Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

core: do not enforce PrivateTmp with DynamicUser if /tmp and /var/tmp are already private tmpfs #32724

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

core: do not enforce PrivateTmp with DynamicUser if /tmp and /var/tmp are already private tmpfs #32724

wants to merge 2 commits into from
+60 −34

Commits on May 22, 2024

  1. core: do not enforce PrivateTmp with DynamicUser if /tmp and /var/tmp… 

    … are tmpfs

DynamicUser= enables PrivateTmp= implicitly to avoid files owned by reusable uids
leaking into the host. Configuring TemporaryFileSystem=/tmp/ /var/ also ensures
this, so allow it as an alternative, since it has less impactful semantics with
respect to PrivateTmp=yes, which links the mount namespace to the host's /tmp
instead.
    @bluca
    bluca committed May 22, 2024
    Configuration menu
    Copy the full SHA
    44cca42 View commit details
    Browse the repository at this point in the history

  2. portable: drop explicit PrivateTmp=yes from profiles 

    It is already implied by DynamicUser=yes if not set, but dropping it
allows users to instead define TemporaryFileSystem=/tmp/ /var/tmp/
in their portable services, which has fewer side effects.
    @bluca
    bluca committed May 22, 2024
    Configuration menu
    Copy the full SHA
    bf4784a View commit details
    Browse the repository at this point in the history