From 8db2b4b7331d812214759b74793d85fb767ffa68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Roukala=20=28n=C3=A9=20Peres=29?= Date: Mon, 16 Jan 2023 15:46:42 +0200 Subject: [PATCH] man: Document the interaction between --systemd and --privileged MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Users need to know about this side effect. Fixes: 5a2405ae1b3a ("Don't mount /dev/tty* inside privileged...") Fixes: f4c81b0aa5fd ("Only prevent VTs to be mounted inside ...") Signed-off-by: Martin Roukala (né Peres) --- docs/source/markdown/options/privileged.md | 4 +++- docs/source/markdown/options/systemd.md | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/source/markdown/options/privileged.md b/docs/source/markdown/options/privileged.md index 608b0ded8f..5cca2ad5e0 100644 --- a/docs/source/markdown/options/privileged.md +++ b/docs/source/markdown/options/privileged.md @@ -9,7 +9,9 @@ Give extended privileges to this container. The default is **false**. By default, Podman containers are unprivileged (**=false**) and cannot, for example, modify parts of the operating system. This is because by default a container is only allowed limited access to devices. A "privileged" container -is given the same access to devices as the user launching the container. +is given the same access to devices as the user launching the container, with +the exception of virtual consoles (_/dev/tty\d+_) when running in systemd +mode (**--systemd=always**). A privileged container turns off the security features that isolate the container from the host. Dropped Capabilities, limited devices, read-only mount diff --git a/docs/source/markdown/options/systemd.md b/docs/source/markdown/options/systemd.md index 973c063536..9a6e9fcf08 100644 --- a/docs/source/markdown/options/systemd.md +++ b/docs/source/markdown/options/systemd.md @@ -24,6 +24,7 @@ Running the container in systemd mode causes the following changes: * Podman sets the default stop signal to **SIGRTMIN+3**. * Podman sets **container_uuid** environment variable in the container to the first 32 characters of the container id. +* Podman will not mount virtual consoles (_/dev/tty\d+_) when running with **--privileged**. This allows systemd to run in a confined container without any modifications.