mirror of
https://github.com/Zeckmathederg/glfs.git
synced 2025-01-24 15:12:11 +08:00
58ad7bcaa6
In the systemd unit file of bluez-5.64, there is:
ProtectSystem=full
ReadWritePaths=/var/lib/bluetooth
The combination of these two options make systemd to bind mount /
recursively and read-only to /run/systemd/unit-root in a new mount
namespace, then bind mount /var/lib/bluetooth to
/run/systemd/unit-root/var/lib/bluetooth, then run bluez in the chroot
at /run/systemd/unit-root in the separate namespace.
This helps to reduce the potential damage if a bluez security
vulnerability is exposed. But, if /var/lib/bluetooth does not exist,
systemd will fail to bind mount it and complain:
bluetooth.service: bluetooth.service: Failed to set up mount
namespacing: /run/systemd/unit-root/var/lib/bluetooth: No such
file or directory
As a simple workaround, just create this directory at installation. A
more elegant solution will be shipped in bluez-5.65:
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=0905a06
Q: Why -m700?
A: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=edc69d2
|
||
|---|---|---|
| .. | ||
| accountsservice.xml | ||
| acpid.xml | ||
| at.xml | ||
| autofs.xml | ||
| blocaled.xml | ||
| bluez.xml | ||
| bubblewrap.xml | ||
| colord.xml | ||
| cpio.xml | ||
| cups-pk-helper.xml | ||
| dbus.xml | ||
| elogind.xml | ||
| fcron.xml | ||
| gpm.xml | ||
| hdparm.xml | ||
| lm_sensors.xml | ||
| logrotate.xml | ||
| lsb-tools.xml | ||
| mc.xml | ||
| modemmanager.xml | ||
| notification-daemon.xml | ||
| p7zip.xml | ||
| pax.xml | ||
| pciutils.xml | ||
| pm-utils.xml | ||
| raptor.xml | ||
| rasqal.xml | ||
| redland.xml | ||
| sg3_utils.xml | ||
| sysstat.xml | ||
| systemd.xml | ||
| sysutils.xml | ||
| udisks2.xml | ||
| unrar.xml | ||
| unzip.xml | ||
| upower.xml | ||
| usbutils.xml | ||
| which.xml | ||
| zip.xml | ||