serv/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2024-12-26 00:13:47 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

log when mox root process cannot forward signals to unprivileged child

Browse source 
and give the mox.service permissions to send such signals.
This commit is contained in:
Mechiel Lukkien 2024-11-21 21:59:36 +01:00
parent 3d4cd00430
commit 32d4e9a14c
No known key found for this signature in database
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
mox-/forkexec_unix.go
View file

@ -59,8 +59,11 @@ func ForkExecUnprivileged() {
sigc := make(chan os.Signal, 1) sigc := make(chan os.Signal, 1)
signal.Notify(sigc, os.Interrupt, syscall.SIGTERM) signal.Notify(sigc, os.Interrupt, syscall.SIGTERM)
go func() { go func() {
sig := <-sigc for {
p.Signal(sig) sig := <-sigc
err := p.Signal(sig)
pkglog.Check(err, "forwarding signal root to unprivileged process")
}
}() }()
st, err := p.Wait() st, err := p.Wait()

2
mox.service
View file

@ -23,7 +23,7 @@ ReadWritePaths=/home/mox/config /home/mox/data
ProtectKernelTunables=yes ProtectKernelTunables=yes
ProtectControlGroups=yes ProtectControlGroups=yes
AmbientCapabilities= AmbientCapabilities=
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_CHOWN CAP_FSETID CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_NET_BIND_SERVICE CAP_CHOWN CAP_FSETID CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_KILL
NoNewPrivileges=yes NoNewPrivileges=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
ProtectProc=invisible ProtectProc=invisible