morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 08:25:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

man/systemd.exec: document that API fs are required to setup namespacing

Browse Source 
Closes #27997
This commit is contained in:
Mike Yuan
2023-10-05 05:04:12 +08:00
parent 6460a89a1b
commit 723c3cd03c
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
man/systemd.exec.xml
View File

@@ -1659,12 +1659,15 @@ StateDirectory=aaa/bbb ccc</programlisting>
i.e. writable mounts appearing on the host will be writable in the unit's namespace too, even when propagated
below a path marked with <varname>ReadOnlyPaths=</varname>! Restricting access with these options hence does
not extend to submounts of a directory that are created later on. This means the lock-down offered by that
setting is not complete, and does not offer full protection. </para>
setting is not complete, and does not offer full protection.</para>
<para>Note that the effect of these settings may be undone by privileged processes. In order to set up an
effective sandboxed environment for a unit it is thus recommended to combine these settings with either
<varname>CapabilityBoundingSet=~CAP_SYS_ADMIN</varname> or
<varname>SystemCallFilter=~@mount</varname>.</para>
<varname>CapabilityBoundingSet=~CAP_SYS_ADMIN</varname> or <varname>SystemCallFilter=~@mount</varname>.</para>
<para>Please be extra careful when applying these options to API file systems (a list of them could be
found in <varname>MountAPIVPS=</varname>), since they may be required for basic system functionalities.
Moreover, <filename>/run/</filename> needs to be writable for setting up mount namespace and propagation.</para>
<para>Simple allow-list example using these directives:
<programlisting>[Service]