From e91035abf0555e0ca85d24a1e02a32063728d9e6 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 2 Jun 2021 18:57:31 +0100 Subject: [PATCH 1/2] TODO: remove some features that have been implemented --- TODO | 2 -- 1 file changed, 2 deletions(-) diff --git a/TODO b/TODO index 084a8540b3..5e91ddffd5 100644 --- a/TODO +++ b/TODO @@ -665,8 +665,6 @@ Features: * add support for "portablectl attach http://foobar.com/waaa.raw (i.e. importd integration) -* add attach --enable and attach --now (for attach+enable+start) - * sync dynamic uids/gids between host+portable srvice (i.e. if DynamicUser=1 is set for a service, make sure that the selected user is resolvable in the service even if it ships its own /etc/passwd) From 88511a3712bcf8c1922ef21abc9e18798e61a80e Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 2 Jun 2021 19:13:05 +0100 Subject: [PATCH 2/2] TODO: mention the new Landlock LSM as a way to implement sandboxing for systemd --user --- TODO | 3 +++ 1 file changed, 3 insertions(+) diff --git a/TODO b/TODO index 5e91ddffd5..0b6733aa35 100644 --- a/TODO +++ b/TODO @@ -858,6 +858,9 @@ Features: on PID 1 with the relevant signals, and makes relevant files in /sys and /proc (such as the sysrq stuff) unavailable +* Support ReadWritePaths/ReadOnlyPaths/InaccessiblePaths in systemd --user instances + via the new unprivileged Landlock LSM (https://landlock.io) + * make sure the ratelimit object can deal with USEC_INFINITY as way to turn off things * journalctl: make sure -f ends when the container indicated by -M terminates