SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: add RestrictAddressFamilies=none to deny all address families

Browse Source 
Closes #15753.
This commit is contained in:
Yu Watanabe
2021-04-19 11:47:08 +01:00
committed by Luca Boccassi
parent 8441993621
commit 4e6c50a5d4
3 changed files with 19 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/dbus-execute.c
+5 -4
View File
@@ -2379,8 +2379,8 @@ int bus_exec_context_set_transient_property(
return 1;
} else if (streq(name, "RestrictAddressFamilies")) {
int allow_list;
_cleanup_strv_free_ char **l = NULL;
int allow_list;
r = sd_bus_message_enter_container(message, 'r', "bas");
if (r < 0)
@@ -2403,10 +2403,11 @@ int bus_exec_context_set_transient_property(
char **s;
if (strv_isempty(l)) {
c->address_families_allow_list = false;
c->address_families_allow_list = allow_list;
c->address_families = set_free(c->address_families);
unit_write_settingf(u, flags, name, "RestrictAddressFamilies=");
unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s",
allow_list ? "none" : "");
return 1;
}
@@ -2430,7 +2431,7 @@ int bus_exec_context_set_transient_property(
if (r < 0)
return r;
} else
(void) set_remove(c->address_families, INT_TO_PTR(af));
set_remove(c->address_families, INT_TO_PTR(af));
}
joined = strv_join(l, " ");
src/core/load-fragment.c
+7
View File
@@ -3437,6 +3437,13 @@ int config_parse_address_families(
return 0;
}
if (streq(rvalue, "none")) {
/* Forbid all address families. */
c->address_families = set_free(c->address_families);
c->address_families_allow_list = true;
return 0;
}
if (rvalue[0] == '~') {
invert = true;
rvalue++;