Skip to content

Commit c2a8934

Browse files
poetteringbluca
authored andcommitted
man: document explicitly tha ReadWritePaths= cannot undo superblock read-only settings
Fixes: #29266 (cherry picked from commit b6be6a6) (cherry picked from commit 0a35850) (cherry picked from commit 4a75edd)
1 parent bee5c6b commit c2a8934

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

man/systemd.exec.xml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1490,7 +1490,12 @@ StateDirectory=aaa/bbb ccc</programlisting>
14901490
permit this. Nest <varname>ReadWritePaths=</varname> inside of <varname>ReadOnlyPaths=</varname> in
14911491
order to provide writable subdirectories within read-only directories. Use
14921492
<varname>ReadWritePaths=</varname> in order to allow-list specific paths for write access if
1493-
<varname>ProtectSystem=strict</varname> is used.</para>
1493+
<varname>ProtectSystem=strict</varname> is used. Note that <varname>ReadWritePaths=</varname> cannot
1494+
be used to gain write access to a file system whose superblock is mounted read-only. On Linux, for
1495+
each mount point write access is granted only if the mount point itself <emphasis>and</emphasis> the
1496+
file system superblock backing it are not marked read-only. <varname>ReadWritePaths=</varname> only
1497+
controls the former, not the latter, hence a read-only file system superblock remains
1498+
protected.</para>
14941499

14951500
<para>Paths listed in <varname>InaccessiblePaths=</varname> will be made inaccessible for processes inside
14961501
the namespace along with everything below them in the file system hierarchy. This may be more restrictive than

0 commit comments

Comments
 (0)