tree 17f1e328557c36ee5de5f0db4fed89e9f6ff322d
parent 159f77a02443e92ba381e253a8fad33406205b7c
author Darrick J. Wong <djwong@kernel.org> 1720041675 -0700
committer Darrick J. Wong <djwong@kernel.org> 1723064179 -0700

xfs_scrub_fail: tighten up the security on the background systemd service

Currently, xfs_scrub_fail has to run with enough privileges to access
the journal contents for a given scrub run and to send a report via
email.  Minimize the risk of xfs_scrub_fail escaping its service
container or contaminating the rest of the system by using systemd's
sandboxing controls to prohibit as much access as possible.

The directives added by this patch were recommended by the command
'systemd-analyze security xfs_scrub_fail@.service' in systemd 249.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>