Luca Boccassi
3a8759e5d4
RootImageOptions=/ExtensionImages=/MountImages= all support custom mount options, use the new mountfsd parameters to configure them if they are specified. This requires additioanl privileges via polkit due to security implications of mount options, so document an example policy that allows to use the nosuid mount option.
33 lines
1.1 KiB
XML
33 lines
1.1 KiB
XML
<?xml version="1.0"?>
|
|
<!DOCTYPE refsect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
|
|
|
<!--
|
|
SPDX-License-Identifier: LGPL-2.1-or-later
|
|
-->
|
|
|
|
<refsect1>
|
|
<title/>
|
|
|
|
<para id="plural">When enabled for services running in per-user instances of the service manager
|
|
using mount options is disabled by default, due to the security implications. It is possible to use a
|
|
<ulink url="https://www.freedesktop.org/software/polkit/docs/latest/">polkit</ulink> policy to allow
|
|
specific mount options, for example:
|
|
|
|
<example id="example">
|
|
<title>A polkit policy that allows mounting the root partition with nosuid</title>
|
|
|
|
<para><filename index="false">/etc/polkit-1/rules.d/mountoptions.rules</filename>:
|
|
</para>
|
|
<programlisting>
|
|
polkit.addRule(function(action, subject) {
|
|
if (action.id == "io.systemd.mount-file-system.mount-untrusted-image-privately" &&
|
|
action.lookup("mount_options") == "root:nosuid") {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|
|
</programlisting>
|
|
</example>
|
|
</para>
|
|
|
|
</refsect1>
|