SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: document union filesystem resolution for RestrictFileSystemAccess=

Browse Source 
Replace the paragraph that claims overlayfs is always blocked. Mention
that only the file data is checked, keep the btrfs note and mention the
new behavior in NEWS.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner
2026-08-10 16:09:06 +02:00
parent 8c199d4f1a
commit 24bbacbe7a
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+6
View File
@@ -60,6 +60,12 @@ CHANGES WITH 262:
allows a container to be started with systemd as PID1 without
installing any unit files.
* RestrictFileSystemAccess= now permits execution from overlayfs
mounts whose file data resides on a signed and verified
dm-verity-protected filesystem, while still denying files in a
writable upper layer. This requires kernel v7.2 or newer; on older
kernels execution from overlayfs mounts remains denied entirely.
Changes in systemd-firstboot:
* The "systemd.firstboot=" kernel command line option now accepts the
man/systemd-system.conf.xml
+6 -4
View File
@@ -553,10 +553,12 @@
shared libraries (<literal>mmap_file</literal>), and write-to-execute transitions such as JIT
compilation (<literal>file_mprotect</literal>).</para>
<para>Note that execution from overlayfs mounts is blocked even if the underlying layers reside on
signed dm-verity devices, because the BPF program sees the overlay filesystem's anonymous device
number rather than the underlying block device. Multi-device filesystems such as btrfs are similarly
unsupported.</para>
<para>Since v262, files on overlayfs mounts are resolved to the layer that hosts their data, so
execution from an overlay whose data resides on a signed dm-verity device is permitted, while files
in a writable upper layer are denied. This requires kernel v7.2 or newer; on older kernels execution from
overlayfs mounts is denied entirely. Note that only the file data is checked, so an untrusted upper
layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as
btrfs are unsupported.</para>
<para>Note that, without further measures to secure the system, kexec can be used to circumvent this.</para>