RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-04-01 14:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #28023 from rjfd/wip-fix-ceph-mgr-systemd

Browse Source 
systemd: ceph-mgr: set MemoryDenyWriteExecute to false

Reviewed-by: Patrick Donnelly <pdonnell@redhat.com>
Reviewed-by: Lenz Grimmer <lgrimmer@suse.com>
Reviewed-by: Kefu Chai <kchai@redhat.com>
Reviewed-by: Sebastian Wagner <swagner@suse.com>
This commit is contained in:
Nathan Cutler 2019-05-17 15:57:28 +02:00 committed by GitHub
commit f27af32e4a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
systemd/ceph-mgr@.service.in
View File

@ -12,7 +12,11 @@ Environment=CLUSTER=ceph
ExecStart=/usr/bin/ceph-mgr -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
ExecReload=/bin/kill -HUP $MAINPID
LockPersonality=true
MemoryDenyWriteExecute=true
# We need to disable this protection as some python libraries generate
# dynamic code, like python-cffi, and require mmap calls to succeed
MemoryDenyWriteExecute=false
NoNewPrivileges=true
PrivateDevices=yes
ProtectControlGroups=true