core:sandbox: remove CAP_SYS_RAWIO on PrivateDevices=yes

The rawio system calls were filtered, but CAP_SYS_RAWIO allows to access raw
data through /proc, ioctl and some other exotic system calls...

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 3bea4976b379fce39c5fd32bcff387208889bcc1..c46c0f6dd88f16314fd96c73f5daed40a52b1b35 100644 (file)
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -946,8 +946,8 @@
         <filename>/dev/port</filename> and others. This is useful to securely turn off physical device access by the
         executed process. Defaults to false. Enabling this option will install a system call filter to block low-level
         I/O system calls that are grouped in the <varname>@raw-io</varname> set, will also remove
-        <constant>CAP_MKNOD</constant> from the capability bounding set for the unit (see above), and set
-        <varname>DevicePolicy=closed</varname> (see
+        <constant>CAP_MKNOD</constant> and <constant>CAP_SYS_RAWIO</constant> from the capability bounding set for
+        the unit (see above), and set <varname>DevicePolicy=closed</varname> (see
         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
         for details). Note that using this setting will disconnect propagation of mounts from the service to the host
         (propagation in the opposite direction continues to work).  This means that this setting may not be used for

diff --git a/src/core/unit.c b/src/core/unit.c
index 71f95c0b96aa639c42fc33c6af65931411673e7e..67668bdc480e3edca7cd4f8da7a8a13b2a3de4d9 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -3399,7 +3399,7 @@ int unit_patch_contexts(Unit *u) {
                         ec->no_new_privileges = true;
 
                 if (ec->private_devices)
-                        ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_MKNOD);
+                        ec->capability_bounding_set &= ~((UINT64_C(1) << CAP_MKNOD) | (UINT64_C(1) << CAP_SYS_RAWIO));
 
                 if (ec->protect_kernel_modules)
                         ec->capability_bounding_set &= ~(UINT64_C(1) << CAP_SYS_MODULE);