dissect-image: optionally allow mounting via new kernel mount API in two steps

This adds support for the new fsmount() logic of the kernel: we'll first
create an unattached fsmount fd, and then in a second step attach this
to some real file system inode – as opposed to attaching file system
directly. The benefit of this is that we can pass the open fsmount fds
over some sockets if need be, to isolate the mounting code from the
attaching code.

1 files changed, 7 insertions, 1 deletions

diff --git a/src/portable/portable.c b/src/portable/portable.c
index 52f38dc83e..a672bff3c5 100644
--- a/src/portable/portable.c
+++ b/src/portable/portable.c
@@ -424,7 +424,13 @@ static int portable_extract_by_path(
                         else
                                 flags |= DISSECT_IMAGE_VALIDATE_OS;
 
-                        r = dissected_image_mount(m, tmpdir, UID_INVALID, UID_INVALID, flags);
+                        r = dissected_image_mount(
+                                        m,
+                                        tmpdir,
+                                        /* uid_shift= */ UID_INVALID,
+                                        /* uid_range= */ UID_INVALID,
+                                        /* userns_fd= */ -EBADF,
+                                        flags);
                         if (r < 0) {
                                 log_debug_errno(r, "Failed to mount dissected image: %m");
                                 goto child_finish;