From e88803816d80621666a23d2f6cb619c9f3bbeb4c Mon Sep 17 00:00:00 2001 From: Fionn Fitzmaurice Date: Fri, 3 Jul 2026 19:21:03 +0800 Subject: [PATCH] Execute in parent's user namespace Setting PrivateUsers=yes runs the service in a user namespace. However, this provides marginal or zero benefit to a process that runs as root. > If set to a true value or "self", a minimal user and group mapping is > configured that maps the "root" user and group as well as the unit's > own user and group to themselves (from systemd.exec (5)). It also does no harm, but there is a trade-off: this prevents update-motd from running on systems that disable user namespaces (e.g. by setting user.max_user_namespaces to zero). This can be desirable for security reasons, as the ability to create user namespaces has, at least historically, been partially responsible for local privilege escalation bugs. See: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers= --- update-motd.service | 1 - 1 file changed, 1 deletion(-) diff --git a/update-motd.service b/update-motd.service index e44daa3..5d4bafa 100644 --- a/update-motd.service +++ b/update-motd.service @@ -20,7 +20,6 @@ ProtectKernelTunables=yes PrivateDevices=yes ProtectSystem=full SystemCallFilter=~@reboot -PrivateUsers=yes NoNewPrivileges=yes ProtectKernelLogs=yes ProtectControlGroups=yes