SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: add some notes regarding security features (#43434)

Browse Source
This commit is contained in:
Luca Boccassi
2026-08-24 15:12:03 +01:00
committed by GitHub
parent f9185464bb dfaa2d3ee1
commit ffb861ef22
4 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/run0.xml
+7
View File
@@ -65,6 +65,10 @@
<command>run0</command> is a symbolic link to <command>systemd-run</command> executable file, and it
behaves as <command>run0</command> if it is invoked through the symbolic link, otherwise behaves as
<command>systemd-run</command>.</para>
<para>Note that TTY isolation as provided by the default value of the <option>--pty</option> option is a
core feature of <command>run0</command>. Redirecting terminals must therefore be done with care,
avoiding giving such control to untrusted programs.</para>
</refsect1>
<refsect1>
@@ -267,6 +271,9 @@
<option>--no-ask-password</option> is specified in which case <option>--pty</option> is selected),
otherwise the relevant file descriptors are passed through directly.</para>
<para>As mentioned above, TTY isolation as implemented by the default value of this option is
crucial for security, so care must be taken when overriding it.</para>
<para id="v257"><option>--pty</option> and <option>--pipe</option> were added in v257.</para>
<para id="v258"><option>--pty-late</option> was added in v258.</para>
</listitem>
man/systemd-mountfsd.service.xml
+4 -1
View File
@@ -46,7 +46,10 @@
<listitem><para>If the disk image contains a Verity enabled disk image, along with a signature
partition with a key in the kernel keyring or in <filename>/etc/verity.d/*.crt</filename> (and related
directories) the disk image is considered trusted.</para></listitem>
directories) the disk image is considered trusted. Note that the GPT partition table of the disk image
is parsed by the kernel to discover its contents and <command>systemd-mountfsd</command> assumes that
the GPT parser is robust against malformed input and applies no security policies or checks around it.
</para></listitem>
</orderedlist>
<para>This service provides one <ulink url="https://varlink.org/">Varlink</ulink> service:
man/systemd-nsresourced.service.xml
+5
View File
@@ -92,6 +92,11 @@
<para>This service provides one <ulink url="https://varlink.org/">Varlink</ulink> service:
<constant>io.systemd.NamespaceResource</constant> allows registering user namespaces, and assign mounts,
cgroups and network interfaces to it.</para>
<para>Note that combining usage of <command>systemd-nsresourced</command> and systems based on
<filename>/etc/subuid</filename> and <filename>/etc/subgid</filename> might result in undefined
behavior if UID or GID ranges defined in those files overlap with the UID or GID ranges used by
nsresourced (the foreign UID range).</para>
</refsect1>
<refsect1>
man/systemd-system.conf.xml
+4 -1
View File
@@ -560,7 +560,10 @@
layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as
btrfs are unsupported.</para>
<para>Note that, without further measures to secure the system, kexec can be used to circumvent this.</para>
<para>Note that, without further measures to secure the system, kexec can be used to circumvent
this. Writable and executable memory mappings can also be used to circumvent this, so they need to
be blocked, which can be achieved using other LSMs, or on a per-service basis by using the
<varname>MemoryDenyWriteExecute=</varname> setting.</para>
<para>This requires the kernel to be booted with <literal>dm_verity.require_signatures=1</literal>
on the kernel command line and with BPF LSM enabled (<literal>lsm=...,bpf</literal>). If either