table of contents
- experimental 258~rc2-1
SYSTEMD-VALIDATEFS@.SERVICE(8) | systemd-validatefs@.service | SYSTEMD-VALIDATEFS@.SERVICE(8) |
NAME¶
systemd-validatefs@.service - Validate File System Mount Constraint Data
SYNOPSIS¶
systemd-validatefs@.service
/usr/lib/systemd/systemd-validatefs [DEVICE]
DESCRIPTION¶
systemd-validatefs@.service is a system service template that can be instantiated for newly established mount points. It reads file system mount constraint data from the file system, and ensures the mount runtime setup matches it. If it doesn't the service fails, which effects an immediate reboot.
This functionality is supposed to ensure that trusted file systems cannot be used in a different context then what they were intended for. More specifically: in an systemd-gpt-auto-generator(8) based environment the file systems to mount are largely auto-discovered based on (unprotected) GPT partition table data. The mount constraint information can be used to validate the GPT partition data, based on the (protected) file system contents.
Specifically, the mount constraints are encoded in the following extended attributes on the root inode of the file systems:
The systemd-validatefs@.service unit is automatically pulled into the initial transaction by systemd-gpt-auto-generator(8) for all file systems it discovers and generates mounts for. systemd-fstab-generator(8) will do this for all mounts with the x-systemd.validatefs mount option in /etc/fstab.
The systemd-repart(8) tool generates these extended attributes automatically for the file systems it puts together, which may be controlled with the AddValidateFS= configuration option.
OPTIONS¶
The /usr/lib/systemd/system-validatefs executable may also be invoked from the command line, where it expects a path to a mount and the following options:
--root=
Added in version 258.
-h, --help
--version
SEE ALSO¶
systemd(1), systemd-gpt-auto-generator(8), systemd-fstab-generator(8), systemd-repart(8)
systemd 258~rc2 |