system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 18:24:38 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

man: explicitly say that BindPaths=/BindReadOnlyPaths= opens a new mount

Browse source 
namespace

Fixes: #32339
This commit is contained in:
Lennart Poettering 2024-04-22 11:18:45 +02:00
parent 3f6551fc82
commit 3c7f0d6b44
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
man/systemd.exec.xml
View file

@ -443,6 +443,9 @@
that in this case both read-only and regular bind mounts are reset, regardless which of the two settings is
used.</para>
<para>Using this option implies that a mount namespace is allocated for the unit, i.e. it implies the
effect of <varname>PrivateMounts=</varname> (see below).</para>
<para>This option is particularly useful when <varname>RootDirectory=</varname>/<varname>RootImage=</varname>
is used. In this case the source path refers to a path on the host file system, while the destination path
refers to a path below the root directory of the unit.</para>
@ -2372,8 +2375,9 @@ RestrictNamespaces=~cgroup net</programlisting>
<para>Other file system namespace unit settings — <varname>PrivateTmp=</varname>,
<varname>PrivateDevices=</varname>, <varname>ProtectSystem=</varname>,
<varname>ProtectHome=</varname>, <varname>ReadOnlyPaths=</varname>,
<varname>InaccessiblePaths=</varname>, <varname>ReadWritePaths=</varname>, … — also enable file
system namespacing in a fashion equivalent to this option. Hence it is primarily useful to explicitly
<varname>InaccessiblePaths=</varname>, <varname>ReadWritePaths=</varname>,
<varname>BindPaths=</varname>, <varname>BindReadOnlyPaths=</varname>, … — also enable file system
namespacing in a fashion equivalent to this option. Hence it is primarily useful to explicitly
request this behaviour if none of the other settings are used.</para>
<xi:include href="system-or-user-ns.xml" xpointer="singular"/>