exec: introduce PrivateDevices= switch to provide services with a private /dev

Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that
sets up a private /dev with only the API pseudo-devices like /dev/null,
/dev/zero, /dev/random, but not any physical devices in them.

src/shared/dev-setup.c

@@ -50,7 +50,7 @@ static int symlink_and_label(const char *old_path, const char *new_path) {
         return r;
 }
 
-void dev_setup(const char *prefix) {
+int dev_setup(const char *prefix) {
         const char *j, *k;
 
         static const char symlinks[] =
@@ -69,16 +69,16 @@ void dev_setup(const char *prefix) {
                 }
 
                 if (prefix) {
-                        char *linkname;
+                        _cleanup_free_ char *link_name = NULL;
 
-                        if (asprintf(&linkname, "%s/%s", prefix, k) < 0) {
-                                log_oom();
-                                break;
-                        }
+                        link_name = strjoin(prefix, "/", k, NULL);
+                        if (!link_name)
+                                return -ENOMEM;
 
-                        symlink_and_label(j, linkname);
-                        free(linkname);
+                        symlink_and_label(j, link_name);
                 } else
                         symlink_and_label(j, k);
         }
+
+        return 0;
 }