From fdfcb946315a119c5201f1223a8c983e2df3c25c Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 8 Nov 2017 15:52:08 +0900 Subject: man: update documents for RuntimeDirectory= and friends --- man/systemd.exec.xml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'man/systemd.exec.xml') diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 2f5192eb60..6843c208ca 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1799,20 +1799,18 @@ CapabilityBoundingSet=~CAP_B CAP_C CacheDirectoryMode=, LogsDirectoryMode= and ConfigurationDirectoryMode=. - Except in case of ConfigurationDirectory=, these options imply - ReadWritePaths= for the specified paths. When combined with + These options imply BindPaths= for the specified paths. When combined with RootDirectory= or RootImage= these paths always reside on the host and - are mounted from there into the unit's file system namespace. If DynamicUser= is used in - conjunction with RuntimeDirectory=, StateDirectory=, - CacheDirectory= and LogsDirectory=, the behaviour of these options is - slightly altered: the directories are created below /run/private, - /var/lib/private, /var/cache/private and + are mounted from there into the unit's file system namespace. + + If DynamicUser= is used in conjunction with StateDirectory=, + CacheDirectory= and LogsDirectory= is slightly altered: the directories + are created below /var/lib/private, /var/cache/private and /var/log/private, respectively, which are host directories made inaccessible to unprivileged users, which ensures that access to these directories cannot be gained through dynamic user ID recycling. Symbolic links are created to hide this difference in behaviour. Both from perspective of the host and from inside the unit, the relevant directories hence always appear directly below - /run, /var/lib, /var/cache and - /var/log. + /var/lib, /var/cache and /var/log. Use RuntimeDirectory= to manage one or more runtime directories for the unit and bind their lifetime to the daemon runtime. This is particularly useful for unprivileged daemons that cannot create -- cgit v1.2.1