namespace: don't consider raw image read-only if /home in it is writable

diff --git a/src/core/namespace.c b/src/core/namespace.c
index e138d3ba02a6876aff3d761d80945fdfc4efecf1..0cce2b4584573a9528f09dd8e3931fa289acc5c9 100644 (file)
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -1105,7 +1105,9 @@ int setup_namespace(
         if (root_image) {
                 dissect_image_flags |= DISSECT_IMAGE_REQUIRE_ROOT;
 
-                if (protect_system == PROTECT_SYSTEM_STRICT && strv_isempty(read_write_paths))
+                if (protect_system == PROTECT_SYSTEM_STRICT &&
+                    protect_home != PROTECT_HOME_NO &&
+                    strv_isempty(read_write_paths))
                         dissect_image_flags |= DISSECT_IMAGE_READ_ONLY;
 
                 r = loop_device_make_by_path(root_image,