picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

main: don't set no_new_privs when using SystemCallArchitectures= system-wide

Browse source 
After all, we want to allow userspace to get new privs...
This commit is contained in:
Lennart Poettering 2014-02-17 01:14:14 +01:00
parent 37c47eb709
commit 8a8bf3c045
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/core/main.c
View file

@ -1191,6 +1191,12 @@ static int enforce_syscall_archs(Set *archs) {
}
}
r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
if (r < 0) {
log_error("Failed to unset NO_NEW_PRIVS: %s", strerror(-r));
goto finish;
}
r = seccomp_load(seccomp);
if (r < 0)
log_error("Failed to add install architecture seccomp: %s", strerror(-r));