From 723c3cd03ce38235df948147150054ce95cb41df Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Thu, 5 Oct 2023 05:04:12 +0800 Subject: [PATCH] man/systemd.exec: document that API fs are required to setup namespacing Closes #27997 --- man/systemd.exec.xml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 54f1dc7e5ce..1988d624cf0 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1659,12 +1659,15 @@ StateDirectory=aaa/bbb ccc i.e. writable mounts appearing on the host will be writable in the unit's namespace too, even when propagated below a path marked with ReadOnlyPaths=! Restricting access with these options hence does not extend to submounts of a directory that are created later on. This means the lock-down offered by that - setting is not complete, and does not offer full protection. + setting is not complete, and does not offer full protection. Note that the effect of these settings may be undone by privileged processes. In order to set up an effective sandboxed environment for a unit it is thus recommended to combine these settings with either - CapabilityBoundingSet=~CAP_SYS_ADMIN or - SystemCallFilter=~@mount. + CapabilityBoundingSet=~CAP_SYS_ADMIN or SystemCallFilter=~@mount. + + Please be extra careful when applying these options to API file systems (a list of them could be + found in MountAPIVPS=), since they may be required for basic system functionalities. + Moreover, /run/ needs to be writable for setting up mount namespace and propagation. Simple allow-list example using these directives: [Service] -- 2.47.3