Merge pull request #8766 from poettering/syscall-filter-service

add a new `@system-service` syscall group that is good as a starting point for whitelisting syscalls

1 files changed, 9 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index c9fa0ee7e1..da2d9defca 100644
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,15 @@ CHANGES WITH 239 in spe:
           both runtime and persistent enablement/masking, i.e. it will remove
           any relevant symlinks both in /run and /etc.
 
+        * Note that all long-running system services shipped with systemd will
+          now default to a system call whitelist (rather than a blacklist, as
+          before). In particular, systemd-udevd will now enforce one too. For
+          most cases this should be safe, however downstream distributions
+          which disabled sandboxing of systemd-udevd (specifically the
+          MountFlags= setting), might want to disable this security feature
+          too, as the default whitelisting will prohibit all mount, swap,
+          reboot and clock changing operations from udev rules.
+
         * sd-boot acquired new loader configuration settings to optionally turn
           off Windows and MacOS boot partition discovery as well as
           reboot-into-firmware menu items. It is also able to pick a better