diff options
Diffstat (limited to 'src/core/namespace.c')
| -rw-r--r-- | src/core/namespace.c | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/src/core/namespace.c b/src/core/namespace.c index 9f15211cb6..de09e9f2c3 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -331,6 +331,8 @@ int setup_namespace( char* tmp_dir, char* var_tmp_dir, bool private_dev, + ProtectedHome protected_home, + bool read_only_system, unsigned mount_flags) { BindMount *m, *mounts = NULL; @@ -347,7 +349,9 @@ int setup_namespace( strv_length(read_write_dirs) + strv_length(read_only_dirs) + strv_length(inaccessible_dirs) + - private_dev; + private_dev + + (protected_home != PROTECTED_HOME_NO ? 2 : 0) + + (read_only_system ? 2 : 0); if (n > 0) { m = mounts = (BindMount *) alloca(n * sizeof(BindMount)); @@ -381,6 +385,18 @@ int setup_namespace( m++; } + if (protected_home != PROTECTED_HOME_NO) { + r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user"), protected_home == PROTECTED_HOME_READ_ONLY ? READONLY : INACCESSIBLE); + if (r < 0) + return r; + } + + if (read_only_system) { + r = append_mounts(&m, STRV_MAKE("/usr", "-/boot"), READONLY); + if (r < 0) + return r; + } + assert(mounts + n == m); qsort(mounts, n, sizeof(BindMount), mount_path_compare); @@ -581,3 +597,11 @@ fail: return r; } + +static const char *const protected_home_table[_PROTECTED_HOME_MAX] = { + [PROTECTED_HOME_NO] = "no", + [PROTECTED_HOME_YES] = "yes", + [PROTECTED_HOME_READ_ONLY] = "read-only", +}; + +DEFINE_STRING_TABLE_LOOKUP(protected_home, ProtectedHome); |