SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: document RestrictFileSystemAccess= W^X hardening

Browse Source 
Describe the system-wide W^X rule and the new proc_mem.force_override=never
and seccomp prerequisites, and drop the advice to block writable and
executable mappings by other means, which the policy now does itself.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner
2026-08-31 23:33:40 +02:00
parent 62e665cacc
commit e0be975735
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-system.conf.xml
+7 -5
View File
@@ -553,6 +553,10 @@
shared libraries (<literal>mmap_file</literal>), and write-to-execute transitions such as JIT shared libraries (<literal>mmap_file</literal>), and write-to-execute transitions such as JIT
compilation (<literal>file_mprotect</literal>).</para> compilation (<literal>file_mprotect</literal>).</para>
<para>The policy also enforces W^X system-wide: no mapping may be writable and executable at the
same time, and a private file mapping that has been modified through copy-on-write may not be made
executable afterwards.</para>
<para>Since v262, files on overlayfs mounts are resolved to the layer that hosts their data, so <para>Since v262, files on overlayfs mounts are resolved to the layer that hosts their data, so
execution from an overlay whose data resides on a signed dm-verity device is permitted, while files execution from an overlay whose data resides on a signed dm-verity device is permitted, while files
in a writable upper layer are denied. This requires kernel v7.2 or newer; on older kernels execution from in a writable upper layer are denied. This requires kernel v7.2 or newer; on older kernels execution from
@@ -561,13 +565,11 @@
btrfs are unsupported.</para> btrfs are unsupported.</para>
<para>Note that, without further measures to secure the system, kexec can be used to circumvent <para>Note that, without further measures to secure the system, kexec can be used to circumvent
this. Writable and executable memory mappings can also be used to circumvent this, so they need to this.</para>
be blocked, which can be achieved using other LSMs, or on a per-service basis by using the
<varname>MemoryDenyWriteExecute=</varname> setting.</para>
<para>This requires the kernel to be booted with <literal>dm_verity.require_signatures=1</literal> <para>This requires the kernel to be booted with <literal>dm_verity.require_signatures=1</literal>
on the kernel command line and with BPF LSM enabled (<literal>lsm=...,bpf</literal>). If either and <literal>proc_mem.force_override=never</literal> on the kernel command line, and with BPF LSM
prerequisite is not met, PID 1 will refuse to complete startup.</para> enabled (<literal>lsm=...,bpf</literal>).</para>
<para>The value <literal>yes</literal> is equivalent to <literal>exec</literal>. Additional <para>The value <literal>yes</literal> is equivalent to <literal>exec</literal>. Additional
modes may be added in the future.</para> modes may be added in the future.</para>