units: tag all .varlink sockets with the right xattrs

This also relaxes the inode access modes a bit, in case they were set to
0600: we now set the "r" bit too, i.e. use 0644. This is beneficial
since it permits unpriv code to read the xattrs of the entrypoints
(which require read access). Note that in order to be able to connect()
to a socket inode you need write access, hence this shouldn't compromise
security in any way.
This commit is contained in:
Lennart Poettering
2026-06-23 23:10:01 +02:00
parent 52e6c185df
commit 53fc4c48e7
39 changed files with 107 additions and 7 deletions
+3
View File
@@ -18,6 +18,9 @@ SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install]
WantedBy=sockets.target