Package: systemd
Version: 254-1
Severity: normal
X-Debbugs-Cc: l...@packages.debian.org
The PrivateNetwork=yes option hardens services by putting them in a private
network namespace.
systemd.exec(5) says:
> Note that the implementation of this setting might be impossible (for
> example if network namespaces are not available), and the unit should be
> written in a way that does not solely rely on this setting for security.
which makes me think that the intended behaviour of this option is: if
possible, put the service in a private network namespace, but if that's
not possible, then launch it anyway.
However, in a lxc container, this isn't working for me, causing
autopkgtest failure for policykit-1 (>= 123) (which I'm going to work
around by removing the PrivateNetwork=yes option for now). This is
important because ci.debian.net can currently only test packages in an
lxc container.
Steps to reproduce
==
On a Debian 12 'bookworm' system (I used a throwaway VM created by
autopkgtest-build-qemu to get a somewhat reproducible environment):
# apt install ca-certificates debootstrap libpam-cgfs lxcfs lxc-templates \
rsync uidmap autopkgtest
# autopkgtest-build-lxc debian trixie amd64
# lxc-start autopkgtest-trixie-amd64
# lxc-attach autopkgtest-trixie-amd64
root@autopkgtest-trixie-amd64:~# cat > /lib/systemd/system/test.service <
Versions of packages systemd suggests:
ii libfido2-11.13.0-1
pn libqrencode4
pn libtss2-esys-3.0.2-0
pn libtss2-mu0
pn libtss2-rc0
pn polkitd
ii python3 3.11.4-5
pn python3-pefile
pn systemd-boot
pn systemd-container
pn systemd-homed
pn systemd-resolved
pn systemd-userdbd
Versions of packages systemd is related to:
ii dbus-user-session 1.14.8-2
pn dracut
pn initramfs-tools
pn libnss-systemd
ii libpam-systemd 254-1
pn udev
-- debconf information:
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
LANGUAGE = (unset),
LC_ALL = (unset),
LC_CTYPE = "C.UTF-8",
LANG = "en_GB.utf8"
are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").
