dilim/systemd

mirror of https://github.com/systemd/systemd.git synced 2026-08-13 06:32:22 +00:00

Go to file

Nicolas Iooss 3a0bf6d6aa namespace: keep selinuxfs mounted read-write with ProtectKernelTunables (#5741 )

When a service unit uses "ProtectKernelTunables=yes", it currently
remounts /sys/fs/selinux read-only. This makes libselinux report SELinux
state as "disabled", because most SELinux features are not usable. For
example it is not possible to validate security contexts (with
security_check_context_raw() or /sys/fs/selinux/context). This behavior
of libselinux has been described in
http://danwalsh.livejournal.com/73099.html and confirmed in a recent
email, https://marc.info/?l=selinux&m=149220233032594&w=2 .

Since commit 0c28d51ac8 ("units: further lock down our long-running
services"), systemd-localed unit uses ProtectKernelTunables=yes.
Nevertheless this service needs to use libselinux API in order to create
/etc/vconsole.conf, /etc/locale.conf... with the right SELinux contexts.
This is broken when /sys/fs/selinux is mounted read-only in the mount
namespace of the service.

Make SELinux-aware systemd services work again when they are using
ProtectKernelTunables=yes by keeping selinuxfs mounted read-write.

2017-07-31 17:45:33 +02:00

github: how to report bugs for older distribution versions (#6146 )

2017-06-20 20:20:25 +02:00

mkosi.arch: fix comment (#6470 )

2017-07-28 09:24:12 +02:00

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

tree-wide: drop NULL sentinel from strjoin

2016-10-23 11:43:27 -04:00

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

factory: remove broken pam_limits

2014-07-30 15:21:54 +02:00

hwdb: Add axis range for System76 Galago Pro (galp2) (#6439 )

2017-07-25 11:35:58 +10:00

Merge pull request #6462 from keszybz/man-tweaks

2017-07-28 11:49:44 +02:00

build-sys: drop automake support

2017-07-18 10:04:44 -04:00

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

shell-completion

Merge pull request #6465 from keszybz/drop-kdbus

2017-07-28 09:29:07 +02:00

namespace: keep selinuxfs mounted read-write with ProtectKernelTunables (#5741 )

2017-07-31 17:45:33 +02:00

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

build-sys: drop automake support

2017-07-18 10:04:44 -04:00

units,sysusers: use DynamicUser= for journal-gatewayd and drop user systemd-journal-gateway from sysusers

2017-07-28 13:37:10 +09:00

Drop bus-policy bits

2017-07-23 09:29:02 -04:00

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

meson: install the git hook (#6425 )

2017-07-24 10:41:45 +02:00

Merge pull request #6472 from yuwata/journal-gateway-fix

2017-07-31 12:11:48 +02:00

login: support user-bus on dbus1

2015-08-31 18:12:37 +02:00

.dir-locals.el

meson: also indent scripts with 8 spaces

2017-04-25 08:49:16 -04:00

.editorconfig

editors: only extend line width to 119 for C and XML files

2016-02-10 12:29:32 +01:00

.gitattributes

git: indicate that tabs are never OK in the systemd tree

2013-10-30 02:25:38 +01:00

.gitignore

build-sys: drop gitignore patterns for in-tree builds

2017-07-18 10:05:06 -04:00

.mailmap

mailmap: add entry

2017-07-18 10:04:44 -04:00

.travis.yml

remove gudev and gtk-doc

2015-06-03 00:22:53 +02:00

.vimrc

vimrc: fix indentation logic for our docbook xml files

2016-04-29 12:23:34 +02:00

.ycm_extra_conf.py

ycm: update flag blacklist

2014-06-04 15:41:10 -04:00

CODING_STYLE

tree-wide: set SA_RESTART for signal handlers we install

2016-12-01 12:41:17 +01:00

configure

build-sys: add basic support for ./configure && make && make install

2017-07-18 10:05:06 -04:00

DISTRO_PORTING

DISTRO_PORTING: document that distros may/should change fallback DNS as well as fallback NTP if they wish

2017-07-24 11:49:16 +02:00

ENVIRONMENT.md

Rename $TEST_DIR to $SYSTEMD_TEST_DATA, document it

2017-02-16 21:36:31 +01:00

HACKING

HACKING: update for meson

2017-07-18 10:05:06 -04:00

LICENSE.GPL2

relicense to LGPLv2.1 (with exceptions)

2012-04-12 00:24:39 +02:00

LICENSE.LGPL2.1

licence: remove references to old FSF address

2012-12-17 11:41:31 +01:00

Makefile

build-sys: add basic support for ./configure && make && make install

2017-07-18 10:05:06 -04:00

meson_options.txt

Merge pull request #6365 from keszybz/fast-tests

2017-07-28 11:09:50 +02:00

meson.build

Merge pull request #6365 from keszybz/fast-tests

2017-07-28 11:09:50 +02:00

mkosi.build

mkosi: use '[' rather than 'test' everywhere

2017-07-20 14:37:05 +02:00

mkosi.default

mkosi: create .mkosi directory

2016-10-06 11:53:58 -04:00

NEWS

NEWS: say that libidn2 is experimental (#6335 )

2017-07-12 09:25:59 +02:00

README

README: document that max_bonds=0 is the way to go for bonding.ko

2017-07-24 11:49:16 +02:00

README.md

README: include small graphs of open issues and pull requests (#5576 )

2017-03-13 08:10:04 +01:00

TODO

Drop kdbus bits

2017-07-23 12:01:54 -04:00

README.md

systemd - System and Service Manager

Details

General information about systemd can be found in the systemd Wiki.

Information about build requirements are provided in the README file.

Consult our NEWS file for information about what's new in the most recent systemd versions.

Please see the HACKING file for information how to hack on systemd and test your modifications.

Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.

When preparing patches for systemd, please follow our Coding Style Guidelines.

If you are looking for support, please contact our mailing list or join our IRC channel.