dasharo/systemd
0
0
Fork 0
mirror of https://github.com/Dasharo/systemd.git synced 2026-03-06 15:02:31 -08:00
Code Issues Packages Projects Releases Wiki Activity

namespace: protect bpf file system as part of ProtectKernelTunables=

Browse Source 
It also exposes kernel objects, let's better include this in
ProtectKernelTunables=.
This commit is contained in:
Lennart Poettering
2018-02-16 16:24:19 +01:00
parent 6590080851
commit 13a141f046
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/core/namespace.c
View File

@@ -106,6 +106,7 @@ static const MountEntry protect_kernel_tunables_table[] = {
{ "/sys", READONLY, false },
{ "/sys/kernel/debug", READONLY, true },
{ "/sys/kernel/tracing", READONLY, true },
{ "/sys/fs/bpf", READONLY, true },
{ "/sys/fs/cgroup", READWRITE, false }, /* READONLY is set by ProtectControlGroups= option */
{ "/sys/fs/selinux", READWRITE, true },
};