Files
systemd/man
Iago López Galeiras 24832d10b6 core: allow using seccomp without no_new_privs when unprivileged
Until now, using any form of seccomp while being unprivileged (User=)
resulted in systemd enabling no_new_privs.

There's no need for doing this because:

* We trust the filters we apply
* If User= is set and a process wants to apply a new seccomp filter, it
will need to set no_new_privs itself

An example of application that might want seccomp + !no_new_privs is a
program that wants to run as an unprivileged user but uses file
capabilities to start a web server on a privileged port while
benefitting from a restrictive seccomp profile.

We now keep the privileges needed to do seccomp before calling
enforce_user() and drop them after the seccomp filters are applied.

If the syscall filter doesn't allow the needed syscalls to drop the
privileges, we keep the previous behavior by enabling no_new_privs.
2023-11-07 11:31:53 +01:00
..
2023-11-06 16:35:31 +00:00
2023-10-06 11:49:38 +02:00
2023-08-29 14:07:24 +01:00
2023-09-19 00:37:37 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-05-15 22:53:22 +02:00
2023-09-19 00:37:37 +01:00
2023-09-19 00:37:37 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-09-19 00:37:37 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-07-02 11:10:12 +01:00
2023-05-15 22:53:22 +02:00
2023-05-15 22:53:22 +02:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-10-24 18:32:17 +02:00
2023-08-29 14:07:24 +01:00
2023-10-24 18:32:18 +02:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-11-03 11:24:58 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-11-06 18:50:30 +00:00
2023-11-03 11:24:58 +01:00
2023-08-29 14:07:24 +01:00
2023-10-24 18:32:18 +02:00
2023-08-29 14:07:24 +01:00
2023-10-24 18:32:17 +02:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-11-04 11:58:12 +09:00
2023-08-29 14:07:24 +01:00
2023-08-29 14:07:24 +01:00
2023-09-19 00:37:37 +01:00
2023-09-19 00:37:37 +01:00
2023-08-29 14:07:24 +01:00
2023-09-19 00:37:37 +01:00
2023-11-06 20:16:34 +01:00
2023-09-19 00:37:37 +01:00
2023-10-07 15:48:22 +09:00
2023-08-29 14:07:24 +01:00
2023-09-19 00:37:37 +01:00
2023-08-29 14:07:24 +01:00