I have long-running service with tight restrictions:
ReadOnlyDirectories=/
ReadWriteDirectories=-/proc
ReadWriteDirectories=-/var/lib/foobar
ReadWriteDirectories=-/var/log/foobar
ReadWriteDirectories=-/var/run
I mounted some new directory on main system, and noticed that
newly-mounted directories have read-write permissions inside service
mount namespace:
nsenter -t `pidof foobar` -m cat /proc/self/mounts|grep -w rw
That's pretty bad, but I'm not sure how it can be solved.
Of course, I can set MountFlags=private, and it will break mount
propagation to service mount namespace - however, it will also break
*umount* propagation, which also can be extremely problematic (if
removable device was mounted when service is (re)started, such service
will keep it mounted even after "host/main" system unmounted device).
Or systemd may be fixed to watch for new mounts, then perform something
akin `nsenter -t $MAINPID mount -o remount,ro $new_mounted_path`,
however there will be window between mount and service namespace fixup.
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel
