core: add new ReadOnlySystem= and ProtectedHome= settings for service units

ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for
a service.

ProtectedHome= uses fs namespaces to mount /home and /run/user
inaccessible or read-only for a service.

This patch also enables these settings for all our long-running services.

Together they should be good building block for a minimal service
sandbox, removing the ability for services to modify the operating
system or access the user's private data.

1 files changed, 25 insertions, 1 deletions

diff --git a/src/core/namespace.c b/src/core/namespace.c
index 9f15211cb..de09e9f2c 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -331,6 +331,8 @@ int setup_namespace(
                 char* tmp_dir,
                 char* var_tmp_dir,
                 bool private_dev,
+                ProtectedHome protected_home,
+                bool read_only_system,
                 unsigned mount_flags) {
 
         BindMount *m, *mounts = NULL;
@@ -347,7 +349,9 @@ int setup_namespace(
                 strv_length(read_write_dirs) +
                 strv_length(read_only_dirs) +
                 strv_length(inaccessible_dirs) +
-                private_dev;
+                private_dev +
+                (protected_home != PROTECTED_HOME_NO ? 2 : 0) +
+                (read_only_system ? 2 : 0);
 
         if (n > 0) {
                 m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
@@ -381,6 +385,18 @@ int setup_namespace(
                         m++;
                 }
 
+                if (protected_home != PROTECTED_HOME_NO) {
+                        r = append_mounts(&m, STRV_MAKE("-/home", "-/run/user"), protected_home == PROTECTED_HOME_READ_ONLY ? READONLY : INACCESSIBLE);
+                        if (r < 0)
+                                return r;
+                }
+
+                if (read_only_system) {
+                        r = append_mounts(&m, STRV_MAKE("/usr", "-/boot"), READONLY);
+                        if (r < 0)
+                                return r;
+                }
+
                 assert(mounts + n == m);
 
                 qsort(mounts, n, sizeof(BindMount), mount_path_compare);
@@ -581,3 +597,11 @@ fail:
 
         return r;
 }
+
+static const char *const protected_home_table[_PROTECTED_HOME_MAX] = {
+        [PROTECTED_HOME_NO] = "no",
+        [PROTECTED_HOME_YES] = "yes",
+        [PROTECTED_HOME_READ_ONLY] = "read-only",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(protected_home, ProtectedHome);