I'm trying to prevent Juniper Network Connect (a vpn client) from modifying /etc/resovl.conf, which I hoped to do with systemd-run. I tried:

systemd-run --property=ReadOnlyDirectories=/etc ./ncsvc -h <redacted> -u <redacted> -p <redacted> -f <redacted>.der -L 2

I get the follwing error message:

Unknown assignment ReadOnlyDirectories=/etc.
Failed to create bus message: No such device or address

I also get the same message running a simple example:

systemd-run --property=ReadOnlyDirectories=/etc env 

How can I run a process with systemd-run and have ReadOnlyDirectories set?


You can run a process with systemd-run and have ReadOnlyDirectories set since v228:

A number of properties previously only settable in unit files are now also available as properties to set when creating transient units programmatically via the bus, as it is exposed with systemd-run's --property= setting. Specifically, these are: SyslogIdentifier=, SyslogLevelPrefix=, TimerSlackNSec=, OOMScoreAdjust=, EnvironmentFile=, ReadWriteDirectories=, ReadOnlyDirectories=, InaccessibleDirectories=, ProtectSystem=, ProtectHome=, RuntimeDirectory=.


You currently can't, not all properties are settable, but it's on the TODO list to fix this.


* allow implementation of InaccessibleDirectories=/ plus
  ReadOnlyDirectories=... for whitelisting files for a service.

and here:

* document:


  - document in wiki how to map ical recurrence events to systemd timer
    unit calendar specifications
  - add a man page containing packaging guidelines and recommending 
    usage of things like Documentation=, PrivateTmp=, PrivateNetwork= 
    and ReadOnlyDirectories=/etc /usr.
  - document systemd-journal-flush.service properly




Not sure if this is a suitable solution for you, but chattr +i /etc/resolv.conf makes the file immutable, hence preventing anyone from modifying it -- even root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.