From e8e852fa766714ff2239fc1f3f6952c74a261558 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Tue, 18 Aug 2026 19:25:56 +0100
Subject: [PATCH 1/4] man: note that mixing sd-nsresourced and /etc/subuid is
 unsupported

---
 man/systemd-nsresourced.service.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/man/systemd-nsresourced.service.xml b/man/systemd-nsresourced.service.xml
index e3ac1eb0c3..3c662d04ed 100644
--- a/man/systemd-nsresourced.service.xml
+++ b/man/systemd-nsresourced.service.xml
@@ -92,6 +92,11 @@
     <para>This service provides one <ulink url="https://varlink.org/">Varlink</ulink> service:
     <constant>io.systemd.NamespaceResource</constant> allows registering user namespaces, and assign mounts,
     cgroups and network interfaces to it.</para>
+
+    <para>Note that combining usage of <command>systemd-nsresourced</command> and systems based on
+    <filename>/etc/subuid</filename> and <filename>/etc/subgid</filename> might result in undefined
+    behavior if UID or GID ranges defined in those files overlap with the UID or GID ranges used by
+    nsresourced (the foreign UID range).</para>
   </refsect1>
 
   <refsect1>

From 744b7801cbd4d32f20827709fa98f6888400fcdd Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Tue, 18 Aug 2026 19:30:43 +0100
Subject: [PATCH 2/4] man: note that GPT is implicitly trusted by sd-mountfsd

---
 man/systemd-mountfsd.service.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/man/systemd-mountfsd.service.xml b/man/systemd-mountfsd.service.xml
index 2e623a2728..a42c71bdea 100644
--- a/man/systemd-mountfsd.service.xml
+++ b/man/systemd-mountfsd.service.xml
@@ -46,7 +46,10 @@
 
       <listitem><para>If the disk image contains a Verity enabled disk image, along with a signature
       partition with a key in the kernel keyring or in <filename>/etc/verity.d/*.crt</filename> (and related
-      directories) the disk image is considered trusted.</para></listitem>
+      directories) the disk image is considered trusted. Note that the GPT partition table of the disk image
+      is parsed by the kernel to discover its contents and <command>systemd-mountfsd</command> assumes that
+      the GPT parser is robust against malformed input and applies no security policies or checks around it.
+      </para></listitem>
     </orderedlist>
 
     <para>This service provides one <ulink url="https://varlink.org/">Varlink</ulink> service:

From 8ae99737831a1d4828ea434cb2f08d525e0c29a2 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Tue, 18 Aug 2026 19:55:29 +0100
Subject: [PATCH 3/4] man: note that overriding TTY isolation with run0 is
 discouraged

---
 man/run0.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/man/run0.xml b/man/run0.xml
index 1eb9905b57..6f3f959b10 100644
--- a/man/run0.xml
+++ b/man/run0.xml
@@ -65,6 +65,10 @@
     <command>run0</command> is a symbolic link to <command>systemd-run</command> executable file, and it
     behaves as <command>run0</command> if it is invoked through the symbolic link, otherwise behaves as
     <command>systemd-run</command>.</para>
+
+    <para>Note that TTY isolation as provided by the default value of the <option>--pty</option> option is a
+    core feature of <command>run0</command>. Redirecting terminals must therefore be done with care,
+    avoiding giving such control to untrusted programs.</para>
   </refsect1>
 
   <refsect1>
@@ -267,6 +271,9 @@
         <option>--no-ask-password</option> is specified in which case <option>--pty</option> is selected),
         otherwise the relevant file descriptors are passed through directly.</para>
 
+        <para>As mentioned above, TTY isolation as implemented by the default value of this option is
+        crucial for security, so care must be taken when overriding it.</para>
+
         <para id="v257"><option>--pty</option> and <option>--pipe</option> were added in v257.</para>
         <para id="v258"><option>--pty-late</option> was added in v258.</para>
         </listitem>

From dfaa2d3ee12422f69511636993ecf3fb9e87559e Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Mon, 24 Aug 2026 12:16:39 +0100
Subject: [PATCH 4/4] man: note that blocking w+x memory is required for
 RestrictFileSystemAccess=

---
 man/systemd-system.conf.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index 9f70dc0c3a..9351c6ec52 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -560,7 +560,10 @@
         layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as
         btrfs are unsupported.</para>
 
-        <para>Note that, without further measures to secure the system, kexec can be used to circumvent this.</para>
+        <para>Note that, without further measures to secure the system, kexec can be used to circumvent
+        this. Writable and executable memory mappings can also be used to circumvent this, so they need to
+        be blocked, which can be achieved using other LSMs, or on a per-service basis by using the
+        <varname>MemoryDenyWriteExecute=</varname> setting.</para>
 
         <para>This requires the kernel to be booted with <literal>dm_verity.require_signatures=1</literal>
         on the kernel command line and with BPF LSM enabled (<literal>lsm=...,bpf</literal>). If either