The changes in the .service file cause this, specifically ReadWritePaths=\ -/etc/gdm/custom.conf \ /etc/ \ -/proc/self/loginuid \ -/var/log/lastlog \ -/var/log/tallylog \ -/var/mail/ ReadOnlyPaths=\ /usr/share/accountsservice/interfaces/ \ /usr/share/dbus-1/interfaces/ \ /var/log/wtmp \ /run/systemd/seats/ this causes the mount operations to happen