SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mountfsd: Add CAP_SYS_PTRACE and CAP_SYS_CHROOT

Browse Source 
CAP_SYS_PTRACE for making sure we can open mount namespaces of
peers via /proc/<pid>/ns and CAP_SYS_CHROOT for making sure we can
join those mount namespaces.
This commit is contained in:
Daan De Meyer
2026-03-20 19:19:10 +01:00
committed by Daan De Meyer
parent 93f1546b93
commit bb7486db61
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
units/systemd-mountfsd.service.in
+1 -1
View File
@@ -18,7 +18,7 @@ Before=sysinit.target shutdown.target
DefaultDependencies=no DefaultDependencies=no
[Service] [Service]
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_RESOURCE CAP_BPF CAP_PERFMON CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_CHOWN CAP_SYS_ADMIN CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_RESOURCE CAP_BPF CAP_PERFMON CAP_SETGID CAP_SETUID CAP_DAC_OVERRIDE CAP_CHOWN CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_SYS_CHROOT
ExecStart={{LIBEXECDIR}}/systemd-mountfsd ExecStart={{LIBEXECDIR}}/systemd-mountfsd
IPAddressDeny=any IPAddressDeny=any
LimitNOFILE={{HIGH_RLIMIT_NOFILE}} LimitNOFILE={{HIGH_RLIMIT_NOFILE}}