units: add a basic SystemCallFilter (#3471)

System Internals / systemd - Topi Miettinen [users.noreply.github.com] - 9 June 2016 02:32 UTC

Add a line SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace for daemons shipped by systemd. As an exception, systemd-timesyncd needs @clock system calls and systemd-localed is not privileged. ptrace(2) is blocked to prevent seccomp escapes.

40093ce units: add a basic SystemCallFilter (#3471)
units/systemd-hostnamed.service.in | 1 +
units/systemd-importd.service.in | 1 +
units/systemd-journald.service.in | 1 +
units/systemd-localed.service.in | 1 +
units/systemd-logind.service.in | 1 +
units/systemd-machined.service.in | 1 +
units/systemd-networkd.service.m4.in | 1 +
units/systemd-resolved.service.m4.in | 1 +
units/systemd-timedated.service.in | 1 +
units/systemd-timesyncd.service.in | 1 +
10 files changed, 10 insertions(+)

Upstream: github.com

  • Share