system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 02:05:05 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

units: add ProtectClock=yes

Browse source 
Add `ProtectClock=yes` to systemd units. Since it implies certain
`DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so
they are still able to access other devices. Exclude timesyncd and timedated.
This commit is contained in:
Topi Miettinen 2020-04-02 21:18:11 +03:00 committed by Lennart Poettering
parent c3362c2f97
commit cabc1c6d7a
6 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
units/systemd-journal-remote.service.in
View file

@ -21,6 +21,7 @@ NoNewPrivileges=yes
PrivateDevices=yes PrivateDevices=yes
PrivateNetwork=yes PrivateNetwork=yes
PrivateTmp=yes PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectHome=yes ProtectHome=yes
ProtectHostname=yes ProtectHostname=yes

1
units/systemd-journald.service.in
View file

@ -25,6 +25,7 @@ LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
OOMScoreAdjust=-250 OOMScoreAdjust=-250
ProtectClock=yes
Restart=always Restart=always
RestartSec=0 RestartSec=0
RestrictAddressFamilies=AF_UNIX AF_NETLINK RestrictAddressFamilies=AF_UNIX AF_NETLINK

1
units/systemd-logind.service.in
View file

@ -36,6 +36,7 @@ LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
PrivateTmp=yes PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectHome=yes ProtectHome=yes
ProtectHostname=yes ProtectHostname=yes

1
units/systemd-networkd.service.in
View file

@ -26,6 +26,7 @@ ExecStart=!!@rootlibexecdir@/systemd-networkd
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
ProtectClock=yes
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectHome=yes ProtectHome=yes
ProtectKernelModules=yes ProtectKernelModules=yes

1
units/systemd-resolved.service.in
View file

@ -28,6 +28,7 @@ MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=yes PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectHome=yes ProtectHome=yes
ProtectKernelModules=yes ProtectKernelModules=yes

3
units/systemd-udevd.service.in
View file

@ -16,6 +16,8 @@ Before=sysinit.target
ConditionPathIsReadWrite=/sys ConditionPathIsReadWrite=/sys
[Service] [Service]
DeviceAllow=block-* rwm
DeviceAllow=char-* rwm
Type=notify Type=notify
# Note that udev also adjusts the OOM score internally and will reset the value internally for its workers # Note that udev also adjusts the OOM score internally and will reset the value internally for its workers
OOMScoreAdjust=-1000 OOMScoreAdjust=-1000
@ -27,6 +29,7 @@ ExecReload=udevadm control --reload --timeout 0
KillMode=mixed KillMode=mixed
TasksMax=infinity TasksMax=infinity
PrivateMounts=yes PrivateMounts=yes
ProtectClock=yes
ProtectHostname=yes ProtectHostname=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6