From: Darrick J. Wong Date: Thu, 11 Jun 2026 14:06:23 +0000 (-0700) Subject: xfs_healer: allow AF_UNIX socket access for xfs_healer instances X-Git-Tag: v7.1.0~40 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=a0f50dec35402126724d7ff36c2a65199cd4d77a;p=xfsprogs-dev.git xfs_healer: allow AF_UNIX socket access for xfs_healer instances When xfs_healer cannot fix a filesystem problem on its own, run_full_repair function tries to start an xfs_scrub service instance to scan the entire filesystem. Unfortunately, as Codex points out, the service definition for xfs_healer instances doesn't allow AF_UNIX sockets, so that will fail. Relax the security posture so that we can do that. Cc: linux-xfs@vger.kernel.org # v7.0.0 Fixes: 88825fe0de0df2 ("xfs_healer: create a per-mount background monitoring service") Signed-off-by: "Darrick J. Wong" Reviewed-by: Andrey Albershteyn --- diff --git a/healer/xfs_healer@.service.in b/healer/xfs_healer@.service.in index 53f89cf9..fd1aaf20 100644 --- a/healer/xfs_healer@.service.in +++ b/healer/xfs_healer@.service.in @@ -55,10 +55,10 @@ PrivateDevices=true # by our sandboxing. healer doesn't care about project ids anyway. InaccessiblePaths=-/etc/projects -# No network access +# No network access except for systemd service bus for initiating full scans PrivateNetwork=true ProtectHostname=true -RestrictAddressFamilies=none +RestrictAddressFamilies=AF_UNIX IPAddressDeny=any # Don't let the program mess with the kernel configuration at all