picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Systemd/src
History
Alessandro Puccetti cf677fe686 core/execute: add the magic character '!' to allow privileged execution (#3493) 
This patch implements the new magic character '!'. By putting '!' in front
of a command, systemd executes it with full privileges ignoring paramters
such as User, Group, SupplementaryGroups, CapabilityBoundingSet,
AmbientCapabilities, SecureBits, SystemCallFilter, SELinuxContext,
AppArmorProfile, SmackProcessLabel, and RestrictAddressFamilies.

Fixes partially https://github.com/systemd/systemd/issues/3414
Related to https://github.com/coreos/rkt/issues/2482

Testing:
1. Create a user 'bob'
2. Create the unit file /etc/systemd/system/exec-perm.service
   (You can use the example below)
3. sudo systemctl start ext-perm.service
4. Verify that the commands starting with '!' were not executed as bob,
   4.1 Looking to the output of ls -l /tmp/exec-perm
   4.2 Each file contains the result of the id command.

`````````````````````````````````````````````````````````````````
[Unit]
Description=ext-perm

[Service]
Type=oneshot
TimeoutStartSec=0
User=bob
ExecStartPre=!/usr/bin/sh -c "/usr/bin/rm /tmp/exec-perm*" ;
    /usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start-pre"
ExecStart=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start" ;
    !/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-star-2"
ExecStartPost=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-start-post"
ExecReload=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-reload"
ExecStop=!/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-stop"
ExecStopPost=/usr/bin/sh -c "/usr/bin/id > /tmp/exec-perm-stop-post"

[Install]
WantedBy=multi-user.target]
`````````````````````````````````````````````````````````````````
 		2016-06-10 18:19:54 +02:00
..
ac-power tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
activate activate: improve SIGCHLD handler 2016-04-05 14:34:04 +00:00
analyze tree-wide: use ansi_highlight() instead of ANSI_HIGHLIGHT where appropriate 2016-05-30 18:22:16 +02:00
ask-password ask-password: add option --no-output to not print password to stdout 2016-03-01 19:02:11 +01:00
backlight tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
basic networkd: add support to configure VLAN on bridge ports 2016-06-10 09:10:41 +02:00
binfmt tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
boot tree-wide: rename draw_special_char to special_glyph 2016-05-09 15:17:57 -04:00
cgls shared: drop kernel_thread bool from cgroups show code 2016-04-22 16:06:20 +02:00
cgroups-agent tree-wide: introduce new SOCKADDR_UN_LEN() macro, and use it everywhere 2016-05-05 22:24:36 +02:00
cgtop cgtop: minimize aux variable scope 2016-06-06 22:04:33 +02:00
core core/execute: add the magic character '!' to allow privileged execution (#3493) 2016-06-10 18:19:54 +02:00
coredump coredump: use next_datagram_size_fd instead of ioctl(FIONREAD) (#3237) 2016-05-11 14:29:24 +02:00
cryptsetup cryptsetup: do not 'fail' if trying to detach a nonexistent device 2016-04-01 20:51:20 +02:00
dbus1-generator tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
debug-generator tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
delta tree-wide: rename draw_special_char to special_glyph 2016-05-09 15:17:57 -04:00
detect-virt tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
escape tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
firstboot tree-wide: rename draw_special_char to special_glyph 2016-05-09 15:17:57 -04:00
fsck tree-wide: introduce new SOCKADDR_UN_LEN() macro, and use it everywhere 2016-05-05 22:24:36 +02:00
fstab-generator fstab-generator: don't process root= if it happens to be "gpt-auto" (#3452) 2016-06-07 10:23:20 +02:00
getty-generator tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
gpt-auto-generator Create initrd-root-device.target synchronization point (#3239) 2016-05-12 18:42:39 +02:00
hibernate-resume tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
hostname util-lib: make localed's nonempty() generic, rename it to empty_to_null() and make use of it everywhere 2016-05-30 17:59:43 +02:00
hwdb hwdb: selinuxify a bit (#3460) 2016-06-07 19:47:41 +02:00
import tree-wide: introduce new SOCKADDR_UN_LEN() macro, and use it everywhere 2016-05-05 22:24:36 +02:00
initctl tree-wide: make ++/-- usage consistent WRT spacing 2016-02-22 20:32:04 -08:00
journal tree-wide: check colors_enabled() before outputting ANSI color strings 2016-05-30 18:23:08 +02:00
journal-remote journal-remote : Ensure reallocation of source->buf does not result in source->size < source->filled (#3086) 2016-04-22 14:04:17 -04:00
kernel-install
…
libsystemd Merge pull request #3431 from poettering/network-fixes 2016-06-08 23:10:16 +02:00
libsystemd-network network: beef up ipv6 RA support considerably 2016-06-06 20:11:38 +02:00
libudev include sys/sysmacros.h in more places 2016-03-14 23:29:10 -04:00
locale util-lib: make localed's nonempty() generic, rename it to empty_to_null() and make use of it everywhere 2016-05-30 17:59:43 +02:00
login logind: minor cleanup and use IN_SET() in manager_handle_action() 2016-06-08 18:18:50 +02:00
machine machinectl: Added stop as alias for poweroff (#3406) 2016-06-06 17:06:20 +02:00
machine-id-setup tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
modules-load tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
network Merge pull request #3428 from toanju/networkd/brvlan 2016-06-10 13:04:44 +02:00
notify tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
nspawn nspawn: introduce --notify-ready=[no|yes] (#3474) 2016-06-10 13:09:06 +02:00
nss-myhostname nss-myhostname: remove dead test of variable that was not set 2016-04-05 23:19:56 -04:00
nss-mymachines tree-wide: make ++/-- usage consistent WRT spacing 2016-02-22 20:32:04 -08:00
nss-resolve Move nss typedefs into nss-util.h 2016-04-02 20:11:41 -04:00
path tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
quotacheck tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
random-seed tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
rc-local-generator tree-wide: make more global variables static 2016-02-13 12:28:28 +01:00
remount-fs tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
reply-password tree-wide: introduce new SOCKADDR_UN_LEN() macro, and use it everywhere 2016-05-05 22:24:36 +02:00
resolve resolved: also rewrite private /etc/resolv.conf when configuration is changed via bus calls 2016-06-06 19:17:38 +02:00
rfkill tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
run run: do not try to use reply after freeing it (#3318) 2016-05-21 18:30:33 -04:00
shared networkd: clean up vlan handling a bit (#3478) 2016-06-09 18:55:16 +02:00
sleep tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
socket-proxy tree-wide: introduce new SOCKADDR_UN_LEN() macro, and use it everywhere 2016-05-05 22:24:36 +02:00
stdio-bridge stdio-bridge: Correctly propagate error 2016-02-29 10:45:34 +01:00
sysctl tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
system-update-generator tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
systemctl systemctl: install sigbus handler (#3435) 2016-06-04 19:24:20 -04:00
systemd Merge pull request #3431 from poettering/network-fixes 2016-06-08 23:10:16 +02:00
sysusers selinux: always try to load the full selinux db 2016-03-01 20:39:30 -05:00
sysv-generator sysv-generator: remove more dead code (#3462) 2016-06-08 10:18:56 +02:00
test Merge pull request #3432 from poettering/resolved-ll-ipv6 2016-06-09 10:18:07 +02:00
timedate tree-wide: use ansi_highlight() instead of ANSI_HIGHLIGHT where appropriate 2016-05-30 18:22:16 +02:00
timesync clock-util: make clock_is_localtime() testable and add initial tests 2016-02-26 11:28:49 +01:00
tmpfiles Fix FS_EXTENT_FL description (#3381) 2016-05-29 11:31:14 -04:00
tty-ask-password-agent ask-password: ask for passphrases not only on the first console of /dev/console 2016-05-24 11:57:27 +02:00
udev udev-builtin-blkid: fix GPT_FLAG_NO_AUTO check for ESP (#3450) 2016-06-09 10:51:20 +02:00
update-done selinux: always try to load the full selinux db 2016-03-01 20:39:30 -05:00
update-utmp tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
user-sessions selinux: always try to load the full selinux db 2016-03-01 20:39:30 -05:00
vconsole vconsole: add log_oom() where appropriate 2016-05-17 10:29:28 +02:00
.gitignore
…
Makefile
…