Unshare IPC namespace when not in relaxed mode

Otherwise tests in the sandbox will think they have access to IPC
stuff when they actually don't.

Fixes #2256

diff --git a/mkosi/sandbox.py b/mkosi/sandbox.py
index e574fd4b904d05584e6ceb714e91203d73c1b282..0e1921d02a33a39b3b9e22bc886a9454cc69772b 100644 (file)
--- a/mkosi/sandbox.py
+++ b/mkosi/sandbox.py
@@ -95,7 +95,10 @@ def sandbox_cmd(
     if relaxed:
         cmdline += ["--bind", "/tmp", "/tmp"]
     else:
-        cmdline += ["--tmpfs", "/tmp"]
+        cmdline += [
+            "--tmpfs", "/tmp",
+            "--unshare-ipc",
+        ]
 
     if (tools / "nix/store").exists():
         cmdline += ["--bind", tools / "nix/store", "/nix/store"]