SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: document union filesystem resolution for RestrictFileSystemAccess=

Browse Source 
Replace the paragraph that claims overlayfs is always blocked. Mention
that only the file data is checked, keep the btrfs note and mention the
new behavior in NEWS.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner
2026-08-10 16:09:06 +02:00
parent 8c199d4f1a
commit 24bbacbe7a
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+6
View File
@@ -60,6 +60,12 @@ CHANGES WITH 262:
allows a container to be started with systemd as PID1 without
installing any unit files.
* RestrictFileSystemAccess= now permits execution from overlayfs
mounts whose file data resides on a signed and verified
dm-verity-protected filesystem, while still denying files in a
writable upper layer. This requires kernel v7.2 or newer; on older
kernels execution from overlayfs mounts remains denied entirely.
Changes in systemd-firstboot:
* The "systemd.firstboot=" kernel command line option now accepts the