SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

units: tag all .varlink sockets with the right xattrs

Browse Source 
This also relaxes the inode access modes a bit, in case they were set to
0600: we now set the "r" bit too, i.e. use 0644. This is beneficial
since it permits unpriv code to read the xattrs of the entrypoints
(which require read access). Note that in order to be able to connect()
to a socket inode you need write access, hence this shouldn't compromise
security in any way.
This commit is contained in:
Lennart Poettering
2026-06-23 23:10:01 +02:00
parent 52e6c185df
commit 53fc4c48e7
39 changed files with 107 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
units/systemd-ask-password.socket
+3
View File
@@ -20,3 +20,6 @@ FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-bootctl.socket
+4 -1
View File
@@ -18,6 +18,9 @@ Before=sockets.target
ListenStream=/run/systemd/io.systemd.BootControl
Symlinks=/run/varlink/registry/io.systemd.BootControl
FileDescriptorName=varlink
SocketMode=0600
SocketMode=0644
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-creds.socket
+3
View File
@@ -20,3 +20,6 @@ FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-factory-reset.socket
+3
View File
@@ -20,6 +20,9 @@ FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-hostnamed.socket
+2
View File
@@ -21,3 +21,5 @@ ListenStream=/run/systemd/io.systemd.Hostname
Symlinks=/run/varlink/registry/io.systemd.Hostname
FileDescriptorName=varlink
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-imds-metrics.socket
+3
View File
@@ -20,3 +20,6 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-imdsd.socket
+3
View File
@@ -21,6 +21,9 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
# Note that this is typically pulled in automatically by
# systemd-imds-generator, but you can also enable it manually if you like.
units/systemd-importd.socket
+2
View File
@@ -23,3 +23,5 @@ ListenStream=/run/systemd/io.systemd.Import
Symlinks=/run/varlink/registry/io.systemd.Import
FileDescriptorName=varlink
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-journalctl.socket
+4 -1
View File
@@ -19,6 +19,9 @@ ListenStream=/run/systemd/io.systemd.JournalAccess
Symlinks=/run/varlink/registry/io.systemd.JournalAccess
FileDescriptorName=varlink
SocketGroup=systemd-journal
SocketMode=0660
SocketMode=0664
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-journald-varlink@.socket
+2
View File
@@ -16,3 +16,5 @@ StopWhenUnneeded=yes
Service=systemd-journald@%i.service
ListenStream=/run/systemd/journal.%i/io.systemd.journal
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-logind-varlink.socket
+2
View File
@@ -17,3 +17,5 @@ Symlinks=/run/varlink/registry/io.systemd.Login /run/varlink/registry/io.systemd
FileDescriptorName=varlink
SocketMode=0666
Service=systemd-logind.service
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-machined.socket
+2
View File
@@ -16,3 +16,5 @@ ListenStream=/run/systemd/machine/io.systemd.Machine
Symlinks=/run/systemd/machine/io.systemd.MachineImage /run/varlink/registry/io.systemd.Machine /run/varlink/registry/io.systemd.MachineImage
FileDescriptorName=varlink
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-mountfsd.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/io.systemd.MountFileSystem
Symlinks=/run/varlink/registry/io.systemd.MountFileSystem
FileDescriptorName=varlink
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-mute-console.socket
+4 -1
View File
@@ -19,6 +19,9 @@ Before=shutdown.target
ListenStream=/run/systemd/io.systemd.MuteConsole
Symlinks=/run/varlink/registry/io.systemd.MuteConsole
FileDescriptorName=varlink
SocketMode=0600
SocketMode=0644
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-networkd-resolve-hook.socket
+2
View File
@@ -22,6 +22,8 @@ FileDescriptorName=resolve-hook
SocketMode=0666
Service=systemd-networkd.service
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-networkd-varlink-metrics.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/report/io.systemd.Network
FileDescriptorName=varlink-metrics
SocketMode=0666
Service=systemd-networkd.service
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-networkd-varlink.socket
+2
View File
@@ -21,6 +21,8 @@ Symlinks=/run/varlink/registry/io.systemd.Network
FileDescriptorName=varlink
SocketMode=0666
Service=systemd-networkd.service
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-nsresourced.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/io.systemd.NamespaceResource
Symlinks=/run/systemd/userdb/io.systemd.NamespaceResource /run/varlink/registry/io.systemd.NamespaceResource
FileDescriptorName=varlink
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-oomd.socket
+2
View File
@@ -22,6 +22,8 @@ ConditionPathExists=/proc/pressure/memory
ListenStream=/run/systemd/oom/io.systemd.ManagedOOM
SocketMode=0666
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-pcrextend.socket
+4 -1
View File
@@ -19,9 +19,12 @@ ConditionSecurity=measured-os
ListenStream=/run/systemd/io.systemd.PCRExtend
Symlinks=/run/varlink/registry/io.systemd.PCRExtend
FileDescriptorName=varlink
SocketMode=0600
SocketMode=0644
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-pcrlock.socket
+4 -1
View File
@@ -19,6 +19,9 @@ ConditionSecurity=measured-uki
ListenStream=/run/systemd/io.systemd.PCRLock
Symlinks=/run/varlink/registry/io.systemd.PCRLock
FileDescriptorName=varlink
SocketMode=0600
SocketMode=0644
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-repart.socket
+4 -1
View File
@@ -19,6 +19,9 @@ Before=shutdown.target
ListenStream=/run/systemd/io.systemd.Repart
Symlinks=/run/varlink/registry/io.systemd.Repart
FileDescriptorName=varlink
SocketMode=0600
SocketMode=0644
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-report-basic.socket
+3
View File
@@ -18,6 +18,9 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-report-cgroup.socket
+3
View File
@@ -20,6 +20,9 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-report-files.socket
+3
View File
@@ -21,6 +21,9 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-report-sign-plain.socket
+3
View File
@@ -28,6 +28,9 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-report-sign-tsm.socket
+3
View File
@@ -22,6 +22,9 @@ SocketMode=0600
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-resolved-monitor.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/resolve/io.systemd.Resolve.Monitor
Symlinks=/run/varlink/registry/io.systemd.Resolve.Monitor
FileDescriptorName=varlink-monitor
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-resolved-varlink.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/resolve/io.systemd.Resolve
Symlinks=/run/varlink/registry/io.systemd.Resolve
FileDescriptorName=varlink
SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/systemd-storage-block.socket
+3
View File
@@ -19,6 +19,9 @@ FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-storage-fs.socket
+3
View File
@@ -20,6 +20,9 @@ FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-sysext.socket
+3
View File
@@ -22,6 +22,9 @@ FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target
units/systemd-udevd-varlink.socket
+3 -1
View File
@@ -19,6 +19,8 @@ Service=systemd-udevd.service
ListenStream=/run/udev/io.systemd.Udev
Symlinks=/run/varlink/registry/io.systemd.Udev
FileDescriptorName=varlink
SocketMode=0600
SocketMode=0644
RemoveOnStop=yes
DeferTrigger=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-userdbd.socket
+2
View File
@@ -19,6 +19,8 @@ Symlinks=/run/systemd/userdb/io.systemd.NameServiceSwitch /run/systemd/userdb/io
FileDescriptorName=varlink
SocketMode=0666
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install]
WantedBy=sockets.target
units/user/systemd-ask-password.socket
+3
View File
@@ -19,3 +19,6 @@ Symlinks=%t/varlink/registry/io.systemd.AskPassword
FileDescriptorName=varlink
SocketMode=0600
Accept=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/user/systemd-importd.socket
+2
View File
@@ -17,3 +17,5 @@ ListenStream=%t/systemd/io.systemd.Import
Symlinks=%t/varlink/registry/io.systemd.Import
FileDescriptorName=varlink
SocketMode=0600
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/user/systemd-journalctl.socket
+3
View File
@@ -17,3 +17,6 @@ Symlinks=%t/varlink/registry/io.systemd.JournalAccess
FileDescriptorName=varlink
SocketMode=0600
Accept=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/user/systemd-machined.socket
+2
View File
@@ -16,3 +16,5 @@ ListenStream=%t/systemd/machine/io.systemd.Machine
Symlinks=%t/systemd/machine/io.systemd.MachineImage %t/varlink/registry/io.systemd.Machine %t/varlink/registry/io.systemd.MachineImage
FileDescriptorName=varlink
SocketMode=0600
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/user/systemd-storage-fs.socket
+3
View File
@@ -18,6 +18,9 @@ FileDescriptorName=varlink
SocketMode=0600
Accept=yes
MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target