On Wed, 18.11.15 13:02, Igor Bukanov ([email protected]) wrote: > On 18 November 2015 at 12:28, Lennart Poettering <[email protected]> > wrote: > > We don't support that. Invoking user processes from a system context > > is something we generally avoid. > > Could you clarify how this is related to an ability to invoke a user > process? For example, I can explicitly pass uid=1000,gid=1000 as a > mount option to fuse.sshfs and that makes the mounted tree owned by > that user also with systemd mount/automount.
Well, setting mount options is fine, and you can pass anything you like there. The problem is with actually invoking processes such as the fuse.sshfs one as a non-root user. We generally don#t do this unless PAM is in the mix, so that selinux/keyring/home directory/limits yaddayadda are in effect. Executing user processes without opening a proper session from them is not OK at all. This is not only insecure but also a source of bugs, as these things need access to home directories, keyrings and whatnot to work correctly. Lennart -- Lennart Poettering, Red Hat _______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
