SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: document that stdio file targets are opened before the MAC transition

Browse Source
This commit is contained in:
benkigeek
2026-09-05 11:57:23 +01:00
committed by Luca Boccassi
parent bc17a73107
commit 9457f81485
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+11 -1
View File
@@ -3420,7 +3420,9 @@ SystemCallErrorNumber=EPERM</programlisting>
system object to standard input. An absolute path following the <literal>:</literal> character is expected,
which may refer to a regular file, a FIFO or special file. If an <constant>AF_UNIX</constant> socket in the
file system is specified, a stream socket is connected to it. The latter is useful for connecting standard
input of processes to arbitrary system services.</para>
input of processes to arbitrary system services. Note that the file system object is opened by the
service manager before the executable is invoked; see the note on the security context this
happens in for <varname>StandardOutput=</varname> below.</para>
<para>The <option>socket</option> option is valid in socket-activated services only, and requires the relevant
socket unit file (see
@@ -3515,6 +3517,14 @@ SystemCallErrorNumber=EPERM</programlisting>
<varname>ExecStartPost=</varname>, <varname>ExecReload=</varname>, <varname>ExecStop=</varname> or
similar.</para>
<para>Note that for <option>file:<replaceable>path</replaceable></option>,
<option>append:<replaceable>path</replaceable></option> and
<option>truncate:<replaceable>path</replaceable></option> of <varname>StandardOutput=</varname>,
<varname>StandardError=</varname> or <varname>StandardInput=</varname>, the target path is opened
by the service manager before the executable is invoked — and hence before
<varname>SELinuxContext=</varname> or any policy-defined transition takes effect. The resulting
descriptor is then inherited across that transition into the unit's own domain.</para>
<para><option>socket</option> connects standard output to a socket acquired via socket activation. The
semantics are similar to the same option of <varname>StandardInput=</varname>, see above.</para>