Once systemd itself is running in a security domain for SMACK,
it will fail to start countless tasks due to missing privileges
for mounted and created directory structures. For /run and shm
specifically, we grant all tasks access.
These 2 mounts are allowed to fail, which will happen if the
system is not running a SMACK enabled kernel or security=none is
passed to the kernel.
---
src/core/mount-setup.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index 4359f59..7845e88 100644
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -79,10 +79,18 @@ static const MountPoint mount_table[] = {
NULL, MNT_NONE },
{ "smackfs", "/sys/fs/smackfs", "smackfs",
"smackfsdef=*", MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
NULL, MNT_NONE },
+#ifdef HAVE_SMACK
+ { "tmpfs", "/dev/shm", "tmpfs",
"mode=1777,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
+ NULL, MNT_IN_CONTAINER },
+#endif
{ "tmpfs", "/dev/shm", "tmpfs",
"mode=1777", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
NULL, MNT_FATAL|MNT_IN_CONTAINER },
{ "devpts", "/dev/pts", "devpts",
"mode=620,gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
NULL, MNT_IN_CONTAINER },
+#ifdef HAVE_SMACK
+ { "tmpfs", "/run", "tmpfs",
"mode=755,smackfsroot=*", MS_NOSUID|MS_NODEV|MS_STRICTATIME,
+ NULL, MNT_IN_CONTAINER },
+#endif
{ "tmpfs", "/run", "tmpfs", "mode=755",
MS_NOSUID|MS_NODEV|MS_STRICTATIME,
NULL, MNT_FATAL|MNT_IN_CONTAINER },
{ "tmpfs", "/sys/fs/cgroup", "tmpfs", "mode=755",
MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_STRICTATIME,
--
1.8.1.3
_______________________________________________
systemd-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/systemd-devel
