Łukasz Stelmach
e0ebc81b2d
Since the commit963b6b906e("core: drop ambient capabilities in user manager") systemd running as the session manager has dropped ambient capabilities retaining other sets allowing user services to be started with elevated capabilities. This, worked fine until the introduction of sd-executor. For a non-root process to be started with elevated capabilities by a non-root parent it either needs file capabilities or ambient capabilities in the parent process. Thus, systemd needs to allow sd-executor to inherit its ambient capabilities and sd-executor should drop them as systemd did before. The ambient set is managed for both system and session managers, but with the default set for PID#1 being empty, this code does not affect operation of PID#1. Fixes:bb5232b6a3("core: add systemd-executor binary")
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack