From dfaa2d3ee12422f69511636993ecf3fb9e87559e Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Mon, 24 Aug 2026 12:16:39 +0100
Subject: [PATCH] man: note that blocking w+x memory is required for
 RestrictFileSystemAccess=

---
 man/systemd-system.conf.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index 9f70dc0c3a..9351c6ec52 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -560,7 +560,10 @@
         layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as
         btrfs are unsupported.</para>
 
-        <para>Note that, without further measures to secure the system, kexec can be used to circumvent this.</para>
+        <para>Note that, without further measures to secure the system, kexec can be used to circumvent
+        this. Writable and executable memory mappings can also be used to circumvent this, so they need to
+        be blocked, which can be achieved using other LSMs, or on a per-service basis by using the
+        <varname>MemoryDenyWriteExecute=</varname> setting.</para>
 
         <para>This requires the kernel to be booted with <literal>dm_verity.require_signatures=1</literal>
         on the kernel command line and with BPF LSM enabled (<literal>lsm=...,bpf</literal>). If either