I am trying to set up a systemd service which needs to have access to a filesystem I don’t normally want mounted (in case it’s relevant, I want to set up Snapper on btrfs, but want to use a flat subvolume layout as described in various places eg. here, and want
.snapshots directories to be unmounted for everything else).
I know it’s possible to give the service its own private mount namespace, but most of the documentation talks about restricting access to data that’s usually available, not granting access to something that usually isn’t. How can I ensure that Snapper will have mounts that the rest of the system will not?
Edit: Of course I can replace the
Exec= value with a script that mounts the filesystem and then does runs the main thing, but that's inelegant in various ways (for one thing, the example above isn't the only time I want to do this, and the other time I don't want the main service to run as root and I'd need to manually change that too instead of just using
User=). If I do go that route, though, would I need the script to also unmount the filesystem, or would systemd clean that up automatically?
Edit 2: The obvious workaround would be to use
ExecStartPre= to do the mounting, but unfortunately, according to the documentation, that doesn’t work for this case:
File system namespaces are set up individually for each process forked off by the service manager. Mounts established in the namespace of the process created by
ExecStartPre=will hence be cleaned up automatically as soon as that process exits and will not be available to subsequent processes forked off for
ExecStart=(and similar applies to the various other commands configured for units). Similarly,
JoinsNamespaceOf=does not permit sharing kernel mount namespaces between units, it only enables sharing of the