morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 08:25:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

core: add 'DefaultRestrictSUIDSGID' config option

Browse Source 
closes #37602

On typical systems, only few services need to create SUID/SGID files.
This often is limited to the user explicitly setting suid/sgid, the
`systemd-tmpfiles*` services, and the package manager. Allowing a default
to globally restrict creation of suid/sgid files makes it easier to apply
this restriction precisely.
This commit is contained in:
Grimmauld
2025-07-08 21:21:25 +02:00
parent fd3b207011
commit 30bbdf0771
6 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/core/main.c
View File

@@ -773,6 +773,7 @@ static int parse_config_file(void) {
{ "Manager", "DefaultStartLimitInterval", config_parse_sec, 0, &arg_defaults.start_limit.interval}, /* obsolete alias */
{ "Manager", "DefaultStartLimitIntervalSec", config_parse_sec, 0, &arg_defaults.start_limit.interval},
{ "Manager", "DefaultStartLimitBurst", config_parse_unsigned, 0, &arg_defaults.start_limit.burst },
{ "Manager", "DefaultRestrictSUIDSGID", config_parse_bool, 0, &arg_defaults.restrict_suid_sgid },
{ "Manager", "DefaultEnvironment", config_parse_environ, arg_runtime_scope, &arg_default_environment },
{ "Manager", "ManagerEnvironment", config_parse_environ, arg_runtime_scope, &arg_manager_environment },
{ "Manager", "DefaultLimitCPU", config_parse_rlimit, RLIMIT_CPU, arg_defaults.rlimit },

2
src/core/manager.c
View File

@@ -4259,6 +4259,8 @@ int manager_set_unit_defaults(Manager *m, const UnitDefaults *defaults) {
m->defaults.timeout_abort_set = defaults->timeout_abort_set;
m->defaults.device_timeout_usec = defaults->device_timeout_usec;
m->defaults.restrict_suid_sgid = defaults->restrict_suid_sgid;
m->defaults.start_limit = defaults->start_limit;
m->defaults.memory_accounting = defaults->memory_accounting;

2
src/core/manager.h
View File

@@ -141,6 +141,8 @@ typedef struct UnitDefaults {
CGroupTasksMax tasks_max;
usec_t timer_accuracy_usec;
bool restrict_suid_sgid;
OOMPolicy oom_policy;
int oom_score_adjust;
bool oom_score_adjust_set;

1
src/core/system.conf.in
View File

@@ -79,5 +79,6 @@
#DefaultMemoryPressureWatch=auto
#DefaultOOMPolicy=stop
#DefaultSmackProcessLabel=
#DefaultRestrictSUIDSGID=
#ReloadLimitIntervalSec=
#ReloadLimitBurst=

2
src/core/unit.c
View File

@@ -191,6 +191,8 @@ static void unit_init(Unit *u) {
ec->oom_score_adjust_set = true;
}
ec->restrict_suid_sgid = u->manager->defaults.restrict_suid_sgid;
if (MANAGER_IS_SYSTEM(u->manager))
ec->keyring_mode = EXEC_KEYRING_SHARED;
else {

1
src/core/user.conf.in
View File

@@ -55,5 +55,6 @@
#DefaultMemoryPressureThresholdSec=200ms
#DefaultMemoryPressureWatch=auto
#DefaultSmackProcessLabel=
#DefaultRestrictSUIDSGID=
#ReloadLimitIntervalSec=
#ReloadLimitBurst