From e0be975735b0e4477251a2e6697aa0895147c905 Mon Sep 17 00:00:00 2001
From: Christian Brauner <brauner@kernel.org>
Date: Tue, 25 Aug 2026 14:38:55 +0200
Subject: [PATCH] man: document RestrictFileSystemAccess= W^X hardening

Describe the system-wide W^X rule and the new proc_mem.force_override=never
and seccomp prerequisites, and drop the advice to block writable and
executable mappings by other means, which the policy now does itself.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 man/systemd-system.conf.xml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index 9351c6ec52..bb28debbf2 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -553,6 +553,10 @@
         shared libraries (<literal>mmap_file</literal>), and write-to-execute transitions such as JIT
         compilation (<literal>file_mprotect</literal>).</para>
 
+        <para>The policy also enforces W^X system-wide: no mapping may be writable and executable at the
+        same time, and a private file mapping that has been modified through copy-on-write may not be made
+        executable afterwards.</para>
+
         <para>Since v262, files on overlayfs mounts are resolved to the layer that hosts their data, so
         execution from an overlay whose data resides on a signed dm-verity device is permitted, while files
         in a writable upper layer are denied. This requires kernel v7.2 or newer; on older kernels execution from
@@ -561,13 +565,11 @@
         btrfs are unsupported.</para>
 
         <para>Note that, without further measures to secure the system, kexec can be used to circumvent
-        this. Writable and executable memory mappings can also be used to circumvent this, so they need to
-        be blocked, which can be achieved using other LSMs, or on a per-service basis by using the
-        <varname>MemoryDenyWriteExecute=</varname> setting.</para>
+        this.</para>
 
         <para>This requires the kernel to be booted with <literal>dm_verity.require_signatures=1</literal>
-        on the kernel command line and with BPF LSM enabled (<literal>lsm=...,bpf</literal>). If either
-        prerequisite is not met, PID 1 will refuse to complete startup.</para>
+        and <literal>proc_mem.force_override=never</literal> on the kernel command line, and with BPF LSM
+        enabled (<literal>lsm=...,bpf</literal>).</para>
 
         <para>The value <literal>yes</literal> is equivalent to <literal>exec</literal>. Additional
         modes may be added in the future.</para>