mirror of
https://github.com/systemd/systemd
synced 2024-07-21 10:17:21 +00:00
8aee931e7a
This adds a small, socket-activated Varlink daemon that can delegate UID ranges for user namespaces to clients asking for it. The primary call is AllocateUserRange() where the user passes in an uninitialized userns fd, which is then set up. There are other calls that allow assigning a mount fd to a userns allocated that way, to set up permissions for a cgroup subtree, and to allocate a veth for such a user namespace. Since the UID assignments are supposed to be transitive, i.e. not permanent, care is taken to ensure that users cannot create inodes owned by these UIDs, so that persistancy cannot be acquired. This is implemented via a BPF-LSM module that ensures that any member of a userns allocated that way cannot create files unless the mount it operates on is owned by the userns itself, or is explicitly allowelisted. BPF LSM program with contributions from Alexei Starovoitov.
55 lines
1.5 KiB
Plaintext
55 lines
1.5 KiB
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
# Settings for systemd units distributed with systemd itself. Most of these
|
|
# should be enabled by default, even if the distribution follows a general
|
|
# default-off policy.
|
|
|
|
enable remote-fs.target
|
|
enable remote-cryptsetup.target
|
|
enable machines.target
|
|
|
|
enable getty@.service
|
|
|
|
enable systemd-boot-update.service
|
|
enable systemd-confext.service
|
|
enable systemd-homed.service
|
|
enable systemd-homed-activate.service
|
|
enable systemd-homed-firstboot.service
|
|
enable systemd-journald-audit.socket
|
|
enable systemd-network-generator.service
|
|
enable systemd-networkd-wait-online.service
|
|
enable systemd-networkd.service
|
|
enable systemd-nsresourced.socket
|
|
enable systemd-pstore.service
|
|
enable systemd-resolved.service
|
|
enable systemd-sysext.service
|
|
enable systemd-timesyncd.service
|
|
enable systemd-userdbd.socket
|
|
|
|
disable console-getty.service
|
|
disable debug-shell.service
|
|
|
|
disable exit.target
|
|
disable halt.target
|
|
disable kexec.target
|
|
disable poweroff.target
|
|
enable reboot.target
|
|
disable rescue.target
|
|
|
|
disable proc-sys-fs-binfmt_misc.mount
|
|
|
|
disable syslog.socket
|
|
|
|
disable systemd-boot-check-no-failures.service
|
|
disable systemd-journal-gatewayd.*
|
|
disable systemd-journal-remote.*
|
|
disable systemd-journal-upload.*
|
|
disable systemd-time-wait-sync.service
|