mirror of
https://github.com/systemd/systemd
synced 2024-10-15 12:34:37 +00:00
units: document why CAP_SYS_PTRACE is needed by journald
This commit is contained in:
parent
48e0abb535
commit
c7faa23235
|
@ -16,7 +16,6 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a
|
|||
Before=sysinit.target
|
||||
|
||||
[Service]
|
||||
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
|
||||
DeviceAllow=char-* rw
|
||||
ExecStart=@rootlibexecdir@/systemd-journald
|
||||
FileDescriptorStoreMax=4224
|
||||
|
@ -42,6 +41,11 @@ SystemCallFilter=@system-service
|
|||
Type=notify
|
||||
@SERVICE_WATCHDOG@
|
||||
|
||||
# In case you're wondering why CAP_SYS_PTRACE is needed, access to
|
||||
# /proc/<pid>/exec requires this capability. Thus if this cap is missing
|
||||
# _EXE/OBJECT_EXE fields will be missing from the journal entries.
|
||||
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
|
||||
|
||||
# If there are many split up journal files we need a lot of fds to access them
|
||||
# all in parallel.
|
||||
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
|
||||
|
|
Loading…
Reference in a new issue