SYSTEMD-MOUNTFSD(8)

📦
version 261.3 · 12 versions
, in ubuntu stonking

💅 SYSTEMD-MOUNTFSD.SERVICE 💅

okay bestie, so this page is from the systemd-mountfsd.service manual — it's literally the disk image file system mount service and it's about to be your new fave. no cap. ✨

🌸 SYNOPSIS 🌸

systemd-mountfsd.service

/usr/lib/systemd/systemd-mountfsd

🦋 DESCRIPTION 🦋

okay so systemd-mountfsd is this iconic system service that literally dissects disk images and hands back mount file descriptors for all the file systems inside them to clients, all via a Varlink IPC API. it's giving "middleware but make it slay." 💅

the disk images you feed it must contain a raw file system image, or they have to follow the UAPI.2 Discoverable Partitions Specification<sup>1</sup>. and before it even thinks about mounting anything, it checks that the disk image is legit — authenticity gets established in one of these ways (or a combo, periodt):

  1. if the disk image is sitting in a regular file in one of these directories — /var/lib/machines/, /var/lib/portables/, /var/lib/extensions/, /var/lib/confexts/ — or their counterparts in /etc/, /run/, /usr/lib/ — then it's assumed to be trusted. like, you're in the VIP section, you're good. 🎀
  2. if the disk image contains a Verity enabled disk image, plus a signature partition with a key in the kernel keyring or in /etc/verity.d/*.crt (and related directories), then the disk image is considered trusted. but bestie, real talk — note that the GPT partition table of the disk image gets parsed by the kernel to discover its contents, and systemd-mountfsd just assumes the GPT parser is robust against malformed input and applies no security policies or checks around it. so like, it's trusting the kernel to not fumble the bag. 🙈

this service provides one Varlink<sup>2</sup> service: io.systemd.MountFileSystem — it accepts a file descriptor to a regular file or block device, and returns a number of file descriptors referring to an fsmount() file descriptor that the client can then attach to a path of their choice. literally choose your own adventure. ✨

the returned mounts are automatically allowlisted in the per-user-namespace allowlist maintained by systemd-nsresourced.service(8). yes, they get the stamp of approval. 👑

and the file systems are automatically fsck(8)'ed before mounting. safety first, bestie. 🫶

🔥 SEE ALSO 🔥

⭐ NOTES ⭐

  1. UAPI.2 Discoverable Partitions Specification — https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
  2. Varlink — https://varlink.org/
💖 okay that's the whole page bestie, you ate that. now go mount some disk images responsibly. mwah. 🎀

made with love by systemd 261.3 🌈 systemd-mountfsd.service(8) era — slay responsibly, iykyk 💜

📦 where this page comes from