diff options
| author | Franck Bui <fbui@suse.com> | 2020-11-25 09:47:46 +0100 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2020-11-25 09:54:28 +0100 |
| commit | c7faa23235694a1e803ba093cba6d6e0193a093e (patch) | |
| tree | ab5ae015897c3046f9e5e92bff38419e18924df8 | |
| parent | 48e0abb53588509f6da3110f225cb9333f35e5ad (diff) | |
| download | systemd-c7faa23235694a1e803ba093cba6d6e0193a093e.tar.gz | |
units: document why CAP_SYS_PTRACE is needed by journald
| -rw-r--r-- | units/systemd-journald.service.in | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 1c43d8c863..eb4bd938d7 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,7 +16,6 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE DeviceAllow=char-* rw ExecStart=@rootlibexecdir@/systemd-journald FileDescriptorStoreMax=4224 @@ -42,6 +41,11 @@ SystemCallFilter=@system-service Type=notify @SERVICE_WATCHDOG@ +# In case you're wondering why CAP_SYS_PTRACE is needed, access to +# /proc/<pid>/exec requires this capability. Thus if this cap is missing +# _EXE/OBJECT_EXE fields will be missing from the journal entries. +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE + # If there are many split up journal files we need a lot of fds to access them # all in parallel. LimitNOFILE=@HIGH_RLIMIT_NOFILE@ |