Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop ambient capabilities #228

Merged
merged 3 commits into from
Nov 24, 2020
Merged

Drop ambient capabilities #228

merged 3 commits into from
Nov 24, 2020

Conversation

stevegrubb
Copy link
Contributor

When systemd starts a daemon with capabilities, it uses ambient capabilities
to do so. If not dropped, the capabilities can spread to any child process.
This is usually not necessary and its a good idea to drop them if not
needed.

When systemd starts a daemon with capabilities, it uses ambient capabilities
to do so. If not dropped, the capabilities can spread to any child process.
This is usually not necessary and its a good idea to drop them if not
needed.
@stevegrubb stevegrubb mentioned this pull request Nov 23, 2020
@rfjakob
Copy link
Owner

rfjakob commented Nov 24, 2020

Can you add the whole explanation as a code comment? Will help to understand why this is needed.

When systemd starts a daemon with capabilities, it uses ambient capabilities
to do so. If not dropped, the capabilities can spread to any child process.
This is usually not necessary and its a good idea to drop them if not
needed.

@stevegrubb
Copy link
Contributor Author

It's added now.

@rfjakob rfjakob merged commit 9edc5cf into rfjakob:master Nov 24, 2020
@rfjakob
Copy link
Owner

rfjakob commented Nov 24, 2020

Merged, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants