Files
systemd/man
Luca Boccassi 301e7cd047 man: specify that ProtectProc= does not work with root/cap_sys_ptrace
When using hidepid=invisible on procfs, the kernel will check if the
gid of the process trying to access /proc is the same as the gid of
the process that mounted the /proc instance, or if it has the ptrace
capability:

https://github.com/torvalds/linux/blob/v5.10/fs/proc/base.c#L723
https://github.com/torvalds/linux/blob/v5.10/fs/proc/root.c#L155

Given we set up the /proc instance as root for system services,
The same restriction applies to CAP_SYS_PTRACE, if a process runs with
it then hidepid=invisible has no effect.

ProtectProc effectively can only be used with User= or DynamicUser=yes,
without CAP_SYS_PTRACE.
Update the documentation to explicitly state these limitations.

Fixes #18997
2021-03-15 16:53:16 +00:00
..
2020-11-25 09:48:17 +01:00
2021-03-02 09:48:20 +01:00
2020-12-17 20:02:32 +01:00
2020-12-17 20:02:32 +01:00
2021-03-11 19:24:53 +01:00
2020-12-16 17:21:48 +01:00
2021-02-25 05:54:11 +09:00
2021-02-25 14:55:17 +01:00
2021-01-04 11:01:17 +00:00
2021-02-21 19:20:47 +01:00
2021-01-04 11:01:17 +00:00
2020-12-18 12:59:29 +09:00
2021-01-15 10:33:28 +01:00
2021-02-04 19:17:50 +01:00
2020-11-09 13:23:58 +09:00
2020-12-17 20:02:32 +01:00
2020-12-16 17:21:48 +01:00
2020-12-17 20:02:32 +01:00