its pending removal 2 years ago (also see NEWS file below). It's
finally gone now.
+ * The BlackList= settings in .network files' [DHCPv4] and
+ [IPv6AcceptRA] sections have been renamed DenyList=. The old names
+ are still understood to provide compatibility.
+
CHANGES WITH 245:
* A new tool "systemd-repart" has been added, that operates as an
of the PAM session, for example for time-limited logins.
* A new @pkey system call group is now defined to make it easier to
- whitelist memory protection syscalls for containers and services
+ allow-list memory protection syscalls for containers and services
which need to use them.
* systemd-udevd: removed the 30s timeout for killing stale workers on
* udev now provides a program (fido_id) that identifies FIDO CTAP1
("U2F")/CTAP2 security tokens based on the usage declared in their
report and descriptor and outputs suitable environment variables.
- This replaces the externally maintained whitelists of all known
+ This replaces the externally maintained allow lists of all known
security tokens that were used previously.
- * Automatically generated autosuspend udev rules for whitelisted
+ * Automatically generated autosuspend udev rules for allow-listed
devices have been imported from the Chromium OS project. This should
improve power saving with many more devices.
* systemd-networkd's DHCPv4 support now understands a new MaxAttempts=
option for configuring the maximum number of DHCP lease requests. It
- also learnt a new BlackList= option for blacklisting DHCP servers (a
+ also learnt a new BlackList= option for deny-listing DHCP servers (a
similar setting has also been added to the IPv6 RA client), as well
as a SendRelease= option for configuring whether to send a DHCP
RELEASE message when terminating.
any relevant symlinks both in /run and /etc.
* Note that all long-running system services shipped with systemd will
- now default to a system call whitelist (rather than a blacklist, as
+ now default to a system call allow list (rather than a deny list, as
before). In particular, systemd-udevd will now enforce one too. For
most cases this should be safe, however downstream distributions
which disabled sandboxing of systemd-udevd (specifically the
MountFlags= setting), might want to disable this security feature
- too, as the default whitelisting will prohibit all mount, swap,
+ too, as the default allow-listing will prohibit all mount, swap,
reboot and clock changing operations from udev rules.
* sd-boot acquired new loader configuration settings to optionally turn
* systemd-nspawn gained support for a new --system-call-filter= command
line option for adding and removing entries in the default system
call filter it applies. Moreover systemd-nspawn has been changed to
- implement a system call whitelist instead of a blacklist.
+ implement a system call allow list instead of a deny list.
* systemd-run gained support for a new --pipe command line option. If
used the STDIN/STDOUT/STDERR file descriptors passed to systemd-run
fsck's progress report to an AF_UNIX socket in the file
system.
- * udev will no longer create device symlinks for all block
- devices by default. A blacklist for excluding special block
- devices from this logic has been turned into a whitelist
- that requires picking block devices explicitly that require
- device symlinks.
+ * udev will no longer create device symlinks for all block devices by
+ default. A deny list for excluding special block devices from this
+ logic has been turned into a allow list that requires picking block
+ devices explicitly that require device symlinks.
* A new (currently still internal) API sd-device.h has been
added to libsystemd. This modernized API is supposed to
Wikipedia. We explicitly document which base applies for
each configuration option.
- * The DeviceAllow= setting in unit files now supports a syntax
- to whitelist an entire group of devices node majors at once,
- based on the /proc/devices listing. For example, with the
- string "char-pts", it is now possible to whitelist all
- current and future pseudo-TTYs at once.
+ * The DeviceAllow= setting in unit files now supports a syntax to
+ allow-list an entire group of devices node majors at once, based on
+ the /proc/devices listing. For example, with the string "char-pts",
+ it is now possible to allow-list all current and future pseudo-TTYs
+ at once.
* sd-event learned a new "post" event source. Event sources of
this type are triggered by the dispatching of any event
* journalctl gained the new "--header" switch to introspect
header data of journal files.
- * A new setting SystemCallFilters= has been added to services
- which may be used to apply blacklists or whitelists to
- system calls. This is based on SECCOMP Mode 2 of Linux 3.5.
+ * A new setting SystemCallFilters= has been added to services which may
+ be used to apply deny lists or allow lists to system calls. This is
+ based on SECCOMP Mode 2 of Linux 3.5.
* nspawn gained a new --link-journal= switch (and quicker: -j)
to link the container journal with the host. This makes it
names. An additional, common rule between both modes listed below is that empty
strings are not valid user/group names.
-Philosophically, the strict mode described below enforces a white-list of what's
-allowed and prohibits everything else, while the relaxed mode described below
-implements a blacklist of what's not allowed and permits everything else.
+Philosophically, the strict mode described below enforces an allow list of
+what's allowed and prohibits everything else, while the relaxed mode described
+below implements a deny list of what's not allowed and permits everything else.
### Strict mode
<varlistentry>
<term><option>--no-new-privileges=</option></term>
- <listitem><para>Takes a boolean argument. Specifies the value of the <constant>PR_SET_NO_NEW_PRIVS</constant>
- flag for the container payload. Defaults to off. When turned on the payload code of the container cannot
- acquire new privileges, i.e. the "setuid" file bit as well as file system capabilities will not have an effect
- anymore. See <citerefentry
- project='man-pages'><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry> for details
- about this flag. </para></listitem>
+ <listitem><para>Takes a boolean argument. Specifies the value of the
+ <constant>PR_SET_NO_NEW_PRIVS</constant> flag for the container payload. Defaults to off. When turned
+ on the payload code of the container cannot acquire new privileges, i.e. the "setuid" file bit as
+ well as file system capabilities will not have an effect anymore. See <citerefentry
+ project='man-pages'><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
+ details about this flag. </para></listitem>
</varlistentry>
<varlistentry>
- <term><option>--system-call-filter=</option></term>
-
- <listitem><para>Alter the system call filter applied to containers. Takes a space-separated list of system call
- names or group names (the latter prefixed with <literal>@</literal>, as listed by the
- <command>syscall-filter</command> command of
+ <term><option>--system-call-filter=</option></term> <listitem><para>Alter the system call filter
+ applied to containers. Takes a space-separated list of system call names or group names (the latter
+ prefixed with <literal>@</literal>, as listed by the <command>syscall-filter</command> command of
<citerefentry><refentrytitle>systemd-analyze</refentrytitle><manvolnum>1</manvolnum></citerefentry>). Passed
- system calls will be permitted. The list may optionally be prefixed by <literal>~</literal>, in which case all
- listed system calls are prohibited. If this command line option is used multiple times the configured lists are
- combined. If both a positive and a negative list (that is one system call list without and one with the
- <literal>~</literal> prefix) are configured, the negative list takes precedence over the positive list. Note
- that <command>systemd-nspawn</command> always implements a system call whitelist (as opposed to a blacklist),
- and this command line option hence adds or removes entries from the default whitelist, depending on the
- <literal>~</literal> prefix. Note that the applied system call filter is also altered implicitly if additional
- capabilities are passed using the <command>--capabilities=</command>.</para></listitem>
+ system calls will be permitted. The list may optionally be prefixed by <literal>~</literal>, in which
+ case all listed system calls are prohibited. If this command line option is used multiple times the
+ configured lists are combined. If both a positive and a negative list (that is one system call list
+ without and one with the <literal>~</literal> prefix) are configured, the negative list takes
+ precedence over the positive list. Note that <command>systemd-nspawn</command> always implements a
+ system call allow list (as opposed to a deny list!), and this command line option hence adds or
+ removes entries from the default allow list, depending on the <literal>~</literal> prefix. Note that
+ the applied system call filter is also altered implicitly if additional capabilities are passed using
+ the <command>--capabilities=</command>.</para></listitem>
</varlistentry>
<varlistentry>
files or directories. Moreover <varname>ProtectSystem=strict</varname> and
<varname>ProtectHome=read-only</varname> are implied, thus prohibiting the service to write to
arbitrary file system locations. In order to allow the service to write to certain directories, they
- have to be whitelisted using <varname>ReadWritePaths=</varname>, but care must be taken so that
+ have to be allow-listed using <varname>ReadWritePaths=</varname>, but care must be taken so that
UID/GID recycling doesn't create security issues involving files created by the service. Use
<varname>RuntimeDirectory=</varname> (see below) in order to assign a writable runtime directory to a
service, owned by the dynamic user/group and removed automatically when the unit is terminated. Use
contain symlinks, they are resolved relative to the root directory set with
<varname>RootDirectory=</varname>/<varname>RootImage=</varname>.</para>
- <para>Paths listed in <varname>ReadWritePaths=</varname> are accessible from within the namespace with the same
- access modes as from outside of it. Paths listed in <varname>ReadOnlyPaths=</varname> are accessible for
- reading only, writing will be refused even if the usual file access controls would permit this. Nest
- <varname>ReadWritePaths=</varname> inside of <varname>ReadOnlyPaths=</varname> in order to provide writable
- subdirectories within read-only directories. Use <varname>ReadWritePaths=</varname> in order to whitelist
- specific paths for write access if <varname>ProtectSystem=strict</varname> is used.</para>
+ <para>Paths listed in <varname>ReadWritePaths=</varname> are accessible from within the namespace
+ with the same access modes as from outside of it. Paths listed in <varname>ReadOnlyPaths=</varname>
+ are accessible for reading only, writing will be refused even if the usual file access controls would
+ permit this. Nest <varname>ReadWritePaths=</varname> inside of <varname>ReadOnlyPaths=</varname> in
+ order to provide writable subdirectories within read-only directories. Use
+ <varname>ReadWritePaths=</varname> in order to allow-list specific paths for write access if
+ <varname>ProtectSystem=strict</varname> is used.</para>
<para>Paths listed in <varname>InaccessiblePaths=</varname> will be made inaccessible for processes inside
the namespace along with everything below them in the file system hierarchy. This may be more restrictive than
<varlistentry>
<term><varname>RestrictAddressFamilies=</varname></term>
- <listitem><para>Restricts the set of socket address families accessible to the processes of this unit. Takes a
- space-separated list of address family names to whitelist, such as <constant>AF_UNIX</constant>,
- <constant>AF_INET</constant> or <constant>AF_INET6</constant>. When prefixed with <constant>~</constant> the
- listed address families will be applied as blacklist, otherwise as whitelist. Note that this restricts access
- to the <citerefentry
- project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call
- only. Sockets passed into the process by other means (for example, by using socket activation with socket
- units, see <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
- are unaffected. Also, sockets created with <function>socketpair()</function> (which creates connected AF_UNIX
- sockets only) are unaffected. Note that this option has no effect on 32-bit x86, s390, s390x, mips, mips-le,
- ppc, ppc-le, pcc64, ppc64-le and is ignored (but works correctly on other ABIs, including x86-64). Note that on
- systems supporting multiple ABIs (such as x86/x86-64) it is recommended to turn off alternative ABIs for
- services, so that they cannot be used to circumvent the restrictions of this option. Specifically, it is
- recommended to combine this option with <varname>SystemCallArchitectures=native</varname> or similar. If
- running in user mode, or in system mode, but without the <constant>CAP_SYS_ADMIN</constant> capability
- (e.g. setting <varname>User=nobody</varname>), <varname>NoNewPrivileges=yes</varname> is implied. By default,
- no restrictions apply, all address families are accessible to processes. If assigned the empty string, any
- previous address family restriction changes are undone. This setting does not affect commands prefixed with
- <literal>+</literal>.</para>
+ <listitem><para>Restricts the set of socket address families accessible to the processes of this
+ unit. Takes a space-separated list of address family names to allow-list, such as
+ <constant>AF_UNIX</constant>, <constant>AF_INET</constant> or <constant>AF_INET6</constant>. When
+ prefixed with <constant>~</constant> the listed address families will be applied as deny list,
+ otherwise as allow list. Note that this restricts access to the <citerefentry
+ project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry>
+ system call only. Sockets passed into the process by other means (for example, by using socket
+ activation with socket units, see
+ <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
+ are unaffected. Also, sockets created with <function>socketpair()</function> (which creates connected
+ AF_UNIX sockets only) are unaffected. Note that this option has no effect on 32-bit x86, s390, s390x,
+ mips, mips-le, ppc, ppc-le, pcc64, ppc64-le and is ignored (but works correctly on other ABIs,
+ including x86-64). Note that on systems supporting multiple ABIs (such as x86/x86-64) it is
+ recommended to turn off alternative ABIs for services, so that they cannot be used to circumvent the
+ restrictions of this option. Specifically, it is recommended to combine this option with
+ <varname>SystemCallArchitectures=native</varname> or similar. If running in user mode, or in system
+ mode, but without the <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
+ <varname>User=nobody</varname>), <varname>NoNewPrivileges=yes</varname> is implied. By default, no
+ restrictions apply, all address families are accessible to processes. If assigned the empty string,
+ any previous address family restriction changes are undone. This setting does not affect commands
+ prefixed with <literal>+</literal>.</para>
<para>Use this option to limit exposure of processes to remote access, in particular via exotic and sensitive
network protocols, such as <constant>AF_PACKET</constant>. Note that in most cases, the local
- <constant>AF_UNIX</constant> address family should be included in the configured whitelist as it is frequently
+ <constant>AF_UNIX</constant> address family should be included in the configured allow list as it is frequently
used for local communication, including for
<citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry>
logging.</para></listitem>
any combination of: <constant>cgroup</constant>, <constant>ipc</constant>, <constant>net</constant>,
<constant>mnt</constant>, <constant>pid</constant>, <constant>user</constant> and <constant>uts</constant>. Any
namespace type listed is made accessible to the unit's processes, access to namespace types not listed is
- prohibited (whitelisting). By prepending the list with a single tilde character (<literal>~</literal>) the
+ prohibited (allow-listing). By prepending the list with a single tilde character (<literal>~</literal>) the
effect may be inverted: only the listed namespace types will be made inaccessible, all unlisted ones are
- permitted (blacklisting). If the empty string is assigned, the default namespace restrictions are applied,
+ permitted (deny-listing). If the empty string is assigned, the default namespace restrictions are applied,
which is equivalent to false. This option may appear more than once, in which case the namespace types are
merged by <constant>OR</constant>, or by <constant>AND</constant> if the lines are prefixed with
<literal>~</literal> (see examples below). Internally, this setting limits access to the
<listitem><para>Takes a space-separated list of system call names. If this setting is used, all
system calls executed by the unit processes except for the listed ones will result in immediate
- process termination with the <constant>SIGSYS</constant> signal (whitelisting). (See
+ process termination with the <constant>SIGSYS</constant> signal (allow-listing). (See
<varname>SystemCallErrorNumber=</varname> below for changing the default action). If the first
character of the list is <literal>~</literal>, the effect is inverted: only the listed system calls
- will result in immediate process termination (blacklisting). Blacklisted system calls and system call
+ will result in immediate process termination (deny-listing). Deny-listed system calls and system call
groups may optionally be suffixed with a colon (<literal>:</literal>) and <literal>errno</literal>
error number (between 0 and 4095) or errno name such as <constant>EPERM</constant>,
<constant>EACCES</constant> or <constant>EUCLEAN</constant> (see <citerefentry
project='man-pages'><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry> for a
- full list). This value will be returned when a blacklisted system call is triggered, instead of
+ full list). This value will be returned when a deny-listed system call is triggered, instead of
terminating the processes immediately. This value takes precedence over the one given in
<varname>SystemCallErrorNumber=</varname>, see below. If running in user mode, or in system mode,
but without the <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
for enforcing a minimal sandboxing environment. Note that the <function>execve</function>,
<function>exit</function>, <function>exit_group</function>, <function>getrlimit</function>,
<function>rt_sigreturn</function>, <function>sigreturn</function> system calls and the system calls
- for querying time and sleeping are implicitly whitelisted and do not need to be listed
+ for querying time and sleeping are implicitly allow-listed and do not need to be listed
explicitly. This option may be specified more than once, in which case the filter masks are
merged. If the empty string is assigned, the filter is reset, all prior assignments will have no
effect. This does not affect commands prefixed with <literal>+</literal>.</para>
might be necessary to temporarily disable system call filters in order to simplify debugging of such
failures.</para>
- <para>If you specify both types of this option (i.e. whitelisting and blacklisting), the first encountered
- will take precedence and will dictate the default action (termination or approval of a system call). Then the
- next occurrences of this option will add or delete the listed system calls from the set of the filtered system
- calls, depending of its type and the default action. (For example, if you have started with a whitelisting of
- <function>read</function> and <function>write</function>, and right after it add a blacklisting of
- <function>write</function>, then <function>write</function> will be removed from the set.)</para>
+ <para>If you specify both types of this option (i.e. allow-listing and deny-listing), the first
+ encountered will take precedence and will dictate the default action (termination or approval of a
+ system call). Then the next occurrences of this option will add or delete the listed system calls
+ from the set of the filtered system calls, depending of its type and the default action. (For
+ example, if you have started with an allow list rule for <function>read</function> and
+ <function>write</function>, and right after it add a deny list rule for <function>write</function>,
+ then <function>write</function> will be removed from the set.)</para>
<para>As the number of possible system calls is large, predefined sets of system calls are provided. A set
starts with <literal>@</literal> character, followed by name of the set.
</row>
<row>
<entry>@system-service</entry>
- <entry>A reasonable set of system calls used by common system services, excluding any special purpose calls. This is the recommended starting point for whitelisting system calls for system services, as it contains what is typically needed by system services, but excludes overly specific interfaces. For example, the following APIs are excluded: <literal>@clock</literal>, <literal>@mount</literal>, <literal>@swap</literal>, <literal>@reboot</literal>.</entry>
+ <entry>A reasonable set of system calls used by common system services, excluding any special purpose calls. This is the recommended starting point for allow-listing system calls for system services, as it contains what is typically needed by system services, but excludes overly specific interfaces. For example, the following APIs are excluded: <literal>@clock</literal>, <literal>@mount</literal>, <literal>@swap</literal>, <literal>@reboot</literal>.</entry>
</row>
<row>
<entry>@timer</entry>
<command>systemd-analyze syscall-filter</command> to list the actual list of system calls in each
filter.</para>
- <para>Generally, whitelisting system calls (rather than blacklisting) is the safer mode of operation. It is
- recommended to enforce system call whitelists for all long-running system services. Specifically, the
- following lines are a relatively safe basic choice for the majority of system services:</para>
+ <para>Generally, allow-listing system calls (rather than deny-listing) is the safer mode of
+ operation. It is recommended to enforce system call allow lists for all long-running system
+ services. Specifically, the following lines are a relatively safe basic choice for the majority of
+ system services:</para>
<programlisting>[Service]
SystemCallFilter=@system-service
call may be used to execute operations similar to what can be done with the older
<function>kill()</function> system call, hence blocking the latter without the former only provides
weak protection. Since new system calls are added regularly to the kernel as development progresses,
- keeping system call blacklists comprehensive requires constant work. It is thus recommended to use
- whitelisting instead, which offers the benefit that new system calls are by default implicitly
- blocked until the whitelist is updated.</para>
+ keeping system call deny lists comprehensive requires constant work. It is thus recommended to use
+ allow-listing instead, which offers the benefit that new system calls are by default implicitly
+ blocked until the allow list is updated.</para>
<para>Also note that a number of system calls are required to be accessible for the dynamic linker to
work. The dynamic linker is required for running most regular programs (specifically: all dynamic ELF
</varlistentry>
<varlistentry>
- <term><varname>BlackList=</varname></term>
+ <term><varname>DenyList=</varname></term>
<listitem>
<para>A whitespace-separated list of IPv4 addresses. DHCP offers from servers in the list are rejected.</para>
</listitem>
</varlistentry>
<varlistentry>
- <term><varname>BlackList=</varname></term>
+ <term><varname>DenyList=</varname></term>
<listitem>
<para>A whitespace-separated list of IPv6 prefixes. IPv6 prefixes supplied via router advertisements in the list are ignored.</para>
</listitem>
<listitem><para>Otherwise, access is granted.</para></listitem>
</itemizedlist>
- <para>In order to implement a whitelisting IP firewall, it is recommended to use a
- <varname>IPAddressDeny=</varname><constant>any</constant> setting on an upper-level slice unit (such as the
- root slice <filename>-.slice</filename> or the slice containing all system services
+ <para>In order to implement an allow-listing IP firewall, it is recommended to use a
+ <varname>IPAddressDeny=</varname><constant>any</constant> setting on an upper-level slice unit
+ (such as the root slice <filename>-.slice</filename> or the slice containing all system services
<filename>system.slice</filename> – see
- <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
- details on these slice units), plus individual per-service <varname>IPAddressAllow=</varname> lines
- permitting network access to relevant services, and only them.</para>
+ <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>
+ for details on these slice units), plus individual per-service <varname>IPAddressAllow=</varname>
+ lines permitting network access to relevant services, and only them.</para>
<para>Note that for socket-activated services, the IP access list configured on the socket unit
applies to all sockets associated with it directly, but not to any sockets created by the
<para>The device node specifier is either a path to a device node in the file system, starting with
<filename>/dev/</filename>, or a string starting with either <literal>char-</literal> or
<literal>block-</literal> followed by a device group name, as listed in
- <filename>/proc/devices</filename>. The latter is useful to whitelist all current and future
+ <filename>/proc/devices</filename>. The latter is useful to allow-list all current and future
devices belonging to a specific device group at once. The device group is matched according to
filename globbing rules, you may hence use the <literal>*</literal> and <literal>?</literal>
wildcards. (Note that such globbing wildcards are not available for device node path
all pseudo TTYs and all ALSA sound devices, respectively. <literal>char-cpu/*</literal> is a
specifier matching all CPU related device groups.</para>
- <para>Note that whitelists defined this way should only reference device groups which are
+ <para>Note that allow lists defined this way should only reference device groups which are
resolvable at the time the unit is started. Any device groups not resolvable then are not added to
- the device whitelist. In order to work around this limitation, consider extending service units
+ the device allow list. In order to work around this limitation, consider extending service units
with a pair of <command>After=modprobe@xyz.service</command> and
<command>Wants=modprobe@xyz.service</command> lines that load the necessary kernel module
implementing the device group if missing.
char **system_call_architectures;
- bool system_call_filter_whitelist;
+ bool system_call_filter_allow_list;
Set *system_call_filter;
uint32_t _umask;
#if HAVE_SECCOMP
-static bool syscall_names_in_filter(Set *s, bool whitelist, const SyscallFilterSet *f) {
+static bool syscall_names_in_filter(Set *s, bool allow_list, const SyscallFilterSet *f) {
const char *syscall;
NULSTR_FOREACH(syscall, f->value) {
const SyscallFilterSet *g;
assert_se(g = syscall_filter_set_find(syscall));
- if (syscall_names_in_filter(s, whitelist, g))
+ if (syscall_names_in_filter(s, allow_list, g))
return true; /* bad! */
continue;
if (id < 0)
continue;
- if (set_contains(s, syscall) == whitelist) {
+ if (set_contains(s, syscall) == allow_list) {
log_debug("Offending syscall filter item: %s", syscall);
return true; /* bad! */
}
assert(a->parameter < _SYSCALL_FILTER_SET_MAX);
f = syscall_filter_sets + a->parameter;
- if (!info->system_call_filter_whitelist && set_isempty(info->system_call_filter)) {
+ if (!info->system_call_filter_allow_list && set_isempty(info->system_call_filter)) {
d = strdup("Service does not filter system calls");
b = 10;
} else {
bool bad;
log_debug("Analyzing system call filter, checking against: %s", f->name);
- bad = syscall_names_in_filter(info->system_call_filter, info->system_call_filter_whitelist, f);
+ bad = syscall_names_in_filter(info->system_call_filter, info->system_call_filter_allow_list, f);
log_debug("Result: %s", bad ? "bad" : "good");
- if (info->system_call_filter_whitelist) {
+ if (info->system_call_filter_allow_list) {
if (bad) {
- (void) asprintf(&d, "System call whitelist defined for service, and %s is included", f->name);
+ (void) asprintf(&d, "System call allow list defined for service, and %s is included", f->name);
b = 9;
} else {
- (void) asprintf(&d, "System call whitelist defined for service, and %s is not included", f->name);
+ (void) asprintf(&d, "System call allow list defined for service, and %s is not included", f->name);
b = 0;
}
} else {
if (bad) {
- (void) asprintf(&d, "System call blacklist defined for service, and %s is not included", f->name);
+ (void) asprintf(&d, "System call deny list defined for service, and %s is not included", f->name);
b = 10;
} else {
- (void) asprintf(&d, "System call blacklist defined for service, and %s is included", f->name);
+ (void) asprintf(&d, "System call deny list defined for service, and %s is included", f->name);
b = 5;
}
}
d = strdup("Service defines custom ingress/egress IP filters with BPF programs");
b = 0;
} else if (!info->ip_address_deny_all) {
- d = strdup("Service does not define an IP address whitelist");
+ d = strdup("Service does not define an IP address allow list");
b = 10;
} else if (info->ip_address_allow_other) {
- d = strdup("Service defines IP address whitelist with non-localhost entries");
+ d = strdup("Service defines IP address allow list with non-localhost entries");
b = 5;
} else if (info->ip_address_allow_localhost) {
- d = strdup("Service defines IP address whitelist with only localhost entries");
+ d = strdup("Service defines IP address allow list with only localhost entries");
b = 2;
} else {
d = strdup("Service blocks all IP address ranges");
void *userdata) {
struct security_info *info = userdata;
- int whitelist, r;
+ int allow_list, r;
assert(bus);
assert(member);
if (r < 0)
return r;
- r = sd_bus_message_read(m, "b", &whitelist);
+ r = sd_bus_message_read(m, "b", &allow_list);
if (r < 0)
return r;
info->restrict_address_family_unix =
info->restrict_address_family_netlink =
info->restrict_address_family_packet =
- info->restrict_address_family_other = whitelist;
+ info->restrict_address_family_other = allow_list;
r = sd_bus_message_enter_container(m, 'a', "s");
if (r < 0)
break;
if (STR_IN_SET(name, "AF_INET", "AF_INET6"))
- info->restrict_address_family_inet = !whitelist;
+ info->restrict_address_family_inet = !allow_list;
else if (streq(name, "AF_UNIX"))
- info->restrict_address_family_unix = !whitelist;
+ info->restrict_address_family_unix = !allow_list;
else if (streq(name, "AF_NETLINK"))
- info->restrict_address_family_netlink = !whitelist;
+ info->restrict_address_family_netlink = !allow_list;
else if (streq(name, "AF_PACKET"))
- info->restrict_address_family_packet = !whitelist;
+ info->restrict_address_family_packet = !allow_list;
else
- info->restrict_address_family_other = !whitelist;
+ info->restrict_address_family_other = !allow_list;
}
r = sd_bus_message_exit_container(m);
void *userdata) {
struct security_info *info = userdata;
- int whitelist, r;
+ int allow_list, r;
assert(bus);
assert(member);
if (r < 0)
return r;
- r = sd_bus_message_read(m, "b", &whitelist);
+ r = sd_bus_message_read(m, "b", &allow_list);
if (r < 0)
return r;
- info->system_call_filter_whitelist = whitelist;
+ info->system_call_filter_allow_list = allow_list;
r = sd_bus_message_enter_container(m, 'a', "s");
if (r < 0)
#include "device-nodes.h"
#include "utf8.h"
-int whitelisted_char_for_devnode(char c, const char *white) {
+int allow_listed_char_for_devnode(char c, const char *white) {
if ((c >= '0' && c <= '9') ||
(c >= 'A' && c <= 'Z') ||
j += seqlen;
i += (seqlen-1);
- } else if (str[i] == '\\' || !whitelisted_char_for_devnode(str[i], NULL)) {
+ } else if (str[i] == '\\' || !allow_listed_char_for_devnode(str[i], NULL)) {
if (len-j < 4)
return -EINVAL;
#include "stdio-util.h"
int encode_devnode_name(const char *str, char *str_enc, size_t len);
-int whitelisted_char_for_devnode(char c, const char *additional);
+int allow_listed_char_for_devnode(char c, const char *additional);
#define DEV_NUM_PATH_MAX \
(STRLEN("/dev/block/") + DECIMAL_STR_MAX(dev_t) + 1 + DECIMAL_STR_MAX(dev_t))
if (!p)
return -ENOMEM;
- /* Newer efivarfs protects variables that are not in a whitelist with FS_IMMUTABLE_FL by default, to protect
- * them for accidental removal and modification. We are not changing these variables accidentally however,
- * hence let's unset the bit first. */
+ /* Newer efivarfs protects variables that are not in an allow list with FS_IMMUTABLE_FL by default,
+ * to protect them for accidental removal and modification. We are not changing these variables
+ * accidentally however, hence let's unset the bit first. */
r = chattr_path(p, 0, FS_IMMUTABLE_FL, &saved_flags);
if (r < 0 && r != -ENOENT)
d = opendir(p);
if (!d) {
- if (errno == ENOENT) /* Doesn't have slaves */
+ if (errno == ENOENT) /* Doesn't have underlying devices */
return false;
return -errno;
if (errno != 0)
return -errno;
- break; /* No more slaves */
+ break; /* No more underlying devices */
}
q = path_join(p, de->d_name);
return r;
}
-static int bpf_prog_whitelist_device(
+static int bpf_prog_allow_list_device(
BPFProgram *prog,
char type,
int major,
return r;
}
-static int bpf_prog_whitelist_major(
+static int bpf_prog_allow_list_major(
BPFProgram *prog,
char type,
int major,
return r;
}
-static int bpf_prog_whitelist_class(
+static int bpf_prog_allow_list_class(
BPFProgram *prog,
char type,
const char *acc) {
int bpf_devices_cgroup_init(
BPFProgram **ret,
CGroupDevicePolicy policy,
- bool whitelist) {
+ bool allow_list) {
const struct bpf_insn pre_insn[] = {
/* load device type to r2 */
assert(ret);
- if (policy == CGROUP_DEVICE_POLICY_AUTO && !whitelist)
+ if (policy == CGROUP_DEVICE_POLICY_AUTO && !allow_list)
return 0;
r = bpf_program_new(BPF_PROG_TYPE_CGROUP_DEVICE, &prog);
if (r < 0)
return log_error_errno(r, "Loading device control BPF program failed: %m");
- if (policy == CGROUP_DEVICE_POLICY_CLOSED || whitelist) {
+ if (policy == CGROUP_DEVICE_POLICY_CLOSED || allow_list) {
r = bpf_program_add_instructions(prog, pre_insn, ELEMENTSOF(pre_insn));
if (r < 0)
return log_error_errno(r, "Extending device control BPF program failed: %m");
int bpf_devices_apply_policy(
BPFProgram *prog,
CGroupDevicePolicy policy,
- bool whitelist,
+ bool allow_list,
const char *cgroup_path,
BPFProgram **prog_installed) {
if (!prog)
goto finish;
- const bool deny_everything = policy == CGROUP_DEVICE_POLICY_STRICT && !whitelist;
+ const bool deny_everything = policy == CGROUP_DEVICE_POLICY_STRICT && !allow_list;
const struct bpf_insn post_insn[] = {
/* return DENY */
return supported = 1;
}
-static int whitelist_device_pattern(
+static int allow_list_device_pattern(
BPFProgram *prog,
const char *path,
char type,
return 0;
if (maj && min)
- return bpf_prog_whitelist_device(prog, type, *maj, *min, acc);
+ return bpf_prog_allow_list_device(prog, type, *maj, *min, acc);
else if (maj)
- return bpf_prog_whitelist_major(prog, type, *maj, acc);
+ return bpf_prog_allow_list_major(prog, type, *maj, acc);
else
- return bpf_prog_whitelist_class(prog, type, acc);
+ return bpf_prog_allow_list_class(prog, type, acc);
} else {
char buf[2+DECIMAL_STR_MAX(unsigned)*2+2+4];
}
}
-int bpf_devices_whitelist_device(
+int bpf_devices_allow_list_device(
BPFProgram *prog,
const char *path,
const char *node,
}
unsigned maj = major(rdev), min = minor(rdev);
- return whitelist_device_pattern(prog, path, S_ISCHR(mode) ? 'c' : 'b', &maj, &min, acc);
+ return allow_list_device_pattern(prog, path, S_ISCHR(mode) ? 'c' : 'b', &maj, &min, acc);
}
-int bpf_devices_whitelist_major(
+int bpf_devices_allow_list_major(
BPFProgram *prog,
const char *path,
const char *name,
if (streq(name, "*"))
/* If the name is a wildcard, then apply this list to all devices of this type */
- return whitelist_device_pattern(prog, path, type, NULL, NULL, acc);
+ return allow_list_device_pattern(prog, path, type, NULL, NULL, acc);
if (safe_atou(name, &maj) >= 0 && DEVICE_MAJOR_VALID(maj))
/* The name is numeric and suitable as major. In that case, let's take its major, and create
* the entry directly. */
- return whitelist_device_pattern(prog, path, type, &maj, NULL, acc);
+ return allow_list_device_pattern(prog, path, type, &maj, NULL, acc);
_cleanup_fclose_ FILE *f = NULL;
bool good = false, any = false;
continue;
any = true;
- (void) whitelist_device_pattern(prog, path, type, &maj, NULL, acc);
+ (void) allow_list_device_pattern(prog, path, type, &maj, NULL, acc);
}
if (!any)
return log_debug_errno(SYNTHETIC_ERRNO(ENOENT),
- "Device whitelist pattern \"%s\" did not match anything.", name);
+ "Device allow list pattern \"%s\" did not match anything.", name);
return 0;
}
-int bpf_devices_whitelist_static(
+int bpf_devices_allow_list_static(
BPFProgram *prog,
const char *path) {
const char *node, *acc;
NULSTR_FOREACH_PAIR(node, acc, auto_devices) {
- k = bpf_devices_whitelist_device(prog, path, node, acc);
+ k = bpf_devices_allow_list_device(prog, path, node, acc);
if (r >= 0 && k < 0)
r = k;
}
/* PTS (/dev/pts) devices may not be duplicated, but accessed */
- k = bpf_devices_whitelist_major(prog, path, "pts", 'c', "rw");
+ k = bpf_devices_allow_list_major(prog, path, "pts", 'c', "rw");
if (r >= 0 && k < 0)
r = k;
typedef struct BPFProgram BPFProgram;
-int bpf_devices_cgroup_init(BPFProgram **ret, CGroupDevicePolicy policy, bool whitelist);
+int bpf_devices_cgroup_init(BPFProgram **ret, CGroupDevicePolicy policy, bool allow_list);
int bpf_devices_apply_policy(
BPFProgram *prog,
CGroupDevicePolicy policy,
- bool whitelist,
+ bool allow_list,
const char *cgroup_path,
BPFProgram **prog_installed);
int bpf_devices_supported(void);
-int bpf_devices_whitelist_device(BPFProgram *prog, const char *path, const char *node, const char *acc);
-int bpf_devices_whitelist_major(BPFProgram *prog, const char *path, const char *name, char type, const char *acc);
-int bpf_devices_whitelist_static(BPFProgram *prog, const char *path);
+int bpf_devices_allow_list_device(BPFProgram *prog, const char *path, const char *node, const char *acc);
+int bpf_devices_allow_list_major(BPFProgram *prog, const char *path, const char *name, char type, const char *acc);
+int bpf_devices_allow_list_static(BPFProgram *prog, const char *path);
"Failed to reset devices.allow/devices.deny: %m");
}
- bool whitelist_static = policy == CGROUP_DEVICE_POLICY_CLOSED ||
+ bool allow_list_static = policy == CGROUP_DEVICE_POLICY_CLOSED ||
(policy == CGROUP_DEVICE_POLICY_AUTO && c->device_allow);
- if (whitelist_static)
- (void) bpf_devices_whitelist_static(prog, path);
+ if (allow_list_static)
+ (void) bpf_devices_allow_list_static(prog, path);
- bool any = whitelist_static;
+ bool any = allow_list_static;
LIST_FOREACH(device_allow, a, c->device_allow) {
char acc[4], *val;
unsigned k = 0;
acc[k++] = 0;
if (path_startswith(a->path, "/dev/"))
- r = bpf_devices_whitelist_device(prog, path, a->path, acc);
+ r = bpf_devices_allow_list_device(prog, path, a->path, acc);
else if ((val = startswith(a->path, "block-")))
- r = bpf_devices_whitelist_major(prog, path, val, 'b', acc);
+ r = bpf_devices_allow_list_major(prog, path, val, 'b', acc);
else if ((val = startswith(a->path, "char-")))
- r = bpf_devices_whitelist_major(prog, path, val, 'c', acc);
+ r = bpf_devices_allow_list_major(prog, path, val, 'c', acc);
else {
log_unit_debug(u, "Ignoring device '%s' while writing cgroup attribute.", a->path);
continue;
log_unit_warning_errno(u, SYNTHETIC_ERRNO(ENODEV), "No devices matched by device filter.");
/* The kernel verifier would reject a program we would build with the normal intro and outro
- but no whitelisting rules (outro would contain an unreachable instruction for successful
+ but no allow-listing rules (outro would contain an unreachable instruction for successful
return). */
policy = CGROUP_DEVICE_POLICY_STRICT;
}
if (r < 0)
return r;
- r = sd_bus_message_append(reply, "b", c->syscall_whitelist);
+ r = sd_bus_message_append(reply, "b", c->syscall_allow_list);
if (r < 0)
return r;
if (r < 0)
return r;
- r = sd_bus_message_append(reply, "b", c->address_families_whitelist);
+ r = sd_bus_message_append(reply, "b", c->address_families_allow_list);
if (r < 0)
return r;
return bus_set_transient_errno(u, name, &c->syscall_errno, message, flags, error);
if (streq(name, "SystemCallFilter")) {
- int whitelist;
+ int allow_list;
_cleanup_strv_free_ char **l = NULL;
r = sd_bus_message_enter_container(message, 'r', "bas");
if (r < 0)
return r;
- r = sd_bus_message_read(message, "b", &whitelist);
+ r = sd_bus_message_read(message, "b", &allow_list);
if (r < 0)
return r;
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *joined = NULL;
- SeccompParseFlags invert_flag = whitelist ? 0 : SECCOMP_PARSE_INVERT;
+ SeccompParseFlags invert_flag = allow_list ? 0 : SECCOMP_PARSE_INVERT;
char **s;
if (strv_isempty(l)) {
- c->syscall_whitelist = false;
+ c->syscall_allow_list = false;
c->syscall_filter = hashmap_free(c->syscall_filter);
unit_write_settingf(u, flags, name, "SystemCallFilter=");
if (!c->syscall_filter)
return log_oom();
- c->syscall_whitelist = whitelist;
+ c->syscall_allow_list = allow_list;
- if (c->syscall_whitelist) {
+ if (c->syscall_allow_list) {
r = seccomp_parse_syscall_filter("@default",
-1,
c->syscall_filter,
SECCOMP_PARSE_PERMISSIVE |
- SECCOMP_PARSE_WHITELIST | invert_flag,
+ SECCOMP_PARSE_ALLOW_LIST | invert_flag,
u->id,
NULL, 0);
if (r < 0)
c->syscall_filter,
SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE |
invert_flag |
- (c->syscall_whitelist ? SECCOMP_PARSE_WHITELIST : 0),
+ (c->syscall_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
u->id,
NULL, 0);
if (r < 0)
if (!joined)
return -ENOMEM;
- unit_write_settingf(u, flags, name, "SystemCallFilter=%s%s", whitelist ? "" : "~", joined);
+ unit_write_settingf(u, flags, name, "SystemCallFilter=%s%s", allow_list ? "" : "~", joined);
}
return 1;
return 1;
} else if (streq(name, "RestrictAddressFamilies")) {
- int whitelist;
+ int allow_list;
_cleanup_strv_free_ char **l = NULL;
r = sd_bus_message_enter_container(message, 'r', "bas");
if (r < 0)
return r;
- r = sd_bus_message_read(message, "b", &whitelist);
+ r = sd_bus_message_read(message, "b", &allow_list);
if (r < 0)
return r;
char **s;
if (strv_isempty(l)) {
- c->address_families_whitelist = false;
+ c->address_families_allow_list = false;
c->address_families = set_free(c->address_families);
unit_write_settingf(u, flags, name, "RestrictAddressFamilies=");
if (!c->address_families)
return log_oom();
- c->address_families_whitelist = whitelist;
+ c->address_families_allow_list = allow_list;
}
STRV_FOREACH(s, l) {
if (af < 0)
return af;
- if (whitelist == c->address_families_whitelist) {
+ if (allow_list == c->address_families_allow_list) {
r = set_put(c->address_families, INT_TO_PTR(af));
if (r < 0)
return r;
if (!joined)
return -ENOMEM;
- unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s%s", whitelist ? "" : "~", joined);
+ unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s%s", allow_list ? "" : "~", joined);
}
return 1;
static bool context_has_address_families(const ExecContext *c) {
assert(c);
- return c->address_families_whitelist ||
+ return c->address_families_allow_list ||
!set_isempty(c->address_families);
}
static bool context_has_syscall_filters(const ExecContext *c) {
assert(c);
- return c->syscall_whitelist ||
+ return c->syscall_allow_list ||
!hashmap_isempty(c->syscall_filter);
}
negative_action = c->syscall_errno == 0 ? scmp_act_kill_process() : SCMP_ACT_ERRNO(c->syscall_errno);
- if (c->syscall_whitelist) {
+ if (c->syscall_allow_list) {
default_action = negative_action;
action = SCMP_ACT_ALLOW;
} else {
}
if (needs_ambient_hack) {
- r = seccomp_filter_set_add(c->syscall_filter, c->syscall_whitelist, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
+ r = seccomp_filter_set_add(c->syscall_filter, c->syscall_allow_list, syscall_filter_sets + SYSCALL_FILTER_SET_SETUID);
if (r < 0)
return r;
}
if (skip_seccomp_unavailable(u, "RestrictAddressFamilies="))
return 0;
- return seccomp_restrict_address_families(c->address_families, c->address_families_whitelist);
+ return seccomp_restrict_address_families(c->address_families, c->address_families_allow_list);
}
static int apply_memory_deny_write_execute(const Unit* u, const ExecContext *c) {
"%sSystemCallFilter: ",
prefix);
- if (!c->syscall_whitelist)
+ if (!c->syscall_allow_list)
fputc('~', f);
#if HAVE_SECCOMP
Hashmap *syscall_filter;
Set *syscall_archs;
int syscall_errno;
- bool syscall_whitelist:1;
+ bool syscall_allow_list:1;
- bool address_families_whitelist:1;
+ bool address_families_allow_list:1;
Set *address_families;
char *network_namespace_path;
if (isempty(rvalue)) {
/* Empty assignment resets the list */
c->syscall_filter = hashmap_free(c->syscall_filter);
- c->syscall_whitelist = false;
+ c->syscall_allow_list = false;
return 0;
}
if (invert)
/* Allow everything but the ones listed */
- c->syscall_whitelist = false;
+ c->syscall_allow_list = false;
else {
/* Allow nothing but the ones listed */
- c->syscall_whitelist = true;
+ c->syscall_allow_list = true;
- /* Accept default syscalls if we are on a whitelist */
+ /* Accept default syscalls if we are on a allow_list */
r = seccomp_parse_syscall_filter(
"@default", -1, c->syscall_filter,
- SECCOMP_PARSE_PERMISSIVE|SECCOMP_PARSE_WHITELIST,
+ SECCOMP_PARSE_PERMISSIVE|SECCOMP_PARSE_ALLOW_LIST,
unit,
NULL, 0);
if (r < 0)
name, num, c->syscall_filter,
SECCOMP_PARSE_LOG|SECCOMP_PARSE_PERMISSIVE|
(invert ? SECCOMP_PARSE_INVERT : 0)|
- (c->syscall_whitelist ? SECCOMP_PARSE_WHITELIST : 0),
+ (c->syscall_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
unit, filename, line);
if (r < 0)
return r;
if (isempty(rvalue)) {
/* Empty assignment resets the list */
c->address_families = set_free(c->address_families);
- c->address_families_whitelist = false;
+ c->address_families_allow_list = false;
return 0;
}
if (!c->address_families)
return log_oom();
- c->address_families_whitelist = !invert;
+ c->address_families_allow_list = !invert;
}
for (p = rvalue;;) {
/* If we previously wanted to forbid an address family and now
* we want to allow it, then just remove it from the list.
*/
- if (!invert == c->address_families_whitelist) {
+ if (!invert == c->address_families_allow_list) {
r = set_put(c->address_families, INT_TO_PTR(af));
if (r < 0)
return log_oom();
return 0;
}
-static int make_read_only(const MountEntry *m, char **blacklist, FILE *proc_self_mountinfo) {
+static int make_read_only(const MountEntry *m, char **deny_list, FILE *proc_self_mountinfo) {
unsigned long new_flags = 0, flags_mask = 0;
bool submounts = false;
int r = 0;
mount_entry_read_only(m) &&
!IN_SET(m->mode, EMPTY_DIR, TMPFS);
if (submounts)
- r = bind_remount_recursive_with_mountinfo(mount_entry_path(m), new_flags, flags_mask, blacklist, proc_self_mountinfo);
+ r = bind_remount_recursive_with_mountinfo(mount_entry_path(m), new_flags, flags_mask, deny_list, proc_self_mountinfo);
else
r = bind_remount_one_with_mountinfo(mount_entry_path(m), new_flags, flags_mask, proc_self_mountinfo);
if (n_mounts > 0) {
_cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
- _cleanup_free_ char **blacklist = NULL;
+ _cleanup_free_ char **deny_list = NULL;
size_t j;
/* Open /proc/self/mountinfo now as it may become unavailable if we mount anything on top of /proc.
normalize_mounts(root, mounts, &n_mounts);
}
- /* Create a blacklist we can pass to bind_mount_recursive() */
- blacklist = new(char*, n_mounts+1);
- if (!blacklist) {
+ /* Create a deny list we can pass to bind_mount_recursive() */
+ deny_list = new(char*, n_mounts+1);
+ if (!deny_list) {
r = -ENOMEM;
goto finish;
}
for (j = 0; j < n_mounts; j++)
- blacklist[j] = (char*) mount_entry_path(mounts+j);
- blacklist[j] = NULL;
+ deny_list[j] = (char*) mount_entry_path(mounts+j);
+ deny_list[j] = NULL;
/* Second round, flip the ro bits if necessary. */
for (m = mounts; m < mounts + n_mounts; ++m) {
- r = make_read_only(m, blacklist, proc_self_mountinfo);
+ r = make_read_only(m, deny_list, proc_self_mountinfo);
if (r < 0) {
if (error_path && mount_entry_path(m))
*error_path = strdup(mount_entry_path(m));
static bool arg_read_crypttab = true;
static const char *arg_crypttab = NULL;
static const char *arg_runtime_directory = NULL;
-static bool arg_whitelist = false;
+static bool arg_allow_list = false;
static Hashmap *arg_disks = NULL;
static char *arg_default_options = NULL;
static char *arg_default_keyfile = NULL;
if (!d)
return log_oom();
- d->create = arg_whitelist = true;
+ d->create = arg_allow_list = true;
} else if (streq(key, "luks.options")) {
if (!d)
return log_oom();
- d->create = arg_whitelist = true;
+ d->create = arg_allow_list = true;
free_and_replace(d->name, uuid_value);
} else
if (uuid)
d = hashmap_get(arg_disks, uuid);
- if (arg_whitelist && !d) {
+ if (arg_allow_list && !d) {
log_info("Not creating device '%s' because it was not specified on the kernel command line.", name);
continue;
}
return j;
}
-/* allow chars in whitelist, plain ascii, hex-escaping and valid utf8 */
-size_t util_replace_chars(char *str, const char *white) {
+/* allow chars in allow list, plain ascii, hex-escaping and valid utf8 */
+size_t util_replace_chars(char *str, const char *allow) {
size_t i = 0, replaced = 0;
assert(str);
while (str[i] != '\0') {
int len;
- if (whitelisted_char_for_devnode(str[i], white)) {
+ if (allow_listed_char_for_devnode(str[i], allow)) {
i++;
continue;
}
}
/* if space is allowed, replace whitespace with ordinary space */
- if (isspace(str[i]) && white && strchr(white, ' ')) {
+ if (isspace(str[i]) && allow && strchr(allow, ' ')) {
str[i] = ' ';
i++;
replaced++;
if (sd_device_get_sysname(d, &nn) < 0)
continue;
- /* Ignore internal displays: the type is encoded in the sysfs name, as the second dash separated item
- * (the first is the card name, the last the connector number). We implement a blacklist of external
- * displays here, rather than a whitelist of internal ones, to ensure we don't block suspends too
- * eagerly. */
+ /* Ignore internal displays: the type is encoded in the sysfs name, as the second dash
+ * separated item (the first is the card name, the last the connector number). We implement a
+ * deny list of external displays here, rather than an allow list of internal ones, to ensure
+ * we don't block suspends too eagerly. */
dash = strchr(nn, '-');
if (!dash)
continue;
return 0;
}
-static int dhcp_server_is_black_listed(Link *link, sd_dhcp_client *client) {
+static int dhcp_server_is_deny_listed(Link *link, sd_dhcp_client *client) {
sd_dhcp_lease *lease;
struct in_addr addr;
int r;
if (r < 0)
return log_link_debug_errno(link, r, "Failed to get DHCP server ip address: %m");
- if (set_contains(link->network->dhcp_black_listed_ip, UINT32_TO_PTR(addr.s_addr))) {
+ if (set_contains(link->network->dhcp_deny_listed_ip, UINT32_TO_PTR(addr.s_addr))) {
log_struct(LOG_DEBUG,
LOG_LINK_INTERFACE(link),
- LOG_LINK_MESSAGE(link, "DHCPv4 ip '%u.%u.%u.%u' found in black listed ip addresses, ignoring offer",
+ LOG_LINK_MESSAGE(link, "DHCPv4 ip '%u.%u.%u.%u' found in deny-listed ip addresses, ignoring offer",
ADDRESS_FMT_VAL(addr)));
return true;
}
}
break;
case SD_DHCP_CLIENT_EVENT_SELECTING:
- r = dhcp_server_is_black_listed(link, client);
+ r = dhcp_server_is_deny_listed(link, client);
if (r < 0)
return r;
if (r != 0)
return 0;
}
-int config_parse_dhcp_black_listed_ip_address(
+int config_parse_dhcp_deny_listed_ip_address(
const char *unit,
const char *filename,
unsigned line,
assert(data);
if (isempty(rvalue)) {
- network->dhcp_black_listed_ip = set_free(network->dhcp_black_listed_ip);
+ network->dhcp_deny_listed_ip = set_free(network->dhcp_deny_listed_ip);
return 0;
}
r = extract_first_word(&p, &n, NULL, 0);
if (r < 0) {
log_syntax(unit, LOG_ERR, filename, line, r,
- "Failed to parse DHCP black listed ip address, ignoring assignment: %s",
+ "Failed to parse DHCP deny-listed IP address, ignoring assignment: %s",
rvalue);
return 0;
}
r = in_addr_from_string(AF_INET, n, &ip);
if (r < 0) {
log_syntax(unit, LOG_ERR, filename, line, r,
- "DHCP black listed ip address is invalid, ignoring assignment: %s", n);
+ "DHCP deny-listed IP address is invalid, ignoring assignment: %s", n);
continue;
}
- r = set_ensure_put(&network->dhcp_black_listed_ip, NULL, UINT32_TO_PTR(ip.in.s_addr));
+ r = set_ensure_put(&network->dhcp_deny_listed_ip, NULL, UINT32_TO_PTR(ip.in.s_addr));
if (r < 0)
log_syntax(unit, LOG_ERR, filename, line, r,
- "Failed to store DHCP black listed ip address '%s', ignoring assignment: %m", n);
+ "Failed to store DHCP deny-listed IP address '%s', ignoring assignment: %m", n);
}
return 0;
int dhcp4_set_promote_secondaries(Link *link);
CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_client_identifier);
-CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_black_listed_ip_address);
+CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_deny_listed_ip_address);
CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_max_attempts);
CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_ip_service_type);
CONFIG_PARSER_PROTOTYPE(config_parse_dhcp_mud_url);
if (r < 0)
return log_link_error_errno(link, r, "Failed to get prefix address: %m");
- if (set_contains(link->network->ndisc_black_listed_prefix, &a.in6)) {
+ if (set_contains(link->network->ndisc_deny_listed_prefix, &a.in6)) {
if (DEBUG_LOGGING) {
_cleanup_free_ char *b = NULL;
(void) in_addr_to_string(AF_INET6, &a, &b);
- log_link_debug(link, "Prefix '%s' is black listed, ignoring", strna(b));
+ log_link_debug(link, "Prefix '%s' is deny-listed, ignoring", strna(b));
}
break;
IPv6Token,
free);
-int config_parse_ndisc_black_listed_prefix(
+int config_parse_ndisc_deny_listed_prefix(
const char *unit,
const char *filename,
unsigned line,
assert(data);
if (isempty(rvalue)) {
- network->ndisc_black_listed_prefix = set_free_free(network->ndisc_black_listed_prefix);
+ network->ndisc_deny_listed_prefix = set_free_free(network->ndisc_deny_listed_prefix);
return 0;
}
r = extract_first_word(&p, &n, NULL, 0);
if (r < 0) {
log_syntax(unit, LOG_ERR, filename, line, r,
- "Failed to parse NDISC black listed prefix, ignoring assignment: %s",
+ "Failed to parse NDISC deny-listed prefix, ignoring assignment: %s",
rvalue);
return 0;
}
r = in_addr_from_string(AF_INET6, n, &ip);
if (r < 0) {
log_syntax(unit, LOG_ERR, filename, line, r,
- "NDISC black listed prefix is invalid, ignoring assignment: %s", n);
+ "NDISC deny-listed prefix is invalid, ignoring assignment: %s", n);
continue;
}
- if (set_contains(network->ndisc_black_listed_prefix, &ip.in6))
+ if (set_contains(network->ndisc_deny_listed_prefix, &ip.in6))
continue;
a = newdup(struct in6_addr, &ip.in6, 1);
if (!a)
return log_oom();
- r = set_ensure_consume(&network->ndisc_black_listed_prefix, &in6_addr_hash_ops, TAKE_PTR(a));
+ r = set_ensure_consume(&network->ndisc_deny_listed_prefix, &in6_addr_hash_ops, TAKE_PTR(a));
if (r < 0)
return log_oom();
}
void ndisc_vacuum(Link *link);
void ndisc_flush(Link *link);
-CONFIG_PARSER_PROTOTYPE(config_parse_ndisc_black_listed_prefix);
+CONFIG_PARSER_PROTOTYPE(config_parse_ndisc_deny_listed_prefix);
CONFIG_PARSER_PROTOTYPE(config_parse_address_generation_type);
CONFIG_PARSER_PROTOTYPE(config_parse_ipv6_accept_ra_start_dhcp6_client);
DHCPv4.ListenPort, config_parse_uint16, 0, offsetof(Network, dhcp_client_port)
DHCPv4.SendRelease, config_parse_bool, 0, offsetof(Network, dhcp_send_release)
DHCPv4.SendDecline, config_parse_bool, 0, offsetof(Network, dhcp_send_decline)
-DHCPv4.BlackList, config_parse_dhcp_black_listed_ip_address, 0, 0
+DHCPv4.DenyList, config_parse_dhcp_deny_listed_ip_address, 0, 0
+DHCPv4.BlackList, config_parse_dhcp_deny_listed_ip_address, 0, 0
DHCPv4.IPServiceType, config_parse_dhcp_ip_service_type, 0, offsetof(Network, ip_service_type)
DHCPv4.SendOption, config_parse_dhcp_send_option, AF_INET, offsetof(Network, dhcp_client_send_options)
DHCPv4.SendVendorOption, config_parse_dhcp_send_option, 0, offsetof(Network, dhcp_client_send_vendor_options)
IPv6AcceptRA.UseDomains, config_parse_dhcp_use_domains, 0, offsetof(Network, ipv6_accept_ra_use_domains)
IPv6AcceptRA.DHCPv6Client, config_parse_ipv6_accept_ra_start_dhcp6_client, 0, offsetof(Network, ipv6_accept_ra_start_dhcp6_client)
IPv6AcceptRA.RouteTable, config_parse_section_route_table, 0, 0
-IPv6AcceptRA.BlackList, config_parse_ndisc_black_listed_prefix, 0, 0
+IPv6AcceptRA.DenyList, config_parse_ndisc_deny_listed_prefix, 0, 0
+IPv6AcceptRA.BlackList, config_parse_ndisc_deny_listed_prefix, 0, 0
DHCPServer.MaxLeaseTimeSec, config_parse_sec, 0, offsetof(Network, dhcp_server_max_lease_time_usec)
DHCPServer.DefaultLeaseTimeSec, config_parse_sec, 0, offsetof(Network, dhcp_server_default_lease_time_usec)
DHCPServer.EmitDNS, config_parse_bool, 0, offsetof(Network, dhcp_server_emit[SD_DHCP_LEASE_DNS].emit)
free(network->dhcp_mudurl);
strv_free(network->dhcp_user_class);
free(network->dhcp_hostname);
- set_free(network->dhcp_black_listed_ip);
+ set_free(network->dhcp_deny_listed_ip);
set_free(network->dhcp_request_options);
set_free(network->dhcp6_request_options);
free(network->mac);
ordered_set_free_free(network->router_search_domains);
free(network->router_dns);
- set_free_free(network->ndisc_black_listed_prefix);
+ set_free_free(network->ndisc_deny_listed_prefix);
free(network->bridge_name);
free(network->bond_name);
bool dhcp_send_decline;
DHCPUseDomains dhcp_use_domains;
sd_ipv4acd *dhcp_acd;
- Set *dhcp_black_listed_ip;
+ Set *dhcp_deny_listed_ip;
Set *dhcp_request_options;
OrderedHashmap *dhcp_client_send_options;
OrderedHashmap *dhcp_client_send_vendor_options;
DHCPUseDomains ipv6_accept_ra_use_domains;
IPv6AcceptRAStartDHCP6Client ipv6_accept_ra_start_dhcp6_client;
uint32_t ipv6_accept_ra_route_table;
- Set *ndisc_black_listed_prefix;
+ Set *ndisc_deny_listed_prefix;
OrderedHashmap *ipv6_tokens;
IPv6PrivacyExtensions ipv6_privacy_extensions;
* spec should say what to do with unknown props
* /bin/mount regarding NFS and FUSE required?
* what does terminal=false mean?
- * sysctl inside or outside? whitelisting?
+ * sysctl inside or outside? allow-listing?
* swapiness typo -> swappiness
*
* Unsupported:
return r;
if (!data.allow) {
- /* The fact that OCI allows 'deny' entries makes really no sense, as 'allow' vs. 'deny' for the
- * devices cgroup controller is really not about whitelisting and blacklisting but about adding
- * and removing entries from the whitelist. Since we always start out with an empty whitelist
- * we hence ignore the whole thing, as removing entries which don't exist make no sense. We'll
- * log about this, since this is really borked in the spec, with one exception: the entry
- * that's supposed to drop the kernel's default we ignore silently */
+ /* The fact that OCI allows 'deny' entries makes really no sense, as 'allow'
+ * vs. 'deny' for the devices cgroup controller is really not about allow-listing and
+ * deny-listing but about adding and removing entries from the allow list. Since we
+ * always start out with an empty allow list we hence ignore the whole thing, as
+ * removing entries which don't exist make no sense. We'll log about this, since this
+ * is really borked in the spec, with one exception: the entry that's supposed to
+ * drop the kernel's default we ignore silently */
if (!data.r || !data.w || !data.m || data.type != 0 || data.major != (unsigned) -1 || data.minor != (unsigned) -1)
- json_log(v, flags|JSON_WARNING, 0, "Devices cgroup whitelist with arbitrary 'allow' entries not supported, ignoring.");
+ json_log(v, flags|JSON_WARNING, 0, "Devices cgroup allow list with arbitrary 'allow' entries not supported, ignoring.");
/* We ignore the 'deny' entry as for us that's implied */
continue;
}
if (!data.r && !data.w && !data.m) {
- json_log(v, flags|LOG_WARNING, 0, "Device cgroup whitelist entry with no effect found, ignoring.");
+ json_log(v, flags|LOG_WARNING, 0, "Device cgroup allow list entry with no effect found, ignoring.");
continue;
}
if (data.minor != (unsigned) -1 && data.major == (unsigned) -1)
return json_log(v, flags, SYNTHETIC_ERRNO(EOPNOTSUPP),
- "Device cgroup whitelist entries with minors but no majors not supported.");
+ "Device cgroup allow list entries with minors but no majors not supported.");
if (data.major != (unsigned) -1 && data.type == 0)
return json_log(v, flags, SYNTHETIC_ERRNO(EOPNOTSUPP),
- "Device cgroup whitelist entries with majors but no device node type not supported.");
+ "Device cgroup allow list entries with majors but no device node type not supported.");
if (data.type == 0) {
- if (data.r && data.w && data.m) /* a catchall whitelist entry means we are looking at a noop */
+ if (data.r && data.w && data.m) /* a catchall allow list entry means we are looking at a noop */
noop = true;
else
return json_log(v, flags, SYNTHETIC_ERRNO(EOPNOTSUPP),
- "Device cgroup whitelist entries with no type not supported.");
+ "Device cgroup allow list entries with no type not supported.");
}
a = reallocarray(list, n_list + 1, sizeof(struct device_data));
scmp_filter_ctx ctx,
uint32_t arch,
uint64_t cap_list_retain,
- char **syscall_whitelist,
- char **syscall_blacklist) {
+ char **syscall_allow_list,
+ char **syscall_deny_list) {
static const struct {
uint64_t capability;
const char* name;
- } whitelist[] = {
+ } allow_list[] = {
/* Let's use set names where we can */
{ 0, "@aio" },
{ 0, "@basic-io" },
char **p;
int r;
- for (size_t i = 0; i < ELEMENTSOF(whitelist); i++) {
- if (whitelist[i].capability != 0 && (cap_list_retain & (1ULL << whitelist[i].capability)) == 0)
+ for (size_t i = 0; i < ELEMENTSOF(allow_list); i++) {
+ if (allow_list[i].capability != 0 && (cap_list_retain & (1ULL << allow_list[i].capability)) == 0)
continue;
- r = seccomp_add_syscall_filter_item(ctx, whitelist[i].name, SCMP_ACT_ALLOW, syscall_blacklist, false);
+ r = seccomp_add_syscall_filter_item(ctx, allow_list[i].name, SCMP_ACT_ALLOW, syscall_deny_list, false);
if (r < 0)
- return log_error_errno(r, "Failed to add syscall filter item %s: %m", whitelist[i].name);
+ return log_error_errno(r, "Failed to add syscall filter item %s: %m", allow_list[i].name);
}
- STRV_FOREACH(p, syscall_whitelist) {
- r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_blacklist, true);
+ STRV_FOREACH(p, syscall_allow_list) {
+ r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_deny_list, true);
if (r < 0)
log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
*p, seccomp_arch_to_string(arch));
return 0;
}
-int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist) {
+int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list) {
uint32_t arch;
int r;
SECCOMP_FOREACH_LOCAL_ARCH(arch) {
_cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
- log_debug("Applying whitelist on architecture: %s", seccomp_arch_to_string(arch));
+ log_debug("Applying allow list on architecture: %s", seccomp_arch_to_string(arch));
r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(EPERM));
if (r < 0)
return log_error_errno(r, "Failed to allocate seccomp object: %m");
- r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_whitelist, syscall_blacklist);
+ r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_allow_list, syscall_deny_list);
if (r < 0)
return r;
#else
-int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist) {
+int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list) {
return 0;
}
#include <sys/types.h>
-int setup_seccomp(uint64_t cap_list_retain, char **syscall_whitelist, char **syscall_blacklist);
+int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_ist, char **syscall_deny_list);
free(s->pivot_root_new);
free(s->pivot_root_old);
free(s->working_directory);
- strv_free(s->syscall_whitelist);
- strv_free(s->syscall_blacklist);
+ strv_free(s->syscall_allow_list);
+ strv_free(s->syscall_deny_list);
rlimit_free_all(s->rlimit);
free(s->hostname);
cpu_set_reset(&s->cpu_set);
}
if (negative)
- r = strv_extend(&settings->syscall_blacklist, word);
+ r = strv_extend(&settings->syscall_deny_list, word);
else
- r = strv_extend(&settings->syscall_whitelist, word);
+ r = strv_extend(&settings->syscall_allow_list, word);
if (r < 0)
return log_oom();
}
UserNamespaceMode userns_mode;
uid_t uid_shift, uid_range;
bool notify_ready;
- char **syscall_whitelist;
- char **syscall_blacklist;
+ char **syscall_allow_list;
+ char **syscall_deny_list;
struct rlimit *rlimit[_RLIMIT_MAX];
char *hostname;
int no_new_privileges;
static void *arg_root_hash = NULL;
static char *arg_verity_data = NULL;
static size_t arg_root_hash_size = 0;
-static char **arg_syscall_whitelist = NULL;
-static char **arg_syscall_blacklist = NULL;
+static char **arg_syscall_allow_list = NULL;
+static char **arg_syscall_deny_list = NULL;
#if HAVE_SECCOMP
static scmp_filter_ctx arg_seccomp = NULL;
#endif
STATIC_DESTRUCTOR_REGISTER(arg_parameters, strv_freep);
STATIC_DESTRUCTOR_REGISTER(arg_root_hash, freep);
STATIC_DESTRUCTOR_REGISTER(arg_verity_data, freep);
-STATIC_DESTRUCTOR_REGISTER(arg_syscall_whitelist, strv_freep);
-STATIC_DESTRUCTOR_REGISTER(arg_syscall_blacklist, strv_freep);
+STATIC_DESTRUCTOR_REGISTER(arg_syscall_allow_list, strv_freep);
+STATIC_DESTRUCTOR_REGISTER(arg_syscall_deny_list, strv_freep);
#if HAVE_SECCOMP
STATIC_DESTRUCTOR_REGISTER(arg_seccomp, seccomp_releasep);
#endif
return log_error_errno(r, "Failed to parse system call filter: %m");
if (negative)
- r = strv_extend(&arg_syscall_blacklist, word);
+ r = strv_extend(&arg_syscall_deny_list, word);
else
- r = strv_extend(&arg_syscall_whitelist, word);
+ r = strv_extend(&arg_syscall_allow_list, word);
if (r < 0)
return log_oom();
}
static int setup_keyring(void) {
key_serial_t keyring;
- /* Allocate a new session keyring for the container. This makes sure the keyring of the session systemd-nspawn
- * was invoked from doesn't leak into the container. Note that by default we block keyctl() and request_key()
- * anyway via seccomp so doing this operation isn't strictly necessary, but in case people explicitly whitelist
- * these system calls let's make sure we don't leak anything into the container. */
+ /* Allocate a new session keyring for the container. This makes sure the keyring of the session
+ * systemd-nspawn was invoked from doesn't leak into the container. Note that by default we block
+ * keyctl() and request_key() anyway via seccomp so doing this operation isn't strictly necessary,
+ * but in case people explicitly allow-list these system calls let's make sure we don't leak anything
+ * into the container. */
keyring = keyctl(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
if (keyring == -1) {
} else
#endif
{
- r = setup_seccomp(arg_caps_retain, arg_syscall_whitelist, arg_syscall_blacklist);
+ r = setup_seccomp(arg_caps_retain, arg_syscall_allow_list, arg_syscall_deny_list);
if (r < 0)
return r;
}
if ((arg_settings_mask & SETTING_SYSCALL_FILTER) == 0) {
- if (!arg_settings_trusted && !strv_isempty(settings->syscall_whitelist))
+ if (!arg_settings_trusted && !strv_isempty(settings->syscall_allow_list))
log_warning("Ignoring SystemCallFilter= settings, file %s is not trusted.", path);
else {
- strv_free_and_replace(arg_syscall_whitelist, settings->syscall_whitelist);
- strv_free_and_replace(arg_syscall_blacklist, settings->syscall_blacklist);
+ strv_free_and_replace(arg_syscall_allow_list, settings->syscall_allow_list);
+ strv_free_and_replace(arg_syscall_deny_list, settings->syscall_deny_list);
}
#if HAVE_SECCOMP
}
#endif
-static int maybe_resize_slave_device(const char *mountpath, dev_t main_devno) {
+static int maybe_resize_underlying_device(const char *mountpath, dev_t main_devno) {
_cleanup_free_ char *fstype = NULL, *devpath = NULL;
dev_t devno;
int r;
if (r < 0)
return log_error_errno(r, "Failed to determine block device of \"%s\": %m", arg_target);
- r = maybe_resize_slave_device(arg_target, devno);
+ r = maybe_resize_underlying_device(arg_target, devno);
if (r < 0)
return r;
"1::2::3 multi.colon\n"
"::0 some.where some.other\n"
- "0.0.0.0 black.listed\n"
+ "0.0.0.0 deny.listed\n"
"::5\t\t\t \tsome.where\tsome.other foobar.foo.foo\t\t\t\n"
" \n", f);
assert_se(fflush_and_check(f) >= 0);
assert_se( set_contains(hosts.no_address, "some.where"));
assert_se( set_contains(hosts.no_address, "some.other"));
- assert_se( set_contains(hosts.no_address, "black.listed"));
+ assert_se( set_contains(hosts.no_address, "deny.listed"));
assert_se(!set_contains(hosts.no_address, "foobar.foo.foo"));
}
if (STR_IN_SET(field, "RestrictAddressFamilies",
"SystemCallFilter")) {
- int whitelist = 1;
+ int allow_list = 1;
const char *p = eq;
if (*p == '~') {
- whitelist = 0;
+ allow_list = 0;
p++;
}
if (r < 0)
return bus_log_create_error(r);
- r = sd_bus_message_append_basic(m, 'b', &whitelist);
+ r = sd_bus_message_append_basic(m, 'b', &allow_list);
if (r < 0)
return bus_log_create_error(r);
"Inserted module '%s'", kmod_module_get_name(mod));
else if (err == KMOD_PROBE_APPLY_BLACKLIST)
log_full(verbose ? LOG_INFO : LOG_DEBUG,
- "Module '%s' is blacklisted", kmod_module_get_name(mod));
+ "Module '%s' is deny-listed", kmod_module_get_name(mod));
else {
assert(err < 0);
const char *prefix,
unsigned long new_flags,
unsigned long flags_mask,
- char **blacklist,
+ char **deny_list,
FILE *proc_self_mountinfo) {
_cleanup_set_free_free_ Set *done = NULL;
* do not have any effect on future submounts that might get propagated, they might be writable. This includes
* future submounts that have been triggered via autofs.
*
- * If the "blacklist" parameter is specified it may contain a list of subtrees to exclude from the
- * remount operation. Note that we'll ignore the blacklist for the top-level path. */
+ * If the "deny_list" parameter is specified it may contain a list of subtrees to exclude from the
+ * remount operation. Note that we'll ignore the deny list for the top-level path. */
simplified = strdup(prefix);
if (!simplified)
if (!path_startswith(path, simplified))
continue;
- /* Ignore this mount if it is blacklisted, but only if it isn't the top-level mount
+ /* Ignore this mount if it is deny-listed, but only if it isn't the top-level mount
* we shall operate on. */
if (!path_equal(path, simplified)) {
- bool blacklisted = false;
+ bool deny_listed = false;
char **i;
- STRV_FOREACH(i, blacklist) {
+ STRV_FOREACH(i, deny_list) {
if (path_equal(*i, simplified))
continue;
continue;
if (path_startswith(path, *i)) {
- blacklisted = true;
- log_debug("Not remounting %s blacklisted by %s, called for %s",
+ deny_listed = true;
+ log_debug("Not remounting %s deny-listed by %s, called for %s",
path, *i, simplified);
break;
}
}
- if (blacklisted)
+ if (deny_listed)
continue;
}
const char *prefix,
unsigned long new_flags,
unsigned long flags_mask,
- char **blacklist) {
+ char **deny_list) {
_cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
int r;
if (r < 0)
return r;
- return bind_remount_recursive_with_mountinfo(prefix, new_flags, flags_mask, blacklist, proc_self_mountinfo);
+ return bind_remount_recursive_with_mountinfo(prefix, new_flags, flags_mask, deny_list, proc_self_mountinfo);
}
int bind_remount_one_with_mountinfo(
int repeat_unmount(const char *path, int flags);
int umount_recursive(const char *target, int flags);
-int bind_remount_recursive(const char *prefix, unsigned long new_flags, unsigned long flags_mask, char **blacklist);
-int bind_remount_recursive_with_mountinfo(const char *prefix, unsigned long new_flags, unsigned long flags_mask, char **blacklist, FILE *proc_self_mountinfo);
+int bind_remount_recursive(const char *prefix, unsigned long new_flags, unsigned long flags_mask, char **deny_list);
+int bind_remount_recursive_with_mountinfo(const char *prefix, unsigned long new_flags, unsigned long flags_mask, char **deny_list, FILE *proc_self_mountinfo);
int bind_remount_one_with_mountinfo(const char *path, unsigned long new_flags, unsigned long flags_mask, FILE *proc_self_mountinfo);
int mount_move_root(const char *path);
const uint32_t seccomp_local_archs[] = {
- /* Note: always list the native arch we are compiled as last, so that users can blacklist seccomp(), but our own calls to it still succeed */
+ /* Note: always list the native arch we are compiled as last, so that users can deny-list seccomp(), but our own calls to it still succeed */
#if defined(__x86_64__) && defined(__ILP32__)
SCMP_ARCH_X86,
/* If we previously wanted to forbid a syscall and now
* we want to allow it, then remove it from the list. */
- if (!(flags & SECCOMP_PARSE_INVERT) == !!(flags & SECCOMP_PARSE_WHITELIST)) {
+ if (!(flags & SECCOMP_PARSE_INVERT) == !!(flags & SECCOMP_PARSE_ALLOW_LIST)) {
r = hashmap_put(filter, INT_TO_PTR(id + 1), INT_TO_PTR(errno_num));
if (r < 0)
switch (r) {
return 0;
}
-int seccomp_restrict_address_families(Set *address_families, bool whitelist) {
+int seccomp_restrict_address_families(Set *address_families, bool allow_list) {
uint32_t arch;
int r;
if (r < 0)
return r;
- if (whitelist) {
+ if (allow_list) {
int af, first = 0, last = 0;
void *afp;
- /* If this is a whitelist, we first block the address families that are out of range and then
- * everything that is not in the set. First, we find the lowest and highest address family in
- * the set. */
+ /* If this is an allow list, we first block the address families that are out of
+ * range and then everything that is not in the set. First, we find the lowest and
+ * highest address family in the set. */
SET_FOREACH(afp, address_families, i) {
af = PTR_TO_INT(afp);
} else {
void *af;
- /* If this is a blacklist, then generate one rule for
- * each address family that are then combined in OR
- * checks. */
+ /* If this is a deny list, then generate one rule for each address family that are
+ * then combined in OR checks. */
SET_FOREACH(af, address_families, i) {
return r;
/* Go through all policies with lower values than that, and block them -- unless they appear in the
- * whitelist. */
+ * allow list. */
for (p = 0; p < max_policy; p++) {
bool good = false;
- /* Check if this is in the whitelist. */
+ /* Check if this is in the allow list. */
for (i = 0; i < ELEMENTSOF(permitted_policies); i++)
if (permitted_policies[i] == p) {
good = true;
}
}
- /* Blacklist all other policies, i.e. the ones with higher values. Note that all comparisons are
- * unsigned here, hence no need no check for < 0 values. */
+ /* Deny-list all other policies, i.e. the ones with higher values. Note that all comparisons
+ * are unsigned here, hence no need no check for < 0 values. */
r = seccomp_rule_add_exact(
seccomp,
SCMP_ACT_ERRNO(EPERM),
typedef enum SeccompParseFlags {
SECCOMP_PARSE_INVERT = 1 << 0,
- SECCOMP_PARSE_WHITELIST = 1 << 1,
+ SECCOMP_PARSE_ALLOW_LIST = 1 << 1,
SECCOMP_PARSE_LOG = 1 << 2,
SECCOMP_PARSE_PERMISSIVE = 1 << 3,
} SeccompParseFlags;
int seccomp_restrict_namespaces(unsigned long retain);
int seccomp_protect_sysctl(void);
int seccomp_protect_syslog(void);
-int seccomp_restrict_address_families(Set *address_families, bool whitelist);
+int seccomp_restrict_address_families(Set *address_families, bool allow_list);
int seccomp_restrict_realtime(void);
int seccomp_memory_deny_write_execute(void);
int seccomp_lock_personality(unsigned long personality);
} else if (STR_IN_SET(name, "SystemCallFilter", "RestrictAddressFamilies")) {
_cleanup_strv_free_ char **l = NULL;
- int whitelist;
+ int allow_list;
r = sd_bus_message_enter_container(m, 'r', "bas");
if (r < 0)
return bus_log_parse_error(r);
- r = sd_bus_message_read(m, "b", &whitelist);
+ r = sd_bus_message_read(m, "b", &allow_list);
if (r < 0)
return bus_log_parse_error(r);
if (r < 0)
return bus_log_parse_error(r);
- if (all || whitelist || !strv_isempty(l)) {
+ if (all || allow_list || !strv_isempty(l)) {
bool first = true;
char **i;
fputc('=', stdout);
}
- if (!whitelist)
+ if (!allow_list)
fputc('~', stdout);
STRV_FOREACH(i, l) {
r = bpf_devices_cgroup_init(&prog, CGROUP_DEVICE_POLICY_CLOSED, true);
assert_se(r >= 0);
- r = bpf_devices_whitelist_static(prog, cgroup_path);
+ r = bpf_devices_allow_list_static(prog, cgroup_path);
assert_se(r >= 0);
r = bpf_devices_apply_policy(prog, CGROUP_DEVICE_POLICY_CLOSED, true, cgroup_path, installed_prog);
r = bpf_devices_cgroup_init(&prog, CGROUP_DEVICE_POLICY_STRICT, true);
assert_se(r >= 0);
- r = bpf_devices_whitelist_device(prog, cgroup_path, "/dev/null", "rw");
+ r = bpf_devices_allow_list_device(prog, cgroup_path, "/dev/null", "rw");
assert_se(r >= 0);
- r = bpf_devices_whitelist_device(prog, cgroup_path, "/dev/random", "r");
+ r = bpf_devices_allow_list_device(prog, cgroup_path, "/dev/random", "r");
assert_se(r >= 0);
- r = bpf_devices_whitelist_device(prog, cgroup_path, "/dev/zero", "w");
+ r = bpf_devices_allow_list_device(prog, cgroup_path, "/dev/zero", "w");
assert_se(r >= 0);
r = bpf_devices_apply_policy(prog, CGROUP_DEVICE_POLICY_STRICT, true, cgroup_path, installed_prog);
assert_se(wrong == 0);
}
-static void test_policy_whitelist_major(const char *pattern, const char *cgroup_path, BPFProgram **installed_prog) {
+static void test_policy_allow_list_major(const char *pattern, const char *cgroup_path, BPFProgram **installed_prog) {
_cleanup_(bpf_program_unrefp) BPFProgram *prog = NULL;
unsigned wrong = 0;
int r;
r = bpf_devices_cgroup_init(&prog, CGROUP_DEVICE_POLICY_STRICT, true);
assert_se(r >= 0);
- r = bpf_devices_whitelist_major(prog, cgroup_path, pattern, 'c', "rw");
+ r = bpf_devices_allow_list_major(prog, cgroup_path, pattern, 'c', "rw");
assert_se(r >= 0);
r = bpf_devices_apply_policy(prog, CGROUP_DEVICE_POLICY_STRICT, true, cgroup_path, installed_prog);
assert_se(wrong == 0);
}
-static void test_policy_whitelist_major_star(char type, const char *cgroup_path, BPFProgram **installed_prog) {
+static void test_policy_allow_list_major_star(char type, const char *cgroup_path, BPFProgram **installed_prog) {
_cleanup_(bpf_program_unrefp) BPFProgram *prog = NULL;
unsigned wrong = 0;
int r;
r = bpf_devices_cgroup_init(&prog, CGROUP_DEVICE_POLICY_STRICT, true);
assert_se(r >= 0);
- r = bpf_devices_whitelist_major(prog, cgroup_path, "*", type, "rw");
+ r = bpf_devices_allow_list_major(prog, cgroup_path, "*", type, "rw");
assert_se(r >= 0);
r = bpf_devices_apply_policy(prog, CGROUP_DEVICE_POLICY_STRICT, true, cgroup_path, installed_prog);
assert_se(r >= 0);
if (add_mismatched) {
- r = bpf_devices_whitelist_major(prog, cgroup_path, "foobarxxx", 'c', "rw");
+ r = bpf_devices_allow_list_major(prog, cgroup_path, "foobarxxx", 'c', "rw");
assert_se(r < 0);
}
test_policy_closed(cgroup, &prog);
test_policy_strict(cgroup, &prog);
- test_policy_whitelist_major("mem", cgroup, &prog);
- test_policy_whitelist_major("1", cgroup, &prog);
+ test_policy_allow_list_major("mem", cgroup, &prog);
+ test_policy_allow_list_major("1", cgroup, &prog);
- test_policy_whitelist_major_star('c', cgroup, &prog);
- test_policy_whitelist_major_star('b', cgroup, &prog);
+ test_policy_allow_list_major_star('c', cgroup, &prog);
+ test_policy_allow_list_major_star('b', cgroup, &prog);
test_policy_empty(false, cgroup, &prog);
test_policy_empty(true, cgroup, &prog);
test(__func__, m, "exec-restrictnamespaces-no.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
test(__func__, m, "exec-restrictnamespaces-yes.service", 1, CLD_EXITED);
test(__func__, m, "exec-restrictnamespaces-mnt.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
- test(__func__, m, "exec-restrictnamespaces-mnt-blacklist.service", 1, CLD_EXITED);
+ test(__func__, m, "exec-restrictnamespaces-mnt-deny-list.service", 1, CLD_EXITED);
test(__func__, m, "exec-restrictnamespaces-merge-and.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
test(__func__, m, "exec-restrictnamespaces-merge-or.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
test(__func__, m, "exec-restrictnamespaces-merge-all.service", can_unshare ? 0 : EXIT_FAILURE, CLD_EXITED);
if (pid == 0) { /* Child? */
int fd;
- /* If we look at the default set (or one that includes it), whitelist instead of blacklist */
+ /* If we look at the default set (or one that includes it), allow-list instead of deny-list */
if (IN_SET(i, SYSCALL_FILTER_SET_DEFAULT, SYSCALL_FILTER_SET_SYSTEM_SERVICE))
r = seccomp_load_syscall_filter_set(SCMP_ACT_ERRNO(EUCLEAN), syscall_filter_sets + i, SCMP_ACT_ALLOW, true);
else
return true;
}
- /* no matches, so we should include this path only if we
- * have no whitelist at all */
+ /* no matches, so we should include this path only if we have no allow list at all */
if (strv_isempty(arg_include_prefixes))
return true;
ListenPort=
UseTimezone=
RouteTable=
+DenyList=
BlackList=
RequestOptions=
SendRelease=
DHCPv6Client=
UseAutonomousPrefix=
UseOnLinkPrefix=
+DenyList=
BlackList=
[DHCPServer]
EmitNTP=
[IPv6AcceptRA]
-BlackList=70:: 70::
\ No newline at end of file
+DenyList=70:: 70::
\ No newline at end of file
projects / thirdparty / systemd.git / commitdiff
