From: Lennart Poettering <lennart@amutable.com>
Date: Fri, 10 Jul 2026 07:13:34 +0000 (+0200)
Subject: nresourced: add user.userbd.* xattrs to nsresourced userdb socket
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=649ab380e1de1e6e643fe12af20d3d5f1b353897;p=thirdparty%2Fsystemd.git

nresourced: add user.userbd.* xattrs to nsresourced userdb socket
---

diff --git a/src/nsresourced/nsresourced-manager.c b/src/nsresourced/nsresourced-manager.c
index 4e671de8331..df12e352b04 100644
--- a/src/nsresourced/nsresourced-manager.c
+++ b/src/nsresourced/nsresourced-manager.c
@@ -33,10 +33,12 @@
 #include "string-util.h"
 #include "strv.h"
 #include "time-util.h"
+#include "uid-classification.h"
 #include "umask-util.h"
 #include "unaligned.h"
 #include "userns-registry.h"
 #include "userns-restrict.h"
+#include "xattr-util.h"
 
 #define LISTEN_TIMEOUT_USEC (25 * USEC_PER_SEC)
 
@@ -450,6 +452,16 @@ static int manager_make_listen_socket(Manager *m) {
         if (r < 0)
                 return log_error_errno(r, "Failed to symlink userdb socket: %m");
 
+        /* Reduce the noise routed to us: advertise that only look-ups for the higher UID range */
+        char text[2 * (DECIMAL_STR_MAX(uid_t) + 1 + DECIMAL_STR_MAX(uid_t) + 1)];
+        xsprintf(text, UID_FMT "-" UID_FMT "," UID_FMT "-" UID_FMT,
+                 CONTAINER_UID_MIN, CONTAINER_UID_MAX,
+                 (uid_t) DYNAMIC_UID_MIN, (uid_t) DYNAMIC_UID_MAX);
+        FOREACH_STRING(xattr, "user.userdb.uid", "user.userdb.gid")
+                (void) xsetxattr(AT_FDCWD, sockaddr.un.sun_path, /* at_flags= */ 0, xattr, text);
+        (void) xsetxattr(AT_FDCWD, sockaddr.un.sun_path, /* at_flags= */ 0, "user.userdb.username", "ns-*");
+        (void) xsetxattr(AT_FDCWD, sockaddr.un.sun_path, /* at_flags= */ 0, "user.userdb.groupname", "ns-*");
+
         if (listen(m->listen_fd, SOMAXCONN) < 0)
                 return log_error_errno(errno, "Failed to listen on socket: %m");
 
diff --git a/units/meson.build b/units/meson.build
index ca50475ebe4..c07e5712b06 100644
--- a/units/meson.build
+++ b/units/meson.build
@@ -1040,7 +1040,7 @@ units = [
           'conditions' : ['ENABLE_NSRESOURCED'],
         },
         {
-          'file' : 'systemd-nsresourced.socket',
+          'file' : 'systemd-nsresourced.socket.in',
           'conditions' : ['ENABLE_NSRESOURCED'],
         },
         {
diff --git a/units/systemd-nsresourced.socket b/units/systemd-nsresourced.socket.in
similarity index 72%
rename from units/systemd-nsresourced.socket
rename to units/systemd-nsresourced.socket.in
index 2840be43e20..3798b9a1e43 100644
--- a/units/systemd-nsresourced.socket
+++ b/units/systemd-nsresourced.socket.in
@@ -22,6 +22,10 @@ FileDescriptorName=varlink
 SocketMode=0666
 XAttrEntryPoint=user.varlink=entrypoint
 XAttrListen=user.varlink=listen
+XAttrEntryPoint=user.userdb.uid={{DYNAMIC_UID_MIN}}-{{DYNAMIC_UID_MAX}},{{CONTAINER_UID_BASE_MIN}}-{{CONTAINER_UID_BASE_MAX+65535}}
+XAttrEntryPoint=user.userdb.gid={{DYNAMIC_UID_MIN}}-{{DYNAMIC_UID_MAX}},{{CONTAINER_UID_BASE_MIN}}-{{CONTAINER_UID_BASE_MAX+65535}}
+XAttrEntryPoint=user.userdb.username=ns-*
+XAttrEntryPoint=user.userdb.groupname=ns-*
 
 [Install]
 WantedBy=sockets.target