man,NEWS: document validatefs enforcement when mounting DDIs

NEWS

@@ -31,6 +31,21 @@ CHANGES WITH 263 in spe:
           org.freedesktop.sysupdate1.Target.DescribeFeature() is now an array of
           strings rather than a single optional string.
 
+        * The file system constraints encoded in the user.validatefs.*
+          extended attributes (as written by systemd-repart's AddValidateFS=
+          setting, which is enabled by default for most file systems) are now
+          also enforced when mounting partitions of disk images, i.e. via
+          systemd-dissect, systemd-nspawn, systemd-sysext, portabled,
+          systemd-mountfsd and RootImage=. Any constraint that is set must be
+          fulfilled: in particular this means that file systems carrying GPT
+          partition label or type constraints may no longer be used as bare
+          file system images without partition table (for example
+          partitions split out of a DDI via systemd-repart --split=yes), and
+          file systems declared for a specific mount point may no longer be
+          used as root file system. Set AddValidateFS=no when building such
+          images, or set $SYSTEMD_DISSECT_VALIDATEFS=0 when using them to
+          restore the previous behaviour.
+
         Changes in systemd-udevd:
 
         * systemd-udevd now uses fanotify rather than inotify to watch device

man/repart.d.xml

@@ -1248,7 +1248,15 @@
         scenarios, which puts together the mount hierarchy from untrusted data from the GPT partition
         table. As these extended attributes are stored inside the file system, they are typically
         authenticated as part of the file system (assuming it is contained in protected volume; i.e. LUKS or
-        dm-verity), and hence may be used to securely validate the matching partition table fields.</para>
+        dm-verity), and hence may be used to securely validate the matching partition table fields. The
+        same constraints are also enforced when the partitions are mounted as part of a disk image, for
+        example via
+        <citerefentry><refentrytitle>systemd-dissect</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+        or
+        <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+        Note that this means that a file system generated with this option enabled cannot be used as bare
+        file system image without partition table anymore, since its GPT constraints cannot be fulfilled
+        then.</para>
 
         <xi:include href="version-info.xml" xpointer="v258"/></listitem>
       </varlistentry>

man/systemd-validatefs@.service.xml

@@ -74,6 +74,21 @@
     <citerefentry><refentrytitle>systemd-repart</refentrytitle><manvolnum>8</manvolnum></citerefentry> tool
     generates these extended attributes automatically for the file systems it puts together, which may be
     controlled with the <varname>AddValidateFS=</varname> configuration option.</para>
+
+    <para>The same constraints are also enforced whenever partitions of a disk image are mounted via the
+    generic image dissection logic, i.e. by
+    <citerefentry><refentrytitle>systemd-dissect</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd-sysext</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd-portabled.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd-mountfsd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    or the <varname>RootImage=</varname> setting in unit files. In this case the mount point is checked
+    relative to the image's root directory. Any constraint that is set must be fulfilled in full: if
+    <varname>user.validatefs.gpt_label</varname> or <varname>user.validatefs.gpt_type_uuid</varname> are
+    set, but the file system is not placed on a GPT partition (for example because the image is a bare file
+    system image, or uses an MBR partition table) the mount is refused. This validation may be turned off by
+    setting the <varname>$SYSTEMD_DISSECT_VALIDATEFS</varname> environment variable to
+    <literal>0</literal>.</para>
   </refsect1>
 
   <refsect1>
@@ -108,6 +123,7 @@
       <member><citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-fstab-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
       <member><citerefentry><refentrytitle>systemd-repart</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
+      <member><citerefentry><refentrytitle>systemd-dissect</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
     </simplelist></para>
   </refsect1>