From d995ccd7b55f403846093ceb61a149c9f52247d7 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 18 Nov 2022 14:58:30 +0100 Subject: [PATCH] update TODO --- TODO | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/TODO b/TODO index 78d8064c9d..cd80d05e7a 100644 --- a/TODO +++ b/TODO @@ -121,6 +121,12 @@ Deprecations and removals: Features: +* maybe prohibit setuid() to the nobody user, to lock things down, via seccomp. + the nobody is not a user any code should run under, ever, as that user would + possibly get a lot of access to resources it really shouldn't be getting + access to due to the userns + nfs semantics of the user. Alternatively: use + the seccomp log action, and allow it. + * sd-boot: add a new PE section .bls or so that carries a cpio with additional boot loader entries (both type1 and type2). Then when initializing, find this section, iterate through it and populate menu with it. cpio is simple enough