From: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com>
Date: Fri, 14 Aug 2026 09:57:17 +0000 (+0200)
Subject: shared: add new securebits (#43376)
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cbc8cb18e10fbc6d9bf17c8a23d648ff27041ddd;p=thirdparty%2Fsystemd.git

shared: add new securebits (#43376)

The securebits parsing code now recognizes 'no-cap-ambient-raise' (added
in Linux 4.3), 'exec-restrict-file', and 'exec-deny-interactive' (both
added in Linux 6.14). The '-locked' variants were added too.

The `exec-restrict-file` and `exec-deny-interactive` securebits are
particularly useful in combination with `RestrictFileSystemAccess=` to
allow developers to extend the "only execute immutable files" concept to
script interpreters. Those securebits are not documented in the
[`capabilities(7)`](https://man7.org/linux/man-pages/man7/capabilities.7.html)
manpage, only in the [Executability
check](https://docs.kernel.org/userspace-api/check_exec.html) kernel
docs.
---

cbc8cb18e10fbc6d9bf17c8a23d648ff27041ddd