From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Thu, 10 Jul 2025 04:30:07 +0000 (+0900)
Subject: core: add 'DefaultRestrictSUIDSGID' config option (#38126)
X-Git-Tag: v258-rc1~128
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1cf5b39d64e980add79ff1b088088bbf4dc45817;p=thirdparty%2Fsystemd.git

core: add 'DefaultRestrictSUIDSGID' config option (#38126)

closes #37602, see there for extra motivation and considered
alternatives.

On typical systems, only few services need to create SUID/SGID files.
This often is limited to the user explicitly setting suid/sgid, the
`systemd-tmpfiles*` services, and the package manager. Allowing a
default to globally restrict creation of suid/sgid files makes it easier
to apply this restriction precisely.

## testing done
- built on aarch64-linux and x86_64-linux
- ran a VM test on x86_64-linux, checking for:
    - VM system boots successfully
    - defaults apply (both `yes`, `no`, and undefined)
    - systemd tmpfiles can set suid/sgid on journal log path
- Other services explicitly defining `RestrictSUIDSGID=no` can create
suid files
---

1cf5b39d64e980add79ff1b088088bbf4dc45817