SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shared: add new securebits

Browse Source 
The securebits parsing code now recognizes 'no-cap-ambient-raise'
(added in Linux 4.3), 'exec-restrict-file', and 'exec-deny-interactive'
(both added in Linux 6.14). The '-locked' variants were added too.
This commit is contained in:
Skye Soss
2026-08-13 13:21:28 -05:00
parent 89fb28f1d3
commit bfc302dad2
3 changed files with 43 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+7 -3
View File
@@ -953,11 +953,15 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
<listitem><para>Controls the secure bits set for the executed process. Takes a space-separated combination of
options from the following list: <option>keep-caps</option>, <option>keep-caps-locked</option>,
<option>no-setuid-fixup</option>, <option>no-setuid-fixup-locked</option>, <option>noroot</option>, and
<option>noroot-locked</option>. This option may appear more than once, in which case the secure bits are
<option>no-setuid-fixup</option>, <option>no-setuid-fixup-locked</option>, <option>noroot</option>,
<option>noroot-locked</option>, <option>no-cap-ambient-raise</option>, <option>no-cap-ambient-raise-locked</option>,
<option>exec-restrict-file</option>, <option>exec-restrict-file-locked</option>,
<option>exec-deny-interactive</option>, and <option>exec-deny-interactive-locked</option>.
This option may appear more than once, in which case the secure bits are
ORed. If the empty string is assigned to this option, the bits are reset to 0. This does not affect commands
prefixed with <literal>+</literal>. See <citerefentry
project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
and <ulink url="https://docs.kernel.org/userspace-api/check_exec.html">Executability check</ulink> for
details.</para></listitem>
</varlistentry>
src/shared/securebits-util.c
+30
View File
@@ -22,6 +22,18 @@ static inline const char* secure_bit_to_string(int i) {
return "noroot";
case SECURE_NOROOT_LOCKED:
return "noroot-locked";
case SECURE_NO_CAP_AMBIENT_RAISE:
return "no-cap-ambient-raise";
case SECURE_NO_CAP_AMBIENT_RAISE_LOCKED:
return "no-cap-ambient-raise-locked";
case SECURE_EXEC_RESTRICT_FILE:
return "exec-restrict-file";
case SECURE_EXEC_RESTRICT_FILE_LOCKED:
return "exec-restrict-file-locked";
case SECURE_EXEC_DENY_INTERACTIVE:
return "exec-deny-interactive";
case SECURE_EXEC_DENY_INTERACTIVE_LOCKED:
return "exec-deny-interactive-locked";
default:
assert_not_reached();
}
@@ -55,6 +67,12 @@ int secure_bits_to_strv(int i, char ***ret) {
SECURE_NO_SETUID_FIXUP_LOCKED,
SECURE_NOROOT,
SECURE_NOROOT_LOCKED,
SECURE_NO_CAP_AMBIENT_RAISE,
SECURE_NO_CAP_AMBIENT_RAISE_LOCKED,
SECURE_EXEC_RESTRICT_FILE,
SECURE_EXEC_RESTRICT_FILE_LOCKED,
SECURE_EXEC_DENY_INTERACTIVE,
SECURE_EXEC_DENY_INTERACTIVE_LOCKED,
};
int r;
@@ -98,6 +116,18 @@ int secure_bits_from_string(const char *s) {
secure_bits |= 1 << SECURE_NOROOT;
else if (streq(word, "noroot-locked"))
secure_bits |= 1 << SECURE_NOROOT_LOCKED;
else if (streq(word, "no-cap-ambient-raise"))
secure_bits |= 1 << SECURE_NO_CAP_AMBIENT_RAISE;
else if (streq(word, "no-cap-ambient-raise-locked"))
secure_bits |= 1 << SECURE_NO_CAP_AMBIENT_RAISE_LOCKED;
else if (streq(word, "exec-restrict-file"))
secure_bits |= 1 << SECURE_EXEC_RESTRICT_FILE;
else if (streq(word, "exec-restrict-file-locked"))
secure_bits |= 1 << SECURE_EXEC_RESTRICT_FILE_LOCKED;
else if (streq(word, "exec-deny-interactive"))
secure_bits |= 1 << SECURE_EXEC_DENY_INTERACTIVE;
else if (streq(word, "exec-deny-interactive-locked"))
secure_bits |= 1 << SECURE_EXEC_DENY_INTERACTIVE_LOCKED;
}
return secure_bits;
src/test/test-secure-bits.c
+6
View File
@@ -11,6 +11,12 @@ static const char * const string_bits[] = {
"no-setuid-fixup-locked",
"noroot",
"noroot-locked",
"no-cap-ambient-raise",
"no-cap-ambient-raise-locked",
"exec-restrict-file",
"exec-restrict-file-locked",
"exec-deny-interactive",
"exec-deny-interactive-locked",
NULL
};