sys-apps/systemd: allow @mount syscalls for systemd-udevd.service

[danzatt]

In Flatcar we are using modprobe helpers that run depmod in temporary overlay. systemd-udevd.service may try to load drivers for some block devices (e.g. ZFS), which ends up calling our helpers, which invoke mount command. The mount syscalls are forbidden by the default systemd-udevd syscall filter.

[pothos]

Instead of patching the source, can we ship a unit drop in?

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/18651858463

[chewi]

Instead of patching the source, can we ship a unit drop in?

Indeed, that is what I was expecting. The SystemCallFilter setting is cumulative.

[pothos]

One can argue where this would go, e.g., we have some drop-ins in https://github.com/flatcar/init/tree/flatcar-master/systemd/system

[danzatt]

I was discussing with @t-lo, and he suggested it would be better to ship it directly in a systemd package instead of baselayout. But yeah, it might be easier to ship it in init/baselayout so that we don't have to maintain yet another patch.

[pothos]

The package is also a good place: the drop-in file can be brought in through the ebuild installing it instead of a source patch

[chewi]

Our systemd package is currently forked from Gentoo, but ideally we would unfork it at some point. You could add the drop-in using a post_src_install function. We already do exactly this for timesyncd in sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd.