picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
Systemd/src/core
History
Lennart Poettering d251207d55 core: add new PrivateUsers= option to service execution 
This setting adds minimal user namespacing support to a service. When set the invoked
processes will run in their own user namespace. Only a trivial mapping will be
set up: the root user/group is mapped to root, and the user/group of the
service will be mapped to itself, everything else is mapped to nobody.

If this setting is used the service runs with no capabilities on the host, but
configurable capabilities within the service.

This setting is particularly useful in conjunction with RootDirectory= as the
need to synchronize /etc/passwd and /etc/group between the host and the service
OS tree is reduced, as only three UID/GIDs need to match: root, nobody and the
user of the service itself. But even outside the RootDirectory= case this
setting is useful to substantially reduce the attack surface of a service.

Example command to test this:

        systemd-run -p PrivateUsers=1 -p User=foobar -t /bin/sh

This runs a shell as user "foobar". When typing "ps" only processes owned by
"root", by "foobar", and by "nobody" should be visible.
2016-08-03 20:42:04 +02:00
..
.gitignore Move daemon-reload from package %post scripts to file triggers 2015-11-15 18:38:37 -05:00
audit-fd.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
audit-fd.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
automount.c automount: don't cancel mount/umount request on reload/reexec (#3670) 2016-07-25 20:04:02 +02:00
automount.h automount: rework propagation between automount and mount units 2016-05-02 16:51:45 +02:00
bus-policy.c util-lib: split out allocation calls into alloc-util.[ch] 2015-10-27 13:45:53 +01:00
bus-policy.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
busname.c Ensure kdbus isn't used (#3501) 2016-06-18 17:24:23 -04:00
busname.h core: move enforcement of the start limit into per-unit-type code again 2016-05-02 13:08:00 +02:00
cgroup.c cgroup: whitelist inaccessible devices for "auto" and "closed" DevicePolicy. 2016-07-22 16:08:31 +02:00
cgroup.h core: remove duplicate includes (#3771) 2016-07-21 10:52:07 +02:00
dbus-automount.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-automount.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-busname.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-busname.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-cgroup.c core: rename MemoryLimitByPhysicalMemory transient property to MemoryLimitScale 2016-07-22 15:33:12 +02:00
dbus-cgroup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-device.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-device.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-execute.c core: add new PrivateUsers= option to service execution 2016-08-03 20:42:04 +02:00
dbus-execute.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-job.c core: don't log job status message in case job was effectively NOP (#3199) 2016-05-16 11:24:51 -04:00
dbus-job.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-kill.c tree-wide: remove newlines from unit_write_drop_in 2016-05-28 16:29:42 -04:00
dbus-kill.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-manager.c core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
dbus-manager.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-mount.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-mount.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-path.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-path.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-scope.c core: make sure RequestStop signal is send directed 2016-07-20 14:35:15 +02:00
dbus-scope.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-service.c tree-wide: remove newlines from unit_write_drop_in 2016-05-28 16:29:42 -04:00
dbus-service.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-slice.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-slice.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-socket.c socket: add support to control no. of connections from one source (#3607) 2016-08-02 13:48:23 -04:00
dbus-socket.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-swap.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-swap.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-target.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-target.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-timer.c tree-wide: remove newlines from unit_write_drop_in 2016-05-28 16:29:42 -04:00
dbus-timer.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dbus-unit.c tree-wide: remove newlines from unit_write_drop_in 2016-05-28 16:29:42 -04:00
dbus-unit.h core,systemctl: add bus API to retrieve processes of a unit 2016-04-22 16:06:20 +02:00
dbus.c tree-wide: introduce new SOCKADDR_UN_LEN() macro, and use it everywhere 2016-05-05 22:24:36 +02:00
dbus.h core: use an AF_UNIX/SOCK_DGRAM socket for cgroup agent notification 2016-05-05 12:37:04 +02:00
device.c Move no_instances information to shared/ 2016-05-01 19:58:59 -04:00
device.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
dynamic-user.c core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
dynamic-user.h core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
execute.c core: add new PrivateUsers= option to service execution 2016-08-03 20:42:04 +02:00
execute.h core: add new PrivateUsers= option to service execution 2016-08-03 20:42:04 +02:00
failure-action.c core: rework reboot parameter logic a bit 2016-04-12 13:43:32 +02:00
failure-action.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
hostname-setup.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
hostname-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
ima-setup.c tree-wide: use mdash instead of a two minuses 2016-04-21 23:00:13 -04:00
ima-setup.h tree-wide: use mdash instead of a two minuses 2016-04-21 23:00:13 -04:00
job.c core: don't log job status message in case job was effectively NOP (#3199) 2016-05-16 11:24:51 -04:00
job.h core: don't log job status message in case job was effectively NOP (#3199) 2016-05-16 11:24:51 -04:00
kill.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
kill.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
killall.c shutdown: use 90s SIGKILL timeout 2016-07-12 17:32:30 +02:00
killall.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
kmod-setup.c Ensure kdbus isn't used (#3501) 2016-06-18 17:24:23 -04:00
kmod-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
load-dropin.c core: don't drop transient drop-ins when loading the rest 2016-04-12 13:43:31 +02:00
load-dropin.h core: rework generator dir logic, move the dirs into LookupPaths structure 2016-04-12 13:43:29 +02:00
load-fragment-gperf.gperf.m4 core: add new PrivateUsers= option to service execution 2016-08-03 20:42:04 +02:00
load-fragment.c Merge pull request #3728 from poettering/dynamic-users 2016-07-25 16:40:26 -04:00
load-fragment.h core: be stricter when parsing User=/Group= fields 2016-07-22 15:53:45 +02:00
locale-setup.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
locale-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
loopback-setup.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
loopback-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
machine-id-setup.c core: rework machine-id-setup.c to use the calls from id128-util.[ch] 2016-07-22 12:59:36 +02:00
machine-id-setup.h core: rework machine-id-setup.c to use the calls from id128-util.[ch] 2016-07-22 12:59:36 +02:00
macros.systemd.in macros.systemd.in: add %systemd_ordering (#3776) 2016-07-22 09:33:13 -04:00
main.c main: load Smack policy before IMA policy (#3859) 2016-08-02 08:58:30 -04:00
Makefile build-sys: add stub makefiles to make emacs easier to use 2012-04-12 13:35:56 +02:00
manager.c Merge pull request #3728 from poettering/dynamic-users 2016-07-25 16:40:26 -04:00
manager.h core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
mount-setup.c namespace: unify limit behavior on non-directory paths 2016-07-19 17:22:02 +02:00
mount-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
mount.c core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
mount.h core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
namespace.c Merge pull request #3764 from poettering/assorted-stuff-2 2016-07-22 09:10:04 +02:00
namespace.h doc,core: Read{Write,Only}Paths= and InaccessiblePaths= 2016-07-19 17:22:02 +02:00
org.freedesktop.systemd1.conf core: added ListUnitsByNames dbus method (#3182) 2016-05-12 18:58:59 +02:00
org.freedesktop.systemd1.policy.in.in core: rework policykit hookup 2015-02-18 18:56:27 +01:00
org.freedesktop.systemd1.service move more main systemd parts to core/ 2012-04-12 14:24:40 +02:00
path.c core: move enforcement of the start limit into per-unit-type code again 2016-05-02 13:08:00 +02:00
path.h core: move enforcement of the start limit into per-unit-type code again 2016-05-02 13:08:00 +02:00
scope.c core: when a scope was abandoned, always log about processes we kill 2016-07-20 14:35:15 +02:00
scope.h Merge pull request #3762 from poettering/sigkill-log 2016-07-22 09:18:30 +02:00
selinux-access.c tree-wide: get rid of selinux_context_t (#3732) 2016-07-15 18:44:02 +02:00
selinux-access.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
selinux-setup.c tree-wide: get rid of selinux_context_t (#3732) 2016-07-15 18:44:02 +02:00
selinux-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
service.c socket: add support to control no. of connections from one source (#3607) 2016-08-02 13:48:23 -04:00
service.h socket: add support to control no. of connections from one source (#3607) 2016-08-02 13:48:23 -04:00
show-status.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
show-status.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
shutdown.c shutdown: already sync IO before we enter the final killing spree 2016-07-12 17:38:19 +02:00
slice.c Move no_instances information to shared/ 2016-05-01 19:58:59 -04:00
slice.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
smack-setup.c tree-wide: indentation fixes 2016-02-26 22:23:38 +01:00
smack-setup.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
socket.c socket: add support to control no. of connections from one source (#3607) 2016-08-02 13:48:23 -04:00
socket.h socket: add support to control no. of connections from one source (#3607) 2016-08-02 13:48:23 -04:00
swap.c core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
swap.h core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
system.conf core: change TasksMax= default for system services to 15% 2016-07-22 15:33:13 +02:00
systemd.pc.in build-sys: move systemd.pc from pkgconfiglibdir back into pkgconfigdatadir 2015-04-21 20:35:17 +02:00
target.c tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
target.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
timer.c core: move enforcement of the start limit into per-unit-type code again 2016-05-02 13:08:00 +02:00
timer.h core: move enforcement of the start limit into per-unit-type code again 2016-05-02 13:08:00 +02:00
transaction.c transaction: don't cancel jobs for units with IgnoreOnIsolate=true (#3671) 2016-07-25 20:02:55 +02:00
transaction.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
triggers.systemd.in rpm triggers: add note about minimum supported version 2016-04-02 11:35:07 -04:00
umount.c core/mount: Don't unmount initramfs mounts 2016-03-04 15:16:34 +00:00
umount.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
unit-printf.c core: reuse manager_get_runtime_prefix() at more places 2016-04-12 13:43:30 +02:00
unit-printf.h tree-wide: remove Emacs lines from all files 2016-02-10 13:41:57 +01:00
unit.c core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
unit.h core: add a concept of "dynamic" user ids, that are allocated as long as a service is running 2016-07-22 15:53:45 +02:00
user.conf core: rename StartLimitInterval= to StartLimitIntervalSec= 2016-04-29 16:27:48 +02:00