picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
Systemd/units
History
Lennart Poettering ee8f26180d units: switch from system call blacklist to whitelist 
This is generally the safer approach, and is what container managers
(including nspawn) do, hence let's move to this too for our own
services. This is particularly useful as this this means the new
@system-service system call filter group will get serious real-life
testing quickly.

This also switches from firing SIGSYS on unexpected syscalls to
returning EPERM. This would have probably been a better default anyway,
but it's hard to change that these days. When whitelisting system calls
SIGSYS is highly problematic as system calls that are newly introduced
to Linux become minefields for services otherwise.

Note that this enables a system call filter for udev for the first time,
and will block @clock, @mount and @swap from it. Some downstream
distributions might want to revert this locally if they want to permit
unsafe operations on udev rules, but in general this shiuld be mostly
safe, as we already set MountFlags=shared for udevd, hence at least
@mount won't change anything.
2018-06-14 17:44:20 +02:00
..
user Drop my copyright headers 2018-06-14 13:03:20 +02:00
user-.slice.d Use a dash-truncated drop-in for user-%j.slice configuration 2018-04-25 16:18:45 +02:00
basic.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
bluetooth.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
busnames.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
console-getty.service.m4 unit,meson: drop .in suffix if no substitution is required (#8740) 2018-04-17 19:49:10 +02:00
container-getty@.service.m4 unit,meson: drop .in suffix if no substitution is required (#8740) 2018-04-17 19:49:10 +02:00
cryptsetup-pre.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
cryptsetup.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
debug-shell.service.in units: link up debug-generator documentation from debug-shell.service 2017-12-26 12:13:51 +01:00
dev-hugepages.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
dev-mqueue.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
emergency.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
emergency.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
exit.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
final.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
getty-pre.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
getty.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
getty@.service.m4 Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
graphical.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
halt-local.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
halt.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
hibernate.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
hybrid-sleep.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-cleanup.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-fs.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-parse-etc.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-root-device.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-root-fs.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-switch-root.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-switch-root.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd-udevadm-cleanup-db.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
initrd.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
kexec.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
kmod-static-nodes.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
ldconfig.service Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
local-fs-pre.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
local-fs.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
machine.slice Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
machines.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
meson-add-wants.sh separate flags from shebang 2017-12-25 19:48:49 +01:00
meson.build Drop my copyright headers 2018-06-14 13:03:20 +02:00
multi-user.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
network-online.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
network-pre.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
network.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
nss-lookup.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
nss-user-lookup.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
paths.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
poweroff.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
printer.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
proc-sys-fs-binfmt_misc.automount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
proc-sys-fs-binfmt_misc.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
quotaon.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
rc-local.service.in man: add a systemd-rc-local-generator(8) man page 2017-12-26 12:13:51 +01:00
reboot.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
remote-cryptsetup.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
remote-fs-pre.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
remote-fs.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
rescue.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
rescue.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
rpcbind.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
serial-getty@.service.m4 Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
shutdown.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sigpwr.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sleep.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
slices.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
smartcard.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sockets.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sound.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
suspend-then-hibernate.target Fix description on suspend-then-hibernate units. 2018-03-28 15:26:18 -05:00
suspend.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
swap.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sys-fs-fuse-connections.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sys-kernel-config.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sys-kernel-debug.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
sysinit.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
syslog.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
system-update-cleanup.service unit,meson: drop .in suffix if no substitution is required (#8740) 2018-04-17 19:49:10 +02:00
system-update.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-ask-password-console.path Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-ask-password-console.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-ask-password-wall.path Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-ask-password-wall.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-backlight@.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-binfmt.service.in fix url for binfmt documentation (#8720) 2018-04-14 15:15:19 +02:00
systemd-coredump.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-coredump@.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-exit.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-firstboot.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-fsck-root.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-fsck@.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-halt.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-hibernate-resume@.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-hibernate.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-hostnamed.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-hwdb-update.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-hybrid-sleep.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-importd.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-initctl.service.in units: initctl: move the fifo to /run/initctl to match sysvinit 2018-03-30 16:52:14 -04:00
systemd-initctl.socket units: initctl: move the fifo to /run/initctl to match sysvinit 2018-03-30 16:52:14 -04:00
systemd-journal-catalog-update.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journal-flush.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journal-gatewayd.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journal-gatewayd.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journal-remote.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journal-remote.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journal-upload.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journald-audit.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journald-dev-log.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-journald.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-journald.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-kexec.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-localed.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-logind.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-machine-id-commit.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-machined.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-modules-load.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-networkd-wait-online.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-networkd.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-networkd.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-nspawn@.service.in nspawn: turn on watchdog logic for nspawn too 2017-12-07 12:34:46 +01:00
systemd-portabled.service.in add new portable service framework 2018-05-24 17:01:57 +02:00
systemd-poweroff.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-quotacheck.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-random-seed.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-reboot.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-remount-fs.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-resolved.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-rfkill.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-rfkill.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-suspend-then-hibernate.service.in Fix description on suspend-then-hibernate units. 2018-03-28 15:26:18 -05:00
systemd-suspend.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-sysctl.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-sysusers.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-time-wait-sync.service.in units: document why systemd-time-wait-sync.service conditions on CAP_SYS_TIME (#8555) 2018-03-22 23:41:54 +03:00
systemd-timedated.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-timesyncd.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-tmpfiles-clean.service.in units: use SuccessExitStatus to ignore syntax errors in tmpfiles 2017-12-01 18:58:54 +01:00
systemd-tmpfiles-clean.timer Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-tmpfiles-setup-dev.service.in tmpfiles: ignore "operational" errors during setup 2018-04-05 08:13:53 +02:00
systemd-tmpfiles-setup.service.in tmpfiles: ignore "operational" errors during setup 2018-04-05 08:13:53 +02:00
systemd-udev-settle.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-udev-trigger.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-udevd-control.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-udevd-kernel.socket Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-udevd.service.in units: switch from system call blacklist to whitelist 2018-06-14 17:44:20 +02:00
systemd-update-done.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-update-utmp-runlevel.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-update-utmp.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-user-sessions.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-vconsole-setup.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
systemd-volatile-root.service.in Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
time-sync.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
timers.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
tmp.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
umount.target Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
user-runtime-dir@.service.in logind: split %t directory creation to a helper unit 2018-04-25 16:20:28 +02:00
user.slice Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00
user@.service.in logind: split %t directory creation to a helper unit 2018-04-25 16:20:28 +02:00
var-lib-machines.mount Add SPDX license headers to unit files 2017-11-19 19:08:15 +01:00