Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

core: do not imply PrivateTmp with DynamicUser, create a private tmpfs instead #32724

Merged
merged 2 commits into from
Jun 17, 2024
Merged

core: do not imply PrivateTmp with DynamicUser, create a private tmpfs instead #32724

merged 2 commits into from
Jun 17, 2024
+244 −63

Commits on Jun 17, 2024

  1. core: do not imply PrivateTmp with DynamicUser, create a private tmpf… 

    …s instead

DynamicUser= enables PrivateTmp= implicitly to avoid files owned by reusable uids
leaking into the host. Change it to instead create a fully private tmpfs instance
instead, which also ensures the same result, since it has less impactful semantics
with respect to PrivateTmp=yes, which links the mount namespace to the host's /tmp
instead. If a user specifies PrivateTmp manually, let the existing behaviour
unchanged to ensure backward compatibility is not broken.
    @bluca
    bluca committed Jun 17, 2024
    Configuration menu
    Copy the full SHA
    0e551b0 View commit details
    Browse the repository at this point in the history

  2. portable: drop explicit PrivateTmp=yes from profiles 

    It is already implied by DynamicUser=yes if not set, but dropping it
allows users to instead define TemporaryFileSystem=/tmp/ /var/tmp/
in their portable services, which has fewer side effects.
    @bluca
    bluca committed Jun 17, 2024
    Configuration menu
    Copy the full SHA
    ac6f179 View commit details
    Browse the repository at this point in the history