Merge pull request #8839 from yuwata/fix-8833

unit: tighten sandboxing for logind

src/login/logind-user.c

@@ -7,7 +7,6 @@
 
 #include <errno.h>
 #include <string.h>
-#include <sys/mount.h>
 #include <unistd.h>
 #include <stdio_ext.h>
 
@@ -17,7 +16,6 @@
 #include "bus-util.h"
 #include "cgroup-util.h"
 #include "clean-ipc.h"
-#include "conf-parser.h"
 #include "escape.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -27,11 +25,9 @@
 #include "label.h"
 #include "logind-user.h"
 #include "mkdir.h"
-#include "mount-util.h"
 #include "parse-util.h"
 #include "path-util.h"
 #include "rm-rf.h"
-#include "smack-util.h"
 #include "special.h"
 #include "stdio-util.h"
 #include "string-table.h"

src/login/logind.c

@@ -17,7 +17,6 @@
 #include "bus-error.h"
 #include "bus-util.h"
 #include "cgroup-util.h"
-#include "conf-parser.h"
 #include "def.h"
 #include "dirent-util.h"
 #include "fd-util.h"

units/systemd-logind.service.in

@@ -29,8 +29,8 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CA
 MemoryDenyWriteExecute=yes
 RestrictRealtime=yes
 RestrictNamespaces=yes
-RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
-SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
 LockPersonality=yes
 IPAddressDeny=any