diff options
| -rw-r--r-- | man/systemd-nspawn.xml | 8 | ||||
| -rw-r--r-- | man/systemd.exec.xml | 14 |
2 files changed, 11 insertions, 11 deletions
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index b8cae62818..a14992f0d9 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -256,14 +256,14 @@ <listitem><para>Takes a data integrity (dm-verity) root hash specified in hexadecimal. This option enables data integrity checks using dm-verity, if the used image contains the appropriate integrity data (see above). The - specified hash must match the root hash of integrity data, and is usually at least 256bits (and hence 64 + specified hash must match the root hash of integrity data, and is usually at least 256 bits (and hence 64 formatted hexadecimal characters) long (in case of SHA256 for example). If this option is not specified, but the image file carries the <literal>user.verity.roothash</literal> extended file attribute (see <citerefentry project='man-pages'><refentrytitle>xattr</refentrytitle><manvolnum>7</manvolnum></citerefentry>), then the root hash is read from it, also as formatted hexadecimal characters. If the extended file attribute is not found (or - not supported by the underlying file system), but a file with the <filename>.roothash</filename> suffix is - found next to the image file, bearing otherwise the same name the root hash is read from it and automatically - used (again, as formatted hexadecimal characters).</para></listitem> + is not supported by the underlying file system), but a file with the <filename>.roothash</filename> suffix is + found next to the image file, bearing otherwise the same name, the root hash is read from it and automatically + used, also as formatted hexadecimal characters.</para></listitem> </varlistentry> <varlistentry> diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 09e78c6786..e95321f3c9 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -150,13 +150,13 @@ <term><varname>MountAPIVFS=</varname></term> <listitem><para>Takes a boolean argument. If on, a private mount namespace for the unit's processes is created - and the API file systems <filename>/proc</filename>, <filename>/sys</filename> and <filename>/dev</filename> - will be mounted inside of it, unless they are already mounted. Note that this option has no effect unless used - in conjunction with <varname>RootDirectory=</varname>/<varname>RootImage=</varname> as these three mounts are generally mounted in the host - anyway, and unless the root directory is changed the private mount namespace will be a 1:1 copy of the host's, - and include these three mounts. Note that the <filename>/dev</filename> file system of the host is bind mounted - if this option is used without <varname>PrivateDevices=</varname>. To run the service with a private, minimal - version of <filename>/dev/</filename>, combine this option with + and the API file systems <filename>/proc</filename>, <filename>/sys</filename>, and <filename>/dev</filename> + are mounted inside of it, unless they are already mounted. Note that this option has no effect unless used in + conjunction with <varname>RootDirectory=</varname>/<varname>RootImage=</varname> as these three mounts are + generally mounted in the host anyway, and unless the root directory is changed, the private mount namespace + will be a 1:1 copy of the host's, and include these three mounts. Note that the <filename>/dev</filename> file + system of the host is bind mounted if this option is used without <varname>PrivateDevices=</varname>. To run + the service with a private, minimal version of <filename>/dev/</filename>, combine this option with <varname>PrivateDevices=</varname>.</para></listitem> </varlistentry> |