SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support ExtensionImages=/MountImages= in user services via mountfsd and PrivateUsers=yes (#39341)

Browse Source
This commit is contained in:
Luca Boccassi
2025-10-16 15:49:46 +01:00
committed by GitHub
parent f875a8026e 68b476a298
commit ac9391c552
8 changed files with 109 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/exec-invoke.c
+3
View File
@@ -4491,6 +4491,9 @@ static bool exec_needs_cap_sys_admin(const ExecContext *context, const ExecParam
context->n_temporary_filesystems > 0 ||
context->root_directory ||
!strv_isempty(context->extension_directories) ||
context->root_image ||
context->n_mount_images > 0 ||
context->n_extension_images > 0 ||
context->protect_system != PROTECT_SYSTEM_NO ||
context->protect_home != PROTECT_HOME_NO ||
exec_needs_pid_namespace(context, params) ||
src/core/namespace.c
+5 -3
View File
@@ -1617,7 +1617,8 @@ static int mount_mqueuefs(const MountEntry *m) {
static int mount_image(
MountEntry *m,
const char *root_directory,
const ImagePolicy *image_policy) {
const ImagePolicy *image_policy,
RuntimeScope runtime_scope) {
_cleanup_(extension_release_data_done) ExtensionReleaseData rdata = {};
ImageClass required_class = _IMAGE_CLASS_INVALID;
@@ -1652,6 +1653,7 @@ static int mount_image(
&rdata,
required_class,
&m->verity,
runtime_scope,
/* ret_image= */ NULL);
if (r == -ENOENT && m->ignore)
return 0;
@@ -2038,10 +2040,10 @@ static int apply_one_mount(
return mount_mqueuefs(m);
case MOUNT_IMAGE:
return mount_image(m, NULL, p->mount_image_policy);
return mount_image(m, NULL, p->mount_image_policy, p->runtime_scope);
case MOUNT_EXTENSION_IMAGE:
return mount_image(m, root_directory, p->extension_image_policy);
return mount_image(m, root_directory, p->extension_image_policy, p->runtime_scope);
case MOUNT_OVERLAY:
return mount_overlay(m);