https://bugzilla.redhat.com/show_bug.cgi?id=1856273
systemd-243.8-1.fc31.x86_64
"systemd-analyze security servicename"
this is nonsense:
System call blacklist defined for service, and @clock is included 0.1
System call blacklist defined for service, and @debug is included 0.1
System call blacklist defined for service, and @module is included 0.1
System call blacklist defined for service, and @mount is included 0.1
System call blacklist defined for service, and @raw-io is included 0.1
System call blacklist defined for service, and @reboot is included 0.1
System call blacklist defined for service, and @swap is included 0.1
this is correct:
System call blacklist defined for service, and @PRIVILEGED is not included 0.2
System call blacklist defined for service, and @resources is not included 0.2
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie mbind migrate_pages mount move_pages open_by_handle_at perf_event_open pivot_root process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon umount2 uselib vmsplice
https://bugzilla.redhat.com/show_bug.cgi?id=1856273
systemd-243.8-1.fc31.x86_64
"systemd-analyze security servicename"
this is nonsense:
System call blacklist defined for service, and @clock is included 0.1
System call blacklist defined for service, and @debug is included 0.1
System call blacklist defined for service, and @module is included 0.1
System call blacklist defined for service, and @mount is included 0.1
System call blacklist defined for service, and @raw-io is included 0.1
System call blacklist defined for service, and @reboot is included 0.1
System call blacklist defined for service, and @swap is included 0.1
this is correct:
System call blacklist defined for service, and @PRIVILEGED is not included 0.2
System call blacklist defined for service, and @resources is not included 0.2
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie mbind migrate_pages mount move_pages open_by_handle_at perf_event_open pivot_root process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon umount2 uselib vmsplice