chiark
/
gitweb
/
~ianmdlvl
/
elogind.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
core: add new RestrictAddressFamilies= switch
[elogind.git]
/
src
/
core
/
execute.h
diff --git
a/src/core/execute.h
b/src/core/execute.h
index 5143fcaa5899ea1de5b794387807ddf6de2f3e7a..3c905cefae9eacab0cdf27799c68e51c82962915 100644
(file)
--- a/
src/core/execute.h
+++ b/
src/core/execute.h
@@
-33,13
+33,16
@@
typedef struct ExecRuntime ExecRuntime;
#include <stdbool.h>
#include <stdio.h>
#include <sched.h>
#include <stdbool.h>
#include <stdio.h>
#include <sched.h>
+#ifdef HAVE_SECCOMP
+#include <seccomp.h>
+
+#include "set.h"
+#endif
#include "list.h"
#include "util.h"
#include "fdset.h"
#include "list.h"
#include "util.h"
#include "fdset.h"
-typedef struct Unit Unit;
-
typedef enum ExecInput {
EXEC_INPUT_NULL,
EXEC_INPUT_TTY,
typedef enum ExecInput {
EXEC_INPUT_NULL,
EXEC_INPUT_TTY,
@@
-135,6
+138,12
@@
struct ExecContext {
char *utmp_id;
char *utmp_id;
+ bool selinux_context_ignore;
+ char *selinux_context;
+
+ bool apparmor_profile_ignore;
+ char *apparmor_profile;
+
char **read_write_dirs, **read_only_dirs, **inaccessible_dirs;
unsigned long mount_flags;
char **read_write_dirs, **read_only_dirs, **inaccessible_dirs;
unsigned long mount_flags;
@@
-151,6
+160,7
@@
struct ExecContext {
bool non_blocking;
bool private_tmp;
bool private_network;
bool non_blocking;
bool private_tmp;
bool private_network;
+ bool private_devices;
bool no_new_privileges;
bool no_new_privileges;
@@
-161,7
+171,15
@@
struct ExecContext {
* don't enter a trigger loop. */
bool same_pgrp;
* don't enter a trigger loop. */
bool same_pgrp;
- uint32_t *syscall_filter;
+ unsigned long personality;
+
+ Set *syscall_filter;
+ Set *syscall_archs;
+ int syscall_errno;
+ bool syscall_whitelist:1;
+
+ Set *address_families;
+ bool address_families_whitelist:1;
bool oom_score_adjust_set:1;
bool nice_set:1;
bool oom_score_adjust_set:1;
bool nice_set:1;
@@
-183,6
+201,7
@@
int exec_spawn(ExecCommand *command,
CGroupControllerMask cgroup_mask,
const char *cgroup_path,
const char *unit_id,
CGroupControllerMask cgroup_mask,
const char *cgroup_path,
const char *unit_id,
+ usec_t watchdog_usec,
int pipe_fd[2],
ExecRuntime *runtime,
pid_t *ret);
int pipe_fd[2],
ExecRuntime *runtime,
pid_t *ret);