Merge pull request #8866 from yuwata/fix-8842

core: disable namespace sandboxing for '+' prefixed lines

src/core/execute.c

@@ -2293,14 +2293,7 @@ static int apply_mount_namespace(
         _cleanup_strv_free_ char **empty_directories = NULL;
         char *tmp = NULL, *var = NULL;
         const char *root_dir = NULL, *root_image = NULL;
-        NamespaceInfo ns_info = {
-                .ignore_protect_paths = false,
-                .private_dev = context->private_devices,
-                .protect_control_groups = context->protect_control_groups,
-                .protect_kernel_tunables = context->protect_kernel_tunables,
-                .protect_kernel_modules = context->protect_kernel_modules,
-                .mount_apivfs = context->mount_apivfs,
-        };
+        NamespaceInfo ns_info = {};
         bool needs_sandboxing;
         BindMount *bind_mounts = NULL;
         size_t n_bind_mounts = 0;
@@ -2340,6 +2333,16 @@ static int apply_mount_namespace(
 
         needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED);
 
+        if (needs_sandboxing)
+                ns_info = (NamespaceInfo) {
+                        .ignore_protect_paths = false,
+                        .private_dev = context->private_devices,
+                        .protect_control_groups = context->protect_control_groups,
+                        .protect_kernel_tunables = context->protect_kernel_tunables,
+                        .protect_kernel_modules = context->protect_kernel_modules,
+                        .mount_apivfs = context->mount_apivfs,
+                };
+
         r = setup_namespace(root_dir, root_image,
                             &ns_info, context->read_write_paths,
                             needs_sandboxing ? context->read_only_paths : NULL,

src/test/test-execute.c

@@ -231,6 +231,7 @@ static void test_exec_privatedevices(Manager *m) {
 
         test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED);
         test(m, "exec-privatedevices-no.service", 0, CLD_EXITED);
+        test(m, "exec-privatedevices-disabled-by-prefix.service", 0, CLD_EXITED);
 
         /* We use capsh to test if the capabilities are
          * properly set, so be sure that it exists */

test/meson.build

@@ -81,6 +81,7 @@ test_data_files = '''
         test-execute/exec-personality-s390.service
         test-execute/exec-personality-x86-64.service
         test-execute/exec-personality-x86.service
+        test-execute/exec-privatedevices-disabled-by-prefix.service
         test-execute/exec-privatedevices-no-capability-mknod.service
         test-execute/exec-privatedevices-no-capability-sys-rawio.service
         test-execute/exec-privatedevices-no.service

test/test-execute/exec-privatedevices-disabled-by-prefix.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Test for PrivateDevices=yes with prefix
+
+[Service]
+ExecStart=/bin/sh -x -c '! test -c /dev/kmsg'
+ExecStart=+/bin/sh -x -c 'test -c /dev/kmsg'
+Type=oneshot
+PrivateDevices=yes

test/test-execute/exec-privatedevices-no.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=Test for PrivateDev=no
+Description=Test for PrivateDevices=no
 
 [Service]
 ExecStart=/bin/sh -x -c 'test -c /dev/kmsg'

test/test-execute/exec-privatedevices-yes.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=Test for PrivateDev=yes
+Description=Test for PrivateDevices=yes
 
 [Service]
 ExecStart=/bin/sh -c 'test ! -c /dev/kmsg'