sysupdated: Permit mount namespaces

dissect-image tries to use mount namespaces to dissect images without
polluting the host mounts. This change allows it to do that.

diff --git a/units/systemd-sysupdated.service.in b/units/systemd-sysupdated.service.in
index 28671fbc54ca7ccf731ff625ebe13e51ee4e89ab..ae0adf3d64a76cce1ed025810692278722b9b283 100644 (file)
--- a/units/systemd-sysupdated.service.in
+++ b/units/systemd-sysupdated.service.in
@@ -21,7 +21,7 @@ NoNewPrivileges=yes
 MemoryDenyWriteExecute=yes
 ProtectHostname=yes
 RestrictRealtime=yes
-RestrictNamespaces=net
+RestrictNamespaces=net mnt
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 SystemCallFilter=@system-service @mount
 SystemCallErrorNumber=EPERM