systemd: Prevent privilege escalation via polkit

Cherry-picked from upstream.  Also applied a fix for the CPUShares
configuration option while I'm at it.

CVE-2013-4327

pkgs/os-specific/linux/systemd/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
       ./0007-Ignore-IPv6-link-local-addresses.patch
       ./0008-Don-t-try-to-unmount-nix-or-nix-store.patch
       ./0009-Start-ctrl-alt-del.target-irreversibly.patch
+      ./0010-Fix-CPUShares-configuration-option.patch
+      ./0011-polkit-Avoid-race-condition-in-scraping-proc.patch
     ] ++ stdenv.lib.optional stdenv.isArm ./libc-bug-accept4-arm.patch;
 
   buildInputs =