From 53fc4c48e7d40293e8f79392e2da91323dd50268 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 3 Jun 2026 08:37:03 +0200 Subject: [PATCH] units: tag all .varlink sockets with the right xattrs This also relaxes the inode access modes a bit, in case they were set to 0600: we now set the "r" bit too, i.e. use 0644. This is beneficial since it permits unpriv code to read the xattrs of the entrypoints (which require read access). Note that in order to be able to connect() to a socket inode you need write access, hence this shouldn't compromise security in any way. --- units/systemd-ask-password.socket | 3 +++ units/systemd-bootctl.socket | 5 ++++- units/systemd-creds.socket | 3 +++ units/systemd-factory-reset.socket | 3 +++ units/systemd-hostnamed.socket | 2 ++ units/systemd-imds-metrics.socket | 3 +++ units/systemd-imdsd.socket | 3 +++ units/systemd-importd.socket | 2 ++ units/systemd-journalctl.socket | 5 ++++- units/systemd-journald-varlink@.socket | 2 ++ units/systemd-logind-varlink.socket | 2 ++ units/systemd-machined.socket | 2 ++ units/systemd-mountfsd.socket | 2 ++ units/systemd-mute-console.socket | 5 ++++- units/systemd-networkd-resolve-hook.socket | 2 ++ units/systemd-networkd-varlink-metrics.socket | 2 ++ units/systemd-networkd-varlink.socket | 2 ++ units/systemd-nsresourced.socket | 2 ++ units/systemd-oomd.socket | 2 ++ units/systemd-pcrextend.socket | 5 ++++- units/systemd-pcrlock.socket | 5 ++++- units/systemd-repart.socket | 5 ++++- units/systemd-report-basic.socket | 3 +++ units/systemd-report-cgroup.socket | 3 +++ units/systemd-report-files.socket | 3 +++ units/systemd-report-sign-plain.socket | 3 +++ units/systemd-report-sign-tsm.socket | 3 +++ units/systemd-resolved-monitor.socket | 2 ++ units/systemd-resolved-varlink.socket | 2 ++ units/systemd-storage-block.socket | 3 +++ units/systemd-storage-fs.socket | 3 +++ units/systemd-sysext.socket | 3 +++ units/systemd-udevd-varlink.socket | 4 +++- units/systemd-userdbd.socket | 2 ++ units/user/systemd-ask-password.socket | 3 +++ units/user/systemd-importd.socket | 2 ++ units/user/systemd-journalctl.socket | 3 +++ units/user/systemd-machined.socket | 2 ++ units/user/systemd-storage-fs.socket | 3 +++ 39 files changed, 107 insertions(+), 7 deletions(-) diff --git a/units/systemd-ask-password.socket b/units/systemd-ask-password.socket index df5eaffc22..4251ecabf4 100644 --- a/units/systemd-ask-password.socket +++ b/units/systemd-ask-password.socket @@ -20,3 +20,6 @@ FileDescriptorName=varlink SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-bootctl.socket b/units/systemd-bootctl.socket index e720f24f54..64b42e3ce1 100644 --- a/units/systemd-bootctl.socket +++ b/units/systemd-bootctl.socket @@ -18,6 +18,9 @@ Before=sockets.target ListenStream=/run/systemd/io.systemd.BootControl Symlinks=/run/varlink/registry/io.systemd.BootControl FileDescriptorName=varlink -SocketMode=0600 +SocketMode=0644 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-creds.socket b/units/systemd-creds.socket index 3ea3ca5b05..452c4d2bcb 100644 --- a/units/systemd-creds.socket +++ b/units/systemd-creds.socket @@ -20,3 +20,6 @@ FileDescriptorName=varlink SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-factory-reset.socket b/units/systemd-factory-reset.socket index 467517ec24..bba00e0fa9 100644 --- a/units/systemd-factory-reset.socket +++ b/units/systemd-factory-reset.socket @@ -20,6 +20,9 @@ FileDescriptorName=varlink SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-hostnamed.socket b/units/systemd-hostnamed.socket index f84853ade8..da938ba019 100644 --- a/units/systemd-hostnamed.socket +++ b/units/systemd-hostnamed.socket @@ -21,3 +21,5 @@ ListenStream=/run/systemd/io.systemd.Hostname Symlinks=/run/varlink/registry/io.systemd.Hostname FileDescriptorName=varlink SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/systemd-imds-metrics.socket b/units/systemd-imds-metrics.socket index f71a31e5b9..e828864010 100644 --- a/units/systemd-imds-metrics.socket +++ b/units/systemd-imds-metrics.socket @@ -20,3 +20,6 @@ SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-imdsd.socket b/units/systemd-imdsd.socket index daeb7840b3..20d8eb3903 100644 --- a/units/systemd-imdsd.socket +++ b/units/systemd-imdsd.socket @@ -21,6 +21,9 @@ SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server # Note that this is typically pulled in automatically by # systemd-imds-generator, but you can also enable it manually if you like. diff --git a/units/systemd-importd.socket b/units/systemd-importd.socket index a538ef0d0e..0fe7edce66 100644 --- a/units/systemd-importd.socket +++ b/units/systemd-importd.socket @@ -23,3 +23,5 @@ ListenStream=/run/systemd/io.systemd.Import Symlinks=/run/varlink/registry/io.systemd.Import FileDescriptorName=varlink SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/systemd-journalctl.socket b/units/systemd-journalctl.socket index 59d0af3449..7284b539aa 100644 --- a/units/systemd-journalctl.socket +++ b/units/systemd-journalctl.socket @@ -19,6 +19,9 @@ ListenStream=/run/systemd/io.systemd.JournalAccess Symlinks=/run/varlink/registry/io.systemd.JournalAccess FileDescriptorName=varlink SocketGroup=systemd-journal -SocketMode=0660 +SocketMode=0664 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-journald-varlink@.socket b/units/systemd-journald-varlink@.socket index e48a93c202..c8d09b93d4 100644 --- a/units/systemd-journald-varlink@.socket +++ b/units/systemd-journald-varlink@.socket @@ -16,3 +16,5 @@ StopWhenUnneeded=yes Service=systemd-journald@%i.service ListenStream=/run/systemd/journal.%i/io.systemd.journal SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/systemd-logind-varlink.socket b/units/systemd-logind-varlink.socket index 377eac7006..83cd5ece8c 100644 --- a/units/systemd-logind-varlink.socket +++ b/units/systemd-logind-varlink.socket @@ -17,3 +17,5 @@ Symlinks=/run/varlink/registry/io.systemd.Login /run/varlink/registry/io.systemd FileDescriptorName=varlink SocketMode=0666 Service=systemd-logind.service +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/systemd-machined.socket b/units/systemd-machined.socket index 75a91bb0cc..dbabd9376c 100644 --- a/units/systemd-machined.socket +++ b/units/systemd-machined.socket @@ -16,3 +16,5 @@ ListenStream=/run/systemd/machine/io.systemd.Machine Symlinks=/run/systemd/machine/io.systemd.MachineImage /run/varlink/registry/io.systemd.Machine /run/varlink/registry/io.systemd.MachineImage FileDescriptorName=varlink SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/systemd-mountfsd.socket b/units/systemd-mountfsd.socket index a3e19cc418..46dfb021dd 100644 --- a/units/systemd-mountfsd.socket +++ b/units/systemd-mountfsd.socket @@ -20,6 +20,8 @@ ListenStream=/run/systemd/io.systemd.MountFileSystem Symlinks=/run/varlink/registry/io.systemd.MountFileSystem FileDescriptorName=varlink SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-mute-console.socket b/units/systemd-mute-console.socket index 5eae6d5acd..1b7ce2bfdb 100644 --- a/units/systemd-mute-console.socket +++ b/units/systemd-mute-console.socket @@ -19,6 +19,9 @@ Before=shutdown.target ListenStream=/run/systemd/io.systemd.MuteConsole Symlinks=/run/varlink/registry/io.systemd.MuteConsole FileDescriptorName=varlink -SocketMode=0600 +SocketMode=0644 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-networkd-resolve-hook.socket b/units/systemd-networkd-resolve-hook.socket index 07b596319b..e56697e77f 100644 --- a/units/systemd-networkd-resolve-hook.socket +++ b/units/systemd-networkd-resolve-hook.socket @@ -22,6 +22,8 @@ FileDescriptorName=resolve-hook SocketMode=0666 Service=systemd-networkd.service RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-networkd-varlink-metrics.socket b/units/systemd-networkd-varlink-metrics.socket index 562cc6b7f2..3ae15c13bc 100644 --- a/units/systemd-networkd-varlink-metrics.socket +++ b/units/systemd-networkd-varlink-metrics.socket @@ -20,6 +20,8 @@ ListenStream=/run/systemd/report/io.systemd.Network FileDescriptorName=varlink-metrics SocketMode=0666 Service=systemd-networkd.service +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-networkd-varlink.socket b/units/systemd-networkd-varlink.socket index 1f4db858bc..264e81f602 100644 --- a/units/systemd-networkd-varlink.socket +++ b/units/systemd-networkd-varlink.socket @@ -21,6 +21,8 @@ Symlinks=/run/varlink/registry/io.systemd.Network FileDescriptorName=varlink SocketMode=0666 Service=systemd-networkd.service +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-nsresourced.socket b/units/systemd-nsresourced.socket index 6b4a883df3..2840be43e2 100644 --- a/units/systemd-nsresourced.socket +++ b/units/systemd-nsresourced.socket @@ -20,6 +20,8 @@ ListenStream=/run/systemd/io.systemd.NamespaceResource Symlinks=/run/systemd/userdb/io.systemd.NamespaceResource /run/varlink/registry/io.systemd.NamespaceResource FileDescriptorName=varlink SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-oomd.socket b/units/systemd-oomd.socket index 4e24342f58..9b0f822d9e 100644 --- a/units/systemd-oomd.socket +++ b/units/systemd-oomd.socket @@ -22,6 +22,8 @@ ConditionPathExists=/proc/pressure/memory ListenStream=/run/systemd/oom/io.systemd.ManagedOOM SocketMode=0666 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-pcrextend.socket b/units/systemd-pcrextend.socket index 0f4ab11e2f..2be4e51a25 100644 --- a/units/systemd-pcrextend.socket +++ b/units/systemd-pcrextend.socket @@ -19,9 +19,12 @@ ConditionSecurity=measured-os ListenStream=/run/systemd/io.systemd.PCRExtend Symlinks=/run/varlink/registry/io.systemd.PCRExtend FileDescriptorName=varlink -SocketMode=0600 +SocketMode=0644 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-pcrlock.socket b/units/systemd-pcrlock.socket index efb6818683..637462bb41 100644 --- a/units/systemd-pcrlock.socket +++ b/units/systemd-pcrlock.socket @@ -19,6 +19,9 @@ ConditionSecurity=measured-uki ListenStream=/run/systemd/io.systemd.PCRLock Symlinks=/run/varlink/registry/io.systemd.PCRLock FileDescriptorName=varlink -SocketMode=0600 +SocketMode=0644 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-repart.socket b/units/systemd-repart.socket index ecd275414d..b79505fe07 100644 --- a/units/systemd-repart.socket +++ b/units/systemd-repart.socket @@ -19,6 +19,9 @@ Before=shutdown.target ListenStream=/run/systemd/io.systemd.Repart Symlinks=/run/varlink/registry/io.systemd.Repart FileDescriptorName=varlink -SocketMode=0600 +SocketMode=0644 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/systemd-report-basic.socket b/units/systemd-report-basic.socket index ba5d88c8e7..f31dab50e2 100644 --- a/units/systemd-report-basic.socket +++ b/units/systemd-report-basic.socket @@ -18,6 +18,9 @@ SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-report-cgroup.socket b/units/systemd-report-cgroup.socket index 39a867cd40..2168129a7a 100644 --- a/units/systemd-report-cgroup.socket +++ b/units/systemd-report-cgroup.socket @@ -20,6 +20,9 @@ SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-report-files.socket b/units/systemd-report-files.socket index f37c508cf6..b5e6491a10 100644 --- a/units/systemd-report-files.socket +++ b/units/systemd-report-files.socket @@ -21,6 +21,9 @@ SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-report-sign-plain.socket b/units/systemd-report-sign-plain.socket index 4a6dea580d..7c3c501709 100644 --- a/units/systemd-report-sign-plain.socket +++ b/units/systemd-report-sign-plain.socket @@ -28,6 +28,9 @@ SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-report-sign-tsm.socket b/units/systemd-report-sign-tsm.socket index 1756dde8cf..5817075fa7 100644 --- a/units/systemd-report-sign-tsm.socket +++ b/units/systemd-report-sign-tsm.socket @@ -22,6 +22,9 @@ SocketMode=0600 Accept=yes MaxConnectionsPerSource=16 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-resolved-monitor.socket b/units/systemd-resolved-monitor.socket index 3674a1f876..9bb4dd646f 100644 --- a/units/systemd-resolved-monitor.socket +++ b/units/systemd-resolved-monitor.socket @@ -20,6 +20,8 @@ ListenStream=/run/systemd/resolve/io.systemd.Resolve.Monitor Symlinks=/run/varlink/registry/io.systemd.Resolve.Monitor FileDescriptorName=varlink-monitor SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-resolved-varlink.socket b/units/systemd-resolved-varlink.socket index a570168373..65593df1d0 100644 --- a/units/systemd-resolved-varlink.socket +++ b/units/systemd-resolved-varlink.socket @@ -20,6 +20,8 @@ ListenStream=/run/systemd/resolve/io.systemd.Resolve Symlinks=/run/varlink/registry/io.systemd.Resolve FileDescriptorName=varlink SocketMode=0666 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/systemd-storage-block.socket b/units/systemd-storage-block.socket index 1d18b481a3..c8097e705b 100644 --- a/units/systemd-storage-block.socket +++ b/units/systemd-storage-block.socket @@ -19,6 +19,9 @@ FileDescriptorName=varlink SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-storage-fs.socket b/units/systemd-storage-fs.socket index c83cf0a11f..d34e39d059 100644 --- a/units/systemd-storage-fs.socket +++ b/units/systemd-storage-fs.socket @@ -20,6 +20,9 @@ FileDescriptorName=varlink SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-sysext.socket b/units/systemd-sysext.socket index 61d7268f37..209592134b 100644 --- a/units/systemd-sysext.socket +++ b/units/systemd-sysext.socket @@ -22,6 +22,9 @@ FileDescriptorName=varlink SocketMode=0666 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target diff --git a/units/systemd-udevd-varlink.socket b/units/systemd-udevd-varlink.socket index c2b7652e5e..b1094b9c9b 100644 --- a/units/systemd-udevd-varlink.socket +++ b/units/systemd-udevd-varlink.socket @@ -19,6 +19,8 @@ Service=systemd-udevd.service ListenStream=/run/udev/io.systemd.Udev Symlinks=/run/varlink/registry/io.systemd.Udev FileDescriptorName=varlink -SocketMode=0600 +SocketMode=0644 RemoveOnStop=yes DeferTrigger=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/systemd-userdbd.socket b/units/systemd-userdbd.socket index 6793d1b41d..83f3d7e560 100644 --- a/units/systemd-userdbd.socket +++ b/units/systemd-userdbd.socket @@ -19,6 +19,8 @@ Symlinks=/run/systemd/userdb/io.systemd.NameServiceSwitch /run/systemd/userdb/io FileDescriptorName=varlink SocketMode=0666 RemoveOnStop=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen [Install] WantedBy=sockets.target diff --git a/units/user/systemd-ask-password.socket b/units/user/systemd-ask-password.socket index 56492fae54..13a2379557 100644 --- a/units/user/systemd-ask-password.socket +++ b/units/user/systemd-ask-password.socket @@ -19,3 +19,6 @@ Symlinks=%t/varlink/registry/io.systemd.AskPassword FileDescriptorName=varlink SocketMode=0600 Accept=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/user/systemd-importd.socket b/units/user/systemd-importd.socket index 67ea62bdb0..35108341f5 100644 --- a/units/user/systemd-importd.socket +++ b/units/user/systemd-importd.socket @@ -17,3 +17,5 @@ ListenStream=%t/systemd/io.systemd.Import Symlinks=%t/varlink/registry/io.systemd.Import FileDescriptorName=varlink SocketMode=0600 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/user/systemd-journalctl.socket b/units/user/systemd-journalctl.socket index b8a504f0f3..a711ca2127 100644 --- a/units/user/systemd-journalctl.socket +++ b/units/user/systemd-journalctl.socket @@ -17,3 +17,6 @@ Symlinks=%t/varlink/registry/io.systemd.JournalAccess FileDescriptorName=varlink SocketMode=0600 Accept=yes +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server diff --git a/units/user/systemd-machined.socket b/units/user/systemd-machined.socket index 17e552a7dc..ffb4ff1ce3 100644 --- a/units/user/systemd-machined.socket +++ b/units/user/systemd-machined.socket @@ -16,3 +16,5 @@ ListenStream=%t/systemd/machine/io.systemd.Machine Symlinks=%t/systemd/machine/io.systemd.MachineImage %t/varlink/registry/io.systemd.Machine %t/varlink/registry/io.systemd.MachineImage FileDescriptorName=varlink SocketMode=0600 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen diff --git a/units/user/systemd-storage-fs.socket b/units/user/systemd-storage-fs.socket index fa8018b2e8..23af4d79e6 100644 --- a/units/user/systemd-storage-fs.socket +++ b/units/user/systemd-storage-fs.socket @@ -18,6 +18,9 @@ FileDescriptorName=varlink SocketMode=0600 Accept=yes MaxConnectionsPerSource=16 +XAttrEntryPoint=user.varlink=entrypoint +XAttrListen=user.varlink=listen +XAttrAccept=user.varlink=server [Install] WantedBy=sockets.target