From de46b2be07538b55df0ba5e312a89eebb87c710a Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Tue, 10 Mar 2020 16:43:10 +0200
Subject: [PATCH 1/2] namespace: ignore prefix chars when comparing paths

Other callers of path_strv_contains() or PATH_IN_SET() don't seem to handle
paths prefixed with -+.
---
 src/basic/path-util.c | 16 ++++++++++++++++
 src/basic/path-util.h |  1 +
 src/core/namespace.c  |  8 ++++----
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/basic/path-util.c b/src/basic/path-util.c
index 49a211a527d..ba13de01ff0 100644
--- a/src/basic/path-util.c
+++ b/src/basic/path-util.c
@@ -1125,3 +1125,19 @@ bool path_strv_contains(char **l, const char *path) {
 
         return false;
 }
+
+bool prefixed_path_strv_contains(char **l, const char *path) {
+        char **i, *j;
+
+        STRV_FOREACH(i, l) {
+                j = *i;
+                if (*j == '-')
+                        j++;
+                if (*j == '+')
+                        j++;
+                if (path_equal(j, path))
+                        return true;
+        }
+
+        return false;
+}
diff --git a/src/basic/path-util.h b/src/basic/path-util.h
index f49a876f3d2..30031fca8ef 100644
--- a/src/basic/path-util.h
+++ b/src/basic/path-util.h
@@ -173,3 +173,4 @@ static inline const char *empty_to_root(const char *path) {
 }
 
 bool path_strv_contains(char **l, const char *path);
+bool prefixed_path_strv_contains(char **l, const char *path);
diff --git a/src/core/namespace.c b/src/core/namespace.c
index cda9d2ca1d3..a461a3cce43 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -1192,7 +1192,7 @@ static bool root_read_only(
         if (protect_system == PROTECT_SYSTEM_STRICT)
                 return true;
 
-        if (path_strv_contains(read_only_paths, "/"))
+        if (prefixed_path_strv_contains(read_only_paths, "/"))
                 return true;
 
         return false;
@@ -1217,9 +1217,9 @@ static bool home_read_only(
         if (protect_home != PROTECT_HOME_NO)
                 return true;
 
-        if (path_strv_contains(read_only_paths, "/home") ||
-            path_strv_contains(inaccessible_paths, "/home") ||
-            path_strv_contains(empty_directories, "/home"))
+        if (prefixed_path_strv_contains(read_only_paths, "/home") ||
+            prefixed_path_strv_contains(inaccessible_paths, "/home") ||
+            prefixed_path_strv_contains(empty_directories, "/home"))
                 return true;
 
         for (i = 0; i < n_temporary_filesystems; i++)

From efa2f3a18b07cadaf5035b22deff197025f814f7 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Tue, 10 Mar 2020 15:36:51 +0200
Subject: [PATCH 2/2] execute: don't create /tmp and /var/tmp if both are
 inaccessible

If both /tmp and either /var/tmp or whole /var are inaccessible, there's no
need to create the temporary directories.
---
 src/core/execute.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/core/execute.c b/src/core/execute.c
index 587b77a3f47..00a2f2e17e4 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -5371,7 +5371,10 @@ static int exec_runtime_make(Manager *m, const ExecContext *c, const char *id, E
         if (!c->private_network && !c->private_tmp && !c->network_namespace_path)
                 return 0;
 
-        if (c->private_tmp) {
+        if (c->private_tmp &&
+            !(prefixed_path_strv_contains(c->inaccessible_paths, "/tmp") &&
+              (prefixed_path_strv_contains(c->inaccessible_paths, "/var/tmp") ||
+               prefixed_path_strv_contains(c->inaccessible_paths, "/var")))) {
                 r = setup_tmp_dirs(id, &tmp_dir, &var_tmp_dir);
                 if (r < 0)
                         return r;