SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: don't downgrade multi-state settings to boolean

Browse Source 
Protect{Home,System,Proc,Subset}= are not booleans, so make sure we use
the intended value instead of just true/false.

See: https://github.com/systemd/systemd/pull/29552
Follow-up to: 79d956d
This commit is contained in:
Frantisek Sumsal
2023-10-15 14:04:28 +08:00
committed by Mike Yuan
parent da638eb4c9
commit abcf59970d
2 changed files with 75 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/exec-invoke.c
+4 -4
View File
@@ -3163,10 +3163,10 @@ static int apply_mount_namespace(
/* If NNP is on, we can turn on MS_NOSUID, since it won't have any effect anymore. */
.mount_nosuid = needs_sandboxing && context->no_new_privileges && !mac_selinux_use(),
.protect_home = needs_sandboxing && context->protect_home,
.protect_system = needs_sandboxing && context->protect_system,
.protect_proc = needs_sandboxing && context->protect_proc,
.proc_subset = needs_sandboxing && context->proc_subset,
.protect_home = needs_sandboxing ? context->protect_home : false,
.protect_system = needs_sandboxing ? context->protect_system : false,
.protect_proc = needs_sandboxing ? context->protect_proc : false,
.proc_subset = needs_sandboxing ? context->proc_subset : false,
};
r = setup_namespace(&parameters, error_path);