{"action":"opened","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/3439","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/3439/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/3439/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/3439/events","html_url":"https://github.com/systemd/systemd/issues/3439","id":158560448,"number":3439,"title":"Private (bind) mounts for a service","user":{"login":"gdamjan","id":81654,"avatar_url":"https://avatars.githubusercontent.com/u/81654?v=3","gravatar_id":"","url":"https://api.github.com/users/gdamjan","html_url":"https://github.com/gdamjan","followers_url":"https://api.github.com/users/gdamjan/followers","following_url":"https://api.github.com/users/gdamjan/following{/other_user}","gists_url":"https://api.github.com/users/gdamjan/gists{/gist_id}","starred_url":"https://api.github.com/users/gdamjan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdamjan/subscriptions","organizations_url":"https://api.github.com/users/gdamjan/orgs","repos_url":"https://api.github.com/users/gdamjan/repos","events_url":"https://api.github.com/users/gdamjan/events{/privacy}","received_events_url":"https://api.github.com/users/gdamjan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-05T15:46:28Z","updated_at":"2016-06-05T15:46:28Z","closed_at":null,"body":"### Submission type\r\n\r\n  - [x ] Request for enhancement (RFE)\r\n\r\n### systemd version the issue has been seen with\r\n\r\nsystemd 230\r\n+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN\r\n\r\n### Used distribution\r\n\r\nArchLinux\r\n\r\n### Description\r\n\r\nIt would be usefull for a severly constrained service to have a private mount (in my case a bind mount) of a directory. I don't want to have that in fstab and be a global mount. But that seems to not be currently possible. The last thing I tried was:\r\n```\r\n[Service]\r\nNoNewPrivileges=yes\r\nPrivateDevices=yes\r\nPrivateTmp=yes\r\nProtectSystem=full\r\nMountFlags=private\r\nPermissionsStartOnly=yes\r\nUser=owncloud\r\nGroup=owncloud\r\nWorkingDirectory=/home/owncloud/\r\nExecStartPre=/usr/bin/mount --bind /home/music /home/owncloud/data/gdamjan/files/music\r\nExecStart=/usr/bin/uwsgi --ini /etc/uwsgi/owncloud.ini\r\n```\r\nbut it seems that the bind mount in ExecStartPre is executed in its own mount namespace and doesn't have effect on the uwsgi process started in ExecStart (an assumption based that there's no error, but the process namespace doesn't have the mount, checked with nsenter).\r\nThe other option would be for the process started in ExecStart to use mount, but then I would have to run the service as root and depend on uwsgi dropping privileges."}}
{"actor":{"display_login":"gdamjan"}}