update TODO

diff --git a/TODO b/TODO
index cabba100a521ad08eee4af7a93dab0d0c2bb04cb..9488cd475e8a79ebea637512ce7d875a1bcbd49b 100644 (file)
--- a/TODO
+++ b/TODO
@@ -24,6 +24,15 @@ Janitorial Clean-ups:
 
 Features:
 
+* fix logging in execute.c: extend log.c to have an optional mode where
+  log_open() is implicitly done before each log line and log_close() right
+  after. This way we don't have open fds around but logs will still
+  work. Because it is slow this mode should used exclusively in the execute.c
+  case.
+
+* set IPAddressDeny=any on all services that shouldn't do networking (possibly
+  combined with IPAddressAllow=localhost).
+
 * dissect: when we discover squashfs, don't claim we had a "writable" partition
   in systemd-dissect