SYSTEMD.IMAGE-POLICY(7) systemd.image-policy SYSTEMD.IMAGE-POLICY(7) systemd.image-policy - systemd (DDI) UAPI.2[1] . (":"). ("=") . ("+"). : root usr home srv esp xbootldr swap root-verity root-verity-sig usr-verity usr-verity-sig tmp var. . . / : o unprotected Verity LUKS. o verity Verity. (: DDI Verity verity ( signed) Verity . : DDI signature verity unprotected). o signed Verity PKCS#7 Verity. o encrypted LUKS. o unused . o absent . : 1. +-----------------------+ | | | | +-----------------------+ |"btrfs" | +-----------------------+ |"erofs" | +-----------------------+ |"ext4" | +-----------------------+ |"f2fs" | +-----------------------+ |"squashfs" | +-----------------------+ |"vfat" | +-----------------------+ |"xfs" | +-----------------------+ . "unused+absent" : ( ) . "unprotected+verity+signed+encrypted+unused+absent" "open" . : open . GPT : o read-only-off read-only-on . o growfs-off growfs-on growfs . read-only-off read-only-on . . growfs-off/growfs-on. ( ). "absent+unused" Verity . "*" " " : =verity+signed+encrypted+unprotected+unused+absent "-" " " : =unused+absent "~" " " : =absent systemd --image-policy= ( "*" ) . systemd-gpt-auto-generator(8) GPT . systemd.image_policy=. -- /. systemd-sysext(8) /usr/ /opt/ /home/ ( ) . systemd-nspawn(1) . image-policy systemd-analyze(1) . /usr/ Verity . : usr=verity+read-only-on:root=encrypted:swap=encrypted /srv/ : root=encrypted+read-only-off:srv=encrypted+absent:swap=absent . root=unprotected+encrypted:swap=absent+unused:=unprotected+encrypted+absent erofs squashfs . root=erofs+squashfs:swap=absent+unused:=unprotected+encrypted+absent systemd(1), systemd-dissect(1), systemd-gpt-auto-generator(8), systemd-sysext(8), systemd-analyze(1) 1. UAPI.2 https://uapi-group.org/specifications/specs/discoverable_partitions_specification 3 . . : . systemd 260.2 SYSTEMD.IMAGE-POLICY(7)