From 647b398cfc19390db4ee092a9e9d9aaba44dca9a Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Thu, 2 Jul 2026 09:10:27 +0100
Subject: [PATCH] man: note that sd-tmpfiles/sysusers --root is not a
 sandboxing feature

This seems to be causing enough confusion that it is worth explicitly
mentioning in the docs

(cherry picked from commit 243fcc6200627c0975f50ba87e565a038ec191bb)
(cherry picked from commit c12e4a6e282e319801b612128c99b31318121817)
---
 man/systemd-sysusers.xml | 4 ++++
 man/systemd-tmpfiles.xml | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/man/systemd-sysusers.xml b/man/systemd-sysusers.xml
index 5c299169eba..c7210d13cc3 100644
--- a/man/systemd-sysusers.xml
+++ b/man/systemd-sysusers.xml
@@ -66,6 +66,10 @@
         <replaceable>root</replaceable> path, including config search
         paths. </para>
 
+        <para>Note that this is not a sandboxing or security feature.
+        <citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+        definitions are potentially not processed in a hermetic fashion to the specified root.</para>
+
         <xi:include href="version-info.xml" xpointer="v215"/></listitem>
       </varlistentry>
 
diff --git a/man/systemd-tmpfiles.xml b/man/systemd-tmpfiles.xml
index 815dcd88d62..41cd4de3cd2 100644
--- a/man/systemd-tmpfiles.xml
+++ b/man/systemd-tmpfiles.xml
@@ -254,6 +254,10 @@
         or directories below mount points in the OS image operated on that are typically overmounted during
         runtime.</para>
 
+        <para>Note that this is not a sandboxing or security feature.
+        <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+        definitions are potentially not processed in a hermetic fashion to the specified root.</para>
+
         <xi:include href="version-info.xml" xpointer="v212"/></listitem>
       </varlistentry>