From 46657f637cc7875c9afbab5f138b59e1fb1c7e3c Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 11 May 2018 00:17:38 +0900 Subject: [PATCH] units: set RestrictNamespaces=yes to networkd and resolved Closes #8949. --- units/systemd-networkd.service.in | 1 + units/systemd-resolved.service.in | 1 + 2 files changed, 2 insertions(+) diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 63ee7354151..d05b3347220 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -33,6 +33,7 @@ ProtectControlGroups=yes ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index c4c7f1feef9..a939f7259cd 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -37,6 +37,7 @@ ProtectKernelTunables=yes ProtectKernelModules=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native -- 2.47.3