]> git.apps.os.sepia.ceph.com Git - xfsprogs-dev.git/commit
xfs_scrub: use dynamic users when running as a systemd service
authorDarrick J. Wong <djwong@kernel.org>
Mon, 29 Jul 2024 23:23:15 +0000 (16:23 -0700)
committerDarrick J. Wong <djwong@kernel.org>
Tue, 30 Jul 2024 00:01:09 +0000 (17:01 -0700)
commitf4481b55c9aeedfb8e53c25063542add00e21991
treee6bd0a45a3a5d259fed4d7f55dab7bc3d848a24d
parent4b1ec6e0b5b83128b4b0c4e32cef7e7f27be85a1
xfs_scrub: use dynamic users when running as a systemd service

Five years ago, systemd introduced the DynamicUser directive that
allocates a new unique user/group id, runs a service with those ids, and
deletes them after the service exits.  This is a good replacement for
User=nobody, since it eliminates the threat of nobody-services messing
with each other.

Make this transition ahead of all the other security tightenings that
will land in the next few patches, and add credits for the people who
suggested the change and reviewed it.

Link: https://0pointer.net/blog/dynamic-users-with-systemd.html
Suggested-by: Helle Vaanzinn <glitsj16@riseup.net>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
scrub/xfs_scrub@.service.in