SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sysupdate: Permit mount namespaces in Varlink service

Browse Source 
The Varlink service enumerates image targets and needs a private mount
namespace while dissecting images. Keep its sandbox in sync with
systemd-sysupdated.service.

Follow-up to 31616d00ef

Fixes #43604
This commit is contained in:
Totoro
2026-09-05 08:22:45 +02:00
committed by Lennart Poettering
parent 726e17a933
commit 7fa7ff87cd
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
units/systemd-sysupdate-update.service.in
+1 -1
View File
@@ -25,7 +25,7 @@ NoNewPrivileges=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
ProtectHostname=yes ProtectHostname=yes
RestrictRealtime=yes RestrictRealtime=yes
RestrictNamespaces=net RestrictNamespaces=net mnt
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallFilter=@system-service @mount SystemCallFilter=@system-service @mount
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
units/systemd-sysupdate@.service.in
+1 -1
View File
@@ -23,7 +23,7 @@ NoNewPrivileges=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
ProtectHostname=yes ProtectHostname=yes
RestrictRealtime=yes RestrictRealtime=yes
RestrictNamespaces=net RestrictNamespaces=net mnt
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallFilter=@system-service @mount SystemCallFilter=@system-service @mount
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM