man: document AT_EXECVE_CHECK support in RestrictFileSystemAccess=

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

NEWS

@@ -132,6 +132,14 @@ CHANGES WITH 263 in spe:
           adds rustc >= 1.85, bindgen >= 0.71.1 and meson >= 1.4.0 as
           optional build dependencies.
 
+        Changes in the system and service manager:
+
+        * RestrictFileSystemAccess= now answers execveat() queries carrying
+          the AT_EXECVE_CHECK flag (Linux 6.14 or newer) with the verdict a
+          real execution of the file would get, so that script interpreters
+          honouring SECBIT_EXEC_RESTRICT_FILE can enforce the policy for the
+          scripts they run.
+
         Changes in systemd-logind:
 
         * systemd-inhibit --mode=delay now defaults to --what=sleep:shutdown,

man/systemd-system.conf.xml

@@ -564,6 +564,12 @@
         layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as
         btrfs are unsupported.</para>
 
+        <para>Since v263, the policy also answers <function>execveat()</function> queries carrying the
+        <constant>AT_EXECVE_CHECK</constant> flag with the verdict a real execution of the file would get, so
+        that script interpreters honouring <constant>SECBIT_EXEC_RESTRICT_FILE</constant> can enforce the policy
+        for the scripts they run. This requires kernel v6.14 or newer. Only the file itself is checked, not the
+        interpreter or the libraries it needs.</para>
+
         <para>Note that, without further measures to secure the system, kexec can be used to circumvent
         this.</para>