Hi, I need an apparently exotic configuration and I don't know how to approach the problem. Here are the requirements:
- [email protected] (systemd --user) + runs with Priv SMACK label (SmackProcessLabel in [email protected]) + has cap_mac_admin (and a few other capabilities) to assign SMACK labels to its children (AmbientCapabilities in [email protected]) - children (session services) run with Reg SMACK label (I added support for DefaultSmackProcessLabel to user.conf, to avoid modifications of all unit files) - children DO NOT inherit capabilites from systemd --user (they do now) This last is a problem because I'd like to avoid modifications of all service files. I tried to drop inheritable caps before execve() (in exec_child()) but as described in capabilities(7) this results in dropping caps from the ambient set too, which means systemd --user doens't get what it needs. Is there anything I am missing? Is there any way to start a service with UID!=0, some capabilities set but not implicitly inheritable by processes spawned by the service? Kind regards, -- Łukasz Stelmach Samsung R&D Institute Poland Samsung Electronics
signature.asc
Description: PGP signature
