morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

core: add 'DefaultRestrictSUIDSGID' config option (#38126)

Browse Source 
closes #37602, see there for extra motivation and considered
alternatives.

On typical systems, only few services need to create SUID/SGID files.
This often is limited to the user explicitly setting suid/sgid, the
`systemd-tmpfiles*` services, and the package manager. Allowing a
default to globally restrict creation of suid/sgid files makes it easier
to apply this restriction precisely.

## testing done
- built on aarch64-linux and x86_64-linux
- ran a VM test on x86_64-linux, checking for:
    - VM system boots successfully
    - defaults apply (both `yes`, `no`, and undefined)
    - systemd tmpfiles can set suid/sgid on journal log path
- Other services explicitly defining `RestrictSUIDSGID=no` can create
suid files
This commit is contained in:
Yu Watanabe
2025-07-10 13:30:07 +09:00
committed by GitHub
parent 6e619d6c8d 0316fb8219
commit 1cf5b39d64
13 changed files with 38 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
man/org.freedesktop.systemd1.xml
View File

@@ -557,6 +557,8 @@ node /org/freedesktop/systemd1 {
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
readonly i DefaultOOMScoreAdjust = ...;
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
readonly b DefaultRestrictSUIDSGID = ...;
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
readonly s CtrlAltDelBurstAction = '...';
@org.freedesktop.DBus.Property.EmitsChangedSignal("const")
readonly u SoftRebootsCount = ...;
@@ -793,6 +795,8 @@ node /org/freedesktop/systemd1 {
<!--property DefaultOOMScoreAdjust is not documented!-->
<!--property DefaultRestrictSUIDSGID is not documented!-->
<!--property CtrlAltDelBurstAction is not documented!-->
<!--Autogenerated cross-references for systemd.directives, do not edit-->
@@ -1237,6 +1241,8 @@ node /org/freedesktop/systemd1 {
<variablelist class="dbus-property" generated="True" extra-ref="DefaultOOMScoreAdjust"/>
<variablelist class="dbus-property" generated="True" extra-ref="DefaultRestrictSUIDSGID"/>
<variablelist class="dbus-property" generated="True" extra-ref="CtrlAltDelBurstAction"/>
<variablelist class="dbus-property" generated="True" extra-ref="SoftRebootsCount"/>
@@ -12366,7 +12372,8 @@ $ gdbus introspect --system --dest org.freedesktop.systemd1 \
<para><varname>ShutdownStartTimestamp</varname>,
<varname>ShutdownStartTimestampMonotonic</varname>, and
<varname>SoftRebootsCount</varname> were added in version 256.</para>
<para><function>RemoveSubgroupFromUnit()</function>, and
<para><varname>DefaultRestrictSUIDSGID</varname>,
<function>RemoveSubgroupFromUnit()</function>, and
<function>KillUnitSubgroup()</function> were added in version 258.</para>
</refsect2>
<refsect2>

11
man/systemd-system.conf.xml
View File

@@ -547,6 +547,17 @@
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>DefaultRestrictSUIDSGID=</varname></term>
<listitem><para>Takes a boolean argument. This is used as a default for units
which lack an explicit definition for <varname>RestrictSUIDSGID=</varname>.
See <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for the details.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
</variablelist>
</refsect1>

6
man/systemd.exec.xml
View File

@@ -2690,7 +2690,11 @@ RestrictNamespaces=~cgroup net</programlisting>
programs that actually require them. Note that this restricts marking of any type of file system
object with these bits, including both regular files and directories (where the SGID is a different
meaning than for files, see documentation). This option is implied if <varname>DynamicUser=</varname>
is enabled. Defaults to off.</para>
is enabled.</para>
<para>In other cases, this setting defaults to the value set with <varname>DefaultRestrictSUIDSGID=</varname> in
<citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, which
defaults to off.</para>
<xi:include href="version-info.xml" xpointer="v242"/></listitem>
</varlistentry>

1
src/core/dbus-manager.c
View File

@@ -2938,6 +2938,7 @@ const sd_bus_vtable bus_manager_vtable[] = {
SD_BUS_PROPERTY("TimerSlackNSec", "t", property_get_timer_slack_nsec, 0, SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("DefaultOOMPolicy", "s", bus_property_get_oom_policy, offsetof(Manager, defaults.oom_policy), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("DefaultOOMScoreAdjust", "i", property_get_oom_score_adjust, 0, SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("DefaultRestrictSUIDSGID", "b", bus_property_get_bool, offsetof(Manager, defaults.restrict_suid_sgid), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("CtrlAltDelBurstAction", "s", bus_property_get_emergency_action, offsetof(Manager, cad_burst_action), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("SoftRebootsCount", "u", bus_property_get_unsigned, offsetof(Manager, soft_reboots_count), SD_BUS_VTABLE_PROPERTY_CONST),

1
src/core/main.c
View File

@@ -773,6 +773,7 @@ static int parse_config_file(void) {
{ "Manager", "DefaultStartLimitInterval", config_parse_sec, 0, &arg_defaults.start_limit.interval}, /* obsolete alias */
{ "Manager", "DefaultStartLimitIntervalSec", config_parse_sec, 0, &arg_defaults.start_limit.interval},
{ "Manager", "DefaultStartLimitBurst", config_parse_unsigned, 0, &arg_defaults.start_limit.burst },
{ "Manager", "DefaultRestrictSUIDSGID", config_parse_bool, 0, &arg_defaults.restrict_suid_sgid },
{ "Manager", "DefaultEnvironment", config_parse_environ, arg_runtime_scope, &arg_default_environment },
{ "Manager", "ManagerEnvironment", config_parse_environ, arg_runtime_scope, &arg_manager_environment },
{ "Manager", "DefaultLimitCPU", config_parse_rlimit, RLIMIT_CPU, arg_defaults.rlimit },

2
src/core/manager.c
View File

@@ -4259,6 +4259,8 @@ int manager_set_unit_defaults(Manager *m, const UnitDefaults *defaults) {
m->defaults.timeout_abort_set = defaults->timeout_abort_set;
m->defaults.device_timeout_usec = defaults->device_timeout_usec;
m->defaults.restrict_suid_sgid = defaults->restrict_suid_sgid;
m->defaults.start_limit = defaults->start_limit;
m->defaults.memory_accounting = defaults->memory_accounting;

2
src/core/manager.h
View File

@@ -141,6 +141,8 @@ typedef struct UnitDefaults {
CGroupTasksMax tasks_max;
usec_t timer_accuracy_usec;
bool restrict_suid_sgid;
OOMPolicy oom_policy;
int oom_score_adjust;
bool oom_score_adjust_set;

1
src/core/system.conf.in
View File

@@ -79,5 +79,6 @@
#DefaultMemoryPressureWatch=auto
#DefaultOOMPolicy=stop
#DefaultSmackProcessLabel=
#DefaultRestrictSUIDSGID=
#ReloadLimitIntervalSec=
#ReloadLimitBurst=

2
src/core/unit.c
View File

@@ -191,6 +191,8 @@ static void unit_init(Unit *u) {
ec->oom_score_adjust_set = true;
}
ec->restrict_suid_sgid = u->manager->defaults.restrict_suid_sgid;
if (MANAGER_IS_SYSTEM(u->manager))
ec->keyring_mode = EXEC_KEYRING_SHARED;
else {

1
src/core/user.conf.in
View File

@@ -55,5 +55,6 @@
#DefaultMemoryPressureThresholdSec=200ms
#DefaultMemoryPressureWatch=auto
#DefaultSmackProcessLabel=
#DefaultRestrictSUIDSGID=
#ReloadLimitIntervalSec=
#ReloadLimitBurst

1
src/core/varlink-manager.c
View File

@@ -76,6 +76,7 @@ static int manager_context_build_json(sd_json_variant **ret, const char *name, v
JSON_BUILD_PAIR_FINITE_USEC("TimerSlackNSec", (uint64_t) prctl(PR_GET_TIMERSLACK)),
SD_JSON_BUILD_PAIR_STRING("DefaultOOMPolicy", oom_policy_to_string(m->defaults.oom_policy)),
SD_JSON_BUILD_PAIR_INTEGER("DefaultOOMScoreAdjust", m->defaults.oom_score_adjust),
SD_JSON_BUILD_PAIR_BOOLEAN("DefaultRestrictSUIDSGID", m->defaults.restrict_suid_sgid),
SD_JSON_BUILD_PAIR_STRING("CtrlAltDelBurstAction", emergency_action_to_string(m->cad_burst_action)));
}

2
src/shared/varlink-io.systemd.Manager.c
View File

@@ -74,6 +74,8 @@ static SD_VARLINK_DEFINE_STRUCT_TYPE(
SD_VARLINK_DEFINE_FIELD(DefaultOOMPolicy, SD_VARLINK_STRING, 0),
SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultOOMScoreAdjust="),
SD_VARLINK_DEFINE_FIELD(DefaultOOMScoreAdjust, SD_VARLINK_INT, 0),
SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultRestrictSUIDSGID="),
SD_VARLINK_DEFINE_FIELD(DefaultRestrictSUIDSGID, SD_VARLINK_BOOL, 0),
SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#CtrlAltDelBurstAction="),
SD_VARLINK_DEFINE_FIELD(CtrlAltDelBurstAction, SD_VARLINK_STRING, 0));

1
units/systemd-tmpfiles-setup.service
View File

@@ -28,3 +28,4 @@ ImportCredential=login.motd
ImportCredential=login.issue
ImportCredential=network.hosts
ImportCredential=ssh.authorized_keys.root
RestrictSUIDSGID=no