From 6460a89a1be7c11bc7b66a134701a07773869849 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Thu, 5 Oct 2023 05:30:46 +0800 Subject: [PATCH 1/2] man/systemd.exec: suffix one more directory with / --- man/systemd.exec.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index e5c1812643..54f1dc7e5c 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -350,7 +350,7 @@ the service with a private, minimal version of /dev/, combine this option with PrivateDevices=. - In order to allow propagating mounts at runtime in a safe manner, /run/systemd/propagate + In order to allow propagating mounts at runtime in a safe manner, /run/systemd/propagate/ on the host will be used to set up new mounts, and /run/host/incoming/ in the private namespace will be used as an intermediate step to store them before being moved to the final mount point. From 723c3cd03ce38235df948147150054ce95cb41df Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Thu, 5 Oct 2023 05:04:12 +0800 Subject: [PATCH 2/2] man/systemd.exec: document that API fs are required to setup namespacing Closes #27997 --- man/systemd.exec.xml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 54f1dc7e5c..1988d624cf 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1659,12 +1659,15 @@ StateDirectory=aaa/bbb ccc i.e. writable mounts appearing on the host will be writable in the unit's namespace too, even when propagated below a path marked with ReadOnlyPaths=! Restricting access with these options hence does not extend to submounts of a directory that are created later on. This means the lock-down offered by that - setting is not complete, and does not offer full protection. + setting is not complete, and does not offer full protection. Note that the effect of these settings may be undone by privileged processes. In order to set up an effective sandboxed environment for a unit it is thus recommended to combine these settings with either - CapabilityBoundingSet=~CAP_SYS_ADMIN or - SystemCallFilter=~@mount. + CapabilityBoundingSet=~CAP_SYS_ADMIN or SystemCallFilter=~@mount. + + Please be extra careful when applying these options to API file systems (a list of them could be + found in MountAPIVPS=), since they may be required for basic system functionalities. + Moreover, /run/ needs to be writable for setting up mount namespace and propagation. Simple allow-list example using these directives: [Service]