SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: support MountAPIVFS and RootDirectory in user manager

Browse Source 
The only piece missing was to somehow make /proc appear in the
new user+mount namespace. It is not possible to mount a new
/proc instance, not even with hidepid=invisible,subset=pid, in
a user namespace unless a PID namespace is created too (and also
at the same time as the other namespaces, it is not possible to
mount a new /proc in a child process that creates a PID namespace
forked from a parent that created a user+mount namespace, it has
to happen at the same time).

Use the host's /proc with a bind-mount as a fallback for this
case. User session services would already run with it, so
nothing is lost.
This commit is contained in:
Luca Boccassi
2022-03-10 10:21:03 +00:00
parent 4c0ab40ab8
commit ea63a260d4
4 changed files with 50 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+3 -9
View File
@@ -143,9 +143,7 @@
<title>Mounting logging sockets into root environment</title>
<programlisting>BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout</programlisting>
</example>
<xi:include href="system-only.xml" xpointer="singular"/></listitem>
</example></listitem>
</varlistentry>
<varlistentry>
@@ -276,9 +274,7 @@
<para>In order to allow propagating mounts at runtime in a safe manner, <filename>/run/systemd/propagate</filename>
on the host will be used to set up new mounts, and <filename>/run/host/incoming/</filename> in the private namespace
will be used as an intermediate step to store them before being moved to the final mount point.</para>
<xi:include href="system-only.xml" xpointer="singular"/></listitem>
will be used as an intermediate step to store them before being moved to the final mount point.</para></listitem>
</varlistentry>
<varlistentry>
@@ -364,9 +360,7 @@
<varname>InaccessiblePaths=</varname>, or under <filename>/home/</filename> and other protected
directories if <varname>ProtectHome=yes</varname> is
specified. <varname>TemporaryFileSystem=</varname> with <literal>:ro</literal> or
<varname>ProtectHome=tmpfs</varname> should be used instead.</para>
<xi:include href="system-only.xml" xpointer="singular"/></listitem>
<varname>ProtectHome=tmpfs</varname> should be used instead.</para></listitem>
</varlistentry>
<varlistentry>