systemd-mountfsd.service, systemd-mountfsd — Disk Image File System Mount Service
systemd-mountfsd.service
/usr/lib/systemd/systemd-mountfsd
systemd-mountfsd is a system service that dissects disk images, and returns mount file descriptors for the file systems contained therein to clients, via a Varlink IPC API.
The disk images provided must contain a raw file system image or must follow the UAPI.2 Discoverable Partitions Specification. Before mounting any file systems authenticity of the disk image is established in one or a combination of the following ways:
If the disk image is located in a regular file in one of the directories
/var/lib/machines/, /var/lib/portables/,
/var/lib/extensions/, /var/lib/confexts/ or their
counterparts in the /etc/, /run/,
/usr/lib/ it is assumed to be trusted.
If the disk image contains a Verity enabled disk image, along with a signature
partition with a key in the kernel keyring or in /etc/verity.d/*.crt (and related
directories) the disk image is considered trusted. Note that the GPT partition table of the disk image
is parsed by the kernel to discover its contents and systemd-mountfsd assumes that
the GPT parser is robust against malformed input and applies no security policies or checks around it.
This service provides one Varlink service:
io.systemd.MountFileSystem which accepts a file descriptor to a regular file or
block device, and returns a number of file descriptors referring to an fsmount()
file descriptor the client may then attach to a path of their choice.
The returned mounts are automatically allowlisted in the per-user-namespace allowlist maintained by systemd-nsresourced.service(8).
The file systems are automatically fsck(8)'ed before mounting.