{"push_id":1153041345,"size":1,"distinct_size":1,"ref":"refs/heads/alep/exec-privileged","head":"ca7c0a0aefc5d40beb480abfd526d3973094a717","before":"f46c1278dc057ea8c695f055b1552c81a15cff38","commits":[{"sha":"ca7c0a0aefc5d40beb480abfd526d3973094a717","author":{"name":"Alessandro Puccetti","email":"005be46eca2fe6c0c380646fcfef904f8c8472bd@kinvolk.io"},"message":"core/execute: add the magic character '!' for privileged permissions\n\nThis patch implements the new magic character '!'. By put '!' in front\nof a command systemd execute it as root ignoring the paramters: User, Group,\nand ConditionSecurity.\n\nFix partially https://github.com/systemd/systemd/issues/3414\nRelated to https://github.com/coreos/rkt/issues/2482\n\nTesting:\nBoot a OS inside a container with systemd-nspawn.\nNote: modify the commands accordingly with your filesystem.\n\n1. Create a filesystem where you can boot an OS.\n2. sudo systemd-nspawn -D ${HOME}/distros/fedora-23/ -b\nThe following is to do inside the container\n3. Create a user 'testing'\n4. Create the unit file /etc/systemd/system/exec-perm.service inside the container\n   (You can use the example below)\n5. systemctl start ext-perm.service\n6. Verify by looking to the output of ls -l /tmp/exec-perm*, also\n   each file contains the result of the id command.\n\n-----------------------------------------------------------------\n[Unit]\nDescription=ext-perm\n\n[Service]\nType=oneshot\nTimeoutStartSec=0\nUser=testing\nExecStartPre=!/usr/bin/sh -c \"/usr/bin/rm /tmp/exec-perm*\" ;\n    /usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-start-pre\"\nExecStart=/usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-start\" ;\n    !/usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-star-2\"\nExecStartPost=/usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-start-post\"\nExecReload=/usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-reload\"\nExecStop=!/usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-stop\"\nExecStopPost=/usr/bin/sh -c \"/usr/bin/id > /tmp/exec-perm-stop-post\"\n\n[Install]\nWantedBy=multi-user.target]\n-----------------------------------------------------------------","distinct":true,"url":"https://api.github.com/repos/kinvolk/systemd/commits/ca7c0a0aefc5d40beb480abfd526d3973094a717"}]}
{"actor":{"display_login":"alepuccetti"}}