URL:
https://github.com/SSSD/sssd/pull/5504
Author: alexey-tikhonov
Title: #5504: systemd configs: limit process capabilities
Action: opened
PR body:
"""
This is to upstream
https://src.fedoraproject.org/rpms/sssd/blob/f34/f/0502-SYSTEMD-Use-capab...
Additionally even more limited CapabilityBoundingSet is applied to ifp and
kcm services (CAP_KILL CAP_NET_ADMIN CAP_SYS_NICE CAP_SYS_ADMIN CAP_SYS_RESOURCE
CAP_BLOCK_SUSPEND are excluded as compared to main sssd service)
:relnote: Example systemd service configs now makes use of CapabilityBoundingSet
option as a security hardening measure.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/5504/head:pr5504
git checkout pr5504