system-or-user-ns-mountfsd-mount-options

When enabled for services running in per-user instances of the service manager using mount options is disabled by default, due to the security implications. It is possible to use a polkit policy to allow specific mount options, for example:

A polkit policy that allows mounting the root partition with nosuid

/etc/polkit-1/rules.d/mountoptions.rules:

polkit.addRule(function(action, subject) {
    if (action.id == "io.systemd.mount-file-system.mount-untrusted-image-privately" &&
            action.lookup("mount_options") == "root:nosuid") {
        return polkit.Result.YES;
    }
});

这篇文档对你有帮助吗？