Tobias Florek <ato...@ibotty.net> writes:

> now that systemd conference has been a success, I wanted to ask whether
> you had a chance to look into it?

I was playing around with bubblewrap and systemd.  I've submitted some
patches for systemd that got merged:


they enable systemd to work without CAP_AUDIT[READ|WRITE] and not fail
when setgroups is disabled (can be done through /proc/PID/setgroups).

I have more patches to bubblewrap:


that are needed to run systemd in it.  I think the overall design, and
that some caps are left only when in a new  user namespace is safe.
Anyway, they require a very accurate review, as a bug there can open the
door to really bad things.


Reply via email to