SYSTEMD-VA...@.SERVICE(8)

💖 SYSTEMD-VALIDATEFS@.SERVICE — validatefs edition 💖

okay bestie, welcome to systemd-validatefs@.service, aka the manual page that lives inside systemd and is here to talk about Validate File System Mount Constraint Data. yes the whole title is a mouthful, we're gonna get through it together 🫶

---

✨ NAME ✨

systemd-validatefs@.service — Validate File System Mount Constraint Data

the way that name is literally just the description again. iconic.

---

🌸 SYNOPSIS 🌸

systemd-validatefs@.service

/usr/lib/systemd/systemd-validatefs MOUNTPOINT

---

🦋 DESCRIPTION 🦋

so systemd-validatefs@.service is a system service template, right? and you can instantiate it for newly established mount points. when it runs, it goes and reads the file system mount constraint data straight off the file system, and then it makes sure the mount runtime setup actually matches that data. if it doesn't match? the service fails, and that failure effects an immediate reboot. no cap. it's giving consequences 💀

the whole point of this functionality is to make sure trusted file systems can't be used in a different context than the one they were intended for. and more specifically — in a systemd-gpt-auto-generator(8) based environment, the file systems to mount are largely auto-discovered based on (unprotected) GPT partition table data. the mount constraint information is what lets you validate that GPT partition data, based on the (protected) file system contents. protected checking unprotected? we love a plot twist ✨

specifically, the mount constraints are encoded in these extended attributes on the root inode of the file systems:

1. user.validatefs.mount_point — this extended attribute shall contain one or more absolute, normalized paths, separated by NUL bytes. if it's set and the specified file system is mounted to a location that doesn't match any of the listed paths, the validation check will fail.
2. user.validatefs.gpt_label — this extended attribute may contain one or more free-form strings, separated by NUL bytes. if it's set, all backing partitions of the file system get checked against this list, and if any backing partition's label is not listed, the validation will fail. heads up though: there may be multiple backing partitions in the case of Verity setups, which combines a data and a hash partition. two for one 🎀
3. user.validatefs.gpt_type_uuid — this extended attribute may contain one or more GPT partition type UUIDs, formatted as string, separated by NUL bytes. as above, all backing partitions of the file system get checked against this list, and if none is matching, the validation will fail.

now, the systemd-validatefs@.service unit gets automatically pulled into the initial transaction by systemd-gpt-auto-generator(8) for all file systems it discovers and generates mounts for. and systemd-fstab-generator(8) will do the same thing for all mounts that have the x-systemd.validatefs mount option in /etc/fstab. automatic queen behavior 👑

also the systemd-repart(8) tool generates these extended attributes automatically for the file systems it puts together, and that's controllable with the AddValidateFS= configuration option. slay.

---

💅 OPTIONS 💅

so the /usr/lib/systemd/systemd-validatefs executable may also be invoked from the command line, and when you do that it expects a path to a mount plus the following options:

• --root= — takes an absolute path or the special string "auto". the specified path is removed as a prefix from the specified mount point argument before the validation. if it's set to "auto" it defaults to unspecified on the host and /sysroot/ when run in initrd context, in order to validate the mount constraint data relative to the future file system root.

added in version 258.

• -h, --help — print a short help text and exit. the classic.
• --version — print a short version string and exit. also the classic.

---

🌈 SEE ALSO 🌈

systemd(1), systemd-gpt-auto-generator(8), systemd-fstab-generator(8), systemd-repart(8)

---

lowkey reminder: this page is from systemd 262.1, so if you're reading this on some ancient version and nothing matches, that's why bestie 😭

that's the whole page, go validate something (or don't, no pressure) 💖✨