pid1: only add a Wants= type dependency on /tmp when PrivateTmp=yes

We support that tmp.mount being masked, and this should not be considered an
error.

(cherry picked from commit b2c7d1bbc2243a425d9b825859bbd0647eecd050)
(cherry picked from commit 6a3a8c70686ab6da80dd87d0bd816a8c18980b71)
(cherry picked from commit 8d8b959cd418f1f91550c7ff5578bfc5af16dbd0)

1 files changed, 11 insertions, 6 deletions

diff --git a/src/core/unit.c b/src/core/unit.c
index c9eaaf8cd2..c7fd7dff2c 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -1099,13 +1099,18 @@ int unit_add_exec_dependencies(Unit *u, ExecContext *c) {
         }
 
         if (c->private_tmp) {
-                const char *p;
 
-                FOREACH_STRING(p, "/tmp", "/var/tmp") {
-                        r = unit_require_mounts_for(u, p, UNIT_DEPENDENCY_FILE);
-                        if (r < 0)
-                                return r;
-                }
+                /* FIXME: for now we make a special case for /tmp and add a weak dependency on
+                 * tmp.mount so /tmp being masked is supported. However there's no reason to treat
+                 * /tmp specifically and masking other mount units should be handled more
+                 * gracefully too, see PR#16894. */
+                r = unit_add_two_dependencies_by_name(u, UNIT_AFTER, UNIT_WANTS, "tmp.mount", true, UNIT_DEPENDENCY_FILE);
+                if (r < 0)
+                        return r;
+
+                r = unit_require_mounts_for(u, "/var/tmp", UNIT_DEPENDENCY_FILE);
+                if (r < 0)
+                        return r;
 
                 r = unit_add_dependency_by_name(u, UNIT_AFTER, SPECIAL_TMPFILES_SETUP_SERVICE, true, UNIT_DEPENDENCY_FILE);
                 if (r < 0)