tree 43ad59a0c420fc506a8dcde8b8893982b1941687
parent 95fa8cc1f84d97f2cb565f758021fc48fdb183e9
author Darrick J. Wong <djwong@kernel.org> 1720041675 -0700
committer Darrick J. Wong <djwong@kernel.org> 1723064179 -0700

xfs_scrub_all: tighten up the security on the background systemd service

Currently, xfs_scrub_all has to run with enough privileges to find
mounted XFS filesystems and the device associated with that mount and to
start xfs_scrub@<mountpoint> sub-services.  Minimize the risk of
xfs_scrub_all escaping its service container or contaminating the rest
of the system by using systemd's sandboxing controls to prohibit as much
access as possible.

The directives added by this patch were recommended by the command
'systemd-analyze security xfs_scrub_all.service' in systemd 249.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>