SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exec: introduce PrivateDevices= switch to provide services with a private /dev

Browse Source 
Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that
sets up a private /dev with only the API pseudo-devices like /dev/null,
/dev/zero, /dev/random, but not any physical devices in them.
This commit is contained in:
Lennart Poettering
2014-01-20 21:28:37 +01:00
parent 3540c7f88f
commit 7f112f50fe
13 changed files with 140 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+18
View File
@@ -894,6 +894,24 @@
for details.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>PrivateDevices=</varname></term>
<listitem><para>Takes a boolean
argument. If true, sets up a new /dev
namespace for the executed processes
and only adds API pseudo devices such
as <filename>/dev/null</filename>,
<filename>/dev/zero</filename> or
<filename>/dev/random</filename> to
it, but no physical devices such as
<filename>/dev/sda</filename>. This is
useful to securely turn off physical
device access by the executed
process. Defaults to
false.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>MountFlags=</varname></term>