picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Ninjatrappeur's systemd working tree
27,447 Commits 2 Branches 0 Tags 166 MiB
C 87.3%
Python 6.2%
Shell 2%
C++ 1.4%
Meson 1.2%
Other 1.8%
Go to file
Lennart Poettering add005357d core: add new RestrictNamespaces= unit file setting 
This new setting permits restricting whether namespaces may be created and
managed by processes started by a unit. It installs a seccomp filter blocking
certain invocations of unshare(), clone() and setns().

RestrictNamespaces=no is the default, and does not restrict namespaces in any
way. RestrictNamespaces=yes takes away the ability to create or manage any kind
of namspace. "RestrictNamespaces=mnt ipc" restricts the creation of namespaces
so that only mount and IPC namespaces may be created/managed, but no other
kind of namespaces.

This setting should be improve security quite a bit as in particular user
namespacing was a major source of CVEs in the kernel in the past, and is
accessible to unprivileged processes. With this setting the entire attack
surface may be removed for system services that do not make use of namespaces.
 		2016-11-04 07:40:13 -06:00
.github documentation: add a short document describing how to test your systemd build tree (#3763) 2016-07-20 22:15:54 -04:00
.mkosi mkosi: install Fedora 25 2016-10-06 11:54:24 -04:00
catalog catalog: add more Korean translations 2016-10-22 17:49:52 +02:00
coccinelle tree-wide: drop NULL sentinel from strjoin 2016-10-23 11:43:27 -04:00
docs docs: add .gitignore 2015-07-06 17:47:38 +02:00
factory/etc factory: remove broken pam_limits 2014-07-30 15:21:54 +02:00
hwdb hwdb update for 232 (#4557) 2016-11-03 13:16:01 -04:00
m4 build-sys: Perform flag tests in context to existing flags 2016-02-06 14:57:46 +01:00
man core: add new RestrictNamespaces= unit file setting 2016-11-04 07:40:13 -06:00
network network: allow LLDP packets to cross non-customer bridges for container network interfaces 2016-05-09 15:45:31 +02:00
po catalog,po: update Polish translation (#4290) 2016-10-05 22:59:37 +02:00
rules rules: introduce disk/by-id (model_serial) symlinks for NVMe drives (#3974) 2016-08-17 14:10:28 +02:00
shell-completion analyze: add syscall-filter verb 2016-11-03 09:35:35 -04:00
src core: add new RestrictNamespaces= unit file setting 2016-11-04 07:40:13 -06:00
sysctl.d treewide: fix typos and remove accidental repetition of words 2016-07-11 16:18:43 +02:00
system-preset unit: drop console-shell.service (#4298) (#4325) 2016-10-10 12:06:26 +02:00
sysusers.d remove bus-proxyd 2016-02-12 19:10:01 +01:00
test test: test DynamicUser= with SupplementaryGroups= 2016-11-03 08:38:28 +01:00
tmpfiles.d treewide: fix typos and remove accidental repetition of words 2016-07-11 16:18:43 +02:00
tools Remove systemd-bootchart 2016-02-23 13:30:09 +01:00
units Merge pull request #4442 from keszybz/detect-virt-userns 2016-10-27 13:16:16 +03:00
xorg login: support user-bus on dbus1 2015-08-31 18:12:37 +02:00
.dir-locals.el editors: only extend line width to 119 for C and XML files 2016-02-10 12:29:32 +01:00
.editorconfig editors: only extend line width to 119 for C and XML files 2016-02-10 12:29:32 +01:00
.gitattributes git: indicate that tabs are never OK in the systemd tree 2013-10-30 02:25:38 +01:00
.gitignore .gitignore: ignore precompiled GCC headers (#4516) 2016-10-28 13:03:01 -04:00
.mailmap NEWS: add contributor list to news file 2016-11-02 15:52:57 -06:00
.travis.yml remove gudev and gtk-doc 2015-06-03 00:22:53 +02:00
.vimrc vimrc: fix indentation logic for our docbook xml files 2016-04-29 12:23:34 +02:00
.ycm_extra_conf.py ycm: update flag blacklist 2014-06-04 15:41:10 -04:00
CODING_STYLE CODING_STYLE fixes (#3804) 2016-07-25 22:34:42 +03:00
DISTRO_PORTING build-sys: Allow disabling installation of pam config snippet 2016-10-12 14:09:14 -03:00
HACKING documentation: add a short document describing how to test your systemd build tree (#3763) 2016-07-20 22:15:54 -04:00
LICENSE.GPL2 relicense to LGPLv2.1 (with exceptions) 2012-04-12 00:24:39 +02:00
LICENSE.LGPL2.1 licence: remove references to old FSF address 2012-12-17 11:41:31 +01:00
Makefile-man.am man: add journal-upload.conf(5) 2016-10-15 18:45:18 -04:00
Makefile.am core: add new RestrictNamespaces= unit file setting 2016-11-04 07:40:13 -06:00
NEWS final NEWS update for 232 (#4558) 2016-11-03 08:56:26 -06:00
README README: list dependencies for testing 2016-10-17 16:54:27 +00:00
README.md documentation: add a short document describing how to test your systemd build tree (#3763) 2016-07-20 22:15:54 -04:00
TODO core: add new RestrictNamespaces= unit file setting 2016-11-04 07:40:13 -06:00
autogen.sh build-sys/autogen: don't use bashisms (#4489) 2016-10-25 19:39:48 -04:00
configure.ac build-sys: bump package and library version in preparation for v232 2016-11-02 16:04:40 -06:00
mkosi.build mkosi: drop git clean 2016-10-06 11:54:24 -04:00
mkosi.default mkosi: create .mkosi directory 2016-10-06 11:53:58 -04:00

README.md

systemd - System and Service Manager

Build Status
Coverity Scan Status

Details

General information about systemd can be found in the systemd Wiki.

Information about build requirements are provided in the README file.

Consult our NEWS file for information about what's new in the most recent systemd versions.

Please see the HACKING file for information how to hack on systemd and test your modifications.

Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.

When preparing patches for systemd, please follow our Coding Style Guidelines.

If you are looking for support, please contact our mailing list or join our IRC channel.