Merge pull request #31210 from poettering/chdir-hardening

WorkingDirectory= hardening

src/basic/mountpoint-util.c

@@ -784,3 +784,10 @@ int mount_option_supported(const char *fstype, const char *key, const char *valu
 
         return true; /* works! */
 }
+
+bool path_below_api_vfs(const char *p) {
+        assert(p);
+
+        /* API VFS are either directly mounted on any of these three paths, or below it. */
+        return PATH_STARTSWITH_SET(p, "/dev", "/sys", "/proc");
+}

src/basic/mountpoint-util.h

@@ -73,3 +73,5 @@ bool mount_new_api_supported(void);
 unsigned long ms_nosymfollow_supported(void);
 
 int mount_option_supported(const char *fstype, const char *key, const char *value);
+
+bool path_below_api_vfs(const char *p);