Merge pull request #13940 from keur/protect_kernel_logs

Add ProtectKernelLogs to systemd.exec

test/meson.build

@@ -109,6 +109,8 @@ test_data_files = '''
         test-execute/exec-privatetmp-no.service
         test-execute/exec-privatetmp-yes.service
         test-execute/exec-protecthome-tmpfs-vs-protectsystem-strict.service
+        test-execute/exec-protectkernellogs-yes-capabilities.service
+        test-execute/exec-protectkernellogs-no-capabilities.service
         test-execute/exec-protectkernelmodules-no-capabilities.service
         test-execute/exec-protectkernelmodules-yes-capabilities.service
         test-execute/exec-protectkernelmodules-yes-mount-propagation.service

test/test-execute/exec-protectkernellogs-no-capabilities.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Test CAP_SYSLOG for ProtectKernelLogs=no
+
+[Service]
+ProtectKernelLogs=no
+ExecStart=/bin/sh -x -c 'capsh --print | grep cap_syslog'
+Type=oneshot

test/test-execute/exec-protectkernellogs-yes-capabilities.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Test CAP_SYSLOG for ProtectKernelLogs=yes
+
+[Service]
+ProtectKernelLogs=yes
+ExecStart=/bin/sh -x -c '! capsh --print | grep cap_syslog'
+Type=oneshot