tree-wide: symlink well-known Varlink service entry point sockets into /run/varlink/registry/ (#40590)

This is generally useful, but is particularly useful in context of
https://github.com/mvo5/varlink-proxy-rs which can expose a set of local
Varlink services via a HTTP bridge. The idea is that the sockets linked
into /run/varlink/registry/ are candidates for being exposed like that.

/cc @mvo5

TODO

@@ -129,6 +129,13 @@ Features:
   - how to plug facts into this? i.e. hostname, ssh keys, and so on
   - switch to daan's suggested hierarchy?
 
+* implement a varlink registry service, similar to the one of the reference
+  implementation, backed by /run/varlink/registry/. Then, also implement
+  connect-via-registry-resolution in sd-varlink and varlinkctl. Care needs to
+  be taken to do the resolution asynchronousy. Also, note that the Varlink
+  reference implementation uses a different address syntax, which needs to be
+  taken into account.
+
 * downgrade the uid/gid disposition enforcement in udev
 
 * have a signal that reloads every unit that supports reloading

man/varlinkctl.xml

@@ -181,6 +181,16 @@
         <xi:include href="version-info.xml" xpointer="v255"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><command>list-registry</command></term>
+
+        <listitem><para>Shows a list of Varlink services currently registered in the service registry, plus
+        their entrypoint sockets. (Currently, this simply enumerates the sockets and symlinked sockets in
+        <filename>/run/varlink/registry/</filename>, see below.)</para>
+
+        <xi:include href="version-info.xml" xpointer="v260"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><command>validate-idl</command> [<replaceable>FILE</replaceable>]</term>
 
@@ -354,6 +364,18 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--system</option></term>
+        <term><option>--user</option></term>
+
+        <listitem>
+          <para>Determines whether to query to the per-system or per-user registry when using the
+          <command>list-registry</command> command. By default, the per-system registry is queried.</para>
+        </listitem>
+
+        <xi:include href="version-info.xml" xpointer="v260"/>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="no-ask-password" />
       <xi:include href="standard-options.xml" xpointer="no-pager" />
       <xi:include href="standard-options.xml" xpointer="help" />
@@ -361,6 +383,31 @@
     </variablelist>
   </refsect1>
 
+  <refsect1>
+    <title>Files &amp; Directories</title>
+
+    <variablelist>
+      <varlistentry>
+        <term><filename>/run/varlink/registry/</filename></term>
+
+        <listitem>
+          <para>Directory containing <constant>AF_UNIX</constant> entrypoint socket inodes (or symlinks to
+          them) of well-known, public Varlink interfaces on the local system. They are named after the
+          Varlink interface they implement.</para>
+
+          <para>Use <command>varlinkctl list-registry</command> to show the contents of this
+          directory.</para>
+
+          <para>(Inodes that neither qualify as socket inodes nor as symlinks to them shall be ignored. A
+          future extension might introduce regular files and directories to enhance the registry
+          functionality.)</para>
+
+          <xi:include href="version-info.xml" xpointer="v260"/>
+        </listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
   <refsect1>
     <title>Examples</title>
 

shell-completion/bash/varlinkctl

@@ -63,7 +63,7 @@ _varlinkctl() {
     fi
 
     local -A VERBS=(
-        [STANDALONE]='help'
+        [STANDALONE]='help list-registry'
         [CALL]='call'
         [FILE]='info list-interfaces validate-idl'
         [ADDRESS_INTERFACES]='list-methods introspect'

src/basic/chase.c

@@ -26,7 +26,10 @@
          CHASE_STEP |                                   \
          CHASE_PROHIBIT_SYMLINKS |                      \
          CHASE_PARENT |                                 \
-         CHASE_MKDIR_0755)
+         CHASE_MKDIR_0755 |                             \
+         CHASE_MUST_BE_DIRECTORY |                      \
+         CHASE_MUST_BE_REGULAR |                        \
+         CHASE_MUST_BE_SOCKET)
 
 bool unsafe_transition(const struct stat *a, const struct stat *b) {
         /* Returns true if the transition from a to b is safe, i.e. that we never transition from unprivileged to
@@ -133,7 +136,6 @@ int chaseat(int dir_fd, const char *path, ChaseFlags flags, char **ret_path, int
         int r;
 
         assert(!FLAGS_SET(flags, CHASE_PREFIX_ROOT));
-        assert(!FLAGS_SET(flags, CHASE_MUST_BE_DIRECTORY|CHASE_MUST_BE_REGULAR));
         assert(!FLAGS_SET(flags, CHASE_STEP|CHASE_EXTRACT_FILENAME));
         assert(!FLAGS_SET(flags, CHASE_NO_AUTOFS|CHASE_TRIGGER_AUTOFS));
         assert(dir_fd >= 0 || IN_SET(dir_fd, AT_FDCWD, XAT_FDROOT));
@@ -328,6 +330,10 @@ int chaseat(int dir_fd, const char *path, ChaseFlags flags, char **ret_path, int
         if (FLAGS_SET(flags, CHASE_PARENT))
                 flags |= CHASE_MUST_BE_DIRECTORY;
 
+        /* If multiple flags are set now, fail immediately */
+        if (FLAGS_SET(flags, CHASE_MUST_BE_DIRECTORY) + FLAGS_SET(flags, CHASE_MUST_BE_REGULAR) + FLAGS_SET(flags, CHASE_MUST_BE_SOCKET) > 1)
+                return -EBADSLT;
+
         for (todo = buffer;;) {
                 _cleanup_free_ char *first = NULL;
                 _cleanup_close_ int child = -EBADF;
@@ -566,6 +572,12 @@ success:
                         if (r < 0)
                                 return r;
                 }
+
+                if (FLAGS_SET(flags, CHASE_MUST_BE_SOCKET)) {
+                        r = stat_verify_socket(&st);
+                        if (r < 0)
+                                return r;
+                }
         }
 
         if (ret_path) {
@@ -872,7 +884,7 @@ int chase_and_opendir(const char *path, const char *root, ChaseFlags chase_flags
         DIR *d;
         int r;
 
-        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_MUST_BE_REGULAR)));
+        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_MUST_BE_REGULAR|CHASE_MUST_BE_SOCKET)));
         assert(ret_dir);
 
         if (empty_or_root(root) && !ret_path && (chase_flags & CHASE_NO_SHORTCUT_MASK) == 0) {
@@ -970,7 +982,7 @@ int chase_and_fopen_unlocked(
         int mode_flags, r;
 
         assert(path);
-        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_PARENT|CHASE_MUST_BE_DIRECTORY)));
+        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_PARENT|CHASE_MUST_BE_DIRECTORY|CHASE_MUST_BE_SOCKET)));
         assert(open_flags);
         assert(ret_file);
 
@@ -1040,7 +1052,7 @@ int chase_and_openat(
         _cleanup_free_ char *p = NULL, *fname = NULL;
         int r;
 
-        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP)));
+        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_MUST_BE_SOCKET)));
 
         XOpenFlags xopen_flags = 0;
         if (FLAGS_SET(chase_flags, CHASE_MUST_BE_DIRECTORY))
@@ -1086,7 +1098,7 @@ int chase_and_opendirat(int dir_fd, const char *path, ChaseFlags chase_flags, ch
         DIR *d;
         int r;
 
-        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_MUST_BE_REGULAR)));
+        assert(!(chase_flags & (CHASE_NONEXISTENT|CHASE_STEP|CHASE_MUST_BE_REGULAR|CHASE_MUST_BE_SOCKET)));
         assert(ret_dir);
 
         if (dir_fd == AT_FDCWD && !ret_path && (chase_flags & CHASE_NO_SHORTCUT_MASK) == 0) {

src/basic/chase.h

@@ -29,6 +29,7 @@ typedef enum ChaseFlags {
         CHASE_EXTRACT_FILENAME   = 1 << 13, /* Only return the last component of the resolved path */
         CHASE_MUST_BE_DIRECTORY  = 1 << 14, /* Fail if returned inode fd is not a dir */
         CHASE_MUST_BE_REGULAR    = 1 << 15, /* Fail if returned inode fd is not a regular file */
+        CHASE_MUST_BE_SOCKET     = 1 << 16, /* Fail if returned inode fd is not a socket */
 } ChaseFlags;
 
 bool unsafe_transition(const struct stat *a, const struct stat *b);

src/basic/stat-util.c

@@ -142,6 +142,21 @@ int is_symlink(const char *path) {
         return verify_stat_at(AT_FDCWD, path, false, stat_verify_symlink, false);
 }
 
+int stat_verify_socket(const struct stat *st) {
+        assert(st);
+
+        if (S_ISLNK(st->st_mode))
+                return -ELOOP;
+
+        if (S_ISDIR(st->st_mode))
+                return -EISDIR;
+
+        if (!S_ISSOCK(st->st_mode))
+                return -ENOTSOCK;
+
+        return 0;
+}
+
 int stat_verify_linked(const struct stat *st) {
         assert(st);
 

src/basic/stat-util.h

@@ -20,6 +20,8 @@ int stat_verify_symlink(const struct stat *st);
 int fd_verify_symlink(int fd);
 int is_symlink(const char *path);
 
+int stat_verify_socket(const struct stat *st);
+
 int stat_verify_linked(const struct stat *st);
 int fd_verify_linked(int fd);
 

src/varlinkctl/varlinkctl.c

@@ -10,6 +10,7 @@
 
 #include "build.h"
 #include "bus-util.h"
+#include "chase.h"
 #include "env-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -21,10 +22,14 @@
 #include "pager.h"
 #include "parse-argument.h"
 #include "parse-util.h"
+#include "path-lookup.h"
+#include "path-util.h"
 #include "pidfd-util.h"
 #include "polkit-agent.h"
 #include "pretty-print.h"
 #include "process-util.h"
+#include "recurse-dir.h"
+#include "runtime-scope.h"
 #include "string-util.h"
 #include "strv.h"
 #include "terminal-util.h"
@@ -49,6 +54,8 @@ static usec_t arg_timeout = 0;
 static bool arg_exec = false;
 static PushFds arg_push_fds = {};
 static bool arg_ask_password = true;
+static bool arg_legend = true;
+static RuntimeScope arg_runtime_scope = RUNTIME_SCOPE_SYSTEM;
 
 static void push_fds_done(PushFds *p) {
         assert(p);
@@ -85,6 +92,7 @@ static int help(void) {
                "                         Invoke method\n"
                "  --exec call ADDRESS METHOD PARAMS -- CMDLINE…\n"
                "                         Invoke method and pass response and fds to command\n"
+               "  list-registry          Show list of services in the service registry\n"
                "  validate-idl [FILE]    Validate interface description\n"
                "  help                   Show this help\n"
                "\n%3$sOptions:%4$s\n"
@@ -92,6 +100,8 @@ static int help(void) {
                "     --version           Show package version\n"
                "     --no-ask-password   Do not prompt for password\n"
                "     --no-pager          Do not pipe output into a pager\n"
+               "     --system            Enumerate system registry\n"
+               "     --user              Enumerate user registry\n"
                "     --more              Request multiple responses\n"
                "     --collect           Collect multiple responses in a JSON array\n"
                "     --oneway            Do not request response\n"
@@ -131,6 +141,8 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_EXEC,
                 ARG_PUSH_FD,
                 ARG_NO_ASK_PASSWORD,
+                ARG_USER,
+                ARG_SYSTEM,
         };
 
         static const struct option options[] = {
@@ -147,6 +159,8 @@ static int parse_argv(int argc, char *argv[]) {
                 { "exec",            no_argument,       NULL, ARG_EXEC            },
                 { "push-fd",         required_argument, NULL, ARG_PUSH_FD         },
                 { "no-ask-password", no_argument,       NULL, ARG_NO_ASK_PASSWORD },
+                { "user",            no_argument,       NULL, ARG_USER            },
+                { "system",          no_argument,       NULL, ARG_SYSTEM          },
                 {},
         };
 
@@ -263,6 +277,14 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_ask_password = false;
                         break;
 
+                case ARG_USER:
+                        arg_runtime_scope = RUNTIME_SCOPE_USER;
+                        break;
+
+                case ARG_SYSTEM:
+                        arg_runtime_scope = RUNTIME_SCOPE_SYSTEM;
+                        break;
+
                 case '?':
                         return -EINVAL;
 
@@ -973,15 +995,115 @@ static int verb_validate_idl(int argc, char *argv[], void *userdata) {
         return 0;
 }
 
+static int verb_list_registry(int argc, char *argv[], void *userdata) {
+        int r;
+
+        assert(argc <= 1);
+
+        _cleanup_free_ char *reg_path = NULL;
+        r = runtime_directory_generic(arg_runtime_scope, "varlink/registry", &reg_path);
+        if (r < 0)
+                return log_error_errno(r, "Failed to determine registry path: %m");
+
+        _cleanup_(table_unrefp) Table *table = table_new("interface", "entrypoint");
+        if (!table)
+                return log_oom();
+
+        (void) table_set_sort(table, (size_t) 0);
+
+        _cleanup_close_ int regfd = open(reg_path, O_DIRECTORY|O_CLOEXEC);
+        if (regfd < 0)  {
+                if (errno != ENOENT)
+                        return log_error_errno(errno, "Failed to open '%s': %m", reg_path);
+        } else {
+                _cleanup_free_ DirectoryEntries *des = NULL;
+                r = readdir_all(regfd, RECURSE_DIR_IGNORE_DOT|RECURSE_DIR_ENSURE_TYPE, &des);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to enumerate '%s': %m", reg_path);
+
+                FOREACH_ARRAY(i, des->entries, des->n_entries) {
+                        struct dirent *de = *i;
+
+                        if (!varlink_idl_interface_name_is_valid(de->d_name)) {
+                                log_debug("Found file '%s' whose names does not qualify as valid Varlink interface name, skipping.", de->d_name);
+                                continue;
+                        }
+
+                        _cleanup_free_ char *j = path_join(reg_path, de->d_name);
+                        if (!j)
+                                return log_oom();
+
+                        switch (de->d_type) {
+                        case DT_LNK: {
+                                _cleanup_free_ char *resolved = NULL;
+
+                                r = chase(j, /* root= */ NULL, CHASE_MUST_BE_SOCKET, &resolved, /* ret_fd= */ NULL);
+                                if (r < 0) {
+                                        log_warning_errno(r, "Failed to resolve '%s', skipping: %m", j);
+                                        continue;
+                                }
+
+                                _cleanup_free_ char *address = strjoin("unix:", resolved);
+                                if (!address)
+                                        return log_oom();
+
+                                r = table_add_many(
+                                                table,
+                                                TABLE_STRING, de->d_name,
+                                                TABLE_STRING, address);
+                                if (r < 0)
+                                        return r;
+
+                                break;
+                        }
+
+                        case DT_SOCK: {
+                                _cleanup_free_ char *address = strjoin("unix:", j);
+                                if (!address)
+                                        return log_oom();
+
+                                r = table_add_many(
+                                                table,
+                                                TABLE_STRING, de->d_name,
+                                                TABLE_STRING, address);
+                                if (r < 0)
+                                        return r;
+
+                                break;
+                        }
+
+                        default:
+                                log_debug("Ignoring inode '%s' of unexpected type: %m", de->d_name);
+                        }
+                }
+        }
+
+        if (!table_isempty(table) || sd_json_format_enabled(arg_json_format_flags)) {
+                r = table_print_with_pager(table, arg_json_format_flags, arg_pager_flags, /* show_header= */ true);
+                if (r < 0)
+                        return log_error_errno(r, "Failed to output table: %m");
+        }
+
+        if (arg_legend && !sd_json_format_enabled(arg_json_format_flags)) {
+                if (table_isempty(table))
+                        printf("No services registered.\n");
+                else
+                        printf("\n%zu registered services listed.\n", table_get_rows(table) - 1);
+        }
+
+        return 0;
+}
+
 static int varlinkctl_main(int argc, char *argv[]) {
         static const Verb verbs[] = {
-                { "info",            2,        2,        0, verb_info         },
-                { "list-interfaces", 2,        2,        0, verb_info         },
-                { "introspect",      2,        VERB_ANY, 0, verb_introspect   },
-                { "list-methods",    2,        VERB_ANY, 0, verb_introspect   },
-                { "call",            3,        VERB_ANY, 0, verb_call         },
-                { "validate-idl",    1,        2,        0, verb_validate_idl },
-                { "help",            VERB_ANY, VERB_ANY, 0, verb_help         },
+                { "info",            2,        2,        0, verb_info          },
+                { "list-interfaces", 2,        2,        0, verb_info          },
+                { "introspect",      2,        VERB_ANY, 0, verb_introspect    },
+                { "list-methods",    2,        VERB_ANY, 0, verb_introspect    },
+                { "call",            3,        VERB_ANY, 0, verb_call          },
+                { "list-registry",   VERB_ANY, 1,        0, verb_list_registry },
+                { "validate-idl",    1,        2,        0, verb_validate_idl  },
+                { "help",            VERB_ANY, VERB_ANY, 0, verb_help          },
                 {}
         };
 

test/units/TEST-74-AUX-UTILS.varlinkctl.sh

@@ -37,6 +37,10 @@ varlinkctl introspect -j /run/systemd/journal/io.systemd.journal | jq --seq .
 varlinkctl introspect /run/systemd/journal/io.systemd.journal io.systemd.Journal
 varlinkctl introspect -j /run/systemd/journal/io.systemd.journal io.systemd.Journal | jq .
 
+varlinkctl list-registry
+varlinkctl list-registry -j | jq .
+varlinkctl list-registry | grep io.systemd.Manager
+
 if command -v userdbctl >/dev/null; then
     systemctl start systemd-userdbd
     varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{ "userName" : "testuser", "service" : "io.systemd.Multiplexer" }'

tmpfiles.d/20-systemd-varlink.conf

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# See tmpfiles.d(5) for details.
+
+# Varlink AF_UNIX entrypoint socket inodes of relevant system services may be
+# linked into this directory, to make them "well-known". Typically, tools such
+# as the Varlink HTTP bridge expose services linked in here as public
+# interfaces. The symlink should be named after the Varlink interface to
+# expose. Interfaces that may be implemented by multiple services (such as
+# the generic "io.systemd.service") should not be symlinked here.
+d /run/varlink/registry/ 0755 root root
+
+# Socket activated services should use Symlinks= in the .socket unit file to
+# create these symlinks. If that's not applicable, consider creating the
+# symlinks via a tmpfiles.d/ snippet, like we do here, so that registration can
+# be influenced by the administrator.
+L /run/varlink/registry/io.systemd.Unit - - - - ../../systemd/io.systemd.Manager
+L /run/varlink/registry/io.systemd.Manager - - - - ../../systemd/io.systemd.Manager
+L /run/varlink/registry/io.systemd.Journal - - - - ../../systemd/journal/io.systemd.journal

tmpfiles.d/meson.build

@@ -13,6 +13,7 @@ files = [['README'                                  ],
          ['systemd-nspawn.conf',  'ENABLE_MACHINED' ],
          ['systemd-pstore.conf',  'ENABLE_PSTORE'   ],
          ['systemd-resolve.conf', 'ENABLE_RESOLVE'  ],
+         ['20-systemd-varlink.conf'                 ],
          ['systemd-tmp.conf'                        ],
          ['tmp.conf'                                ],
          ['x11.conf'                                ],
@@ -59,3 +60,5 @@ endforeach
 if install_sysconfdir
         install_emptydir(sysconfdir / 'tmpfiles.d')
 endif
+
+subdir('user')

tmpfiles.d/user/20-systemd-varlink.conf

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+# See tmpfiles.d(5) for details.
+
+d %t/varlink/registry/ 0755
+
+L %t/varlink/registry/io.systemd.Unit - - - - ../../systemd/io.systemd.Manager
+L %t/varlink/registry/io.systemd.Manager - - - - ../../systemd/io.systemd.Manager

tmpfiles.d/user/meson.build

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+files = [ '20-systemd-varlink.conf' ]
+
+foreach f : files
+        install_data(f, install_dir : usertmpfilesdir)
+endforeach
+
+if install_sysconfdir
+        install_emptydir(sysconfdir / 'user-tmpfiles.d')
+endif

tools/command_ignorelist

@@ -572,3 +572,4 @@ loader.conf.xml ./refsect1[title="Options"]/variablelist/varlistentry[term="rebo
 loader.conf.xml ./refsect1[title="Options"]/variablelist/varlistentry[term="reboot-on-error"]/listitem/para/variablelist/varlistentry[term="auto"]
 loader.conf.xml ./refsect1[title="Options"]/variablelist/varlistentry[term="secure-boot-enroll-action"]/listitem/variablelist/varlistentry[term="reboot"]
 loader.conf.xml ./refsect1[title="Options"]/variablelist/varlistentry[term="secure-boot-enroll-action"]/listitem/variablelist/varlistentry[term="shutdown"]
+varlinkctl.xml ./refsect1[title="Options"]/variablelist/varlistentry[term="--system"]

units/systemd-ask-password.socket

@@ -15,6 +15,7 @@ Before=sockets.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.AskPassword
+Symlinks=/run/varlink/registry/io.systemd.AskPassword
 FileDescriptorName=varlink
 SocketMode=0666
 Accept=yes

units/systemd-bootctl.socket

@@ -16,6 +16,7 @@ Before=sockets.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.BootControl
+Symlinks=/run/varlink/registry/io.systemd.BootControl
 FileDescriptorName=varlink
 SocketMode=0600
 Accept=yes

units/systemd-creds.socket

@@ -15,6 +15,7 @@ Before=sockets.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.Credentials
+Symlinks=/run/varlink/registry/io.systemd.Credentials
 FileDescriptorName=varlink
 SocketMode=0666
 Accept=yes

units/systemd-factory-reset.socket

@@ -15,6 +15,7 @@ Before=sockets.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.FactoryReset
+Symlinks=/run/varlink/registry/io.systemd.FactoryReset
 FileDescriptorName=varlink
 SocketMode=0666
 Accept=yes

units/systemd-hostnamed.socket

@@ -15,5 +15,6 @@ Documentation=man:machine-info(5)
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.Hostname
+Symlinks=/run/varlink/registry/io.systemd.Hostname
 FileDescriptorName=varlink
 SocketMode=0666

units/systemd-importd.socket

@@ -20,5 +20,6 @@ Before=shutdown.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.Import
+Symlinks=/run/varlink/registry/io.systemd.Import
 FileDescriptorName=varlink
 SocketMode=0666

units/systemd-logind-varlink.socket

@@ -13,6 +13,7 @@ Documentation=man:systemd-logind.service(8)
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.Login
+Symlinks=/run/varlink/registry/io.systemd.Login
 FileDescriptorName=varlink
 SocketMode=0666
 Service=systemd-logind.service

units/systemd-machined.socket

@@ -13,6 +13,6 @@ Documentation=man:systemd-machined.service(8)
 
 [Socket]
 ListenStream=/run/systemd/machine/io.systemd.Machine
-ListenStream=/run/systemd/machine/io.systemd.MachineImage
+Symlinks=/run/systemd/machine/io.systemd.MachineImage /run/varlink/registry/io.systemd.Machine /run/varlink/registry/io.systemd.MachineImage
 FileDescriptorName=varlink
 SocketMode=0666

units/systemd-mountfsd.socket

@@ -16,6 +16,8 @@ Before=sockets.target shutdown.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.MountFileSystem
+Symlinks=/run/varlink/registry/io.systemd.MountFileSystem
+FileDescriptorName=varlink
 SocketMode=0666
 
 [Install]

units/systemd-mute-console.socket

@@ -17,6 +17,7 @@ Before=shutdown.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.MuteConsole
+Symlinks=/run/varlink/registry/io.systemd.MuteConsole
 FileDescriptorName=varlink
 SocketMode=0600
 Accept=yes

units/systemd-networkd-varlink.socket

@@ -17,6 +17,7 @@ Conflicts=shutdown.target
 
 [Socket]
 ListenStream=/run/systemd/netif/io.systemd.Network
+Symlinks=/run/varlink/registry/io.systemd.Network
 FileDescriptorName=varlink
 SocketMode=0666
 Service=systemd-networkd.service

units/systemd-nsresourced.socket

@@ -16,7 +16,8 @@ Before=sockets.target shutdown.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.NamespaceResource
-Symlinks=/run/systemd/userdb/io.systemd.NamespaceResource
+Symlinks=/run/systemd/userdb/io.systemd.NamespaceResource /run/varlink/registry/io.systemd.NamespaceResource
+FileDescriptorName=varlink
 SocketMode=0666
 
 [Install]

units/systemd-pcrextend.socket

@@ -17,6 +17,7 @@ ConditionSecurity=measured-uki
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.PCRExtend
+Symlinks=/run/varlink/registry/io.systemd.PCRExtend
 FileDescriptorName=varlink
 SocketMode=0600
 Accept=yes

units/systemd-pcrlock.socket

@@ -17,6 +17,7 @@ ConditionSecurity=measured-uki
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.PCRLock
+Symlinks=/run/varlink/registry/io.systemd.PCRLock
 FileDescriptorName=varlink
 SocketMode=0600
 Accept=yes

units/systemd-repart.socket

@@ -17,6 +17,7 @@ Before=shutdown.target
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.Repart
+Symlinks=/run/varlink/registry/io.systemd.Repart
 FileDescriptorName=varlink
 SocketMode=0600
 Accept=yes

units/systemd-resolved-monitor.socket

@@ -17,6 +17,7 @@ Conflicts=shutdown.target
 [Socket]
 Service=systemd-resolved.service
 ListenStream=/run/systemd/resolve/io.systemd.Resolve.Monitor
+Symlinks=/run/varlink/registry/io.systemd.Resolve.Monitor
 FileDescriptorName=varlink-monitor
 SocketMode=0666
 

units/systemd-resolved-varlink.socket

@@ -17,6 +17,7 @@ Conflicts=shutdown.target
 [Socket]
 Service=systemd-resolved.service
 ListenStream=/run/systemd/resolve/io.systemd.Resolve
+Symlinks=/run/varlink/registry/io.systemd.Resolve
 FileDescriptorName=varlink
 SocketMode=0666
 

units/systemd-sysext.socket

@@ -17,6 +17,7 @@ ConditionCapability=CAP_SYS_ADMIN
 
 [Socket]
 ListenStream=/run/systemd/io.systemd.sysext
+Symlinks=/run/varlink/registry/io.systemd.sysext
 FileDescriptorName=varlink
 SocketMode=0666
 Accept=yes

units/systemd-udevd-varlink.socket

@@ -17,6 +17,7 @@ ConditionPathIsReadWrite=/sys
 [Socket]
 Service=systemd-udevd.service
 ListenStream=/run/udev/io.systemd.Udev
+Symlinks=/run/varlink/registry/io.systemd.Udev
 FileDescriptorName=varlink
 SocketMode=0600
 RemoveOnStop=yes

units/systemd-userdbd.socket

@@ -15,7 +15,8 @@ Before=sockets.target
 
 [Socket]
 ListenStream=/run/systemd/userdb/io.systemd.Multiplexer
-Symlinks=/run/systemd/userdb/io.systemd.NameServiceSwitch /run/systemd/userdb/io.systemd.DropIn
+Symlinks=/run/systemd/userdb/io.systemd.NameServiceSwitch /run/systemd/userdb/io.systemd.DropIn /run/varlink/registry/io.systemd.UserDatabase
+FileDescriptorName=varlink
 SocketMode=0666
 RemoveOnStop=yes
 

units/user/systemd-ask-password.socket

@@ -15,6 +15,7 @@ Before=sockets.target
 
 [Socket]
 ListenStream=%t/systemd/io.systemd.AskPassword
+Symlinks=%t/varlink/registry/io.systemd.AskPassword
 FileDescriptorName=varlink
 SocketMode=0600
 Accept=yes

units/user/systemd-importd.socket

@@ -14,5 +14,6 @@ Documentation=man:org.freedesktop.import1(5)
 
 [Socket]
 ListenStream=%t/systemd/io.systemd.Import
+Symlinks=%t/varlink/registry/io.systemd.Import
 FileDescriptorName=varlink
 SocketMode=0600

units/user/systemd-machined.socket

@@ -13,6 +13,6 @@ Documentation=man:systemd-machined.service(8)
 
 [Socket]
 ListenStream=%t/systemd/machine/io.systemd.Machine
-ListenStream=%t/systemd/machine/io.systemd.MachineImage
+Symlinks=%t/systemd/machine/io.systemd.MachineImage %t/varlink/registry/io.systemd.Machine %t/varlink/registry/io.systemd.MachineImage
 FileDescriptorName=varlink
 SocketMode=0600