<function>RemoveSubgroup()</function>,
|
||||
<varname>ReloadResult</varname>, and
|
||||
<varname>CleanResult</varname> were added in version 258.</para>
|
||||
@@ -12514,7 +12543,9 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
|
||||
<varname>ManagedOOMMemoryPressureDurationUSec</varname>,
|
||||
<varname>ProtectControlGroupsEx</varname>, and
|
||||
<varname>PrivatePIDs</varname> were added in version 257.</para>
|
||||
<para><varname>ProtectHostnameEx</varname> and <function>RemoveSubgroup()</function> were added in version 258.</para>
|
||||
<para><varname>ProtectHostnameEx</varname>,
|
||||
<varname>DelegateNamespaces</varname>, and
|
||||
<function>RemoveSubgroup()</function> were added in version 258.</para>
|
||||
</refsect2>
|
||||
<refsect2>
|
||||
<title>Slice Unit Objects</title>
|
||||
|
||||
@@ -2375,6 +2375,43 @@ RestrictNamespaces=~cgroup net</programlisting>
|
||||
<xi:include href="version-info.xml" xpointer="v233"/></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><varname>DelegateNamespaces=</varname></term>
|
||||
|
||||
<listitem><para>Delegates ownership of the given namespace types to the user namespace of the
|
||||
processes of this unit. For details about Linux namespaces, see <citerefentry
|
||||
project='man-pages'><refentrytitle>namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
|
||||
Either takes a boolean argument, or a space-separated list of namespace type identifiers. If false
|
||||
(the default), the unit's processes' user namespace will not have ownership over any namespaces
|
||||
created during setup of the unit's sandboxed environment. If true, ownership of all namespace types
|
||||
(except for user namespaces, where the concept doesn't apply) created during setup of the unit's
|
||||
sandboxed environment is delegated to the unit's processes' user namespace. Otherwise, a
|
||||
space-separated list of namespace type identifiers must be specified, consisting of any combination
|
||||
of: <constant>cgroup</constant>, <constant>ipc</constant>, <constant>net</constant>,
|
||||
<constant>mnt</constant>, <constant>pid</constant>, and <constant>uts</constant>. All namespaces of
|
||||
the listed types will be owned by the unit's processes' user namespace if they are created during
|
||||
setup of the unit's sandboxed environment (allow-listing). By prepending the list with a single tilde
|
||||
character (<literal>~</literal>) the effect may be inverted: all namespaces of types not listed and
|
||||
created during setup of the unit's sandboxed environment will be owned by the unit's processes' user
|
||||
namespace (deny-listing). If the empty string is assigned, the default namespace ownership is
|
||||
applied, which is equivalent to false. This option may appear more than once, in which case the
|
||||
namespace types are merged by <constant>OR</constant>, or by <constant>AND</constant> if the lines
|
||||
are prefixed with <literal>~</literal> (see examples below). Internally, this setting controls the
|
||||
order in which namespaces are unshared by systemd. Namespace types that should be owned by the unit's
|
||||
processes' user namespace will be unshared after unsharing the user namespace. Internally, this
|
||||
setting controls the order in which namespaces are unshared. Delegated namespaces will be unshared
|
||||
after the user namespace is unshared. Other namespaces will be unshared before the user namespace is
|
||||
unshared.</para>
|
||||
|
||||
<para>Delegating any namespace with <varname>DelegateNamespaces=</varname> implies
|
||||
<varname>PrivateUsers=self</varname> unless <varname>PrivateUsers=</varname> is explicitly enabled
|
||||
already by the unit. Delegating a namespace does not imply that the namespace is unshared, that is
|
||||
done with the namespace specific unit setting such as <varname>PrivateNetwork=</varname> or
|
||||
<varname>PrivateMounts=</varname>.</para>
|
||||
|
||||
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><varname>LockPersonality=</varname></term>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user