diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 9462206340..6eb2cfab95 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1556,7 +1556,12 @@ StateDirectory=aaa/bbb ccc permit this. Nest ReadWritePaths= inside of ReadOnlyPaths= in order to provide writable subdirectories within read-only directories. Use ReadWritePaths= in order to allow-list specific paths for write access if - ProtectSystem=strict is used. + ProtectSystem=strict is used. Note that ReadWritePaths= cannot + be used to gain write access to a file system whose superblock is mounted read-only. On Linux, for + each mount point write access is granted only if the mount point itself and the + file system superblock backing it are not marked read-only. ReadWritePaths= only + controls the former, not the latter, hence a read-only file system superblock remains + protected. Paths listed in InaccessiblePaths= will be made inaccessible for processes inside the namespace along with everything below them in the file system hierarchy. This may be more restrictive than