SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exec: imply NoNewPriviliges= only when seccomp filters are used in user mode

Browse Source
This commit is contained in:
Lennart Poettering
2014-02-26 02:28:52 +01:00
parent 9c423fbf2a
commit f513e420c8
3 changed files with 46 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/execute.c
+5 -2
View File
@@ -1706,7 +1706,8 @@ int exec_spawn(ExecCommand *command,
}
#ifdef HAVE_SECCOMP
if (context->address_families) {
if (context->address_families_whitelist ||
!set_isempty(context->address_families)) {
err = apply_address_families(context);
if (err < 0) {
r = EXIT_ADDRESS_FAMILIES;
@@ -1714,7 +1715,9 @@ int exec_spawn(ExecCommand *command,
}
}
if (context->syscall_filter || context->syscall_archs) {
if (context->syscall_whitelist ||
!set_isempty(context->syscall_filter) ||
!set_isempty(context->syscall_archs)) {
err = apply_seccomp(context);
if (err < 0) {
r = EXIT_SECCOMP;