From b719d038ad710d490b9679e0e6a4d38c6ebb6134 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 15 Sep 2022 06:07:22 +0900 Subject: [PATCH] unit: drop ProtectClock=yes from systemd-udevd.service This partially reverts cabc1c6d7adae658a2966a4b02a6faabb803e92b. The setting ProtectClock= implies DeviceAllow=, which is not suitable for udevd. Although we are slowly removing cgropsv1 support, but DeviceAllow= with cgroupsv1 is necessarily racy, and reloading PID1 during the early boot process may cause issues like #24668. Let's disable ProtectClock= for udevd. And, if necessary, let's explicitly drop CAP_SYS_TIME and CAP_WAKE_ALARM (and possibly others) by using CapabilityBoundingSet= later. Fixes #24668. --- units/systemd-udevd.service.in | 3 --- 1 file changed, 3 deletions(-) diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index 99011982740c4..3579de4a68713 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -17,8 +17,6 @@ ConditionPathIsReadWrite=/sys [Service] Delegate=pids -DeviceAllow=block-* rwm -DeviceAllow=char-* rwm Type=notify # Note that udev will reset the value internally for its workers OOMScoreAdjust=-1000 @@ -30,7 +28,6 @@ ExecReload=udevadm control --reload --timeout 0 KillMode=mixed TasksMax=infinity PrivateMounts=yes -ProtectClock=yes ProtectHostname=yes MemoryDenyWriteExecute=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6