cgroup-util: Handle capsule@ paths like user@ paths

The capsule instances are related to user instances, so treat them
equally to user@.service when handling cgroup paths. This also saves us
from polluting public libsystemd API with variant for capsules too.

Fix: #36098

src/basic/cgroup-util.c

@@ -12,6 +12,7 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
+#include "capsule-util.h"
 #include "cgroup-util.h"
 #include "constants.h"
 #include "dirent-util.h"
@@ -1284,7 +1285,7 @@ static const char *skip_session(const char *p) {
 }
 
 /**
- * Skip user@*.service, but require it to be there.
+ * Skip user@*.service or capsule@*.service, but require either of them to be there.
  */
 static const char *skip_user_manager(const char *p) {
         size_t n;
@@ -1295,26 +1296,37 @@ static const char *skip_user_manager(const char *p) {
         p += strspn(p, "/");
 
         n = strcspn(p, "/");
-        if (n < STRLEN("user@x.service"))
+        if (n < CONST_MIN(STRLEN("user@x.service"), STRLEN("capsule@x.service")))
                 return NULL;
 
-        if (memcmp(p, "user@", 5) == 0 && memcmp(p + n - 8, ".service", 8) == 0) {
-                char buf[n - 5 - 8 + 1];
+        /* Any possible errors from functions called below are converted to NULL return, so our callers won't
+         * resolve user/capsule name. */
+        _cleanup_free_ char *unit_name = strndup(p, n);
+        if (!unit_name)
+                return NULL;
 
-                memcpy(buf, p + 5, n - 5 - 8);
-                buf[n - 5 - 8] = 0;
+        _cleanup_free_ char *i = NULL;
+        UnitNameFlags type = unit_name_to_instance(unit_name, &i);
 
-                /* Note that user manager services never need unescaping,
-                 * since they cannot conflict with the kernel's own
-                 * names, hence we don't need to call cg_unescape()
-                 * here. */
+        if (type != UNIT_NAME_INSTANCE)
+                return NULL;
 
-                if (parse_uid(buf, NULL) < 0)
+        /* Note that user manager services never need unescaping, since they cannot conflict with the
+         * kernel's own names, hence we don't need to call cg_unescape() here.  Prudently check validity of
+         * instance names, they should be always valid as we validate them upon unit start. */
+        if (startswith(unit_name, "user@")) {
+                if (parse_uid(i, NULL) < 0)
                         return NULL;
 
                 p += n;
                 p += strspn(p, "/");
+                return p;
+        } else if (startswith(unit_name, "capsule@")) {
+                if (capsule_name_is_valid(i) <= 0)
+                        return NULL;
 
+                p += n;
+                p += strspn(p, "/");
                 return p;
         }