SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

units: tag all .varlink sockets with the right xattrs

Browse Source 
This also relaxes the inode access modes a bit, in case they were set to
0600: we now set the "r" bit too, i.e. use 0644. This is beneficial
since it permits unpriv code to read the xattrs of the entrypoints
(which require read access). Note that in order to be able to connect()
to a socket inode you need write access, hence this shouldn't compromise
security in any way.
This commit is contained in:
Lennart Poettering
2026-06-23 23:10:01 +02:00
parent 52e6c185df
commit 53fc4c48e7
39 changed files with 107 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
units/systemd-ask-password.socket
+3
View File
@@ -20,3 +20,6 @@ FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-bootctl.socket
+4 -1
View File
@@ -18,6 +18,9 @@ Before=sockets.target
ListenStream=/run/systemd/io.systemd.BootControl ListenStream=/run/systemd/io.systemd.BootControl
Symlinks=/run/varlink/registry/io.systemd.BootControl Symlinks=/run/varlink/registry/io.systemd.BootControl
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0644
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-creds.socket
+3
View File
@@ -20,3 +20,6 @@ FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-factory-reset.socket
+3
View File
@@ -20,6 +20,9 @@ FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-hostnamed.socket
+2
View File
@@ -21,3 +21,5 @@ ListenStream=/run/systemd/io.systemd.Hostname
Symlinks=/run/varlink/registry/io.systemd.Hostname Symlinks=/run/varlink/registry/io.systemd.Hostname
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-imds-metrics.socket
+3
View File
@@ -20,3 +20,6 @@ SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-imdsd.socket
+3
View File
@@ -21,6 +21,9 @@ SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
# Note that this is typically pulled in automatically by # Note that this is typically pulled in automatically by
# systemd-imds-generator, but you can also enable it manually if you like. # systemd-imds-generator, but you can also enable it manually if you like.
units/systemd-importd.socket
+2
View File
@@ -23,3 +23,5 @@ ListenStream=/run/systemd/io.systemd.Import
Symlinks=/run/varlink/registry/io.systemd.Import Symlinks=/run/varlink/registry/io.systemd.Import
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-journalctl.socket
+4 -1
View File
@@ -19,6 +19,9 @@ ListenStream=/run/systemd/io.systemd.JournalAccess
Symlinks=/run/varlink/registry/io.systemd.JournalAccess Symlinks=/run/varlink/registry/io.systemd.JournalAccess
FileDescriptorName=varlink FileDescriptorName=varlink
SocketGroup=systemd-journal SocketGroup=systemd-journal
SocketMode=0660 SocketMode=0664
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-journald-varlink@.socket
+2
View File
@@ -16,3 +16,5 @@ StopWhenUnneeded=yes
Service=systemd-journald@%i.service Service=systemd-journald@%i.service
ListenStream=/run/systemd/journal.%i/io.systemd.journal ListenStream=/run/systemd/journal.%i/io.systemd.journal
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-logind-varlink.socket
+2
View File
@@ -17,3 +17,5 @@ Symlinks=/run/varlink/registry/io.systemd.Login /run/varlink/registry/io.systemd
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Service=systemd-logind.service Service=systemd-logind.service
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-machined.socket
+2
View File
@@ -16,3 +16,5 @@ ListenStream=/run/systemd/machine/io.systemd.Machine
Symlinks=/run/systemd/machine/io.systemd.MachineImage /run/varlink/registry/io.systemd.Machine /run/varlink/registry/io.systemd.MachineImage Symlinks=/run/systemd/machine/io.systemd.MachineImage /run/varlink/registry/io.systemd.Machine /run/varlink/registry/io.systemd.MachineImage
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-mountfsd.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/io.systemd.MountFileSystem
Symlinks=/run/varlink/registry/io.systemd.MountFileSystem Symlinks=/run/varlink/registry/io.systemd.MountFileSystem
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-mute-console.socket
+4 -1
View File
@@ -19,6 +19,9 @@ Before=shutdown.target
ListenStream=/run/systemd/io.systemd.MuteConsole ListenStream=/run/systemd/io.systemd.MuteConsole
Symlinks=/run/varlink/registry/io.systemd.MuteConsole Symlinks=/run/varlink/registry/io.systemd.MuteConsole
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0644
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-networkd-resolve-hook.socket
+2
View File
@@ -22,6 +22,8 @@ FileDescriptorName=resolve-hook
SocketMode=0666 SocketMode=0666
Service=systemd-networkd.service Service=systemd-networkd.service
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-networkd-varlink-metrics.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/report/io.systemd.Network
FileDescriptorName=varlink-metrics FileDescriptorName=varlink-metrics
SocketMode=0666 SocketMode=0666
Service=systemd-networkd.service Service=systemd-networkd.service
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-networkd-varlink.socket
+2
View File
@@ -21,6 +21,8 @@ Symlinks=/run/varlink/registry/io.systemd.Network
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Service=systemd-networkd.service Service=systemd-networkd.service
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-nsresourced.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/io.systemd.NamespaceResource
Symlinks=/run/systemd/userdb/io.systemd.NamespaceResource /run/varlink/registry/io.systemd.NamespaceResource Symlinks=/run/systemd/userdb/io.systemd.NamespaceResource /run/varlink/registry/io.systemd.NamespaceResource
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-oomd.socket
+2
View File
@@ -22,6 +22,8 @@ ConditionPathExists=/proc/pressure/memory
ListenStream=/run/systemd/oom/io.systemd.ManagedOOM ListenStream=/run/systemd/oom/io.systemd.ManagedOOM
SocketMode=0666 SocketMode=0666
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-pcrextend.socket
+4 -1
View File
@@ -19,9 +19,12 @@ ConditionSecurity=measured-os
ListenStream=/run/systemd/io.systemd.PCRExtend ListenStream=/run/systemd/io.systemd.PCRExtend
Symlinks=/run/varlink/registry/io.systemd.PCRExtend Symlinks=/run/varlink/registry/io.systemd.PCRExtend
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0644
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-pcrlock.socket
+4 -1
View File
@@ -19,6 +19,9 @@ ConditionSecurity=measured-uki
ListenStream=/run/systemd/io.systemd.PCRLock ListenStream=/run/systemd/io.systemd.PCRLock
Symlinks=/run/varlink/registry/io.systemd.PCRLock Symlinks=/run/varlink/registry/io.systemd.PCRLock
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0644
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-repart.socket
+4 -1
View File
@@ -19,6 +19,9 @@ Before=shutdown.target
ListenStream=/run/systemd/io.systemd.Repart ListenStream=/run/systemd/io.systemd.Repart
Symlinks=/run/varlink/registry/io.systemd.Repart Symlinks=/run/varlink/registry/io.systemd.Repart
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0644
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/systemd-report-basic.socket
+3
View File
@@ -18,6 +18,9 @@ SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-report-cgroup.socket
+3
View File
@@ -20,6 +20,9 @@ SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-report-files.socket
+3
View File
@@ -21,6 +21,9 @@ SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-report-sign-plain.socket
+3
View File
@@ -28,6 +28,9 @@ SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-report-sign-tsm.socket
+3
View File
@@ -22,6 +22,9 @@ SocketMode=0600
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-resolved-monitor.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/resolve/io.systemd.Resolve.Monitor
Symlinks=/run/varlink/registry/io.systemd.Resolve.Monitor Symlinks=/run/varlink/registry/io.systemd.Resolve.Monitor
FileDescriptorName=varlink-monitor FileDescriptorName=varlink-monitor
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-resolved-varlink.socket
+2
View File
@@ -20,6 +20,8 @@ ListenStream=/run/systemd/resolve/io.systemd.Resolve
Symlinks=/run/varlink/registry/io.systemd.Resolve Symlinks=/run/varlink/registry/io.systemd.Resolve
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-storage-block.socket
+3
View File
@@ -19,6 +19,9 @@ FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-storage-fs.socket
+3
View File
@@ -20,6 +20,9 @@ FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-sysext.socket
+3
View File
@@ -22,6 +22,9 @@ FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/systemd-udevd-varlink.socket
+3 -1
View File
@@ -19,6 +19,8 @@ Service=systemd-udevd.service
ListenStream=/run/udev/io.systemd.Udev ListenStream=/run/udev/io.systemd.Udev
Symlinks=/run/varlink/registry/io.systemd.Udev Symlinks=/run/varlink/registry/io.systemd.Udev
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0644
RemoveOnStop=yes RemoveOnStop=yes
DeferTrigger=yes DeferTrigger=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/systemd-userdbd.socket
+2
View File
@@ -19,6 +19,8 @@ Symlinks=/run/systemd/userdb/io.systemd.NameServiceSwitch /run/systemd/userdb/io
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0666 SocketMode=0666
RemoveOnStop=yes RemoveOnStop=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target
units/user/systemd-ask-password.socket
+3
View File
@@ -19,3 +19,6 @@ Symlinks=%t/varlink/registry/io.systemd.AskPassword
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0600
Accept=yes Accept=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/user/systemd-importd.socket
+2
View File
@@ -17,3 +17,5 @@ ListenStream=%t/systemd/io.systemd.Import
Symlinks=%t/varlink/registry/io.systemd.Import Symlinks=%t/varlink/registry/io.systemd.Import
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0600
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/user/systemd-journalctl.socket
+3
View File
@@ -17,3 +17,6 @@ Symlinks=%t/varlink/registry/io.systemd.JournalAccess
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0600
Accept=yes Accept=yes
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
units/user/systemd-machined.socket
+2
View File
@@ -16,3 +16,5 @@ ListenStream=%t/systemd/machine/io.systemd.Machine
Symlinks=%t/systemd/machine/io.systemd.MachineImage %t/varlink/registry/io.systemd.Machine %t/varlink/registry/io.systemd.MachineImage Symlinks=%t/systemd/machine/io.systemd.MachineImage %t/varlink/registry/io.systemd.Machine %t/varlink/registry/io.systemd.MachineImage
FileDescriptorName=varlink FileDescriptorName=varlink
SocketMode=0600 SocketMode=0600
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
units/user/systemd-storage-fs.socket
+3
View File
@@ -18,6 +18,9 @@ FileDescriptorName=varlink
SocketMode=0600 SocketMode=0600
Accept=yes Accept=yes
MaxConnectionsPerSource=16 MaxConnectionsPerSource=16
XAttrEntryPoint=user.varlink=entrypoint
XAttrListen=user.varlink=listen
XAttrAccept=user.varlink=server
[Install] [Install]
WantedBy=sockets.target WantedBy=sockets.target