system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-09-30 05:15:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

units: enable MaxConnectionsPerSocket= for all our Accept=yes units

Browse source 
Let's make sure that user's cannot DoS services for other users so
easily, and enable MaxConnectionsPerSocket= by default for all of them.

Note that this is mostly paranoia for systemd-pcrextend.socket and
systemd-sysext.socket: the socket is only accessible to root anyway,
hence the accounting shouldn#t change anything. But this is just a
safety net, in preparation that we open up some functionality of these
services sooner or later.
This commit is contained in:
Lennart Poettering 2024-02-07 13:19:54 +01:00
parent 48930a5ded
commit 5d1e8cd3e0
4 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
units/systemd-coredump.socket
View file

@ -19,3 +19,4 @@ ListenSequentialPacket=/run/systemd/coredump
SocketMode=0600
Accept=yes
MaxConnections=16
MaxConnectionsPerSource=8

1
units/systemd-creds.socket
View file

@ -18,3 +18,4 @@ ListenStream=/run/systemd/io.systemd.Credentials
FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16

1
units/systemd-pcrextend.socket
View file

@ -20,6 +20,7 @@ ListenStream=/run/systemd/io.systemd.PCRExtend
FileDescriptorName=varlink
SocketMode=0600
Accept=yes
MaxConnectionsPerSource=16
[Install]
WantedBy=sockets.target

1
units/systemd-sysext.socket
View file

@ -20,6 +20,7 @@ ListenStream=/run/systemd/io.systemd.sysext
FileDescriptorName=varlink
SocketMode=0600
Accept=yes
MaxConnectionsPerSource=16
[Install]
WantedBy=sockets.target