core: add new ReadOnlySystem= and ProtectedHome= settings for service units

[elogind.git] / src / core / namespace.c

diff --git a/src/core/namespace.c b/src/core/namespace.c
index 9f15211cb62f0774ed78351afa87b086db804df7..de09e9f2c36e121b26c75b9afe833756e1f19ffe 100644 (file)
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -331,6 +331,8 @@ int setup_namespace(
                 char* tmp_dir,
                 char* var_tmp_dir,
                 bool private_dev,
+                ProtectedHome protected_home,
+                bool read_only_system,
                 unsigned mount_flags) {
 
         BindMount *m, *mounts = NULL;
@@ -347,7 +349,9 @@ int setup_namespace(
                 strv_length(read_write_dirs) +
                 strv_length(read_only_dirs) +
                 strv_length(inaccessible_dirs) +
-                private_dev;
+                private_dev +
+                (protected_home != PROTECTED_HOME_NO ? 2 : 0) +
+                (read_only_system ? 2 : 0);
 
         if (n > 0) {
                 m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
@@ -381,6 +385,18 @@ int setup_namespace(
                         m++;
                 }
 
+                if (protected_home != PROTECTED_HOME_NO) {
+                        r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user"), protected_home == PROTECTED_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
+                        if (r < 0)
+                                return r;
+                }
+
+                if (read_only_system) {
+                        r = append_mounts(&m, STRV_MAKE("/usr", "-/boot"), READONLY);
+                        if (r < 0)
+                                return r;
+                }
+
                 assert(mounts + n == m);
 
                 qsort(mounts, n, sizeof(BindMount), mount_path_compare);
@@ -581,3 +597,11 @@ fail:
 
         return r;
 }
+
+static const char *const protected_home_table[_PROTECTED_HOME_MAX] = {
+        [PROTECTED_HOME_NO] = "no",
+        [PROTECTED_HOME_YES] = "yes",
+        [PROTECTED_HOME_READ_ONLY] = "read-only",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(protected_home, ProtectedHome);