system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-09-30 05:15:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

man/systemd.exec: list inaccessible files for ProtectKernelTunables

Browse source
This commit is contained in:
Maximilian Wilhelm 2024-06-19 13:41:39 +02:00 committed by Yu Watanabe
parent 5f7136a369
commit 163bb43cea
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
man/systemd.exec.xml
View file

@ -2022,8 +2022,9 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<filename>/proc/sys/</filename>, <filename>/sys/</filename>, <filename>/proc/sysrq-trigger</filename>,
<filename>/proc/latency_stats</filename>, <filename>/proc/acpi</filename>,
<filename>/proc/timer_stats</filename>, <filename>/proc/fs</filename> and <filename>/proc/irq</filename> will
be made read-only to all processes of the unit. Usually, tunable kernel variables should be initialized only at
boot-time, for example with the
be made read-only and <filename>/proc/kallsyms</filename> as well as <filename>/proc/kcore</filename> will be
inaccessible to all processes of the unit.
Usually, tunable kernel variables should be initialized only at boot-time, for example with the
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> mechanism. Few
services need to write to these at runtime; it is hence recommended to turn this on for most services. For this
setting the same restrictions regarding mount propagation and privileges apply as for