chiark / gitweb /
units: conditionalize configfs and debugfs with CAP_SYS_RAWIO
authorLennart Poettering <lennart@poettering.net>
Fri, 4 Jul 2014 01:10:09 +0000 (03:10 +0200)
committerLennart Poettering <lennart@poettering.net>
Fri, 4 Jul 2014 01:24:42 +0000 (03:24 +0200)
We really don't want these in containers as they provide a too lowlevel
look on the system.

Conditionalize them with CAP_SYS_RAWIO since that's required to access
/proc/kcore, /dev/kmem and similar, which feel similar in style. Also,
npsawn containers lack that capability.

units/sys-kernel-config.mount
units/sys-kernel-debug.mount

index 020101c..21648ef 100644 (file)
@@ -11,6 +11,7 @@ Documentation=https://www.kernel.org/doc/Documentation/filesystems/configfs/conf
 Documentation=http://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
 DefaultDependencies=no
 ConditionPathExists=/sys/kernel/config
+ConditionCapability=CAP_SYS_RAWIO
 After=systemd-modules-load.service
 Before=sysinit.target
 
index 5369728..1e94387 100644 (file)
@@ -11,6 +11,7 @@ Documentation=https://www.kernel.org/doc/Documentation/filesystems/debugfs.txt
 Documentation=http://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
 DefaultDependencies=no
 ConditionPathExists=/sys/kernel/debug
+ConditionCapability=CAP_SYS_RAWIO
 Before=sysinit.target
 
 [Mount]