userdb: Add userdb.user.* and userdb.group.* credentials (#36740)

Let's allow providing extra userdb users and groups via credentials.
Similarly to systemd-udev-load-credentials.service, we ship
systemd-userdb-load-credentials.service which transform the JSON
user/group records provided via the corresponding credentials to static
userdb dropins in /run/userdb.

units/meson.build

@@ -818,6 +818,10 @@ units = [
           'conditions' : ['HAVE_PAM'],
           'symlinks' : ['multi-user.target.wants/'],
         },
+        {
+          'file' : 'systemd-userdb-load-credentials.service',
+          'conditions' : ['ENABLE_USERDB'],
+        },
         {
           'file' : 'systemd-userdbd.service.in',
           'conditions' : ['ENABLE_USERDB'],

units/systemd-userdb-load-credentials.service

@@ -0,0 +1,31 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Load JSON user/group Records from Credentials
+Documentation=man:systemd-userdb(8)
+Documentation=man:systemd.system-credentials(7)
+
+DefaultDependencies=no
+Before=systemd-user-sessions.service nss-user-lookup.target
+After=local-fs.target
+Conflicts=shutdown.target
+Before=shutdown.target
+
+ConditionPathExists=!/etc/initrd-release
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=userdbctl load-credentials
+ImportCredential=userdb.user.*
+ImportCredential=userdb.group.*
+
+[Install]
+WantedBy=sysinit.target

units/systemd-userdbd.service.in

@@ -13,6 +13,7 @@ Documentation=man:systemd-userdbd.service(8)
 Requires=systemd-userdbd.socket
 After=systemd-userdbd.socket
 Before=sysinit.target
+Wants=systemd-userdb-load-credentials.service
 DefaultDependencies=no
 
 [Service]