SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: Introduce PrivateBPF= to mount a private BPFFS

Browse Source 
Add a new option PrivateBPF= to mount a new instance of bpffs within a
namespace.
PrivateBPF= can be set to "no" to use the host bpffs in readonly mode
and "yes" to do a new mount.
The mount is done with the new fsopen()/fsmount() API because in future
we'll hook some commands between the two calls.
This commit is contained in:
Matteo Croce
2025-07-08 22:33:28 +02:00
parent 2c7dabff50
commit 3a47437fc9
14 changed files with 284 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+10
View File
@@ -2555,6 +2555,16 @@ RestrictNamespaces=~cgroup net</programlisting>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>PrivateBPF=</varname></term>
<listitem><para>Takes a boolean argument. If set, mount a private instance of the BPF filesystem
on <filename>/sys/fs/bpf/</filename>. Otherwise, if <varname>ProtectKernelTunables=</varname> is set,
the instance from the host is inherited but mounted read-only. Defaults to false.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>LockPersonality=</varname></term>