picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
46,238 Commits 2 Branches 0 Tags 166 MiB
Commit Graph

260 Commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek d34cd37490 Make PrivateTmp dirs also inaccessible from the outside 
Currently, PrivateTmp=yes means that the service cannot see the /tmp
shared by rest of the system and is isolated from other services using
PrivateTmp, but users can access and modify /tmp as seen by the
service.

Move the private /tmp and /var/tmp directories into a 0077-mode
directory. This way unpriviledged users on the system cannot see (or
modify) /tmp as seen by the service.
 2013-03-20 14:08:41 -04:00
Michal Sekletar c17ec25e4d core: reuse the same /tmp, /var/tmp and inaccessible dir 
All Execs within the service, will get mounted the same
/tmp and /var/tmp directories, if service is configured with
PrivateTmp=yes. Temporary directories are cleaned up by service
itself in addition to systemd-tmpfiles. Directory which is mounted
as inaccessible is created at runtime in /run/systemd.
 2013-03-15 22:56:40 -04:00
Lennart Poettering 1e41be2015 nspawn,namespaces: make sure we recursively bind mount things in 
We want to make sure that everything from the host is also visible in
the sandbox.
 2012-08-13 16:25:03 +02:00
Lennart Poettering ac0930c892 namespace: rework namespace support 
- don't use pivot_root() anymore, just reuse root hierarchy
- first create all mounts, then mark them read-only so that we get the
  right behaviour when people want writable mounts inside of
  read-only mounts
- don't pass invalid combinations of MS_ constants to the kernel
 2012-08-13 15:27:04 +02:00
Lennart Poettering 64825d3c58 fix a couple of issues found with llvm-analyze 2012-08-08 23:54:21 +02:00
Lennart Poettering c1d70f7ca5 namespace: make PrivateTmp= apply to both /tmp and /var/tmp 2012-05-14 22:41:30 +02:00
Kay Sievers 9eb977db5b util: split-out path-util.[ch] 2012-05-08 02:33:10 +02:00
Kay Sievers 4d46fec56d remove MS_* which can not be combined with current kernel code 
MS_BIND|MS_MOVE can not be combined:
  do_mount()
    else if (flags & MS_BIND)
      do_loopback(&path, dev_name, flags & MS_REC);
    [...]
    else if (flags & MS_MOVE)
      do_move_mount(&path, dev_name);

MS_REMOUNT|MS_UNBINDABLE can not be combined:
  do_mount()
    if (flags & MS_REMOUNT)
      do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, data_page);
    [...]
    else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
      do_change_type(&path, flags);
 2012-04-18 13:37:45 +02:00
Lennart Poettering 5430f7f2bc relicense to LGPLv2.1 (with exceptions) 
We finally got the OK from all contributors with non-trivial commits to
relicense systemd from GPL2+ to LGPL2.1+.

Some udev bits continue to be GPL2+ for now, but we are looking into
relicensing them too, to allow free copy/paste of all code within
systemd.

The bits that used to be MIT continue to be MIT.

The big benefit of the relicensing is that closed source code may now
link against libsystemd-login.so and friends.
 2012-04-12 00:24:39 +02:00
Kay Sievers b30e2f4c18 move libsystemd_core.la sources into core/ 2012-04-11 16:03:51 +02:00
Renamed from src/namespace.c (Browse further)