doc: add comments

desbma · Jul 15, 2024 · 8ec737a · 8ec737a
1 parent 57fbeb5
commit 8ec737a
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/src/systemd/options.rs b/src/systemd/options.rs
@@ -1295,6 +1295,9 @@ pub fn build_options(
             "CAP_CHOWN",
             OptionValueEffect::DenySyscalls(DenySyscalls::Class("chown")),
         ),
+        // CAP_NET_BIND_SERVICE would be too complex/unreliable to handle:
+        // - for IPv4 sockets, either PROT_SOCK or net.ipv4.ip_unprivileged_port_start sysctl control the provileged port threshold
+        // - for other socket families, rules are different
         (
             "CAP_SYS_BOOT",
             OptionValueEffect::DenySyscalls(DenySyscalls::Class("reboot")),

diff --git a/tests/cl.rs b/tests/cl.rs
@@ -14,6 +14,8 @@ use predicates::prelude::*;
 // tests.
 //
 
+// TODO test CapabilityBoundingSet
+
 #[test]
 fn run_true() {
     Command::cargo_bin(env!("CARGO_PKG_NAME"))