core: introduce exec_context_with_rootfs_strict() as a stricter version of exec_conte...

We have two very similar checks in place: in some contexts we want to
know if *any* RootDirectory= is configured, in the other we want to
suppress if it is configured to our regular root. Let's add a helper for
both (even if we only need it once), to make the mirrored behaviour
clear.

diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index a0b0a87a659e61ee18967d6de1e88854776875b1..298fd0754e7ac424e8eb01b0fb2e09cb039b70f3 100644 (file)
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -4530,10 +4530,8 @@ static bool exec_needs_cap_sys_admin(const ExecContext *context, const ExecParam
                context->bind_log_sockets > 0 ||
                context->n_bind_mounts > 0 ||
                context->n_temporary_filesystems > 0 ||
-               context->root_directory ||
-               context->root_directory_as_fd ||
+               exec_context_with_rootfs_strict(context) ||
                !strv_isempty(context->extension_directories) ||
-               context->root_image ||
                context->n_mount_images > 0 ||
                context->n_extension_images > 0 ||
                context->protect_system != PROTECT_SYSTEM_NO ||

diff --git a/src/core/execute.c b/src/core/execute.c
index 51d6996e72029c0274b24136271916695280ef77..8e5796b92acae0ddc03c6ece2118aeb4b881eedd 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2063,6 +2063,16 @@ bool exec_context_with_rootfs(const ExecContext *c) {
         return !empty_or_root(c->root_directory) || c->root_image || c->root_directory_as_fd;
 }
 
+bool exec_context_with_rootfs_strict(const ExecContext *c) {
+        assert(c);
+
+        /* just like exec_context_with_rootfs(), but doesn't suppress a root directory of "/", i.e. returns
+         * true in more cases: when a root directory is explicitly configured, even if it's our usual
+         * root. */
+
+        return c->root_directory || c->root_image || c->root_directory_as_fd;
+}
+
 int exec_context_has_vpicked_extensions(const ExecContext *context) {
         int r;
 

diff --git a/src/core/execute.h b/src/core/execute.h
index 6624c3a71ce79cbc805744cfc261d3327e2f0819..6fe0d5e57074f6f40146bbbec6c463c88d68d4f4 100644 (file)
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -577,6 +577,7 @@ char** exec_context_get_restrict_filesystems(const ExecContext *c);
 bool exec_context_restrict_namespaces_set(const ExecContext *c);
 bool exec_context_restrict_filesystems_set(const ExecContext *c);
 bool exec_context_with_rootfs(const ExecContext *c);
+bool exec_context_with_rootfs_strict(const ExecContext *c);
 
 int exec_context_has_vpicked_extensions(const ExecContext *context);