[systemd-devel] Add filesystem paths to InaccessiblePaths globally for some paths ?

[Steve Traylen]

Units like "systemd-resolved.service" contain with good reason: 
"ProtectSystem=strict"

This of course bind mounts mounted filesystems into the units userspace.

"strict" is

"If set to "strict" the entire file system hierarchy is mounted 
read-only, except for the API file system subtrees /dev/, /proc/ and /sys/"

Can these filesystems /dev, /proc, /sys be extended globally somewhere?

There is the perfectly good: "InaccessiblePaths=-/cvmfs" which does a 
great job of not mounting /cvmfs into the name space but alas this
is a per unit setting of course AFAIK.

Motivation here is that when "funny" filesystems (think /afs, /cvmfsm, 
... /eos ) go "bad" for what ever reason this can stop "reload 
systemd-resolved.service" being restarted as remount is bad. I've not 
tried but can may be reproduce with something more standard like a stale 
/nfs.

Any way to set  a default for InaccessiblePaths= or equivalent to stop 
these FSs being bind mounted in ever.


Steve.