|
On 12/12/2016 04:02 PM, Lennart
Poettering wrote:
Hmm, yeah, I should probably blog more about all the nice sandboxing features we have now in systemd. There's quite some stuff now we should enable wherever we can. Specifically ProtectSystem=, ProtectHome=, ProtectKernelTunables=, ProtectKernelModules=, ProtectedControlGroups=, PrivateUsers=, PrivateTmp=, PrivateDevices=, PrivateNetwork=, SystemCallFilter=, RestrictAddressFamilies=, RestrictNamespaces=, MemoryDenyWriteExecute=, RestrictRealtime=. For now, the only docs available for them are the man pages. Not all of them are available on all currently maintained Fedoras, but a good chunk is. That wasn't quite easy to find although it does make sense in retrospect: man systemd.exec man -k ProtectSystem and man systemd|grep ProtectSystem didn't
show anything because they don't really index the man pages.
While looking for this, I came up with a useful technique for
combing through man pages: maybe it'll be useful to someone: for a in $(man -k systemd | cut -f 1 -d ' ') ; do echo $a; man $a | grep ProtectSystem ; done (the $(man .. cut) combo returns the names of all man pages
relevant to systemd, and then we grep through their content)
|
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
