core: create inaccessible nodes for users when making runtime dirs

To support ProtectHome=y in a user namespace (which mounts the inaccessible
nodes), the nodes need to be accessible by the user. Create these paths and
devices in the user runtime directory so they can be used later if needed.

test/TEST-43-PRIVATEUSER-UNPRIV/test.sh

@@ -11,6 +11,7 @@ test_setup() {
         eval $(udevadm info --export --query=env --name=${LOOPDEV}p2)
 
         setup_basic_environment
+        inst_binary stat
 
         mask_supporting_services
 

test/TEST-43-PRIVATEUSER-UNPRIV/testsuite.sh

@@ -46,6 +46,15 @@ runas nobody systemd-run --user --unit=test-protect-home-tmpfs \
     -p PrivateUsers=yes -p ProtectHome=tmpfs \
     -P test ! -e /home/nobody
 
+# Confirm that home, /root, and /run/user are inaccessible under "yes"
+runas nobody systemd-run --user --unit=test-protect-home-yes \
+    -p PrivateUsers=yes -p ProtectHome=yes \
+    -P bash -c '
+        test "$(stat -c %a /home)" = "0"
+        test "$(stat -c %a /root)" = "0"
+        test "$(stat -c %a /run/user)" = "0"
+    '
+
 # Confirm we cannot change groups because we only have one mapping in the user
 # namespace (no CAP_SETGID in the parent namespace to write the additional
 # mapping of the user supplied group and thus cannot change groups to an