SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nspawn: apply BindUser/Ephemeral from settings file only if trusted

Browse Source 
Originally reported on yeswehack.com as:
YWH-PGM9780-116

Follow-up for 2f89304490
Follow-up for a2f577fca0
This commit is contained in:
Luca Boccassi
2026-03-12 00:24:01 +00:00
parent 6df5f80bd3
commit 61bceb1bff
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn.c
+14 -4
View File
@@ -4783,8 +4783,13 @@ static int merge_settings(Settings *settings, const char *path) {
}
if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
settings->ephemeral >= 0)
arg_ephemeral = settings->ephemeral;
settings->ephemeral >= 0) {
if (!arg_settings_trusted)
log_warning("Ignoring ephemeral setting, file %s is not trusted.", path);
else
arg_ephemeral = settings->ephemeral;
}
if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
settings->root) {
@@ -4953,8 +4958,13 @@ static int merge_settings(Settings *settings, const char *path) {
}
if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
!strv_isempty(settings->bind_user))
strv_free_and_replace(arg_bind_user, settings->bind_user);
!strv_isempty(settings->bind_user)) {
if (!arg_settings_trusted)
log_warning("Ignoring bind user setting, file %s is not trusted.", path);
else
strv_free_and_replace(arg_bind_user, settings->bind_user);
}
if (!FLAGS_SET(arg_settings_mask, SETTING_BIND_USER_SHELL) &&
settings->bind_user_shell_set) {