Daan De Meyer
0e231729fd
When registering a machine, machined verifies that the leader process is owned by the calling user via process_is_owned_by_uid(). This check fails for user scope machined when the leader is inside a user namespace: after the leader calls setns(CLONE_NEWUSER), it becomes non-dumpable, and the subsequent ptrace_may_access() check in the kernel denies access to the process's user namespace, since the calling user lacks CAP_SYS_PTRACE in the mm's user namespace (the host namespace), even though the user owns the child user namespace. Skip this check when running in user scope. For system scope, the check is important because multiple users share the same machined instance, so one user must not be able to claim another user's process as a machine leader. For user scope this is unnecessary: the varlink socket lives under $XDG_RUNTIME_DIR (mode 0700), so only the owning user can connect, and the user machined instance can only perform operations bounded by that user's own privileges. Registering a foreign PID does not escalate capabilities.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release