Merge pull request #6735 from yuwata/multiple-capability-lines

core: update man and test to support multiple CapabilityBoundingSet= lines

diff --git a/man/systemd.service.xml b/man/systemd.service.xml
index 9863532692fca2e65cdbdc596b54e5d8de14dc36..c6fa0edea0a89c6b38e9f7757fcc7c66330ad2f9 100644 (file)
--- a/man/systemd.service.xml
+++ b/man/systemd.service.xml
@@ -330,7 +330,7 @@
               <row>
                 <entry><literal>!!</literal></entry>
 
-                <entry>This prefix is very similar to <literal>!!</literal>, however it only has an effect on systems lacking support for ambient process capabilities, i.e. without support for <varname>AmbientCapabilities=</varname>. It's intended to be used for unit files that take benefit of ambient capabilities to run processes with minimal privileges wherever possible while remaining compatible with systems that lack ambient capabilities support. Note that when <literal>!!</literal> is used, and a system lacking ambient capability support is detected any configured <varname>SystemCallFilter=</varname> and <varname>CapabilityBoundingSet=</varname> stanzas are implicitly modified, in order to permit spawned processes to drop credentials and capabilites themselves, even if this is configured to not be allowed. Moreover, if this prefix is used and a system lacking ambient capability support is detected <varname>AmbientCapabilities=</varname> will be skipped and not be applied. On systems supporting ambient capabilities, <literal>!!</literal> has no effect and is redundant.</entry>
+                <entry>This prefix is very similar to <literal>!!</literal>, however it only has an effect on systems lacking support for ambient process capabilities, i.e. without support for <varname>AmbientCapabilities=</varname>. It's intended to be used for unit files that take benefit of ambient capabilities to run processes with minimal privileges wherever possible while remaining compatible with systems that lack ambient capabilities support. Note that when <literal>!!</literal> is used, and a system lacking ambient capability support is detected any configured <varname>SystemCallFilter=</varname> and <varname>CapabilityBoundingSet=</varname> stanzas are implicitly modified, in order to permit spawned processes to drop credentials and capabilities themselves, even if this is configured to not be allowed. Moreover, if this prefix is used and a system lacking ambient capability support is detected <varname>AmbientCapabilities=</varname> will be skipped and not be applied. On systems supporting ambient capabilities, <literal>!!</literal> has no effect and is redundant.</entry>
               </row>
             </tbody>
           </tgroup>
@@ -338,7 +338,7 @@
 
         <para><literal>@</literal>, <literal>-</literal>, and one of
         <literal>+</literal>/<literal>!</literal>/<literal>!!</literal> may be used together and they can appear in any
-        order. However, only one of <literal>+</literal>, <literal>!</literal>, <literal>!!</literal> may be used a at
+        order. However, only one of <literal>+</literal>, <literal>!</literal>, <literal>!!</literal> may be used at a
         time. Note that these prefixes are also supported for the other command line settings,
         i.e. <varname>ExecStartPre=</varname>, <varname>ExecStartPost=</varname>, <varname>ExecReload</varname>,
         <varname>ExecStop=</varname> and <varname>ExecStopPost=</varname>.</para>

diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
index 5e1163c6a74aa341dc5171306aa170db8e9e0b7e..fdedeffb9aaabf09dc0583b3b18cae3b6e922713 100644 (file)
--- a/src/basic/fs-util.c
+++ b/src/basic/fs-util.c
@@ -23,6 +23,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
+#include <linux/magic.h>
 #include <time.h>
 #include <unistd.h>
 
@@ -721,6 +722,9 @@ int chase_symlinks(const char *path, const char *original_root, unsigned flags,
 
                 if (fstat(child, &st) < 0)
                         return -errno;
+                if ((flags & CHASE_NO_AUTOFS) &&
+                    fd_check_fstype(child, AUTOFS_SUPER_MAGIC) > 0)
+                        return -EREMOTE;
 
                 if (S_ISLNK(st.st_mode)) {
                         char *joined;

diff --git a/src/basic/fs-util.h b/src/basic/fs-util.h
index 094acf179963ec1da3449fb7d5117fee67198e3e..d3342d5cdaadff288c4911c2e214a15ca96d395a 100644 (file)
--- a/src/basic/fs-util.h
+++ b/src/basic/fs-util.h
@@ -81,6 +81,7 @@ int inotify_add_watch_fd(int fd, int what, uint32_t mask);
 enum {
         CHASE_PREFIX_ROOT = 1,   /* If set, the specified path will be prefixed by the specified root before beginning the iteration */
         CHASE_NONEXISTENT = 2,   /* If set, it's OK if the path doesn't actually exist. */
+        CHASE_NO_AUTOFS = 4,     /* If set, return -EREMOTE if autofs mount point found */
 };
 
 int chase_symlinks(const char *path_with_prefix, const char *root, unsigned flags, char **ret);

diff --git a/src/core/service.c b/src/core/service.c
index 004e2a735816b0966aa934bef1724411882da4b8..c9a7222cc641ace38611295c19ec60bb8bceb730 100644 (file)
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -2305,7 +2305,7 @@ static int service_serialize(Unit *u, FILE *f, FDSet *fds) {
         unit_serialize_item(u, f, "bus-name-owner", s->bus_name_owner);
 
         unit_serialize_item_format(u, f, "n-restarts", "%u", s->n_restarts);
-        unit_serialize_item(u, f, "n-restarts", yes_no(s->flush_n_restarts));
+        unit_serialize_item(u, f, "flush-n-restarts", yes_no(s->flush_n_restarts));
 
         r = unit_serialize_item_escaped(u, f, "status-text", s->status_text);
         if (r < 0)

diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c
index 29eb2b17d4ea912ffb8668f4e5bafb8bc284a8da..0857f5907ed513df4136d4f3df5df0434b00ab71 100644 (file)
--- a/src/shared/seccomp-util.c
+++ b/src/shared/seccomp-util.c
@@ -403,6 +403,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "stat64\0"
                 "stat\0"
                 "statfs\0"
+                "statx\0"
                 "symlink\0"
                 "symlinkat\0"
                 "truncate64\0"

diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index 8f960cc0edb8ed7e113fed49a226a1fea041d75f..875a886bf3de9cbe92ca2bf060c09c3e4674e87b 100644 (file)
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -1664,6 +1664,9 @@ static int process_item(Item *i) {
                 }
         }
 
+        if (chase_symlinks(i->path, NULL, CHASE_NO_AUTOFS, NULL) == -EREMOTE)
+                return t;
+
         r = arg_create ? create_item(i) : 0;
         q = arg_remove ? remove_item(i) : 0;
         p = arg_clean ? clean_item(i) : 0;