d9bc1c3614
So far we set the "trusted.delegate" xattr on cgroups where delegation is on. This duplicates this behaviour with the "user.delegate" xattr. This has two benefits: 1. unprivileged clients can *read* the xattr. "systemd-cgls" can thus show delegated cgroups as such properly, even when invoked without privs 2. unprivileged systemd instances can set the xattr, i.e. when systemd --user delegates a cgroup to further payloads. This weakens security a tiny bit, given that code that got a cgroup delegated can manipulate the xattr, but I think that's OK, given they have a higher trust level regarding cgroups anyway, if they got a subtree delegated, and access controls on the cgroup itself are still enforced. Moreover PID 1 as the cgroup manager only sets these xattrs, never reads them — the xattr is primarily a way to tell payloads about the delegation, and it's strictly this one way.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list or join our IRC channel.
Stable branches with backported patches are available in the stable repo.