deblan-mirror/reaction
1
0
Fork 0
mirror of https://framagit.org/ppom/reaction synced 2026-03-14 12:45:47 +01:00
Code Issues Projects Releases Packages Wiki Activity

Set CapabiltyBoundingSet again

Browse source
This commit is contained in:
ppom 2026-02-12 12:00:00 +01:00
commit a8cd1af78d
No known key found for this signature in database
2 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/concepts/plugin.rs
View file

@ -53,6 +53,8 @@ fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<Stri
// Various Protections
("LockPersonality", vec!["true"]),
("NoNewPrivileges", vec!["true"]),
("AmbientCapabilities", vec![""]),
("CapabilityBoundingSet", vec![""]),
// Isolate File
("RemoveIPC", vec!["true"]),
("RestrictNamespaces", vec!["true"]),
@ -67,7 +69,6 @@ fn systemd_default_options(working_directory: &str) -> BTreeMap<String, Vec<Stri
// ("DynamicUser", vec!["true"]),
// ("User", vec!["reaction-plugin-test"]),
// Too restrictive
// ("CapabilityBoundingSet", vec![""]),
// ("NoExecPaths", vec!["/"]),
// ("RestrictAddressFamilies", vec![""]),
]

2
tests/test-conf/test-ipset.jsonnet
View file

@ -13,7 +13,7 @@
path: './target/debug/reaction-plugin-ipset',
check_root: false,
systemd_options: {
AmbientCapabilities: ['CAP_NET_ADMIN'],
CapabilityBoundingSet: ['~CAP_NET_ADMIN', '~CAP_PERFMON'],
},
},
},