From 694ac19a83e55e956b8e2ff0a463556e2763def4 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Fri, 23 Oct 2026 10:20:38 +0200 Subject: [PATCH] man: document AT_EXECVE_CHECK support in RestrictFileSystemAccess= Signed-off-by: Christian Brauner (Amutable) --- NEWS | 8 ++++++++ man/systemd-system.conf.xml | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/NEWS b/NEWS index ffc0d68fd86..488a91faec7 100644 --- a/NEWS +++ b/NEWS @@ -132,6 +132,14 @@ CHANGES WITH 263 in spe: adds rustc >= 1.85, bindgen >= 0.71.1 and meson >= 1.4.0 as optional build dependencies. + Changes in the system and service manager: + + * RestrictFileSystemAccess= now answers execveat() queries carrying + the AT_EXECVE_CHECK flag (Linux 6.14 or newer) with the verdict a + real execution of the file would get, so that script interpreters + honouring SECBIT_EXEC_RESTRICT_FILE can enforce the policy for the + scripts they run. + Changes in systemd-logind: * systemd-inhibit --mode=delay now defaults to --what=sleep:shutdown, diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml index bb28debbf21..2a1d57546a6 100644 --- a/man/systemd-system.conf.xml +++ b/man/systemd-system.conf.xml @@ -564,6 +564,12 @@ layer may still control a binary's ownership and setuid bits. Multi-device filesystems such as btrfs are unsupported. + Since v263, the policy also answers execveat() queries carrying the + AT_EXECVE_CHECK flag with the verdict a real execution of the file would get, so + that script interpreters honouring SECBIT_EXEC_RESTRICT_FILE can enforce the policy + for the scripts they run. This requires kernel v6.14 or newer. Only the file itself is checked, not the + interpreter or the libraries it needs. + Note that, without further measures to secure the system, kexec can be used to circumvent this.