char* tmp_dir,
char* var_tmp_dir,
bool private_dev,
+ ProtectedHome protected_home,
+ bool read_only_system,
unsigned mount_flags) {
BindMount *m, *mounts = NULL;
strv_length(read_write_dirs) +
strv_length(read_only_dirs) +
strv_length(inaccessible_dirs) +
- private_dev;
+ private_dev +
+ (protected_home != PROTECTED_HOME_NO ? 2 : 0) +
+ (read_only_system ? 2 : 0);
if (n > 0) {
m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
m++;
}
+ if (protected_home != PROTECTED_HOME_NO) {
+ r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user"), protected_home == PROTECTED_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
+ if (r < 0)
+ return r;
+ }
+
+ if (read_only_system) {
+ r = append_mounts(&m, STRV_MAKE("/usr", "-/boot"), READONLY);
+ if (r < 0)
+ return r;
+ }
+
assert(mounts + n == m);
qsort(mounts, n, sizeof(BindMount), mount_path_compare);
return r;
}
+
+static const char *const protected_home_table[_PROTECTED_HOME_MAX] = {
+ [PROTECTED_HOME_NO] = "no",
+ [PROTECTED_HOME_YES] = "yes",
+ [PROTECTED_HOME_READ_ONLY] = "read-only",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(protected_home, ProtectedHome);