core: introduce BindJournalSockets=

Closes #32478

src/core/execute.c

@@ -284,7 +284,7 @@ bool exec_needs_mount_namespace(
              context->directories[EXEC_DIRECTORY_LOGS].n_items > 0))
                 return true;
 
-        if (context->log_namespace)
+        if (exec_context_get_effective_bind_journal_sockets(context))
                 return true;
 
         return false;
@@ -539,6 +539,7 @@ void exec_context_init(ExecContext *c) {
                 .tty_cols = UINT_MAX,
                 .private_mounts = -1,
                 .mount_apivfs = -1,
+                .bind_journal_sockets = -1,
                 .memory_ksm = -1,
                 .set_login_environment = -1,
         };
@@ -979,6 +980,7 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
                 "%sProtectHome: %s\n"
                 "%sProtectSystem: %s\n"
                 "%sMountAPIVFS: %s\n"
+                "%sBindJournalSockets: %s\n"
                 "%sIgnoreSIGPIPE: %s\n"
                 "%sMemoryDenyWriteExecute: %s\n"
                 "%sRestrictRealtime: %s\n"
@@ -1004,6 +1006,7 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
                 prefix, protect_home_to_string(c->protect_home),
                 prefix, protect_system_to_string(c->protect_system),
                 prefix, yes_no(exec_context_get_effective_mount_apivfs(c)),
+                prefix, yes_no(exec_context_get_effective_bind_journal_sockets(c)),
                 prefix, yes_no(c->ignore_sigpipe),
                 prefix, yes_no(c->memory_deny_write_execute),
                 prefix, yes_no(c->restrict_realtime),
@@ -1486,6 +1489,27 @@ bool exec_context_get_effective_mount_apivfs(const ExecContext *c) {
         return false;
 }
 
+bool exec_context_get_effective_bind_journal_sockets(const ExecContext *c) {
+        assert(c);
+
+        /* If log namespace is specified, "/run/systemd/journal.namespace/" would be bind mounted to
+         * "/run/systemd/journal/", which effectively means BindJournalSockets=yes */
+        if (c->log_namespace)
+                return true;
+
+        if (c->bind_journal_sockets >= 0)
+                return c->bind_journal_sockets > 0;
+
+        if (exec_context_get_effective_mount_apivfs(c))
+                return true;
+
+        /* When PrivateDevices=yes, /dev/log gets symlinked to /run/systemd/journal/dev-log */
+        if (exec_context_with_rootfs(c) && c->private_devices)
+                return true;
+
+        return false;
+}
+
 void exec_context_free_log_extra_fields(ExecContext *c) {
         assert(c);