system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-22 02:34:54 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

man: add a note about flags on /tmp and /var/tmp

Browse source 
Inspired by https://bugzilla.redhat.com/show_bug.cgi?id=1875340.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2020-10-03 12:08:10 +02:00
parent 422128b46d
commit 7ec2f5e00c
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
man/file-hierarchy.xml
View file

@ -589,6 +589,19 @@
directives of service units (see
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details).</para>
<para><filename>/tmp/</filename>, <filename>/var/tmp/</filename> and <filename>/dev/shm/</filename>
should be mounted <option>nosuid</option> and <option>nodev</option>, which means that set-user-id mode
and character or block special devices are not interpreted on those file systems. In general it is not
possible to mount them <option>noexec</option>, because various programs use those directories for
dynamically generated or optimized code, and with that flag those use cases would break. Using this flag
is OK on special-purpose installations or systems where all software that may be installed is known and
doesn't require such functionality. See the discussion of
<option>nosuid</option>/<option>nodev</option>/<option>noexec</option> in <citerefentry
project='man-pages'><refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum></citerefentry> and
<constant>PROT_EXEC</constant> in <citerefentry
project='man-pages'><refentrytitle>mmap</refentrytitle><manvolnum>2</manvolnum></citerefentry>.
</para>
</refsect1>
<refsect1>