Luca Boccassi f2af682cd6 man: note that cgroup-based sandboxing is not bypassed by '+' ...

DeviceAllow= and others are applied to the whole cgroup via bpf, so
using '+' on an Exec line will not bypass them. Explain this in the
manpage.

Fixes https://github.com/systemd/systemd/issues/26035

2023-01-18 17:59:43 +00:00

70 KiB

Raw Blame History

View Raw