diff --git a/man/rules/meson.build b/man/rules/meson.build
index 33f44b0659..6284183756 100644
--- a/man/rules/meson.build
+++ b/man/rules/meson.build
@@ -1138,6 +1138,7 @@ manpages = [
'systemd-sysext-initrd.service',
'systemd-sysext.service'],
'ENABLE_SYSEXT'],
+ ['sysext.conf', '5', ['confext.conf'], 'ENABLE_SYSEXT'],
['systemd-system-update-generator', '8', [], ''],
['systemd-system.conf',
'5',
diff --git a/man/sysext.conf.xml b/man/sysext.conf.xml
new file mode 100644
index 0000000000..f717b74426
--- /dev/null
+++ b/man/sysext.conf.xml
@@ -0,0 +1,101 @@
+
+
+
+
+
+
+
+ sysext.conf
+ systemd
+
+
+
+ sysext.conf
+ 5
+
+
+
+ sysext.conf
+ confext.conf
+ sysext.conf.d
+ confext.conf.d
+ Configuration files for systemd-sysext
+
+
+
+ /etc/systemd/sysext.conf
+ /etc/systemd/sysext.conf.d/*.conf
+ /run/systemd/sysext.conf
+ /run/systemd/sysext.conf.d/*.conf
+ /usr/lib/systemd/sysext.conf
+ /usr/lib/systemd/sysext.conf.d/*.conf
+ /etc/systemd/confext.conf
+ /etc/systemd/confext.conf.d/*.conf
+ /run/systemd/confext.conf
+ /run/systemd/confext.conf.d/*.conf
+ /usr/lib/systemd/confext.conf
+ /usr/lib/systemd/confext.conf.d/*.conf
+
+
+
+ Description
+
+ These configuration files control the behavior of
+ systemd-sysext8 and
+ systemd-confext8.
+ They are especially useful when needing to customize the behavior of the
+ respective extension service units.
+
+
+
+
+
+ Options
+
+ The following options are understood in both the [Sysext] and
+ [Confext] sections:
+
+
+ Section Options
+
+
+
+ Mutable=
+ Set the mutable mode for system extensions. Takes one of no,
+ yes, auto, import,
+ ephemeral, or ephemeral-import. For details about the modes,
+ see the option in
+ systemd-sysext8.
+ Defaults to no.
+
+
+
+
+
+
+ ImagePolicy=
+ Set the image policy. Takes an image policy string as argument, as per
+ systemd.image-policy7.
+ For details, see the option in
+ systemd-sysext8.
+
+
+
+
+
+
+
+
+
+
+ See Also
+
+ systemd1
+ systemd-sysext8
+ systemd.syntax7
+
+
+
+
diff --git a/man/systemd-sysext.xml b/man/systemd-sysext.xml
index 07e97071a5..8705fa7275 100644
--- a/man/systemd-sysext.xml
+++ b/man/systemd-sysext.xml
@@ -74,7 +74,12 @@
System extension images are strictly read-only by default. On mutable host file systems,
/usr/ and /opt/ hierarchies become read-only while extensions
are merged, unless mutability is enabled. Mutability may be enabled via the
- option; see "Mutability" below for more information.
+ option and the Mutable= option in the configuration file;
+ see "Mutability" below for more information.
+
+ Various command options can be configured globally via configuration files. See
+ sysext.conf5
+ for details.
System extensions are supposed to be purely additive, i.e. they are supposed to include only files
that do not exist in the underlying basic OS image. However, the underlying mechanism (overlayfs) also
@@ -477,6 +482,7 @@
See Also
systemd1
+ sysext.conf5
systemd-nspawn1
systemd-stub7
importctl1
diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index d849ee2610..c8c75d68bd 100644
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -17,6 +17,7 @@
#include "bus-util.h"
#include "capability-util.h"
#include "chase.h"
+#include "conf-parser.h"
#include "devnum-util.h"
#include "discover-image.h"
#include "dissect-image.h"
@@ -148,6 +149,37 @@ static int parse_mutable_mode(const char *p) {
return mutable_mode_from_string(p);
}
+static DEFINE_CONFIG_PARSE_ENUM(config_parse_mutable_mode, mutable_mode, MutableMode);
+
+static int parse_config_file(ImageClass image_class) {
+ const char *section = image_class == IMAGE_SYSEXT ? "SysExt" : "ConfExt";
+ const ConfigTableItem items[] = {
+ { section, "Mutable", config_parse_mutable_mode, 0, &arg_mutable },
+ { section, "ImagePolicy", config_parse_image_policy, 0, &arg_image_policy },
+ {}
+ };
+ _cleanup_free_ char *config_file = NULL;
+ int r;
+
+ config_file = strjoin("systemd/", image_class_info[image_class].short_identifier, ".conf");
+ if (!config_file)
+ return log_oom();
+
+ r = config_parse_standard_file_with_dropins_full(
+ arg_root,
+ config_file,
+ image_class == IMAGE_SYSEXT ? "SysExt\0" : "ConfExt\0",
+ config_item_table_lookup, items,
+ CONFIG_PARSE_WARN,
+ /* userdata = */ NULL,
+ /* ret_stats_by_path = */ NULL,
+ /* ret_dropin_files = */ NULL);
+ if (r < 0)
+ return r;
+
+ return 0;
+}
+
static int is_our_mount_point(
ImageClass image_class,
const char *p) {
@@ -2590,6 +2622,7 @@ static int run(int argc, char *argv[]) {
arg_image_class = invoked_as(argv, "systemd-confext") ? IMAGE_CONFEXT : IMAGE_SYSEXT;
+ /* Parse environment variable first */
env_var = getenv(image_class_info[arg_image_class].mode_env);
if (env_var) {
r = parse_mutable_mode(env_var);
@@ -2600,6 +2633,12 @@ static int run(int argc, char *argv[]) {
arg_mutable = r;
}
+ /* Parse configuration file */
+ r = parse_config_file(arg_image_class);
+ if (r < 0)
+ log_warning_errno(r, "Failed to parse global config file, ignoring: %m");
+
+ /* Parse command line */
r = parse_argv(argc, argv);
if (r <= 0)
return r;