src/core/core-varlink.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "core-varlink.h"
   4 #include "mkdir-label.h"
   5 #include "strv.h"
   6 #include "user-util.h"
   7 #include "varlink.h"
   8 #include "varlink-io.systemd.UserDatabase.h"
   9 #include "varlink-io.systemd.ManagedOOM.h"
  10
  11 typedef struct LookupParameters {
  12         const char *user_name;
  13         const char *group_name;
  14         union {
  15                 uid_t uid;
  16                 gid_t gid;
  17         };
  18         const char *service;
  19 } LookupParameters;
  20
  21 static const char* const managed_oom_mode_properties[] = {
  22         "ManagedOOMSwap",
  23         "ManagedOOMMemoryPressure",
  24 };
  25
  26 static int build_user_json(const char *user_name, uid_t uid, JsonVariant **ret) {
  27         assert(user_name);
  28         assert(uid_is_valid(uid));
  29         assert(ret);
  30
  31         return json_build(ret, JSON_BUILD_OBJECT(
  32                                    JSON_BUILD_PAIR("record", JSON_BUILD_OBJECT(
  33                                        JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(user_name)),
  34                                        JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid)),
  35                                        JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(uid)),
  36                                        JSON_BUILD_PAIR("realName", JSON_BUILD_CONST_STRING("Dynamic User")),
  37                                        JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_CONST_STRING("/")),
  38                                        JSON_BUILD_PAIR("shell", JSON_BUILD_CONST_STRING(NOLOGIN)),
  39                                        JSON_BUILD_PAIR("locked", JSON_BUILD_BOOLEAN(true)),
  40                                        JSON_BUILD_PAIR("service", JSON_BUILD_CONST_STRING("io.systemd.DynamicUser")),
  41                                        JSON_BUILD_PAIR("disposition", JSON_BUILD_CONST_STRING("dynamic"))))));
  42 }
  43
  44 static bool user_match_lookup_parameters(LookupParameters *p, const char *name, uid_t uid) {
  45         assert(p);
  46
  47         if (p->user_name && !streq(name, p->user_name))
  48                 return false;
  49
  50         if (uid_is_valid(p->uid) && uid != p->uid)
  51                 return false;
  52
  53         return true;
  54 }
  55
  56 static int build_managed_oom_json_array_element(Unit *u, const char *property, JsonVariant **ret_v) {
  57         bool use_limit = false;
  58         CGroupContext *c;
  59         const char *mode;
  60
  61         assert(u);
  62         assert(property);
  63         assert(ret_v);
  64
  65         if (!UNIT_VTABLE(u)->can_set_managed_oom)
  66                 return -EOPNOTSUPP;
  67
  68         c = unit_get_cgroup_context(u);
  69         if (!c)
  70                 return -EINVAL;
  71
  72         CGroupRuntime *crt = unit_get_cgroup_runtime(u);
  73         if (!crt)
  74                 return -EINVAL;
  75
  76         if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(u)))
  77                 /* systemd-oomd should always treat inactive units as though they didn't enable any action since they
  78                  * should not have a valid cgroup */
  79                 mode = managed_oom_mode_to_string(MANAGED_OOM_AUTO);
  80         else if (streq(property, "ManagedOOMSwap"))
  81                 mode = managed_oom_mode_to_string(c->moom_swap);
  82         else if (streq(property, "ManagedOOMMemoryPressure")) {
  83                 mode = managed_oom_mode_to_string(c->moom_mem_pressure);
  84                 use_limit = true;
  85         } else
  86                 return -EINVAL;
  87
  88         return json_build(ret_v, JSON_BUILD_OBJECT(
  89                                  JSON_BUILD_PAIR("mode", JSON_BUILD_STRING(mode)),
  90                                  JSON_BUILD_PAIR("path", JSON_BUILD_STRING(crt->cgroup_path)),
  91                                  JSON_BUILD_PAIR("property", JSON_BUILD_STRING(property)),
  92                                  JSON_BUILD_PAIR_CONDITION(use_limit, "limit", JSON_BUILD_UNSIGNED(c->moom_mem_pressure_limit))));
  93 }
  94
  95 int manager_varlink_send_managed_oom_update(Unit *u) {
  96         _cleanup_(json_variant_unrefp) JsonVariant *arr = NULL, *v = NULL;
  97         CGroupRuntime *crt;
  98         CGroupContext *c;
  99         int r;
 100
 101         assert(u);
 102
 103         if (!UNIT_VTABLE(u)->can_set_managed_oom || !u->manager)
 104                 return 0;
 105
 106         crt = unit_get_cgroup_runtime(u);
 107         if (!crt || !crt->cgroup_path)
 108                 return 0;
 109
 110         if (MANAGER_IS_SYSTEM(u->manager)) {
 111                 /* In system mode we can't send any notifications unless oomd connected back to us. In this
 112                  * mode oomd must initiate communication, not us. */
 113                 if (!u->manager->managed_oom_varlink)
 114                         return 0;
 115         } else {
 116                 /* If we are in user mode, let's connect to oomd if we aren't connected yet. In this mode we
 117                  * must initiate communication to oomd, not the other way round. */
 118                 r = manager_varlink_init(u->manager);
 119                 if (r <= 0)
 120                         return r;
 121         }
 122
 123         c = unit_get_cgroup_context(u);
 124         if (!c)
 125                 return 0;
 126
 127         r = json_build(&arr, JSON_BUILD_EMPTY_ARRAY);
 128         if (r < 0)
 129                 return r;
 130
 131         FOREACH_ELEMENT(i, managed_oom_mode_properties) {
 132                 _cleanup_(json_variant_unrefp) JsonVariant *e = NULL;
 133
 134                 r = build_managed_oom_json_array_element(u, *i, &e);
 135                 if (r < 0)
 136                         return r;
 137
 138                 r = json_variant_append_array(&arr, e);
 139                 if (r < 0)
 140                         return r;
 141         }
 142
 143         r = json_build(&v, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("cgroups", JSON_BUILD_VARIANT(arr))));
 144         if (r < 0)
 145                 return r;
 146
 147         if (MANAGER_IS_SYSTEM(u->manager))
 148                 /* in system mode, oomd is our client, thus send out notifications as replies to the
 149                  * initiating method call from them. */
 150                 r = varlink_notify(u->manager->managed_oom_varlink, v);
 151         else
 152                 /* in user mode, we are oomd's client, thus send out notifications as method calls that do
 153                  * not expect a reply. */
 154                 r = varlink_send(u->manager->managed_oom_varlink, "io.systemd.oom.ReportManagedOOMCGroups", v);
 155
 156         return r;
 157 }
 158
 159 static int build_managed_oom_cgroups_json(Manager *m, JsonVariant **ret) {
 160         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *arr = NULL;
 161         int r;
 162
 163         assert(m);
 164         assert(ret);
 165
 166         r = json_build(&arr, JSON_BUILD_EMPTY_ARRAY);
 167         if (r < 0)
 168                 return r;
 169
 170         for (UnitType t = 0; t < _UNIT_TYPE_MAX; t++) {
 171
 172                 if (!unit_vtable[t]->can_set_managed_oom)
 173                         continue;
 174
 175                 LIST_FOREACH(units_by_type, u, m->units_by_type[t]) {
 176                         CGroupContext *c;
 177
 178                         if (UNIT_IS_INACTIVE_OR_FAILED(unit_active_state(u)))
 179                                 continue;
 180
 181                         c = unit_get_cgroup_context(u);
 182                         if (!c)
 183                                 continue;
 184
 185                         FOREACH_ELEMENT(i, managed_oom_mode_properties) {
 186                                 _cleanup_(json_variant_unrefp) JsonVariant *e = NULL;
 187
 188                                 /* For the initial varlink call we only care about units that enabled (i.e. mode is not
 189                                  * set to "auto") oomd properties. */
 190                                 if (!(streq(*i, "ManagedOOMSwap") && c->moom_swap == MANAGED_OOM_KILL) &&
 191                                     !(streq(*i, "ManagedOOMMemoryPressure") && c->moom_mem_pressure == MANAGED_OOM_KILL))
 192                                         continue;
 193
 194                                 r = build_managed_oom_json_array_element(u, *i, &e);
 195                                 if (r < 0)
 196                                         return r;
 197
 198                                 r = json_variant_append_array(&arr, e);
 199                                 if (r < 0)
 200                                         return r;
 201                         }
 202                 }
 203         }
 204
 205         r = json_build(&v, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("cgroups", JSON_BUILD_VARIANT(arr))));
 206         if (r < 0)
 207                 return r;
 208
 209         *ret = TAKE_PTR(v);
 210         return 0;
 211 }
 212
 213 static int vl_method_subscribe_managed_oom_cgroups(
 214                 Varlink *link,
 215                 JsonVariant *parameters,
 216                 VarlinkMethodFlags flags,
 217                 void *userdata) {
 218
 219         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 220         Manager *m = ASSERT_PTR(userdata);
 221         pid_t pid;
 222         Unit *u;
 223         int r;
 224
 225         assert(link);
 226
 227         r = varlink_get_peer_pid(link, &pid);
 228         if (r < 0)
 229                 return r;
 230
 231         u = manager_get_unit_by_pid(m, pid);
 232         if (!u)
 233                 return varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
 234
 235         /* This is meant to be a deterrent and not actual security. The alternative is to check for the systemd-oom
 236          * user that this unit runs as, but NSS lookups are blocking and not allowed from PID 1. */
 237         if (!streq(u->id, "systemd-oomd.service"))
 238                 return varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
 239
 240         if (json_variant_elements(parameters) > 0)
 241                 return varlink_error_invalid_parameter(link, parameters);
 242
 243         /* We only take one subscriber for this method so return an error if there's already an existing one.
 244          * This shouldn't happen since systemd-oomd is the only client of this method. */
 245         if (FLAGS_SET(flags, VARLINK_METHOD_MORE) && m->managed_oom_varlink)
 246                 return varlink_error(link, "io.systemd.ManagedOOM.SubscriptionTaken", NULL);
 247
 248         r = build_managed_oom_cgroups_json(m, &v);
 249         if (r < 0)
 250                 return r;
 251
 252         if (!FLAGS_SET(flags, VARLINK_METHOD_MORE))
 253                 return varlink_reply(link, v);
 254
 255         assert(!m->managed_oom_varlink);
 256         m->managed_oom_varlink = varlink_ref(link);
 257         return varlink_notify(m->managed_oom_varlink, v);
 258 }
 259
 260 static int manager_varlink_send_managed_oom_initial(Manager *m) {
 261         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 262         int r;
 263
 264         assert(m);
 265
 266         if (MANAGER_IS_SYSTEM(m))
 267                 return 0;
 268
 269         assert(m->managed_oom_varlink);
 270
 271         r = build_managed_oom_cgroups_json(m, &v);
 272         if (r < 0)
 273                 return r;
 274
 275         return varlink_send(m->managed_oom_varlink, "io.systemd.oom.ReportManagedOOMCGroups", v);
 276 }
 277
 278 static int vl_method_get_user_record(Varlink *link, JsonVariant *parameters, VarlinkMethodFlags flags, void *userdata) {
 279
 280         static const JsonDispatch dispatch_table[] = {
 281                 { "uid",      JSON_VARIANT_UNSIGNED, json_dispatch_uid_gid,      offsetof(LookupParameters, uid),       0         },
 282                 { "userName", JSON_VARIANT_STRING,   json_dispatch_const_string, offsetof(LookupParameters, user_name), JSON_SAFE },
 283                 { "service",  JSON_VARIANT_STRING,   json_dispatch_const_string, offsetof(LookupParameters, service),   0         },
 284                 {}
 285         };
 286
 287         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 288         LookupParameters p = {
 289                 .uid = UID_INVALID,
 290         };
 291         _cleanup_free_ char *found_name = NULL;
 292         uid_t found_uid = UID_INVALID, uid;
 293         Manager *m = ASSERT_PTR(userdata);
 294         const char *un;
 295         int r;
 296
 297         assert(parameters);
 298
 299         r = varlink_dispatch(link, parameters, dispatch_table, &p);
 300         if (r != 0)
 301                 return r;
 302
 303         if (!streq_ptr(p.service, "io.systemd.DynamicUser"))
 304                 return varlink_error(link, "io.systemd.UserDatabase.BadService", NULL);
 305
 306         if (uid_is_valid(p.uid))
 307                 r = dynamic_user_lookup_uid(m, p.uid, &found_name);
 308         else if (p.user_name)
 309                 r = dynamic_user_lookup_name(m, p.user_name, &found_uid);
 310         else {
 311                 DynamicUser *d;
 312
 313                 HASHMAP_FOREACH(d, m->dynamic_users) {
 314                         r = dynamic_user_current(d, &uid);
 315                         if (r == -EAGAIN) /* not realized yet? */
 316                                 continue;
 317                         if (r < 0)
 318                                 return r;
 319
 320                         if (!user_match_lookup_parameters(&p, d->name, uid))
 321                                 continue;
 322
 323                         if (v) {
 324                                 r = varlink_notify(link, v);
 325                                 if (r < 0)
 326                                         return r;
 327
 328                                 v = json_variant_unref(v);
 329                         }
 330
 331                         r = build_user_json(d->name, uid, &v);
 332                         if (r < 0)
 333                                 return r;
 334                 }
 335
 336                 if (!v)
 337                         return varlink_error(link, "io.systemd.UserDatabase.NoRecordFound", NULL);
 338
 339                 return varlink_reply(link, v);
 340         }
 341         if (r == -ESRCH)
 342                 return varlink_error(link, "io.systemd.UserDatabase.NoRecordFound", NULL);
 343         if (r < 0)
 344                 return r;
 345
 346         uid = uid_is_valid(found_uid) ? found_uid : p.uid;
 347         un = found_name ?: p.user_name;
 348
 349         if (!user_match_lookup_parameters(&p, un, uid))
 350                 return varlink_error(link, "io.systemd.UserDatabase.ConflictingRecordFound", NULL);
 351
 352         r = build_user_json(un, uid, &v);
 353         if (r < 0)
 354                 return r;
 355
 356         return varlink_reply(link, v);
 357 }
 358
 359 static int build_group_json(const char *group_name, gid_t gid, JsonVariant **ret) {
 360         assert(group_name);
 361         assert(gid_is_valid(gid));
 362         assert(ret);
 363
 364         return json_build(ret, JSON_BUILD_OBJECT(
 365                                    JSON_BUILD_PAIR("record", JSON_BUILD_OBJECT(
 366                                        JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(group_name)),
 367                                        JSON_BUILD_PAIR("description", JSON_BUILD_CONST_STRING("Dynamic Group")),
 368                                        JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid)),
 369                                        JSON_BUILD_PAIR("service", JSON_BUILD_CONST_STRING("io.systemd.DynamicUser")),
 370                                        JSON_BUILD_PAIR("disposition", JSON_BUILD_CONST_STRING("dynamic"))))));
 371 }
 372
 373 static bool group_match_lookup_parameters(LookupParameters *p, const char *name, gid_t gid) {
 374         assert(p);
 375
 376         if (p->group_name && !streq(name, p->group_name))
 377                 return false;
 378
 379         if (gid_is_valid(p->gid) && gid != p->gid)
 380                 return false;
 381
 382         return true;
 383 }
 384
 385 static int vl_method_get_group_record(Varlink *link, JsonVariant *parameters, VarlinkMethodFlags flags, void *userdata) {
 386
 387         static const JsonDispatch dispatch_table[] = {
 388                 { "gid",       JSON_VARIANT_UNSIGNED, json_dispatch_uid_gid,      offsetof(LookupParameters, gid),        0         },
 389                 { "groupName", JSON_VARIANT_STRING,   json_dispatch_const_string, offsetof(LookupParameters, group_name), JSON_SAFE },
 390                 { "service",   JSON_VARIANT_STRING,   json_dispatch_const_string, offsetof(LookupParameters, service),    0         },
 391                 {}
 392         };
 393
 394         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 395         LookupParameters p = {
 396                 .gid = GID_INVALID,
 397         };
 398         _cleanup_free_ char *found_name = NULL;
 399         uid_t found_gid = GID_INVALID, gid;
 400         Manager *m = ASSERT_PTR(userdata);
 401         const char *gn;
 402         int r;
 403
 404         assert(parameters);
 405
 406         r = varlink_dispatch(link, parameters, dispatch_table, &p);
 407         if (r != 0)
 408                 return r;
 409
 410         if (!streq_ptr(p.service, "io.systemd.DynamicUser"))
 411                 return varlink_error(link, "io.systemd.UserDatabase.BadService", NULL);
 412
 413         if (gid_is_valid(p.gid))
 414                 r = dynamic_user_lookup_uid(m, (uid_t) p.gid, &found_name);
 415         else if (p.group_name)
 416                 r = dynamic_user_lookup_name(m, p.group_name, (uid_t*) &found_gid);
 417         else {
 418                 DynamicUser *d;
 419
 420                 HASHMAP_FOREACH(d, m->dynamic_users) {
 421                         uid_t uid;
 422
 423                         r = dynamic_user_current(d, &uid);
 424                         if (r == -EAGAIN)
 425                                 continue;
 426                         if (r < 0)
 427                                 return r;
 428
 429                         if (!group_match_lookup_parameters(&p, d->name, (gid_t) uid))
 430                                 continue;
 431
 432                         if (v) {
 433                                 r = varlink_notify(link, v);
 434                                 if (r < 0)
 435                                         return r;
 436
 437                                 v = json_variant_unref(v);
 438                         }
 439
 440                         r = build_group_json(d->name, (gid_t) uid, &v);
 441                         if (r < 0)
 442                                 return r;
 443                 }
 444
 445                 if (!v)
 446                         return varlink_error(link, "io.systemd.UserDatabase.NoRecordFound", NULL);
 447
 448                 return varlink_reply(link, v);
 449         }
 450         if (r == -ESRCH)
 451                 return varlink_error(link, "io.systemd.UserDatabase.NoRecordFound", NULL);
 452         if (r < 0)
 453                 return r;
 454
 455         gid = gid_is_valid(found_gid) ? found_gid : p.gid;
 456         gn = found_name ?: p.group_name;
 457
 458         if (!group_match_lookup_parameters(&p, gn, gid))
 459                 return varlink_error(link, "io.systemd.UserDatabase.ConflictingRecordFound", NULL);
 460
 461         r = build_group_json(gn, gid, &v);
 462         if (r < 0)
 463                 return r;
 464
 465         return varlink_reply(link, v);
 466 }
 467
 468 static int vl_method_get_memberships(Varlink *link, JsonVariant *parameters, VarlinkMethodFlags flags, void *userdata) {
 469
 470         static const JsonDispatch dispatch_table[] = {
 471                 { "userName",  JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(LookupParameters, user_name),  JSON_SAFE },
 472                 { "groupName", JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(LookupParameters, group_name), JSON_SAFE },
 473                 { "service",   JSON_VARIANT_STRING, json_dispatch_const_string, offsetof(LookupParameters, service),    0         },
 474                 {}
 475         };
 476
 477         LookupParameters p = {};
 478         int r;
 479
 480         assert(parameters);
 481
 482         r = varlink_dispatch(link, parameters, dispatch_table, &p);
 483         if (r != 0)
 484                 return r;
 485
 486         if (!streq_ptr(p.service, "io.systemd.DynamicUser"))
 487                 return varlink_error(link, "io.systemd.UserDatabase.BadService", NULL);
 488
 489         /* We don't support auxiliary groups with dynamic users. */
 490         return varlink_error(link, "io.systemd.UserDatabase.NoRecordFound", NULL);
 491 }
 492
 493 static void vl_disconnect(VarlinkServer *s, Varlink *link, void *userdata) {
 494         Manager *m = ASSERT_PTR(userdata);
 495
 496         assert(s);
 497         assert(link);
 498
 499         if (link == m->managed_oom_varlink)
 500                 m->managed_oom_varlink = varlink_unref(link);
 501 }
 502
 503 static int manager_setup_varlink_server(Manager *m, VarlinkServer **ret) {
 504         _cleanup_(varlink_server_unrefp) VarlinkServer *s = NULL;
 505         int r;
 506
 507         assert(m);
 508         assert(ret);
 509
 510         r = varlink_server_new(&s, VARLINK_SERVER_ACCOUNT_UID|VARLINK_SERVER_INHERIT_USERDATA);
 511         if (r < 0)
 512                 return log_debug_errno(r, "Failed to allocate varlink server object: %m");
 513
 514         varlink_server_set_userdata(s, m);
 515
 516         r = varlink_server_add_interface_many(
 517                         s,
 518                         &vl_interface_io_systemd_UserDatabase,
 519                         &vl_interface_io_systemd_ManagedOOM);
 520         if (r < 0)
 521                 return log_debug_errno(r, "Failed to add interfaces to varlink server: %m");
 522
 523         r = varlink_server_bind_method_many(
 524                         s,
 525                         "io.systemd.UserDatabase.GetUserRecord",  vl_method_get_user_record,
 526                         "io.systemd.UserDatabase.GetGroupRecord", vl_method_get_group_record,
 527                         "io.systemd.UserDatabase.GetMemberships", vl_method_get_memberships,
 528                         "io.systemd.ManagedOOM.SubscribeManagedOOMCGroups", vl_method_subscribe_managed_oom_cgroups);
 529         if (r < 0)
 530                 return log_debug_errno(r, "Failed to register varlink methods: %m");
 531
 532         r = varlink_server_bind_disconnect(s, vl_disconnect);
 533         if (r < 0)
 534                 return log_debug_errno(r, "Failed to register varlink disconnect handler: %m");
 535
 536         *ret = TAKE_PTR(s);
 537         return 0;
 538 }
 539
 540 static int manager_varlink_init_system(Manager *m) {
 541         _cleanup_(varlink_server_unrefp) VarlinkServer *s = NULL;
 542         int r;
 543
 544         assert(m);
 545
 546         if (m->varlink_server)
 547                 return 1;
 548
 549         if (!MANAGER_IS_SYSTEM(m))
 550                 return 0;
 551
 552         r = manager_setup_varlink_server(m, &s);
 553         if (r < 0)
 554                 return log_error_errno(r, "Failed to set up varlink server: %m");
 555
 556         if (!MANAGER_IS_TEST_RUN(m)) {
 557                 (void) mkdir_p_label("/run/systemd/userdb", 0755);
 558
 559                 FOREACH_STRING(address, "/run/systemd/userdb/io.systemd.DynamicUser", VARLINK_ADDR_PATH_MANAGED_OOM_SYSTEM) {
 560                         if (MANAGER_IS_RELOADING(m)) {
 561                                 /* If manager is reloading, we skip listening on existing addresses, since
 562                                  * the fd should be acquired later through deserialization. */
 563                                 if (access(address, F_OK) >= 0)
 564                                         continue;
 565                                 if (errno != ENOENT)
 566                                         return log_error_errno(errno,
 567                                                                "Failed to check if varlink socket '%s' exists: %m", address);
 568                         }
 569
 570                         r = varlink_server_listen_address(s, address, 0666);
 571                         if (r < 0)
 572                                 return log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address);
 573                 }
 574         }
 575
 576         r = varlink_server_attach_event(s, m->event, EVENT_PRIORITY_IPC);
 577         if (r < 0)
 578                 return log_error_errno(r, "Failed to attach varlink connection to event loop: %m");
 579
 580         m->varlink_server = TAKE_PTR(s);
 581         return 1;
 582 }
 583
 584 static int vl_reply(Varlink *link, JsonVariant *parameters, const char *error_id, VarlinkReplyFlags flags, void *userdata) {
 585         Manager *m = ASSERT_PTR(userdata);
 586         int r;
 587
 588         if (error_id)
 589                 log_debug("varlink systemd-oomd client error: %s", error_id);
 590
 591         if (FLAGS_SET(flags, VARLINK_REPLY_ERROR) && FLAGS_SET(flags, VARLINK_REPLY_LOCAL)) {
 592                 /* Varlink connection was closed, likely because of systemd-oomd restart. Let's try to
 593                  * reconnect and send the initial ManagedOOM update again. */
 594
 595                 m->managed_oom_varlink = varlink_unref(link);
 596
 597                 log_debug("Reconnecting to %s", VARLINK_ADDR_PATH_MANAGED_OOM_USER);
 598
 599                 r = manager_varlink_init(m);
 600                 if (r <= 0)
 601                         return r;
 602         }
 603
 604         return 0;
 605 }
 606
 607 static int manager_varlink_init_user(Manager *m) {
 608         _cleanup_(varlink_close_unrefp) Varlink *link = NULL;
 609         int r;
 610
 611         assert(m);
 612
 613         if (m->managed_oom_varlink)
 614                 return 1;
 615
 616         if (MANAGER_IS_TEST_RUN(m))
 617                 return 0;
 618
 619         r = varlink_connect_address(&link, VARLINK_ADDR_PATH_MANAGED_OOM_USER);
 620         if (r < 0) {
 621                 if (r == -ENOENT || ERRNO_IS_DISCONNECT(r)) {
 622                         log_debug("systemd-oomd varlink unix socket not found, skipping user manager varlink setup");
 623                         return 0;
 624                 }
 625                 return log_error_errno(r, "Failed to connect to %s: %m", VARLINK_ADDR_PATH_MANAGED_OOM_USER);
 626         }
 627
 628         varlink_set_userdata(link, m);
 629
 630         r = varlink_bind_reply(link, vl_reply);
 631         if (r < 0)
 632                 return r;
 633
 634         r = varlink_attach_event(link, m->event, EVENT_PRIORITY_IPC);
 635         if (r < 0)
 636                 return log_error_errno(r, "Failed to attach varlink connection to event loop: %m");
 637
 638         m->managed_oom_varlink = TAKE_PTR(link);
 639
 640         /* Queue the initial ManagedOOM update. */
 641         (void) manager_varlink_send_managed_oom_initial(m);
 642
 643         return 1;
 644 }
 645
 646 int manager_varlink_init(Manager *m) {
 647         return MANAGER_IS_SYSTEM(m) ? manager_varlink_init_system(m) : manager_varlink_init_user(m);
 648 }
 649
 650 void manager_varlink_done(Manager *m) {
 651         assert(m);
 652
 653         /* Explicitly close the varlink connection to oomd. Note we first take the varlink connection out of
 654          * the manager, and only then disconnect it — in two steps – so that we don't end up accidentally
 655          * unreffing it twice. After all, closing the connection might cause the disconnect handler we
 656          * installed (vl_disconnect() above) to be called, where we will unref it too. */
 657         varlink_close_unref(TAKE_PTR(m->managed_oom_varlink));
 658
 659         m->varlink_server = varlink_server_unref(m->varlink_server);
 660         m->managed_oom_varlink = varlink_close_unref(m->managed_oom_varlink);
 661 }