core: add new ReadOnlySystem= and ProtectedHome= settings for service units

ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for
a service.

ProtectedHome= uses fs namespaces to mount /home and /run/user
inaccessible or read-only for a service.

This patch also enables these settings for all our long-running services.

Together they should be good building block for a minimal service
sandbox, removing the ability for services to modify the operating
system or access the user's private data.

1 files changed, 3 insertions, 0 deletions

diff --git a/src/core/execute.h b/src/core/execute.h
index c9e29ffc8a..3d6f77c8ef 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -39,6 +39,7 @@ typedef struct ExecRuntime ExecRuntime;
 #include "set.h"
 #include "fdset.h"
 #include "missing.h"
+#include "namespace.h"
 
 typedef enum ExecInput {
         EXEC_INPUT_NULL,
@@ -156,6 +157,8 @@ struct ExecContext {
         bool private_tmp;
         bool private_network;
         bool private_devices;
+        bool read_only_system;
+        ProtectedHome protected_home;
 
         bool no_new_privileges;