From e4e022f9db759b5e45ff08974b12e050d5f4f769 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Thu, 12 Apr 2018 10:34:11 -0500 Subject: [PATCH] xfs_scrub: disable private /tmp for scrub service Don't make /tmp private when invoking xfs_scrub as a service, because /tmp might contain or itself be an xfs filesystem mountpoint. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen Signed-off-by: Eric Sandeen --- scrub/xfs_scrub@.service.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scrub/xfs_scrub@.service.in b/scrub/xfs_scrub@.service.in index c14f8138f..56acea671 100644 --- a/scrub/xfs_scrub@.service.in +++ b/scrub/xfs_scrub@.service.in @@ -9,7 +9,8 @@ WorkingDirectory=%I PrivateNetwork=true ProtectSystem=full ProtectHome=read-only -PrivateTmp=yes +# Disable private /tmp just in case %i is a path under /tmp. +PrivateTmp=no AmbientCapabilities=CAP_SYS_ADMIN CAP_FOWNER CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_SYS_RAWIO NoNewPrivileges=yes User=nobody -- 2.47.2