picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge pull request #11922 from poettering/hostname-protect-fix

Browse source 
be a bit more conservative with enabling ProtectHostname= for everything
This commit is contained in:
Lennart Poettering 2019-03-08 17:46:42 +01:00 committed by GitHub
parent b459700b98 a18449b5bd
commit c50792331e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
man/systemd.exec.xml
View file

@ -1135,9 +1135,13 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<listitem><para>Takes a boolean argument. When set, sets up a new UTS namespace for the executed
processes. In addition, changing hostname or domainname is prevented. Defaults to off.</para>
<para>Note that the implementation of this setting might be impossible (for example if UTS namespaces are not
available), and the unit should be written in a way that does not solely rely on this setting for
security.</para></listitem>
<para>Note that the implementation of this setting might be impossible (for example if UTS namespaces
are not available), and the unit should be written in a way that does not solely rely on this setting
for security.</para>
<para>Note that when this option is enabled for a service hostname changes no longer propagate from
the system into the service, it is hence not suitable for services that need to take notice of system
hostname changes dynamically.</para></listitem>
</varlistentry>
<varlistentry>

1
units/systemd-journald.service.in
View file

@ -23,7 +23,6 @@ IPAddressDeny=any
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProtectHostname=yes
Restart=always
RestartSec=0
RestrictAddressFamilies=AF_UNIX AF_NETLINK

1
units/systemd-networkd.service.in
View file

@ -27,7 +27,6 @@ MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelModules=yes
ProtectSystem=strict
Restart=on-failure

1
units/systemd-resolved.service.in
View file

@ -30,7 +30,6 @@ PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict