SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #27669 from keszybz/man-fixes-254

Browse Source 
Some simple man page fixes to reduce the list of issues tagged for v254
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2023-05-17 14:12:33 +02:00
committed by GitHub
parent a190e0c301 f90360eb74
commit ffcdd3194d
3 changed files with 44 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+13 -8
View File
@@ -1826,17 +1826,22 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<varlistentry>
<term><varname>ProtectClock=</varname></term>
<listitem><para>Takes a boolean argument. If set, writes to the hardware clock or system clock will be denied.
It is recommended to turn this on for most services that do not need modify the clock. Defaults to off. Enabling
this option removes <constant>CAP_SYS_TIME</constant> and <constant>CAP_WAKE_ALARM</constant> from the
capability bounding set for this unit, installs a system call filter to block calls that can set the
clock, and <varname>DeviceAllow=char-rtc r</varname> is implied. This ensures <filename>/dev/rtc0</filename>,
<filename>/dev/rtc1</filename>, etc. are made read-only to the service. See
<listitem><para>Takes a boolean argument. If set, writes to the hardware clock or system clock will
be denied. Defaults to off. Enabling this option removes <constant>CAP_SYS_TIME</constant> and
<constant>CAP_WAKE_ALARM</constant> from the capability bounding set for this unit, installs a system
call filter to block calls that can set the clock, and <varname>DeviceAllow=char-rtc r</varname> is
implied. Note that the system calls are blocked altogether, the filter does not take into account
that some of the calls can be used to read the clock state with some parameter combinations.
Effectively, <filename>/dev/rtc0</filename>, <filename>/dev/rtc1</filename>, etc. are made read-only
to the service. See
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for the details about <varname>DeviceAllow=</varname>. If this setting is on, but the unit
doesn't have the <constant>CAP_SYS_ADMIN</constant> capability (e.g. services for which
for the details about <varname>DeviceAllow=</varname>. If this setting is on, but the unit doesn't
have the <constant>CAP_SYS_ADMIN</constant> capability (e.g. services for which
<varname>User=</varname> is set), <varname>NoNewPrivileges=yes</varname> is implied.</para>
<para>It is recommended to turn this on for most services that do not need modify the clock or check
its state.</para>
<xi:include href="system-or-user-ns.xml" xpointer="singular"/></listitem>
</varlistentry>