picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

journal: limit caps we pass to journald

This commit is contained in:
Lennart Poettering 2012-02-09 02:06:13 +01:00
parent cea6691857
commit ccd07a083e
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -16,6 +16,8 @@ CHANGES WITH 41:
understood to set system wide environment variables
dynamically at boot.
* We now limit the set of capabilities of systemd-journald.
Contributions from: Benjamin Franzke, Kay Sievers, Lennart
Poettering, Michael Olbrich, Michal Schmidt, Tom Gundersen,
William Douglas

2
units/systemd-journald.service.in
View File

@ -18,7 +18,7 @@ After=syslog.socket
ExecStart=@rootlibexecdir@/systemd-journald
NotifyAccess=all
StandardOutput=null
#CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SETUID CAP_SETGID CAP_DAC_OVERRIDE
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER
# Increase the default a bit in order to allow many simultaneous
# services being run since we keep one fd open per service.