diff options
| author | Lin Jian <me@linj.tech> | 2023-09-07 10:27:20 +0800 |
|---|---|---|
| committer | Lin Jian <me@linj.tech> | 2023-09-21 16:52:16 +0800 |
| commit | 759ec1113d0a1d6315b38bd83ec3562dacc08238 (patch) | |
| tree | da272287f8b12355ff4ffe6e1f2bd944ae2f5543 /nixos/doc/manual/development | |
| parent | 0e69d3ec89f55e5ef6b3684b71815d57d8a5a98b (diff) | |
| download | nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.tar nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.tar.gz nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.tar.bz2 nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.tar.lz nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.tar.xz nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.tar.zst nixpkgs-759ec1113d0a1d6315b38bd83ec3562dacc08238.zip | |
nixos/network-interfaces: stop wrapping ping with cap_net_raw
From systemd 243 release note[1]: This release enables unprivileged programs (i.e. requiring neither setuid nor file capabilities) to send ICMP Echo (i.e. ping) requests by turning on the "net.ipv4.ping_group_range" sysctl of the Linux kernel for the whole UNIX group range, i.e. all processes. So this wrapper is not needed any more. See also [2] and [3]. This patch also removes: - apparmor profiles in NixOS for ping itself and the wrapped one - other references for the wrapped ping [1]: https://github.com/systemd/systemd/blob/8e2d9d40b33bc8e8f5d3479fb075d3fab32a4184/NEWS#L6457-L6464 [2]: https://github.com/systemd/systemd/pull/13141 [3]: https://fedoraproject.org/wiki/Changes/EnableSysctlPingGroupRange
Diffstat (limited to 'nixos/doc/manual/development')
| -rw-r--r-- | nixos/doc/manual/development/activation-script.section.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/nixos/doc/manual/development/activation-script.section.md b/nixos/doc/manual/development/activation-script.section.md index c339258c6dc..cc317a6a01a 100644 --- a/nixos/doc/manual/development/activation-script.section.md +++ b/nixos/doc/manual/development/activation-script.section.md @@ -69,4 +69,4 @@ do: `/etc/group` and `/etc/shadow`. This also creates home directories - `usrbinenv` creates `/usr/bin/env` - `var` creates some directories in `/var` that are not service-specific -- `wrappers` creates setuid wrappers like `ping` and `sudo` +- `wrappers` creates setuid wrappers like `sudo` |