picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
Systemd/src/test
History
Lennart Poettering add005357d core: add new RestrictNamespaces= unit file setting 
This new setting permits restricting whether namespaces may be created and
managed by processes started by a unit. It installs a seccomp filter blocking
certain invocations of unshare(), clone() and setns().

RestrictNamespaces=no is the default, and does not restrict namespaces in any
way. RestrictNamespaces=yes takes away the ability to create or manage any kind
of namspace. "RestrictNamespaces=mnt ipc" restricts the creation of namespaces
so that only mount and IPC namespaces may be created/managed, but no other
kind of namespaces.

This setting should be improve security quite a bit as in particular user
namespacing was a major source of CVEs in the kernel in the past, and is
accessible to unprivileged processes. With this setting the entire attack
surface may be removed for system services that do not make use of namespaces.
2016-11-04 07:40:13 -06:00
..
.gitignore test: generate tests for OrderedHashmap from Hashmap tests 2014-10-23 17:38:02 +02:00
Makefile
test-acl-util.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-af-list.c util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] 2015-10-24 23:05:02 +02:00
test-alloc-util.c tests: move alloc related tests to test-alloc-util.c 2016-03-03 18:46:58 +01:00
test-architecture.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-arphrd-list.c util-lib: split our string related calls from util.[ch] into its own file string-util.[ch] 2015-10-24 23:05:02 +02:00
test-ask-password-api.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-async.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-barrier.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-bitmap.c bitmap: make bitmap_clear free the bitmap array 2015-07-31 19:08:26 +02:00
test-boot-timestamps.c shared/acpi-fpdt: use ENODATA for missing data and skip test 2016-03-04 21:45:45 -05:00
test-btrfs.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-calendarspec.c tests: fix memleak in test-calendarspec (#4424) 2016-10-20 17:44:30 +02:00
test-cap-list.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-capability.c tests: test ambient capabilities. 2016-01-12 12:14:50 +02:00
test-cgroup-mask.c Merge pull request #3290 from htejun/cgroup2-io-compat 2016-05-20 18:53:11 +02:00
test-cgroup-util.c nspawn: cleanup and chown the synced cgroup hierarchy (#4223) 2016-10-13 09:50:46 -04:00
test-cgroup.c core: when forcibly killing/aborting left-over unit processes log about it 2016-07-20 14:35:15 +02:00
test-clock.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-condition.c shared/condition: add ConditionVirtualization=[!]private-users 2016-10-26 20:12:52 -04:00
test-conf-files.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-conf-parser.c tests: move conf-parser related tests to test-conf-parser.c 2016-03-03 19:04:06 +01:00
test-copy.c test-copy: wrap assignments in function call in parentheses 2016-10-23 11:46:51 -04:00
test-cpu-set-util.c tests: move cpu-set-util related tests to test-cpu-set-util.c 2016-03-03 18:46:58 +01:00
test-daemon.c Enable test-daemon, test-log, test-watchdog by default 2016-03-04 21:45:45 -05:00
test-date.c tree-wide: drop NULL sentinel from strjoin 2016-10-23 11:43:27 -04:00
test-device-nodes.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-dns-domain.c shared: recognize DNS names with more than one trailing dot as invalid (#4111) 2016-09-09 16:11:54 +01:00
test-ellipsize.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-engine.c tests: get rid of strerror 2016-09-13 20:10:57 -04:00
test-env-util.c test-env-util: test env_{value,assignment}_is_valid 2016-03-21 16:49:42 -04:00
test-escape.c tests: move escape related tests to test-escape.c 2016-03-03 18:46:58 +01:00
test-execute.c test: test DynamicUser= with SupplementaryGroups= 2016-11-03 08:38:28 +01:00
test-extract-word.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-fd-util.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-fdset.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-fileio.c tree-wide: drop NULL sentinel from strjoin 2016-10-23 11:43:27 -04:00
test-firewall-util.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-fs-util.c namespace: chase symlinks for mounts to set up in userspace 2016-09-25 10:42:18 +02:00
test-fstab-util.c tests: move fstab-util related tests to test-fstab-util.c 2016-03-03 19:04:06 +01:00
test-glob-util.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-hashmap-plain.c test-hashmap: fix undefined behaviour on string constants 2016-02-18 19:39:10 -05:00
test-hashmap.c tree-wide: sort includes 2015-11-16 22:09:36 +01:00
test-helper.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-hexdecoct.c tests: move hexdecoct tests to test-hexdecoct.c 2016-03-03 18:46:58 +01:00
test-hostname-util.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-hostname.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-id128.c test: fix stack overflow reported by ASAN 2016-08-06 02:14:51 +00:00
test-install-root.c install: introduce UnitFileFlags 2016-10-24 10:19:08 +02:00
test-install.c install: introduce UnitFileFlags 2016-10-24 10:19:08 +02:00
test-io-util.c tests: move io-util related tests to test-io-util 2016-03-03 19:04:06 +01:00
test-ipcrm.c core: add RemoveIPC= setting 2016-08-19 00:37:25 +02:00
test-job-type.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-libudev.c test-libudev: disable monitor mode by default and add to automatic tests 2016-03-04 21:45:45 -05:00
test-list.c list: LIST_INSERT_BEFORE: update head if necessary (#4261) 2016-10-04 16:15:37 +02:00
test-locale-util.c tree-wide: sort includes 2015-11-16 22:09:36 +01:00
test-log.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-loopback.c Move test-loopback to normal tests 2016-03-04 21:45:44 -05:00
test-namespace.c tree-wide: drop NULL sentinel from strjoin 2016-10-23 11:43:27 -04:00
test-netlink-manual.c tree-wide: minor formatting inconsistency cleanups 2016-02-23 14:20:34 -08:00
test-ns.c core:sandbox: lets make /lib/modules/ inaccessible on ProtectKernelModules= 2016-10-12 14:11:16 +02:00
test-nss.c tree-wide: htonl() is weird, let's use htobe32() instead (#3538) 2016-06-15 01:26:01 +02:00
test-parse-util.c util-lib: unify parsing of nice level values 2016-08-05 11:18:32 +02:00
test-path-lookup.c systemctl: don't confuse sysv code with generated units 2016-04-12 13:43:32 +02:00
test-path-util.c tests: clarify test_path_startswith return value (#4508) 2016-10-30 10:21:29 -04:00
test-path.c tree-wide: drop NULL sentinel from strjoin 2016-10-23 11:43:27 -04:00
test-prioq.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-proc-cmdline.c tree-wide: make parse_proc_cmdline() strip "rd." prefix automatically 2016-10-22 16:08:55 -04:00
test-process-util.c tests: skip process 1 tests if systemd not is running 2016-07-29 14:30:46 -07:00
test-ratelimit.c tree-wide: sort includes 2015-11-16 22:09:36 +01:00
test-replace-var.c tree-wide: drop NULL sentinel from strjoin 2016-10-23 11:43:27 -04:00
test-rlimit-util.c core: make parsing of RLIMIT_NICE aware of actual nice levels 2016-04-29 16:27:49 +02:00
test-sched-prio.c tests: get rid of strerror 2016-09-13 20:10:57 -04:00
test-seccomp.c core: add new RestrictNamespaces= unit file setting 2016-11-04 07:40:13 -06:00
test-selinux.c test-selinux: use yes_no() and strnull() 2016-03-04 21:45:58 -05:00
test-set.c core: set_put never returns -EEXIST 2015-04-10 17:13:15 +02:00
test-sigbus.c test: test-sigbus must be skipped when -fsanitize=address is used 2016-08-06 02:14:51 +00:00
test-signal-util.c tests: move signal-util related tests to test-signal-util.c 2016-03-03 18:46:58 +01:00
test-siphash24.c test-siphash24: add a test for concatenating very short buffers 2016-02-20 16:34:59 -05:00
test-sizeof.c test-sizeof: add a helper which prints variable sizes and signedness 2016-03-02 10:42:27 -05:00
test-sleep.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-socket-util.c tree-wide: htonl() is weird, let's use htobe32() instead (#3538) 2016-06-15 01:26:01 +02:00
test-stat-util.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-strbuf.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-string-util.c tests: move string related tests to test-string-util.c 2016-03-03 18:46:58 +01:00
test-strip-tab-ansi.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-strv.c strv: fix STRV_FOREACH_BACKWARDS() to be a single statement only 2016-10-07 20:14:38 +02:00
test-strxcpyx.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-tables.c Merge pull request #4442 from keszybz/detect-virt-userns 2016-10-27 13:16:16 +03:00
test-terminal-util.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-time.c util-lib: make timestamp generation and parsing reversible (#3869) 2016-08-03 19:04:53 -04:00
test-tmpfiles.c fileio: simplify mkostemp_safe() (#4090) 2016-09-13 08:20:38 +02:00
test-udev.c tests: port udev-test to log_*_errno (#3015) 2016-04-11 21:31:57 +02:00
test-uid-range.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-unaligned.c util-lib: add accessors for unaligned native endian words 2016-06-06 19:59:09 +02:00
test-unit-file.c tests: make sure tests pass when invoked in "sudo" 2016-11-02 08:55:24 -06:00
test-unit-name.c core: remove ManagerRunningAs enum 2016-04-12 13:43:30 +02:00
test-user-util.c sysusers: move various user credential validity checks to src/basic/ 2016-07-22 15:53:45 +02:00
test-utf8.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-util.c core: support percentage specifications on TasksMax= 2016-07-22 15:33:12 +02:00
test-verbs.c test-verbs: add unit tests for verbs minilib 2015-01-08 15:57:38 -05:00
test-watchdog.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
test-web-util.c tests: move web-util related tests to test-web-util.c 2016-03-03 18:46:58 +01:00
test-xattr-util.c tests: move xattr-util related tests to test-xattr-util.c 2016-03-03 19:04:07 +01:00
test-xml.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00