Merge pull request #13940 from keur/protect_kernel_logs

Add ProtectKernelLogs to systemd.exec
2019-11-15 16:26:10 +01:00
parent 7be830c6e8 82dce83b19
commit 8af381679d
30 changed files with 261 additions and 15 deletions
@@ -4269,6 +4269,9 @@ int unit_patch_contexts(Unit *u) {
                if (ec->protect_kernel_modules)
                        ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYS_MODULE);

+                if (ec->protect_kernel_logs)
+                        ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYSLOG);
+
                if (ec->dynamic_user) {
                        if (!ec->user) {
                                r = user_from_unit_name(u, &ec->user);