b92dae961c
The module was allowing specific chown syscalls, which is brittle because there are several and different ones are used by glibc on different architectures. For example, fchownat was already added to the allowlist for aarch64, while on armv6l chrony crashes because chown32 is not in the allowlist. systemd provides the @chown syscall set, which includes all the chown syscalls and avoids this brittleness. I believe the syscalls would all be equivalent from an attacker's perspective, so there is unlikely to be any security impact. |
||
|---|---|---|
| .. | ||
| config | ||
| hardware | ||
| i18n/input-method | ||
| installer | ||
| misc | ||
| profiles | ||
| programs | ||
| security | ||
| services | ||
| system | ||
| tasks | ||
| testing | ||
| virtualisation | ||
| module-list.nix | ||
| rename.nix | ||