SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: Make DelegateNamespaces= work for user managers with CAP_SYS_ADMIN (#36771)

Browse Source 
Currently DelegateNamespaces= only works for services spawned by the
system manager. User managers will always unshare the user namespace
first even if they're running with CAP_SYS_ADMIN.

Let's add support for DelegateNamespaces= for user managers if they're
running with CAP_SYS_ADMIN. By default, we'll still delegate all
namespaces
for user managers, but this can now be overridden by explicitly passing
DelegateNamespaces=.

If a user manager is running without CAP_SYS_ADMIN, the user manager is
still always unshared first just like before.
This commit is contained in:
Yu Watanabe
2025-03-20 06:28:18 +09:00
committed by GitHub
parent b0fe8df5a9 38748596f0
commit db4b4e0cd3
7 changed files with 92 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/capability-util.c
+3 -2
View File
@@ -114,8 +114,9 @@ int capability_ambient_set_apply(uint64_t set, bool also_inherit) {
int r;
/* Remove capabilities requested in ambient set, but not in the bounding set */
BIT_FOREACH(i, set) {
assert((unsigned) i <= cap_last_cap());
for (unsigned i = 0; i <= cap_last_cap(); i++) {
if (!BIT_SET(set, i))
continue;
if (prctl(PR_CAPBSET_READ, (unsigned long) i) != 1) {
log_debug("Ambient capability %s requested but missing from bounding set, suppressing automatically.",