From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 22 Apr 2024 11:02:08 +0000 (+0200)
Subject: man: document that ReadOnlyPaths= doesn't affect ability to connect to AF_UNIX
X-Git-Tag: v256-rc1~71^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fef46ffb5b3a98cb557c9f77d230fbb220355b9e;p=thirdparty%2Fsystemd.git

man: document that ReadOnlyPaths= doesn't affect ability to connect to AF_UNIX

Fixes: #23470
---

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index c11c7db706f..44233d0265f 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -1383,6 +1383,11 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
     accessible to privileged processes. However, most namespacing settings, that will not work on their own in user
     services, will work when used in conjunction with <varname>PrivateUsers=</varname><option>true</option>.</para>
 
+    <para>Note that the various options that turn directories read-only (such as
+    <varname>ProtectSystem=</varname>, <varname>ReadOnlyPaths=</varname>, …) do not affect the ability for
+    programs to connect to and communicate with <constant>AF_UNIX</constant> sockets in these
+    directores. These options cannot be used to lock down access to IPC services hence.</para>
+
     <variablelist class='unit-directives'>
 
       <varlistentry>