mountfsd: add support for mount options

RootImageOptions=/ExtensionImages=/MountImages= all support custom mount options, but mountfsd does not support it. Add varlink parameters to allow callers to specify mount options so that those directives can work as expected. Given the security implications of some mount options (e.g.: ACLs, SELinux), require additional privileges to use custom mount options. Pass the list of requested options to polkit details, so that the policy can check the exact details if needed, for example to only allow nosuid and reject the rest.
2026-01-07 00:47:52 +01:00
parent 3ff23e8c4b
commit 78b40aea61
2 changed files with 97 additions and 6 deletions
@@ -60,6 +60,8 @@ static SD_VARLINK_DEFINE_METHOD(
                SD_VARLINK_DEFINE_INPUT(password, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
                SD_VARLINK_FIELD_COMMENT("Takes an image policy string (see systemd.image-policy(7) for details) to apply while mounting the image"),
                SD_VARLINK_DEFINE_INPUT(imagePolicy, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The mount options to be used for the partitions of the image, keyed by the partition designator. Requires elevated privileges via polkit if specified, the polkit request details will list them in the 'mount_options' field."),
+                SD_VARLINK_DEFINE_INPUT(mountOptions, SD_VARLINK_STRING, SD_VARLINK_MAP|SD_VARLINK_NULLABLE),
                SD_VARLINK_FIELD_COMMENT("Whether to automatically reuse already set up dm-verity devices that share the same roothash."),
                SD_VARLINK_DEFINE_INPUT(veritySharing, SD_VARLINK_BOOL, SD_VARLINK_NULLABLE),
                SD_VARLINK_FIELD_COMMENT("File descriptor of the file containing the dm-verity data, if the image is a bare filesystem rather than a DDI."),