From b5a33299b055714e9ead2db33243f811ea488afa Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Tue, 1 May 2018 13:33:34 +0900 Subject: [PATCH 1/3] core: disable namespace sandboxing for '+' prefixed lines Fixes #8842. --- src/core/execute.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/src/core/execute.c b/src/core/execute.c index e9d244a9ae..11bf176f6b 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -2293,14 +2293,7 @@ static int apply_mount_namespace( _cleanup_strv_free_ char **empty_directories = NULL; char *tmp = NULL, *var = NULL; const char *root_dir = NULL, *root_image = NULL; - NamespaceInfo ns_info = { - .ignore_protect_paths = false, - .private_dev = context->private_devices, - .protect_control_groups = context->protect_control_groups, - .protect_kernel_tunables = context->protect_kernel_tunables, - .protect_kernel_modules = context->protect_kernel_modules, - .mount_apivfs = context->mount_apivfs, - }; + NamespaceInfo ns_info = {}; bool needs_sandboxing; BindMount *bind_mounts = NULL; size_t n_bind_mounts = 0; @@ -2340,6 +2333,16 @@ static int apply_mount_namespace( needs_sandboxing = (params->flags & EXEC_APPLY_SANDBOXING) && !(command->flags & EXEC_COMMAND_FULLY_PRIVILEGED); + if (needs_sandboxing) + ns_info = (NamespaceInfo) { + .ignore_protect_paths = false, + .private_dev = context->private_devices, + .protect_control_groups = context->protect_control_groups, + .protect_kernel_tunables = context->protect_kernel_tunables, + .protect_kernel_modules = context->protect_kernel_modules, + .mount_apivfs = context->mount_apivfs, + }; + r = setup_namespace(root_dir, root_image, &ns_info, context->read_write_paths, needs_sandboxing ? context->read_only_paths : NULL, From cfa24ca0e60168e212e45aad8258bb082d7c6dd9 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Tue, 1 May 2018 13:42:32 +0900 Subject: [PATCH 2/3] test: add tests for PrivateDevices= with '+' prefix --- src/test/test-execute.c | 1 + test/meson.build | 1 + .../exec-privatedevices-disabled-by-prefix.service | 8 ++++++++ 3 files changed, 10 insertions(+) create mode 100644 test/test-execute/exec-privatedevices-disabled-by-prefix.service diff --git a/src/test/test-execute.c b/src/test/test-execute.c index 2b5706822c..4943bfa689 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -231,6 +231,7 @@ static void test_exec_privatedevices(Manager *m) { test(m, "exec-privatedevices-yes.service", 0, CLD_EXITED); test(m, "exec-privatedevices-no.service", 0, CLD_EXITED); + test(m, "exec-privatedevices-disabled-by-prefix.service", 0, CLD_EXITED); /* We use capsh to test if the capabilities are * properly set, so be sure that it exists */ diff --git a/test/meson.build b/test/meson.build index c65e7e4538..7c20788d0d 100644 --- a/test/meson.build +++ b/test/meson.build @@ -81,6 +81,7 @@ test_data_files = ''' test-execute/exec-personality-s390.service test-execute/exec-personality-x86-64.service test-execute/exec-personality-x86.service + test-execute/exec-privatedevices-disabled-by-prefix.service test-execute/exec-privatedevices-no-capability-mknod.service test-execute/exec-privatedevices-no-capability-sys-rawio.service test-execute/exec-privatedevices-no.service diff --git a/test/test-execute/exec-privatedevices-disabled-by-prefix.service b/test/test-execute/exec-privatedevices-disabled-by-prefix.service new file mode 100644 index 0000000000..19b1da5240 --- /dev/null +++ b/test/test-execute/exec-privatedevices-disabled-by-prefix.service @@ -0,0 +1,8 @@ +[Unit] +Description=Test for PrivateDevices=yes with prefix + +[Service] +ExecStart=/bin/sh -x -c '! test -c /dev/kmsg' +ExecStart=+/bin/sh -x -c 'test -c /dev/kmsg' +Type=oneshot +PrivateDevices=yes From 9c6f2e5ab9acc704cd2a5b3d7133897d593a5476 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Tue, 1 May 2018 13:42:48 +0900 Subject: [PATCH 3/3] test: fix descriptions --- test/test-execute/exec-privatedevices-no.service | 2 +- test/test-execute/exec-privatedevices-yes.service | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/test-execute/exec-privatedevices-no.service b/test/test-execute/exec-privatedevices-no.service index 0285a83ee4..4ddbf189b7 100644 --- a/test/test-execute/exec-privatedevices-no.service +++ b/test/test-execute/exec-privatedevices-no.service @@ -1,5 +1,5 @@ [Unit] -Description=Test for PrivateDev=no +Description=Test for PrivateDevices=no [Service] ExecStart=/bin/sh -x -c 'test -c /dev/kmsg' diff --git a/test/test-execute/exec-privatedevices-yes.service b/test/test-execute/exec-privatedevices-yes.service index 094257f414..3516667207 100644 --- a/test/test-execute/exec-privatedevices-yes.service +++ b/test/test-execute/exec-privatedevices-yes.service @@ -1,5 +1,5 @@ [Unit] -Description=Test for PrivateDev=yes +Description=Test for PrivateDevices=yes [Service] ExecStart=/bin/sh -c 'test ! -c /dev/kmsg'