There are many options available for Units (like services) in systemd. Three of them are called
InaccessibleDirectories. I'm using Debian 8.5 on a virtual machine. In some (newer?) versions of systemd they are called
InaccessiblePaths. Can I use this options to whitelist directories, which should be accessible?
I have an application which is known to access some directories only. I would like to restrict the access to this directories. But it does not seem to have any effect if I use
ReadWritePaths to specify this directories. The manpage says
Directories listed in ReadWriteDirectories= are accessible from within the namespace with the same access rights as from outside.
But directories not specified in this option seems to be accessible the same way. How to deny access to everything not specified? Or is it up to my system that it doesn't work? Someone could thing that it may be possible to use
InaccessibleDirectories=/ to blacklist everything else but the manpage of a newer version, where the option is called
Entries listed in InaccessiblePaths= will be made inaccessible for processes inside the namespace, and may not countain any other mountpoints, including those specified by ReadWritePaths= or ReadOnlyPaths=.
Well, is there a possibility to use
ReadOnlyDirectories to setup a whitelist of directories? If it is not possible, why does
ReadWriteDirectories exist sinde it seems to do nothing?