picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

man: document the default value of NoNewPrivileges= 

Fixes #4329.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2016-10-22 23:41:45 -04:00
parent 9b232d3241
commit 74388c2d11
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
man/systemd.exec.xml
View File

@ -1234,13 +1234,22 @@
<varlistentry>
<term><varname>NoNewPrivileges=</varname></term>
<listitem><para>Takes a boolean argument. If true, ensures
that the service process and all its children can never gain
new privileges. This option is more powerful than the
respective secure bits flags (see above), as it also prohibits
UID changes of any kind. This is the simplest, most effective
way to ensure that a process and its children can never
elevate privileges again.</para></listitem>
<listitem><para>Takes a boolean argument. If true, ensures that the service
process and all its children can never gain new privileges. This option is more
powerful than the respective secure bits flags (see above), as it also prohibits
UID changes of any kind. This is the simplest and most effective way to ensure that
a process and its children can never elevate privileges again. Defaults to false,
but in the user manager instance certain settings force
<varname>NoNewPrivileges=yes</varname>, ignoring the value of this setting.
Those is the case when <varname>SystemCallFilter=</varname>,
<varname>SystemCallArchitectures=</varname>,
<varname>RestrictAddressFamilies=</varname>,
<varname>PrivateDevices=</varname>,
<varname>ProtectKernelTunables=</varname>,
<varname>ProtectKernelModules=</varname>,
<varname>MemoryDenyWriteExecute=</varname>, or
<varname>RestrictRealtime=</varname> are specified.
</para></listitem>
</varlistentry>
<varlistentry>