systemd/units/systemd-sysext.socket

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=System Extension Image Management
Documentation=man:systemd-sysext(8)
DefaultDependencies=no
After=local-fs.target
Before=sockets.target
ConditionCapability=CAP_SYS_ADMIN

[Socket]
ListenStream=/run/systemd/io.systemd.sysext
FileDescriptorName=varlink
SocketMode=0600
Accept=yes
MaxConnectionsPerSource=16

[Install]
WantedBy=sockets.target
sysext: make some calls available via varlink 2023-10-10 00:57:41 +08:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
			`#`
			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
units: drop "(Varlink)" We generally don't specify the protocol implementation in unit descriptions. For journald, we have: $ git grep Description 'units/journald' units/systemd-journald-audit.socket:Description=Journal Audit Socket units/systemd-journald-dev-log.socket:Description=Journal Socket (/dev/log) units/systemd-journald-varlink@.socket:Description=Journal Varlink Socket for Namespace %i units/systemd-journald.service.in:Description=Journal Service units/systemd-journald.socket:Description=Journal Sockets units/systemd-journald@.service.in:Description=Journal Service for Namespace %i units/systemd-journald@.socket:Description=Journal Sockets for Namespace %i so we need to keep "Varlink" in the name. But also use "Sockets" (plural) for the "main" socket unit, since it opens multiple sockets. 2024-03-14 17:16:25 +08:00			`Description=System Extension Image Management`
sysext: make some calls available via varlink 2023-10-10 00:57:41 +08:00			`Documentation=man:systemd-sysext(8)`
			`DefaultDependencies=no`
			`After=local-fs.target`
			`Before=sockets.target`
			`ConditionCapability=CAP_SYS_ADMIN`

			`[Socket]`
			`ListenStream=/run/systemd/io.systemd.sysext`
			`FileDescriptorName=varlink`
			`SocketMode=0600`
			`Accept=yes`
units: enable MaxConnectionsPerSocket= for all our Accept=yes units Let's make sure that user's cannot DoS services for other users so easily, and enable MaxConnectionsPerSocket= by default for all of them. Note that this is mostly paranoia for systemd-pcrextend.socket and systemd-sysext.socket: the socket is only accessible to root anyway, hence the accounting shouldn#t change anything. But this is just a safety net, in preparation that we open up some functionality of these services sooner or later. 2024-02-07 20:19:54 +08:00			`MaxConnectionsPerSource=16`
sysext: make some calls available via varlink 2023-10-10 00:57:41 +08:00
			`[Install]`
			`WantedBy=sockets.target`