core: Add ProtectHostname=private

This allows an option for systemd exec units to enable UTS namespaces
but not restrict changing hostname via seccomp. Thus, units can change
hostname without affecting the host.

Fixes: #30348

src/core/exec-invoke.c

@@ -1726,15 +1726,17 @@ static int apply_protect_hostname(const ExecContext *c, const ExecParameters *p,
                                  "support UTS namespaces, ignoring namespace setup.");
 
 #if HAVE_SECCOMP
-        int r;
+        if (c->protect_hostname == PROTECT_HOSTNAME_YES) {
+                int r;
 
-        if (skip_seccomp_unavailable(c, p, "ProtectHostname="))
-                return 0;
+                if (skip_seccomp_unavailable(c, p, "ProtectHostname="))
+                        return 0;
 
-        r = seccomp_protect_hostname();
-        if (r < 0) {
-                *ret_exit_status = EXIT_SECCOMP;
-                return log_exec_error_errno(c, p, r, "Failed to apply hostname restrictions: %m");
+                r = seccomp_protect_hostname();
+                if (r < 0) {
+                        *ret_exit_status = EXIT_SECCOMP;
+                        return log_exec_error_errno(c, p, r, "Failed to apply hostname restrictions: %m");
+                }
         }
 #endif
 
@@ -3417,6 +3419,9 @@ static int apply_mount_namespace(
                 .protect_kernel_tunables = needs_sandboxing && context->protect_kernel_tunables,
                 .protect_kernel_modules = needs_sandboxing && context->protect_kernel_modules,
                 .protect_kernel_logs = needs_sandboxing && context->protect_kernel_logs,
+                /* Only mount /proc/sys/kernel/hostname and domainname read-only if ProtectHostname=yes. Otherwise, ProtectHostname=no
+                 * allows changing hostname for the host and ProtectHostname=private allows changing the hostname in the unit's UTS
+                 * namespace. */
                 .protect_hostname = needs_sandboxing && context->protect_hostname == PROTECT_HOSTNAME_YES,
 
                 .private_dev = needs_sandboxing && context->private_devices,

src/core/namespace.c

@@ -3308,6 +3308,7 @@ DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(protect_home, ProtectHome, PROTECT_HOME_
 static const char *const protect_hostname_table[_PROTECT_HOSTNAME_MAX] = {
         [PROTECT_HOSTNAME_NO]      = "no",
         [PROTECT_HOSTNAME_YES]     = "yes",
+        [PROTECT_HOSTNAME_PRIVATE] = "private",
 };
 
 DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(protect_hostname, ProtectHostname, PROTECT_HOSTNAME_YES);

src/core/namespace.h

@@ -31,6 +31,7 @@ typedef enum ProtectHome {
 typedef enum ProtectHostname {
         PROTECT_HOSTNAME_NO,
         PROTECT_HOSTNAME_YES,
+        PROTECT_HOSTNAME_PRIVATE,
         _PROTECT_HOSTNAME_MAX,
         _PROTECT_HOSTNAME_INVALID = -EINVAL,
 } ProtectHostname;