0

I am trying to set up a systemd service which needs to have access to a filesystem I don’t normally want mounted (in case it’s relevant, I want to set up Snapper on btrfs, but want to use a flat subvolume layout as described in various places eg. here, and want .snapshots directories to be unmounted for everything else).

I know it’s possible to give the service its own private mount namespace, but most of the documentation talks about restricting access to data that’s usually available, not granting access to something that usually isn’t. How can I ensure that Snapper will have mounts that the rest of the system will not?

Edit: Of course I can replace the Exec= value with a script that mounts the filesystem and then does runs the main thing, but that's inelegant in various ways (for one thing, the example above isn't the only time I want to do this, and the other time I don't want the main service to run as root and I'd need to manually change that too instead of just using User=). If I do go that route, though, would I need the script to also unmount the filesystem, or would systemd clean that up automatically?

Edit 2: The obvious workaround would be to use ExecStartPre= to do the mounting, but unfortunately, according to the documentation, that doesn’t work for this case:

File system namespaces are set up individually for each process forked off by the service manager. Mounts established in the namespace of the process created by ExecStartPre= will hence be cleaned up automatically as soon as that process exits and will not be available to subsequent processes forked off for ExecStart= (and similar applies to the various other commands configured for units). Similarly, JoinsNamespaceOf= does not permit sharing kernel mount namespaces between units, it only enables sharing of the /tmp/ and /var/tmp/ directories.

0

In general, what you are looking for is unshare -m which is what PrivateMounts does:

PrivateMounts=true

You can also add an entry to fstab for that path with the option group=xxx, where xxx is the user's group. This will allow the user to perform the mount without being root.

You can then proceed creating your service file like normal, adding something like:

ExecStartPre=mount ....

The mount should be executed in the separate mount namespace, which will not be shared with the rest of the processes and will be auto unmounted when the service exits. The only catch is that the user will be able to perform the mount even in the root mount namespace.

|improve this answer|||||
  • According to the documentation, ExecStartPre doesn’t work for this case: “File system namespaces are set up individually for each process forked off by the service manager. Mounts established in the namespace of the process created by ExecStartPre= will hence be cleaned up automatically as soon as that process exits and will not be available to subsequent processes forked off for ExecStart= (and similar applies to the various other commands configured for units).” – Daniel H Jan 29 at 12:02
  • Using the grouo= option in fstab might be a good idea, though – Daniel H Jan 29 at 12:06
  • Gah... good point. I guess you'll have to run both as ExecStart. – V13 Jan 30 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.