{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/2780","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/2780/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/2780/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/2780/events","html_url":"https://github.com/systemd/systemd/issues/2780","id":137704367,"number":2780,"title":"[enhancement] Permit nesting of `ReadWriteDirectories`, `ReadOnlyDirectories` and `InaccessibleDirectories`","user":{"login":"nbraud","id":1155801,"avatar_url":"https://avatars.githubusercontent.com/u/1155801?v=3","gravatar_id":"","url":"https://api.github.com/users/nbraud","html_url":"https://github.com/nbraud","followers_url":"https://api.github.com/users/nbraud/followers","following_url":"https://api.github.com/users/nbraud/following{/other_user}","gists_url":"https://api.github.com/users/nbraud/gists{/gist_id}","starred_url":"https://api.github.com/users/nbraud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbraud/subscriptions","organizations_url":"https://api.github.com/users/nbraud/orgs","repos_url":"https://api.github.com/users/nbraud/repos","events_url":"https://api.github.com/users/nbraud/events{/privacy}","received_events_url":"https://api.github.com/users/nbraud/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-01T22:23:21Z","updated_at":"2016-03-06T02:30:41Z","closed_at":null,"body":"### Submission type\r\n\r\n> Request for enhancement (RFE)\r\n\r\n### systemd version the issue has been seen with\r\n\r\n> 228\r\n\r\n### Used distribution\r\n\r\n> Debian Stretch\r\n\r\n### Proposal\r\n\r\nCurrently, it is impossible to use `ReadWriteDirectories`, `ReadOnlyDirectories` and `InaccessibleDirectories` on nested folders: this results in the following error:\r\n\r\n    Failed at step NAMESPACE spawning /some/binary: No such file or directory\r\n\r\nThis makes it rather difficult to express things like the following:\r\n\r\n    [Service]\r\n    InaccessibleDirectories=/srv\r\n    ReadOnlyDirectories=/srv/some-application\r\n    ReadWriteDirectories=/srv/some-application/cache\r\n\r\nInstead, one has to rely on a “blacklist approach” by listing all the directories in (for example) `/srv`.\r\n\r\n\r\nMoreover, while attempting to reproduce the issue on systemd 228, I discovered that if `PrivateTmp=true` is set, and `InaccessibleDirectories` and `ReadOnlyDirectories` are set in `/tmp`, they silently fail to be mounted in the service's namespace."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/192783587","html_url":"https://github.com/systemd/systemd/issues/2780#issuecomment-192783587","issue_url":"https://api.github.com/repos/systemd/systemd/issues/2780","id":192783587,"user":{"login":"nbraud","id":1155801,"avatar_url":"https://avatars.githubusercontent.com/u/1155801?v=3","gravatar_id":"","url":"https://api.github.com/users/nbraud","html_url":"https://github.com/nbraud","followers_url":"https://api.github.com/users/nbraud/followers","following_url":"https://api.github.com/users/nbraud/following{/other_user}","gists_url":"https://api.github.com/users/nbraud/gists{/gist_id}","starred_url":"https://api.github.com/users/nbraud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nbraud/subscriptions","organizations_url":"https://api.github.com/users/nbraud/orgs","repos_url":"https://api.github.com/users/nbraud/repos","events_url":"https://api.github.com/users/nbraud/events{/privacy}","received_events_url":"https://api.github.com/users/nbraud/received_events","type":"User","site_admin":false},"created_at":"2016-03-06T02:30:41Z","updated_at":"2016-03-06T02:30:41Z","body":"@poettering Sorry, it seems I didn't explain my issue very clearly: yes, I can nest `ReadOnlyDirectories` and `ReadWriteDirectories` freely.\r\nMy issue is that `InaccessibleDirectories` can only be put at the “leaves”, making it very cumbersome to describe some things (like my `/srv` example).\r\n\r\nWould it be reasonable to automatically `mkdir -p` as needed when a mountpoint is specified under an `InaccessibleDirectory`?  That cannot break existing unit files, and it seems like a fairly desirable feature."}}