diff options
| author | Mike Yuan <me@yhndnzj.com> | 2023-10-04 23:04:12 +0200 |
|---|---|---|
| committer | Mike Yuan <me@yhndnzj.com> | 2023-10-04 23:31:05 +0200 |
| commit | 723c3cd03ce38235df948147150054ce95cb41df (patch) | |
| tree | d8ce1a291866a6c2514dfe6d855c7dca43087e7e /man | |
| parent | man/systemd.exec: suffix one more directory with / (diff) | |
| download | systemd-723c3cd03ce38235df948147150054ce95cb41df.tar.xz systemd-723c3cd03ce38235df948147150054ce95cb41df.zip | |
man/systemd.exec: document that API fs are required to setup namespacing
Closes #27997
Diffstat (limited to 'man')
| -rw-r--r-- | man/systemd.exec.xml | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 54f1dc7e5c..1988d624cf 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1659,12 +1659,15 @@ StateDirectory=aaa/bbb ccc</programlisting> i.e. writable mounts appearing on the host will be writable in the unit's namespace too, even when propagated below a path marked with <varname>ReadOnlyPaths=</varname>! Restricting access with these options hence does not extend to submounts of a directory that are created later on. This means the lock-down offered by that - setting is not complete, and does not offer full protection. </para> + setting is not complete, and does not offer full protection.</para> <para>Note that the effect of these settings may be undone by privileged processes. In order to set up an effective sandboxed environment for a unit it is thus recommended to combine these settings with either - <varname>CapabilityBoundingSet=~CAP_SYS_ADMIN</varname> or - <varname>SystemCallFilter=~@mount</varname>.</para> + <varname>CapabilityBoundingSet=~CAP_SYS_ADMIN</varname> or <varname>SystemCallFilter=~@mount</varname>.</para> + + <para>Please be extra careful when applying these options to API file systems (a list of them could be + found in <varname>MountAPIVPS=</varname>), since they may be required for basic system functionalities. + Moreover, <filename>/run/</filename> needs to be writable for setting up mount namespace and propagation.</para> <para>Simple allow-list example using these directives: <programlisting>[Service] |