2 Commits

Author	SHA1	Message	Date
Lennart Poettering	4e67759960	core: be more lenient when checking whether sandboxing is necessary ... In some containers unshare() is made unavailable entirely. Let's deal with this that more gracefully and disable our sandboxing of services then, so that we work in a container, under the assumption the container manager is then responsible for sandboxing if we can't do it ourselves. Previously, we'd insist on sandboxing as soon as any form of BindPath= is used. With this change we only insist on it if we have a setting like that where source and destination differ, i.e. there's a mapping established that actually rearranges things, and thus would result in systematically different behaviour if skipped (as opposed to mappings that just make stuff read-only/writable that otherwise arent'). (Let's also update a test that intended to test for this behaviour with a more specific configuration that still triggers the behaviour with this change in place) Fixes: #13955 (For testing purposes unshare() can easily be blocked with systemd-nspawn --system-call-filter=~unshare.)	2019-11-20 12:30:04 +01:00
Yu Watanabe	23fd04e92d	test: add test for ReadOnlyPaths= with RuntimeDirectory=	2017-11-08 15:48:32 +09:00