systemd/units/systemd-creds.socket

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Credential Encryption/Decryption
Documentation=man:systemd-creds(1)
DefaultDependencies=no
Before=sockets.target

[Socket]
ListenStream=/run/systemd/io.systemd.Credentials
FileDescriptorName=varlink
SocketMode=0666
Accept=yes
MaxConnectionsPerSource=16
creds: add varlink API for encrypting/decrypting credentials 2023-11-23 22:22:27 +01:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
			`#`
			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
units: drop "(Varlink)" We generally don't specify the protocol implementation in unit descriptions. For journald, we have: $ git grep Description 'units/journald' units/systemd-journald-audit.socket:Description=Journal Audit Socket units/systemd-journald-dev-log.socket:Description=Journal Socket (/dev/log) units/systemd-journald-varlink@.socket:Description=Journal Varlink Socket for Namespace %i units/systemd-journald.service.in:Description=Journal Service units/systemd-journald.socket:Description=Journal Sockets units/systemd-journald@.service.in:Description=Journal Service for Namespace %i units/systemd-journald@.socket:Description=Journal Sockets for Namespace %i so we need to keep "Varlink" in the name. But also use "Sockets" (plural) for the "main" socket unit, since it opens multiple sockets. 2024-03-14 10:16:25 +01:00			`Description=Credential Encryption/Decryption`
creds: add varlink API for encrypting/decrypting credentials 2023-11-23 22:22:27 +01:00			`Documentation=man:systemd-creds(1)`
			`DefaultDependencies=no`
			`Before=sockets.target`

			`[Socket]`
			`ListenStream=/run/systemd/io.systemd.Credentials`
			`FileDescriptorName=varlink`
creds: open up access to clients via Polkit Use auth_admin_keep, so that users don't have to re-auth interactively again and again when encrypting/decrypting batches of credentials. 2023-11-23 22:22:27 +01:00			`SocketMode=0666`
creds: add varlink API for encrypting/decrypting credentials 2023-11-23 22:22:27 +01:00			`Accept=yes`
units: enable MaxConnectionsPerSocket= for all our Accept=yes units Let's make sure that user's cannot DoS services for other users so easily, and enable MaxConnectionsPerSocket= by default for all of them. Note that this is mostly paranoia for systemd-pcrextend.socket and systemd-sysext.socket: the socket is only accessible to root anyway, hence the accounting shouldn#t change anything. But this is just a safety net, in preparation that we open up some functionality of these services sooner or later. 2024-02-07 13:19:54 +01:00			`MaxConnectionsPerSource=16`