rauc.service: let the bundle mount point be an auto-cleaned dir in a slave mount-namespace
rauc.service: let the bundle mount point be an auto-cleaned dir in a slave mount-namespace

The directive RuntimeDirectory= lets systemd create directories right before
starting the service and clean them up directly after the service has stopped.
Using such a directory as the mount point for RAUC bundles guarantees that
bundles are always unmounted whenever the RAUC service stops. By segregating the
service into its own mount namespace that does not propagate new mounts upwards
into the global mount namespace via the directive MountFlags=, one gains
additional security against manipulation of the bundle.

Signed-off-by: Ulrich Ölmann <dd989c3d4b9e0c1c162946243f1ca35d034a3035@pengutronix.de>

jluebbe/rauc,rauc/rauc,jluebbe/rauc,rauc/rauc,ejoerns/rauc,ejoerns/rauc,ejoerns/rauc,jluebbe/rauc,rauc/rauc