diff options
| author | Lennart Poettering <lennart@poettering.net> | 2024-04-22 11:18:45 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2024-04-22 15:16:54 +0200 |
| commit | 3c7f0d6b4401ab3ca62f6021adeb533a8e3802a6 (patch) | |
| tree | 59efbd2c5f61a727db9023e015c7a61ecc594926 /man | |
| parent | man: run update-man-rules again (diff) | |
| download | systemd-3c7f0d6b4401ab3ca62f6021adeb533a8e3802a6.tar.xz systemd-3c7f0d6b4401ab3ca62f6021adeb533a8e3802a6.zip | |
man: explicitly say that BindPaths=/BindReadOnlyPaths= opens a new mount
namespace
Fixes: #32339
Diffstat (limited to 'man')
| -rw-r--r-- | man/systemd.exec.xml | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 64b7b07fc7..598a399b93 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -443,6 +443,9 @@ that in this case both read-only and regular bind mounts are reset, regardless which of the two settings is used.</para> + <para>Using this option implies that a mount namespace is allocated for the unit, i.e. it implies the + effect of <varname>PrivateMounts=</varname> (see below).</para> + <para>This option is particularly useful when <varname>RootDirectory=</varname>/<varname>RootImage=</varname> is used. In this case the source path refers to a path on the host file system, while the destination path refers to a path below the root directory of the unit.</para> @@ -2372,8 +2375,9 @@ RestrictNamespaces=~cgroup net</programlisting> <para>Other file system namespace unit settings — <varname>PrivateTmp=</varname>, <varname>PrivateDevices=</varname>, <varname>ProtectSystem=</varname>, <varname>ProtectHome=</varname>, <varname>ReadOnlyPaths=</varname>, - <varname>InaccessiblePaths=</varname>, <varname>ReadWritePaths=</varname>, … — also enable file - system namespacing in a fashion equivalent to this option. Hence it is primarily useful to explicitly + <varname>InaccessiblePaths=</varname>, <varname>ReadWritePaths=</varname>, + <varname>BindPaths=</varname>, <varname>BindReadOnlyPaths=</varname>, … — also enable file system + namespacing in a fashion equivalent to this option. Hence it is primarily useful to explicitly request this behaviour if none of the other settings are used.</para> <xi:include href="system-or-user-ns.xml" xpointer="singular"/> |