From 7fa7ff87cd27f0076769f4e8790d75ee6cb52fd7 Mon Sep 17 00:00:00 2001 From: Totoro Date: Thu, 3 Sep 2026 21:51:29 +0800 Subject: [PATCH] sysupdate: Permit mount namespaces in Varlink service The Varlink service enumerates image targets and needs a private mount namespace while dissecting images. Keep its sandbox in sync with systemd-sysupdated.service. Follow-up to 31616d00efe80f07793af46f9bf9bcad1d5a7526 Fixes #43604 --- units/systemd-sysupdate-update.service.in | 2 +- units/systemd-sysupdate@.service.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/units/systemd-sysupdate-update.service.in b/units/systemd-sysupdate-update.service.in index 894d17034c..74adb61fda 100644 --- a/units/systemd-sysupdate-update.service.in +++ b/units/systemd-sysupdate-update.service.in @@ -25,7 +25,7 @@ NoNewPrivileges=yes MemoryDenyWriteExecute=yes ProtectHostname=yes RestrictRealtime=yes -RestrictNamespaces=net +RestrictNamespaces=net mnt RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=@system-service @mount SystemCallErrorNumber=EPERM diff --git a/units/systemd-sysupdate@.service.in b/units/systemd-sysupdate@.service.in index c54d469597..09b1d16c9a 100644 --- a/units/systemd-sysupdate@.service.in +++ b/units/systemd-sysupdate@.service.in @@ -23,7 +23,7 @@ NoNewPrivileges=yes MemoryDenyWriteExecute=yes ProtectHostname=yes RestrictRealtime=yes -RestrictNamespaces=net +RestrictNamespaces=net mnt RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=@system-service @mount SystemCallErrorNumber=EPERM