nresourced: add user.userbd.* xattrs to nsresourced userdb socket

diff --git a/src/nsresourced/nsresourced-manager.c b/src/nsresourced/nsresourced-manager.c
index 4e671de8331974daef8067d0d64a9512f89ff013..df12e352b04ff87fddd0df222b61a95e26c9682c 100644 (file)
--- a/src/nsresourced/nsresourced-manager.c
+++ b/src/nsresourced/nsresourced-manager.c
@@ -33,10 +33,12 @@
 #include "string-util.h"
 #include "strv.h"
 #include "time-util.h"
+#include "uid-classification.h"
 #include "umask-util.h"
 #include "unaligned.h"
 #include "userns-registry.h"
 #include "userns-restrict.h"
+#include "xattr-util.h"
 
 #define LISTEN_TIMEOUT_USEC (25 * USEC_PER_SEC)
 
@@ -450,6 +452,16 @@ static int manager_make_listen_socket(Manager *m) {
         if (r < 0)
                 return log_error_errno(r, "Failed to symlink userdb socket: %m");
 
+        /* Reduce the noise routed to us: advertise that only look-ups for the higher UID range */
+        char text[2 * (DECIMAL_STR_MAX(uid_t) + 1 + DECIMAL_STR_MAX(uid_t) + 1)];
+        xsprintf(text, UID_FMT "-" UID_FMT "," UID_FMT "-" UID_FMT,
+                 CONTAINER_UID_MIN, CONTAINER_UID_MAX,
+                 (uid_t) DYNAMIC_UID_MIN, (uid_t) DYNAMIC_UID_MAX);
+        FOREACH_STRING(xattr, "user.userdb.uid", "user.userdb.gid")
+                (void) xsetxattr(AT_FDCWD, sockaddr.un.sun_path, /* at_flags= */ 0, xattr, text);
+        (void) xsetxattr(AT_FDCWD, sockaddr.un.sun_path, /* at_flags= */ 0, "user.userdb.username", "ns-*");
+        (void) xsetxattr(AT_FDCWD, sockaddr.un.sun_path, /* at_flags= */ 0, "user.userdb.groupname", "ns-*");
+
         if (listen(m->listen_fd, SOMAXCONN) < 0)
                 return log_error_errno(errno, "Failed to listen on socket: %m");
 

diff --git a/units/meson.build b/units/meson.build
index ca50475ebe4996667e7a5e76e400f6ed507ab8ab..c07e5712b0694cd651785c292722410018770403 100644 (file)
--- a/units/meson.build
+++ b/units/meson.build
@@ -1040,7 +1040,7 @@ units = [
           'conditions' : ['ENABLE_NSRESOURCED'],
         },
         {
-          'file' : 'systemd-nsresourced.socket',
+          'file' : 'systemd-nsresourced.socket.in',
           'conditions' : ['ENABLE_NSRESOURCED'],
         },
         {

diff --git a/units/systemd-nsresourced.socket b/units/systemd-nsresourced.socket.in
similarity index 72%
rename from units/systemd-nsresourced.socket
rename to units/systemd-nsresourced.socket.in
index 2840be43e20aa4ccb21fd3c9d5e42f0937f73c97..3798b9a1e432a03e34ef56e1628a2f16a4898d28 100644 (file)
--- a/units/systemd-nsresourced.socket
+++ b/units/systemd-nsresourced.socket.in
@@ -22,6 +22,10 @@ FileDescriptorName=varlink
 SocketMode=0666
 XAttrEntryPoint=user.varlink=entrypoint
 XAttrListen=user.varlink=listen
+XAttrEntryPoint=user.userdb.uid={{DYNAMIC_UID_MIN}}-{{DYNAMIC_UID_MAX}},{{CONTAINER_UID_BASE_MIN}}-{{CONTAINER_UID_BASE_MAX+65535}}
+XAttrEntryPoint=user.userdb.gid={{DYNAMIC_UID_MIN}}-{{DYNAMIC_UID_MAX}},{{CONTAINER_UID_BASE_MIN}}-{{CONTAINER_UID_BASE_MAX+65535}}
+XAttrEntryPoint=user.userdb.username=ns-*
+XAttrEntryPoint=user.userdb.groupname=ns-*
 
 [Install]
 WantedBy=sockets.target