SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core/namespace: make bind mounted journal sockets nosuid + noexec + nodev

Browse Source 
Addresses https://github.com/systemd/systemd/pull/32487#discussion_r1743464797
This commit is contained in:
Mike Yuan
2024-09-04 21:44:24 +02:00
parent 7583859ba8
commit 95f9e85aaa
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/namespace.c
+7 -3
View File
@@ -121,9 +121,9 @@ typedef struct MountList {
} MountList;
static const BindMount bind_journal_sockets_table[] = {
{ (char*) "/run/systemd/journal/socket", (char*) "/run/systemd/journal/socket", .read_only = true, .ignore_enoent = true },
{ (char*) "/run/systemd/journal/stdout", (char*) "/run/systemd/journal/stdout", .read_only = true, .ignore_enoent = true },
{ (char*) "/run/systemd/journal/dev-log", (char*) "/run/systemd/journal/dev-log", .read_only = true, .ignore_enoent = true },
{ (char*) "/run/systemd/journal/socket", (char*) "/run/systemd/journal/socket", .read_only = true, .nosuid = true, .noexec = true, .nodev = true, .ignore_enoent = true },
{ (char*) "/run/systemd/journal/stdout", (char*) "/run/systemd/journal/stdout", .read_only = true, .nosuid = true, .noexec = true, .nodev = true, .ignore_enoent = true },
{ (char*) "/run/systemd/journal/dev-log", (char*) "/run/systemd/journal/dev-log", .read_only = true, .nosuid = true, .noexec = true, .nodev = true, .ignore_enoent = true },
};
/* If MountAPIVFS= is used, let's mount /sys, /proc, /dev and /run into the it, but only as a fallback if the user hasn't mounted
@@ -447,6 +447,8 @@ static int append_bind_mounts(MountList *ml, const BindMount *binds, size_t n) {
.mode = b->recursive ? MOUNT_BIND_RECURSIVE : MOUNT_BIND,
.read_only = b->read_only,
.nosuid = b->nosuid,
.noexec = b->noexec,
.flags = b->nodev ? MS_NODEV : 0,
.source_const = b->source,
.ignore = b->ignore_enoent,
};
@@ -2797,7 +2799,9 @@ int bind_mount_add(BindMount **b, size_t *n, const BindMount *item) {
.source = TAKE_PTR(s),
.destination = TAKE_PTR(d),
.read_only = item->read_only,
.nodev = item->nodev,
.nosuid = item->nosuid,
.noexec = item->noexec,
.recursive = item->recursive,
.ignore_enoent = item->ignore_enoent,
};
src/core/namespace.h
+2
View File
@@ -65,7 +65,9 @@ struct BindMount {
char *source;
char *destination;
bool read_only;
bool nodev;
bool nosuid;
bool noexec;
bool recursive;
bool ignore_enoent;
};