fix: PrivateDevices=true denies mknod and makes /dev noexec

desbma · Jan 31, 2025 · 7f5b3d5 · 7f5b3d5
1 parent 39e2aa4
commit 7f5b3d5
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/src/systemd/options.rs b/src/systemd/options.rs
@@ -1113,6 +1113,11 @@ pub(crate) fn build_options(
                     .collect(),
                 }),
                 OptionValueEffect::DenySyscalls(DenySyscalls::Class("raw-io")),
+                OptionValueEffect::DenyAction(ProgramAction::MknodSpecial),
+                OptionValueEffect::DenyExec(PathDescription::Base {
+                    base: "/dev/".into(),
+                    exceptions: vec![],
+                }),
             ])),
         }],
         updater: None,

diff --git a/tests/cl.rs b/tests/cl.rs
@@ -709,7 +709,7 @@ fn run_mknod() {
         .stdout(predicate::str::contains("ProtectSystem=strict\n").count(1))
         .stdout(predicate::str::contains("ProtectHome=tmpfs\n").count(1))
         .stdout(predicate::str::contains("PrivateTmp=true\n").count(1).or(predicate::str::contains("PrivateTmp=disconnected\n").count(1)))
-        .stdout(predicate::str::contains("PrivateDevices=true\n").count(1))
+        .stdout(predicate::str::contains("PrivateDevices=").not())
         .stdout(predicate::str::contains("ProtectKernelTunables=true\n").count(1))
         .stdout(predicate::str::contains("ProtectKernelModules=true\n").count(1))
         .stdout(predicate::str::contains("ProtectKernelLogs=true\n").count(1))