mirror of
https://github.com/Zeckmathederg/glfs.git
synced 2025-01-24 15:12:11 +08:00
58ad7bcaa6
In the systemd unit file of bluez-5.64, there is: ProtectSystem=full ReadWritePaths=/var/lib/bluetooth The combination of these two options make systemd to bind mount / recursively and read-only to /run/systemd/unit-root in a new mount namespace, then bind mount /var/lib/bluetooth to /run/systemd/unit-root/var/lib/bluetooth, then run bluez in the chroot at /run/systemd/unit-root in the separate namespace. This helps to reduce the potential damage if a bluez security vulnerability is exposed. But, if /var/lib/bluetooth does not exist, systemd will fail to bind mount it and complain: bluetooth.service: bluetooth.service: Failed to set up mount namespacing: /run/systemd/unit-root/var/lib/bluetooth: No such file or directory As a simple workaround, just create this directory at installation. A more elegant solution will be shipped in bluez-5.65: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=0905a06 Q: Why -m700? A: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=edc69d2 |
||
---|---|---|
.. | ||
genlib | ||
genutils | ||
graphlib | ||
prog | ||
sysutils | ||
general.xml |