From 9457f81485bfe8e09d45c0376fe02ebce7c15872 Mon Sep 17 00:00:00 2001 From: benkigeek Date: Thu, 3 Sep 2026 20:19:37 +0300 Subject: [PATCH] man: document that stdio file targets are opened before the MAC transition --- man/systemd.exec.xml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index cbb2983d02..ddf603a6c1 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -3420,7 +3420,9 @@ SystemCallErrorNumber=EPERM system object to standard input. An absolute path following the : character is expected, which may refer to a regular file, a FIFO or special file. If an AF_UNIX socket in the file system is specified, a stream socket is connected to it. The latter is useful for connecting standard - input of processes to arbitrary system services. + input of processes to arbitrary system services. Note that the file system object is opened by the + service manager before the executable is invoked; see the note on the security context this + happens in for StandardOutput= below. The option is valid in socket-activated services only, and requires the relevant socket unit file (see @@ -3515,6 +3517,14 @@ SystemCallErrorNumber=EPERM ExecStartPost=, ExecReload=, ExecStop= or similar. + Note that for , + and + of StandardOutput=, + StandardError= or StandardInput=, the target path is opened + by the service manager before the executable is invoked — and hence before + SELinuxContext= or any policy-defined transition takes effect. The resulting + descriptor is then inherited across that transition into the unit's own domain. + connects standard output to a socket acquired via socket activation. The semantics are similar to the same option of StandardInput=, see above.