units: relax sandbox so that uidmap stuff can work

The uidmap suff requires additional caps and userns to work in some
cases. Allow it.

Follow-up for: 1147c538bbb6a2d3d5ba2e40f1437bcbeb22b33e

diff --git a/units/systemd-homed.service.in b/units/systemd-homed.service.in
index f8198c45b72fa995876c5344cf1d42e8cac71e72..b03c6879c9a11e86339847427fad1a27777127e9 100644 (file)
--- a/units/systemd-homed.service.in
+++ b/units/systemd-homed.service.in
@@ -16,7 +16,7 @@ After=home.mount
 
 [Service]
 BusName=org.freedesktop.home1
-CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE CAP_SETPCAP CAP_DAC_READ_SEARCH
+CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE CAP_SETPCAP CAP_DAC_READ_SEARCH CAP_SETFCAP
 DeviceAllow=/dev/loop-control rw
 DeviceAllow=/dev/mapper/control rw
 DeviceAllow=block-* rw
@@ -28,7 +28,7 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 NoNewPrivileges=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG AF_INET AF_INET6
-RestrictNamespaces=mnt
+RestrictNamespaces=mnt user
 RestrictRealtime=yes
 StateDirectory=systemd/home
 SystemCallArchitectures=native