David Rheinsberg
d268b22b25
With `F_SEAL_SEAL` a memfd can disable further sealing operations, effectively sealing the set of seals. Testing for it ensures that no further seals can be added, it never prevents seals from being dropped, since seals cannot be dropped, ever. Now testing for `F_SEAL_SEAL` makes sense if you want to ensure that some seals are *not* set. That is, you either test for the entire set of seals to match a local set, or you verify that a specific seal is not set. Neither is what we are doing, so it feels wrong requiring it to be set. By dropping the requirement for `F_SEAL_SEAL`, the same FD can be shared with other entities while retaining the ability to further restrict the set of seals later on (e.g., being able to mark a region as executable later on, and then adding `F_SEAL_EXEC`).
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list or join our IRC channel.
Stable branches with backported patches are available in the stable repo.