systemd doesn't really understand how to do bind mounts with new options. Right now, we can do:
But this translates into:
mount /var/lib/mock /var/lib/mock -t none -o bind,nosuid
rather than the correct sequence:
mount /var/lib/mock /var/lib/mock -o bind
mount -o remount,nosuid /var/lib/mock
since mount doesn't support bind-mounting plus extra options (this is documented in the manpage). It would be nice if systemd could apply some magic here and make it work.
(Note you can't even make two mounts, because systemd's naming convention means only one unit file can be specified per mountpoint.)
Yes this bit me also, but I'm using fstab entries like this:
LABEL=var /var auto defaults,relatime 0 1
/var/home /home none bind,noatime,auto 0 0
/home does not get mounted noatime until I do
mount -o remount,bind
So a big +1 from me for fixing this.
Karel Zak (util-linux maintainer) explains this stuff nicely in the context of the 'ro' attribute on his blog
I am pretty sure should probably get this fixed in the kernel, so that we can actually create the bind mounts atomically. It's less than ideal if everybody sees two mount events and when apps react to that (such as nautilus and gvfs) they will first see a mount point with incorrect mount options...
Closing, this should either be fixed in the kernel (ideally) or in util-linux' mount command. We shouldn't work around it in systemd.
In case anybody stumbles over this problem, I've devised a possible
workaround until there's a proper fix for this issue: