units/systemd-journalctl@.service: run with DynamicUser=yes

Follow-up for a109189fab

This follows the existing practice for
systemd-journal-{upload,gatewayd}.service,
as I think allocating a full-blown user
specifically for this purpose is an overkill.
And with DynamicUser=yes we can also take
advantage of implied sandboxing.

meson.build

@@ -895,7 +895,6 @@ foreach option : ['adm-gid',
                   'video-gid',
                   'wheel-gid',
                   'systemd-journal-gid',
-                  'systemd-journal-uid',
                   'systemd-network-uid',
                   'systemd-resolve-uid',
                   'systemd-timesync-uid']

meson_options.txt

@@ -328,8 +328,6 @@ option('wheel-gid', type : 'integer', value : 0,
        description : 'soft-static allocation for the "wheel" group')
 option('systemd-journal-gid', type : 'integer', value : 0,
        description : 'soft-static allocation for the systemd-journal group')
-option('systemd-journal-uid', type : 'integer', value : 0,
-       description : 'soft-static allocation for the systemd-journal user')
 option('systemd-network-uid', type : 'integer', value : 0,
        description : 'soft-static allocation for the systemd-network user')
 option('systemd-resolve-uid', type : 'integer', value : 0,

sysusers.d/systemd-journal.conf.in

@@ -5,5 +5,4 @@
 #  the Free Software Foundation; either version 2.1 of the License, or
 #  (at your option) any later version.
 
-g  systemd-journal {{SYSTEMD_JOURNAL_GID}} -
+g systemd-journal {{SYSTEMD_JOURNAL_GID}} -
-u! systemd-journal {{SYSTEMD_JOURNAL_UID}} "systemd Journal"

units/systemd-journalctl@.service

@@ -17,4 +17,6 @@ RequiresMountsFor=/var/log/journal
 
 [Service]
 ExecStart=journalctl
-User=systemd-journal
+DynamicUser=yes
+User=systemd-journal-access
+SupplementaryGroups=systemd-journal