Conversation

Notices

1. Embed this notice
   bluca@fosstodon.org's status on Saturday, 20-Apr-2024 07:35:57 JST bluca

   in reply to

   • Lennart Poettering
   • Richard Hughes

   @hughsie @pid_eins it's not documented, but you can see the list here: https://github.com/systemd/systemd/blob/bf49f3bb441b58c40b3e595bc5a5561051719d1c/src/shared/seccomp-util.c#L884

   and yes, that includes mlock

   • James Morris likes this.
   • Embed this notice
     Richard Hughes (hughsie@mastodon.social)'s status on Saturday, 20-Apr-2024 07:35:58 JST Richard Hughes

     • Lennart Poettering

     @pid_eins is it expected a service can do mlock() when it has just allow-listed SystemCallFilter=@system-service? I couldn't find any docs on what caps system-service actually maps to.

     We're trying to move from denying-listing caps to allow-listing in #fwupd. Thanks!