meson: sort shell completions and exit earlier when shell completion is disabled (#39816)

Currently, when a socket unit specifies SmackLabel=,
the label is not applied to the underlying Unix socket file or its file
descriptor.

This change ensures that the SMACK label is applied both to the
Unix socket path on the filesystem and to all associated socket FDs
when the socket is created.

Testing:

- Tested on Fedora 43 with kernel 6.17.7 with SMACK enabled.
- Created a systemd socket unit:

    [Unit]
    Description=UNIX socket

    [Socket]
    ListenStream=/run/test.sock
    SmackLabel=label

    [Install]
    WantedBy=sockets.target

- Created a corresponding service:

    [Unit]
    Description=UNIX socket service
    Requires=test.socket

    [Service]
    ExecStart=/usr/bin/socat -v - -
    StandardInput=socket

    [Install]
    WantedBy=multi-user.target

- Verified SMACK labels using getfattr:

  - Without SmackLabel:
    ```
    # file: run/test.sock
    security.SMACK64="_"
    # file: proc/<pid>/fd/*
    security.SMACK64="*"
    ```
  - With SmackLabel=label:
    ```
    # file: run/test.sock
    security.SMACK64="label"
    # file: proc/<pid>/fd/*
    security.SMACK64="label"
    ```

NEWS

@@ -80,7 +80,7 @@ CHANGES WITH 259 in spe:
           conflict between /dev/disk/by-label/ symlinks is removed, as this
           symlink is generated both for file system and LUKS superblock
           labels. There's a new VolumeLabel= setting for partitions that can be
-          used to expicitly choose a LUKS superblock label, which can be used
+          used to explicitly choose a LUKS superblock label, which can be used
           to explicitly revert to the old naming, if required.
 
         Service manager/PID1:

meson.build

@@ -2561,11 +2561,13 @@ foreach dict : executables
                 continue
         endif
 
+        exe_sources = dict.get('sources', []) + dict.get('extract', [])
+
         kwargs = {}
         foreach key, val : dict
                 if key in ['name', 'dbus', 'public', 'conditions',
                            'type', 'suite', 'timeout', 'parallel',
-                           'objects', 'extract']
+                           'objects', 'sources', 'extract']
                         continue
                 endif
 
@@ -2596,12 +2598,17 @@ foreach dict : executables
 
         if is_fuzz
                 foreach key, val : fuzz_additional_kwargs
+                        if key == 'sources'
+                                exe_sources += val
+                        else
                                 kwargs += { key : [ kwargs.get(key, []), val ] }
+                        endif
                 endforeach
         endif
 
         exe = executable(
                 name,
+                sources : exe_sources,
                 kwargs : kwargs,
                 implicit_include_directories : false,
         )
@@ -2609,7 +2616,7 @@ foreach dict : executables
         executables_by_name += { name : exe }
 
         if not name.endswith('.standalone')
-                sources += dict.get('sources', [])
+                sources += exe_sources
         endif
 
         if dict.has_key('extract')

shell-completion/bash/meson.build

@@ -1,7 +1,9 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 bashcompletiondir = get_option('bashcompletiondir')
-if bashcompletiondir == ''
+if bashcompletiondir == 'no'
+        subdir_done()
+elif bashcompletiondir == ''
         bash_completion = dependency('bash-completion', required : false)
         if bash_completion.found()
                 bashcompletiondir = bash_completion.get_variable(pkgconfig : 'completionsdir')
@@ -14,30 +16,17 @@ custom_target(
         input : 'systemctl.in',
         output : 'systemctl',
         command : [jinja2_cmdline, '@INPUT@', '@OUTPUT@'],
-        install : bashcompletiondir != 'no',
+        install : true,
         install_dir : bashcompletiondir)
 
-items = [['busctl',              ''],
-         ['journalctl',          ''],
-         ['systemd-analyze',     ''],
-         ['systemd-cat',         ''],
-         ['systemd-cgls',        ''],
-         ['systemd-cgtop',       ''],
-         ['systemd-creds',       ''],
-         ['systemd-delta',       ''],
-         ['systemd-detect-virt', ''],
-         ['systemd-id128',       ''],
-         ['systemd-nspawn',      'ENABLE_NSPAWN'],
-         ['systemd-path',        ''],
-         ['systemd-run',         ''],
-         ['systemd-vpick',       ''],
-         ['udevadm',             ''],
+foreach item : [
         ['bootctl',             ''],
-         ['run0',                ''],
+        ['busctl',              ''],
         ['coredumpctl',         'ENABLE_COREDUMP'],
         ['homectl',             'ENABLE_HOMED'],
         ['hostnamectl',         'ENABLE_HOSTNAMED'],
         ['importctl',           'ENABLE_IMPORTD'],
+        ['journalctl',          ''],
         ['kernel-install',      'ENABLE_KERNEL_INSTALL'],
         ['localectl',           'ENABLE_LOCALED'],
         ['loginctl',            'ENABLE_LOGIND'],
@@ -46,17 +35,32 @@ items = [['busctl',              ''],
         ['oomctl',              'ENABLE_OOMD'],
         ['portablectl',         'ENABLE_PORTABLED'],
         ['resolvectl',          'ENABLE_RESOLVE'],
-         ['systemd-cryptenroll', 'HAVE_LIBCRYPTSETUP'],
+        ['run0',                ''],
+        ['systemd-analyze',     ''],
+        ['systemd-cat',         ''],
+        ['systemd-cgls',        ''],
+        ['systemd-cgtop',       ''],
         ['systemd-confext',     'ENABLE_SYSEXT'],
+        ['systemd-creds',       ''],
+        ['systemd-cryptenroll', 'HAVE_LIBCRYPTSETUP'],
+        ['systemd-delta',       ''],
+        ['systemd-detect-virt', ''],
         ['systemd-dissect',     'HAVE_BLKID'],
+        ['systemd-id128',       ''],
+        ['systemd-nspawn',      'ENABLE_NSPAWN'],
+        ['systemd-path',        ''],
         ['systemd-resolve',     'ENABLE_RESOLVE'],
+        ['systemd-run',         ''],
         ['systemd-sysext',      'ENABLE_SYSEXT'],
         ['systemd-vmspawn',     'ENABLE_VMSPAWN'],
+        ['systemd-vpick',       ''],
         ['timedatectl',         'ENABLE_TIMEDATED'],
-         ['userdbctl',           'ENABLE_USERDB']]
+        ['udevadm',             ''],
+        ['userdbctl',           'ENABLE_USERDB'],
+        ['varlinkctl',          ''],
+]
 
-foreach item : items
-        if bashcompletiondir != 'no' and (item[1] == '' or conf.get(item[1]) == 1)
+        if item[1] == '' or conf.get(item[1]) == 1
                 install_data(item[0],
                              install_dir : bashcompletiondir)
         endif

shell-completion/bash/varlinkctl

@@ -0,0 +1,117 @@
+# shellcheck shell=bash
+# varlinkctl(1) completion                           -*- shell-script -*-
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+#
+# systemd is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with systemd; If not, see <https://www.gnu.org/licenses/>.
+
+__contains_word () {
+    local w word=$1; shift
+    for w in "$@"; do
+        [[ $w = "$word" ]] && return
+    done
+}
+
+__get_interfaces() {
+    local address=$1
+    local a
+    varlinkctl list-interfaces --no-pager "$address" 2>/dev/null |
+        { while read -r a; do echo " $a"; done; }
+}
+
+__get_methods() {
+    local address=$1
+    local a
+    varlinkctl list-methods --no-pager "$address" 2>/dev/null |
+        { while read -r a; do echo " $a"; done; }
+}
+
+_varlinkctl() {
+    local i n verb comps
+    local cur=${COMP_WORDS[COMP_CWORD]} prev=${COMP_WORDS[COMP_CWORD-1]}
+    local -A OPTS=(
+        [STANDALONE]='-h --help --version --no-pager -q --quiet
+                      --oneway --collect --more --exec -j -E'
+        [ARG]='--graceful --timeout --push-fd --json'
+    )
+
+    if __contains_word "$prev" ${OPTS[ARG]}; then
+        case $prev in
+            --json)
+                comps=$( varlinkctl --json=help 2>/dev/null )
+                ;;
+        esac
+        COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
+        return 0
+    fi
+
+    if [[ "$cur" = -* ]]; then
+        COMPREPLY=( $(compgen -W '${OPTS[*]}' -- "$cur") )
+        return 0
+    fi
+
+    local -A VERBS=(
+        [STANDALONE]='help'
+        [CALL]='call'
+        [FILE]='info list-interfaces validate-idl'
+        [ADDRESS_INTERFACES]='list-methods introspect'
+    )
+
+    for ((i=0; i < COMP_CWORD; i++)); do
+        if __contains_word "${COMP_WORDS[i]}" ${VERBS[*]} &&
+                ! __contains_word "${COMP_WORDS[i-1]}" ${OPTS[ARG]}; then
+            verb=${COMP_WORDS[i]}
+            break
+        fi
+    done
+
+    n=$((COMP_CWORD - i))
+
+    if [[ -z ${verb-} ]]; then
+        comps=${VERBS[*]}
+    elif __contains_word "$verb" ${VERBS[STANDALONE]}; then
+        comps=''
+    elif __contains_word "$verb" ${VERBS[FILE]}; then
+        comps=$(compgen -f -- "$cur")
+        compopt -o filenames
+    elif __contains_word "$verb" ${VERBS[ADDRESS_INTERFACES]}; then
+        if [[ $n -eq 1 ]] ; then
+            comps=$(compgen -f -- "$cur")
+            compopt -o filenames
+        elif [[ $n -eq 2 ]] ; then
+            comps=$( __get_interfaces ${COMP_WORDS[COMP_CWORD-1]})
+        else
+            comps=''
+        fi
+    elif __contains_word "$verb" ${VERBS[CALL]}; then
+        if [[ $n -eq 1 ]] ; then
+            comps=$(compgen -f -- "$cur")
+            compopt -o filenames
+        elif [[ $n -eq 2 ]] ; then
+            comps=$( __get_methods ${COMP_WORDS[COMP_CWORD-1]})
+        elif [[ $n -eq 3 ]] ; then
+            comps="'{}'"
+        elif [[ ${COMP_WORDS[COMP_CWORD-1]} == "--" ]] && __contains_word "--exec" ${COMP_WORDS[*]} ; then
+            comps=$(compgen -c -- "$cur")
+        else
+            comps=''
+        fi
+    fi
+
+    COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
+    return 0
+}
+
+complete -F _varlinkctl varlinkctl

shell-completion/zsh/meson.build

@@ -1,7 +1,9 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 zshcompletiondir = get_option('zshcompletiondir')
-if zshcompletiondir == ''
+if zshcompletiondir == 'no'
+        subdir_done()
+elif zshcompletiondir == ''
         zshcompletiondir = datadir / 'zsh/site-functions'
 endif
 
@@ -9,41 +11,42 @@ custom_target(
         input : '_systemctl.in',
         output : '_systemctl',
         command : [jinja2_cmdline, '@INPUT@', '@OUTPUT@'],
-        install : zshcompletiondir != 'no',
+        install : true,
         install_dir : zshcompletiondir)
 
-items = [['_busctl',                   ''],
-         ['_journalctl',               ''],
-         ['_systemd-analyze',          ''],
-         ['_systemd-delta',            ''],
-         ['_systemd-nspawn',           ''],
-         ['_systemd',                  ''],
-         ['_systemd-path',             ''],
-         ['_systemd-run',              ''],
-         ['_run0',                     ''],
-         ['_udevadm',                  ''],
-         ['_varlinkctl',               ''],
-         ['_kernel-install',           'ENABLE_KERNEL_INSTALL'],
-         ['_sd_bus_address',           ''],
-         ['_sd_hosts_or_user_at_host', ''],
-         ['_sd_outputmodes',           ''],
-         ['_sd_unit_files',            ''],
-         ['_sd_machines',              ''],
+foreach item : [
         ['_bootctl',                  ''],
+        ['_busctl',                   ''],
         ['_coredumpctl',              'ENABLE_COREDUMP'],
         ['_hostnamectl',              'ENABLE_HOSTNAMED'],
+        ['_journalctl',               ''],
+        ['_kernel-install',           'ENABLE_KERNEL_INSTALL'],
         ['_localectl',                'ENABLE_LOCALED'],
         ['_loginctl',                 'ENABLE_LOGIND'],
         ['_machinectl',               'ENABLE_MACHINED'],
         ['_networkctl',               'ENABLE_NETWORKD'],
         ['_oomctl',                   'ENABLE_OOMD'],
-         ['_systemd-inhibit',          'ENABLE_LOGIND'],
         ['_resolvectl',               'ENABLE_RESOLVE'],
+        ['_run0',                     ''],
+        ['_sd_bus_address',           ''],
+        ['_sd_hosts_or_user_at_host', ''],
+        ['_sd_machines',              ''],
+        ['_sd_outputmodes',           ''],
+        ['_sd_unit_files',            ''],
+        ['_systemd',                  ''],
+        ['_systemd-analyze',          ''],
+        ['_systemd-delta',            ''],
+        ['_systemd-inhibit',          'ENABLE_LOGIND'],
+        ['_systemd-nspawn',           ''],
+        ['_systemd-path',             ''],
+        ['_systemd-run',              ''],
         ['_systemd-tmpfiles',         'ENABLE_TMPFILES'],
-         ['_timedatectl',              'ENABLE_TIMEDATED']]
+        ['_timedatectl',              'ENABLE_TIMEDATED'],
+        ['_udevadm',                  ''],
+        ['_varlinkctl',               ''],
+]
 
-foreach item : items
-        if zshcompletiondir != 'no' and (item[1] == '' or conf.get(item[1]) == 1)
+        if item[1] == '' or conf.get(item[1]) == 1
                 install_data(item[0],
                              install_dir : zshcompletiondir)
         endif

src/analyze/meson.build

@@ -48,7 +48,7 @@ executables += [
         executable_template + {
                 'name' : 'systemd-analyze',
                 'public' : conf.get('ENABLE_ANALYZE') == 1,
-                'sources' : systemd_analyze_sources + systemd_analyze_extract_sources,
+                'sources' : systemd_analyze_sources,
                 'extract' : systemd_analyze_extract_sources,
                 'include_directories' : core_includes,
                 'link_with' : [

src/basic/errno-util.c

@@ -0,0 +1,10 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "errno-util.h"
+
+const char* strerror_or_eof(int errnum, char *buf, size_t buflen) {
+        if (errnum != 0)
+                return strerror_r(ABS(errnum), buf, buflen);
+
+        return "Unexpected EOF";
+}

src/basic/errno-util.h

@@ -15,10 +15,9 @@
  * Note that we use the GNU variant of strerror_r() here. */
 #define STRERROR(errnum) strerror_r(ABS(errnum), (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN)
 
-/* A helper to print an error message or message for functions that return 0 on EOF.
- * Note that we can't use ({ … }) to define a temporary variable, so errnum is
- * evaluated twice. */
-#define STRERROR_OR_EOF(errnum) ((errnum) != 0 ? STRERROR(errnum) : "Unexpected EOF")
+/* A helper to print an error message or message for functions that return 0 on EOF. */
+const char* strerror_or_eof(int errnum, char *buf, size_t buflen);
+#define STRERROR_OR_EOF(errnum) strerror_or_eof(errnum, (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN)
 
 static inline void _reset_errno_(int *saved_errno) {
         if (*saved_errno < 0) /* Invalidated by UNPROTECT_ERRNO? */

src/basic/meson.build

@@ -31,6 +31,7 @@ basic_sources = files(
         'env-file.c',
         'env-util.c',
         'errno-list.c',
+        'errno-util.c',
         'escape.c',
         'ether-addr-util.c',
         'extract-word.c',

src/basic/socket-util.c

@@ -669,26 +669,6 @@ static const char* const netlink_family_table[] = {
 
 DEFINE_STRING_TABLE_LOOKUP_WITH_FALLBACK(netlink_family, int, INT_MAX);
 
-static const char* const socket_address_bind_ipv6_only_table[_SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX] = {
-        [SOCKET_ADDRESS_DEFAULT] = "default",
-        [SOCKET_ADDRESS_BOTH] = "both",
-        [SOCKET_ADDRESS_IPV6_ONLY] = "ipv6-only"
-};
-
-DEFINE_STRING_TABLE_LOOKUP(socket_address_bind_ipv6_only, SocketAddressBindIPv6Only);
-
-SocketAddressBindIPv6Only socket_address_bind_ipv6_only_or_bool_from_string(const char *n) {
-        int r;
-
-        r = parse_boolean(n);
-        if (r > 0)
-                return SOCKET_ADDRESS_IPV6_ONLY;
-        if (r == 0)
-                return SOCKET_ADDRESS_BOTH;
-
-        return socket_address_bind_ipv6_only_from_string(n);
-}
-
 bool sockaddr_equal(const union sockaddr_union *a, const union sockaddr_union *b) {
         assert(a);
         assert(b);

src/basic/socket-util.h

@@ -53,14 +53,6 @@ typedef struct SocketAddress {
         int protocol;
 } SocketAddress;
 
-typedef enum SocketAddressBindIPv6Only {
-        SOCKET_ADDRESS_DEFAULT,
-        SOCKET_ADDRESS_BOTH,
-        SOCKET_ADDRESS_IPV6_ONLY,
-        _SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX,
-        _SOCKET_ADDRESS_BIND_IPV6_ONLY_INVALID = -EINVAL,
-} SocketAddressBindIPv6Only;
-
 #define socket_address_family(a) ((a)->sockaddr.sa.sa_family)
 
 const char* socket_address_type_to_string(int t) _const_;
@@ -74,19 +66,6 @@ static inline int socket_address_unlink(const SocketAddress *a) {
 
 bool socket_address_can_accept(const SocketAddress *a) _pure_;
 
-int socket_address_listen(
-                const SocketAddress *a,
-                int flags,
-                int backlog,
-                SocketAddressBindIPv6Only only,
-                const char *bind_to_device,
-                bool reuse_port,
-                bool free_bind,
-                bool transparent,
-                mode_t directory_mode,
-                mode_t socket_mode,
-                const char *label);
-
 int socket_address_verify(const SocketAddress *a, bool strict) _pure_;
 int socket_address_print(const SocketAddress *a, char **p);
 bool socket_address_matches_fd(const SocketAddress *a, int fd);
@@ -108,10 +87,6 @@ int getsockname_pretty(int fd, char **ret);
 
 int socknameinfo_pretty(const struct sockaddr *sa, socklen_t salen, char **_ret);
 
-const char* socket_address_bind_ipv6_only_to_string(SocketAddressBindIPv6Only b) _const_;
-SocketAddressBindIPv6Only socket_address_bind_ipv6_only_from_string(const char *s) _pure_;
-SocketAddressBindIPv6Only socket_address_bind_ipv6_only_or_bool_from_string(const char *s);
-
 int netlink_family_to_string_alloc(int b, char **s);
 int netlink_family_from_string(const char *s) _pure_;
 

src/basic/user-util.c

@@ -28,6 +28,26 @@
 #include "user-util.h"
 #include "utf8.h"
 
+#define DEFINE_STRERROR_ACCOUNT(type)                                   \
+        const char* strerror_##type(                                    \
+                        int errnum,                                     \
+                        char *buf,                                      \
+                        size_t buflen) {                                \
+                                                                        \
+                errnum = ABS(errnum);                                   \
+                switch (errnum) {                                       \
+                case ESRCH:                                             \
+                        return "Unknown " STRINGIFY(type);              \
+                case ENOEXEC:                                           \
+                        return "Not a system " STRINGIFY(type);         \
+                default:                                                \
+                        return strerror_r(errnum, buf, buflen);         \
+                }                                                       \
+        }
+
+DEFINE_STRERROR_ACCOUNT(user);
+DEFINE_STRERROR_ACCOUNT(group);
+
 bool uid_is_valid(uid_t uid) {
 
         /* Also see POSIX IEEE Std 1003.1-2008, 2016 Edition, 3.436. */

src/basic/user-util.h

@@ -20,11 +20,11 @@
 #define MAP_UID_MIN ((uid_t) 60514)
 #define MAP_UID_MAX ((uid_t) 60577)
 
-/* A helper to print an error message when user or group resolution fails.
- * Note that we can't use ({ … }) to define a temporary variable, so errnum is
- * evaluated multiple times. */
-#define STRERROR_USER(errnum) ((errnum) == -ESRCH ? "Unknown user" : (errnum) == -ENOEXEC ? "Not a system user" : STRERROR(errnum))
-#define STRERROR_GROUP(errnum) ((errnum) == -ESRCH ? "Unknown group" : (errnum) == -ENOEXEC ? "Not a system group" : STRERROR(errnum))
+/* A helper to print an error message when user or group resolution fails. */
+const char* strerror_user(int errnum, char *buf, size_t buflen);
+#define STRERROR_USER(errnum) strerror_user(errnum, (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN)
+const char* strerror_group(int errnum, char *buf, size_t buflen);
+#define STRERROR_GROUP(errnum) strerror_group(errnum, (char[ERRNO_BUF_LEN]){}, ERRNO_BUF_LEN)
 
 static inline bool ERRNO_IS_NEG_BAD_ACCOUNT(intmax_t r) {
         return IN_SET(r,

src/busctl/meson.build

@@ -11,7 +11,7 @@ executables += [
         executable_template + {
                 'name' : 'busctl',
                 'public' : true,
-                'sources' : busctl_sources + busctl_extract_sources,
+                'sources' : busctl_sources,
                 'extract' : busctl_extract_sources,
         },
         test_template + {

src/core/socket.c

@@ -1504,7 +1504,7 @@ static int socket_determine_selinux_label(Socket *s, char **ret) {
 static int socket_address_listen_do(
                 Socket *s,
                 const SocketAddress *address,
-                const char *label) {
+                const char *selinux_label) {
 
         assert(s);
         assert(address);
@@ -1520,7 +1520,8 @@ static int socket_address_listen_do(
                         s->transparent,
                         s->directory_mode,
                         s->socket_mode,
-                        label);
+                        selinux_label,
+                        s->smack);
 }
 
 #define log_address_error_errno(u, address, error, fmt)          \

src/core/socket.h

@@ -6,6 +6,7 @@
 #include "execute.h"
 #include "list.h"
 #include "pidref.h"
+#include "socket-label.h"
 #include "socket-util.h"
 #include "unit.h"
 

src/coredump/meson.build

@@ -36,7 +36,7 @@ common_dependencies = [
 executables += [
         libexec_template + {
                 'name' : 'systemd-coredump',
-                'sources' : systemd_coredump_sources + systemd_coredump_extract_sources,
+                'sources' : systemd_coredump_sources,
                 'include_directories' : [libexec_template['include_directories'], include_directories('.')],
                 'extract' : systemd_coredump_extract_sources,
                 'link_with' : [libshared],

src/hibernate-resume/meson.build

@@ -7,10 +7,7 @@ endif
 executables += [
         libexec_template + {
                 'name' : 'systemd-hibernate-resume',
-                'sources' : files(
-                        'hibernate-resume.c',
-                        'hibernate-resume-config.c',
-                ),
+                'sources' : files('hibernate-resume.c'),
                 'extract' : files('hibernate-resume-config.c'),
         },
         generator_template + {

src/home/meson.build

@@ -61,10 +61,10 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-homed',
                 'dbus' : true,
-                'sources' : systemd_homed_sources + systemd_homed_extract_sources,
+                'sources' : systemd_homed_sources,
+                'extract' : systemd_homed_extract_sources,
                 'include_directories' : includes +
                                         include_directories('.'),
-                'extract' : systemd_homed_extract_sources,
                 'dependencies' : [
                         libcrypt,
                         libm,

src/import/meson.build

@@ -50,7 +50,7 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-importd',
                 'dbus' : true,
-                'sources' : systemd_importd_sources + systemd_importd_extract_sources,
+                'sources' : systemd_importd_sources,
                 'extract' : systemd_importd_extract_sources,
                 'dependencies' : [common_deps, threads],
         },

src/integritysetup/meson.build

@@ -7,10 +7,7 @@ endif
 executables += [
         libexec_template + {
                 'name' : 'systemd-integritysetup',
-                'sources' : files(
-                        'integrity-util.c',
-                        'integritysetup.c',
-                ),
+                'sources' : files('integritysetup.c'),
                 'extract' : files('integrity-util.c'),
                 'dependencies' : libcryptsetup,
         },

src/journal-remote/meson.build

@@ -39,7 +39,7 @@ executables += [
                         'ENABLE_REMOTE',
                         'HAVE_MICROHTTPD',
                 ],
-                'sources' : systemd_journal_gatewayd_sources + systemd_journal_gatewayd_extract_sources,
+                'sources' : systemd_journal_gatewayd_sources,
                 'extract' : systemd_journal_gatewayd_extract_sources,
                 'dependencies' : common_deps + [libmicrohttpd],
         },
@@ -50,9 +50,9 @@ executables += [
                 # fuzz-journal-remote even when --auto-features=disabled (see tools/oss-fuzz.sh for why).
                 # Instead, we make sure we don't install it when the remote feature is disabled.
                 'install' : conf.get('ENABLE_REMOTE') == 1,
-                'sources' : systemd_journal_remote_sources + systemd_journal_remote_extract_sources,
-                'objects' : conf.get('HAVE_MICROHTTPD') == 1 ? ['systemd-journal-gatewayd'] : [],
+                'sources' : systemd_journal_remote_sources,
                 'extract' : systemd_journal_remote_extract_sources,
+                'objects' : conf.get('HAVE_MICROHTTPD') == 1 ? ['systemd-journal-gatewayd'] : [],
                 'dependencies' : common_deps + [libmicrohttpd],
         },
         libexec_template + {
@@ -62,9 +62,9 @@ executables += [
                         'ENABLE_REMOTE',
                         'HAVE_LIBCURL',
                 ],
-                'sources' : systemd_journal_upload_sources + systemd_journal_upload_extract_sources,
-                'objects' : ['systemd-journal-remote'],
+                'sources' : systemd_journal_upload_sources,
                 'extract' : systemd_journal_upload_extract_sources,
+                'objects' : ['systemd-journal-remote'],
                 'dependencies' : common_deps + [libcurl],
         },
         test_template + {

src/journal/meson.build

@@ -64,9 +64,9 @@ journal_fuzz_template = fuzz_template + {
 executables += [
         libexec_template + {
                 'name' : 'systemd-journald',
-                'sources' : systemd_journald_sources + systemd_journald_extract_sources,
-                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
+                'sources' : systemd_journald_sources,
                 'extract' : systemd_journald_extract_sources,
+                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
                 'dependencies' : [
                         liblz4_cflags,
                         libselinux_cflags,

src/libsystemd-network/meson.build

@@ -93,10 +93,7 @@ executables += [
                 'sources' : files('test-lldp-rx.c'),
         },
         network_test_template + {
-                'sources' : files(
-                        'test-ndisc-ra.c',
-                        'icmp6-test-util.c',
-                ),
+                'sources' : files('test-ndisc-ra.c'),
                 'extract' : files('icmp6-test-util.c'),
         },
         network_test_template + {

src/locale/meson.build

@@ -29,7 +29,7 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-localed',
                 'dbus' : true,
-                'sources' : systemd_localed_sources + systemd_localed_extract_sources,
+                'sources' : systemd_localed_sources,
                 'extract' : systemd_localed_extract_sources,
                 'dependencies' : libxkbcommon_deps,
         },

src/login/meson.build

@@ -45,9 +45,9 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-logind',
                 'dbus' : true,
-                'sources' : systemd_logind_sources + systemd_logind_extract_sources,
-                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
+                'sources' : systemd_logind_sources,
                 'extract' : systemd_logind_extract_sources,
+                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
                 'dependencies' : [
                         threads,
                 ],

src/machine/meson.build

@@ -25,7 +25,7 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-machined',
                 'dbus' : true,
-                'sources' : systemd_machined_sources + systemd_machined_extract_sources,
+                'sources' : systemd_machined_sources,
                 'extract' : systemd_machined_extract_sources,
         },
         executable_template + {

src/network/meson.build

@@ -198,7 +198,7 @@ executables += [
                 'name' : 'systemd-networkd',
                 'dbus' : true,
                 'conditions' : ['ENABLE_NETWORKD'],
-                'sources' : systemd_networkd_sources + systemd_networkd_extract_sources,
+                'sources' : systemd_networkd_sources,
                 'extract' : systemd_networkd_extract_sources,
                 'include_directories' : network_includes,
                 'link_with' : [
@@ -227,7 +227,7 @@ executables += [
         },
         libexec_template + {
                 'name' : 'systemd-network-generator',
-                'sources' : files('generator/network-generator.c', 'generator/network-generator-main.c'),
+                'sources' : files('generator/network-generator-main.c'),
                 'extract' : files('generator/network-generator.c'),
                 'link_with' : networkd_link_with,
         },

src/nspawn/meson.build

@@ -40,12 +40,12 @@ executables += [
         executable_template + {
                 'name' : 'systemd-nspawn',
                 'public' : true,
-                'sources' : nspawn_sources + nspawn_extract_sources,
+                'sources' : nspawn_sources,
+                'extract' : nspawn_extract_sources,
                 'include_directories' : [
                         executable_template['include_directories'],
                         include_directories('.')
                 ],
-                'extract' : nspawn_extract_sources,
                 'dependencies' : [
                         libseccomp_cflags,
                         libselinux_cflags,

src/nsresourced/meson.build

@@ -30,9 +30,9 @@ endif
 executables += [
         libexec_template + {
                 'name' : 'systemd-nsresourced',
-                'sources' : systemd_nsresourced_sources + systemd_nsresourced_extract_sources,
-                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
+                'sources' : systemd_nsresourced_sources,
                 'extract' : systemd_nsresourced_extract_sources,
+                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
                 'dependencies' : threads,
         },
         libexec_template + {

src/oom/meson.build

@@ -18,7 +18,7 @@ executables += [
         libexec_template + {
                 'name' : 'systemd-oomd',
                 'dbus' : true,
-                'sources' : systemd_oomd_sources + systemd_oomd_extract_sources,
+                'sources' : systemd_oomd_sources,
                 'extract' : systemd_oomd_extract_sources,
                 'dependencies' : libatomic,
         },

src/resolve/meson.build

@@ -81,9 +81,9 @@ executables += [
         libexec_template + resolve_common_template + {
                 'name' : 'systemd-resolved',
                 'dbus' : true,
-                'sources' : systemd_resolved_sources + systemd_resolved_extract_sources,
-                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
+                'sources' : systemd_resolved_sources,
                 'extract' : systemd_resolved_extract_sources,
+                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
         },
         executable_template + resolve_common_template + {
                 'name' : 'resolvectl',

src/shared/socket-label.c

@@ -8,10 +8,34 @@
 #include "fs-util.h"
 #include "log.h"
 #include "mkdir-label.h"
+#include "parse-util.h"
 #include "selinux-util.h"
+#include "smack-util.h"
+#include "socket-label.h"
 #include "socket-util.h"
+#include "string-table.h"
 #include "umask-util.h"
 
+static const char* const socket_address_bind_ipv6_only_table[_SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX] = {
+        [SOCKET_ADDRESS_DEFAULT]   = "default",
+        [SOCKET_ADDRESS_BOTH]      = "both",
+        [SOCKET_ADDRESS_IPV6_ONLY] = "ipv6-only"
+};
+
+DEFINE_STRING_TABLE_LOOKUP(socket_address_bind_ipv6_only, SocketAddressBindIPv6Only);
+
+SocketAddressBindIPv6Only socket_address_bind_ipv6_only_or_bool_from_string(const char *n) {
+        int r;
+
+        r = parse_boolean(n);
+        if (r > 0)
+                return SOCKET_ADDRESS_IPV6_ONLY;
+        if (r == 0)
+                return SOCKET_ADDRESS_BOTH;
+
+        return socket_address_bind_ipv6_only_from_string(n);
+}
+
 int socket_address_listen(
                 const SocketAddress *a,
                 int flags,
@@ -23,7 +47,8 @@ int socket_address_listen(
                 bool transparent,
                 mode_t directory_mode,
                 mode_t socket_mode,
-                const char *label) {
+                const char *selinux_label,
+                const char *smack_label) {
 
         _cleanup_close_ int fd = -EBADF;
         const char *p;
@@ -38,20 +63,26 @@ int socket_address_listen(
         if (socket_address_family(a) == AF_INET6 && !socket_ipv6_is_supported())
                 return -EAFNOSUPPORT;
 
-        if (label) {
-                r = mac_selinux_create_socket_prepare(label);
+        if (selinux_label) {
+                r = mac_selinux_create_socket_prepare(selinux_label);
                 if (r < 0)
                         return r;
         }
 
         fd = RET_NERRNO(socket(socket_address_family(a), a->type | flags, a->protocol));
 
-        if (label)
+        if (selinux_label)
                 mac_selinux_create_socket_clear();
 
         if (fd < 0)
                 return fd;
 
+        if (smack_label) {
+                r = mac_smack_apply_fd(fd, SMACK_ATTR_ACCESS, smack_label);
+                if (r < 0)
+                        log_warning_errno(r, "Failed to apply SMACK label for socket FD, ignoring: %m");
+        }
+
         if (socket_address_family(a) == AF_INET6 && only != SOCKET_ADDRESS_DEFAULT) {
                 r = setsockopt_int(fd, IPPROTO_IPV6, IPV6_V6ONLY, only == SOCKET_ADDRESS_IPV6_ONLY);
                 if (r < 0)
@@ -107,6 +138,11 @@ int socket_address_listen(
                         if (r < 0)
                                 return r;
                 }
+                if (smack_label) {
+                        r = mac_smack_apply(p, SMACK_ATTR_ACCESS, smack_label);
+                        if (r < 0)
+                                log_warning_errno(r, "Failed to apply SMACK label for socket path, ignoring: %m");
+                }
         } else {
                 if (bind(fd, &a->sockaddr.sa, a->size) < 0)
                         return -errno;

src/shared/socket-label.h

@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "shared-forward.h"
+
+typedef enum SocketAddressBindIPv6Only {
+        SOCKET_ADDRESS_DEFAULT,
+        SOCKET_ADDRESS_BOTH,
+        SOCKET_ADDRESS_IPV6_ONLY,
+        _SOCKET_ADDRESS_BIND_IPV6_ONLY_MAX,
+        _SOCKET_ADDRESS_BIND_IPV6_ONLY_INVALID = -EINVAL,
+} SocketAddressBindIPv6Only;
+
+const char* socket_address_bind_ipv6_only_to_string(SocketAddressBindIPv6Only b) _const_;
+SocketAddressBindIPv6Only socket_address_bind_ipv6_only_from_string(const char *s) _pure_;
+SocketAddressBindIPv6Only socket_address_bind_ipv6_only_or_bool_from_string(const char *s);
+
+int socket_address_listen(
+                const SocketAddress *a,
+                int flags,
+                int backlog,
+                SocketAddressBindIPv6Only only,
+                const char *bind_to_device,
+                bool reuse_port,
+                bool free_bind,
+                bool transparent,
+                mode_t directory_mode,
+                mode_t socket_mode,
+                const char *selinux_label,
+                const char *smack_label);

src/shared/socket-netlink.c

@@ -15,6 +15,7 @@
 #include "netlink-sock-diag.h"
 #include "netlink-util.h"
 #include "parse-util.h"
+#include "socket-label.h"
 #include "socket-netlink.h"
 #include "socket-util.h"
 #include "string-util.h"
@@ -183,8 +184,18 @@ int make_socket_fd(int log_level, const char* address, int type, int flags) {
 
         a.type = type;
 
-        fd = socket_address_listen(&a, type | flags, SOMAXCONN_DELUXE, SOCKET_ADDRESS_DEFAULT,
-                                   NULL, false, false, false, 0755, 0644, NULL);
+        fd = socket_address_listen(
+                        &a,
+                        type | flags,
+                        SOMAXCONN_DELUXE, SOCKET_ADDRESS_DEFAULT,
+                        /* bind_to_device= */ NULL,
+                        /* reuse_port= */ false,
+                        /* free_bind= */ false,
+                        /* transparent= */ false,
+                        0755,
+                        0644,
+                        /* selinux_label= */ NULL,
+                        /* smack_label= */ NULL);
         if (fd < 0 || log_get_max_level() >= log_level) {
                 _cleanup_free_ char *p = NULL;
 

src/shutdown/meson.build

@@ -14,7 +14,7 @@ systemd_shutdown_extract_sources = files(
 executables += [
         libexec_template + {
                 'name' : 'systemd-shutdown',
-                'sources' : systemd_shutdown_sources + systemd_shutdown_extract_sources,
+                'sources' : systemd_shutdown_sources,
                 'extract' : systemd_shutdown_extract_sources,
                 'dependencies' : libmount_cflags,
         },

src/sleep/meson.build

@@ -1,18 +1,11 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-sleep_sources = files(
-        'sleep.c',
-)
-sleep_extract_sources = files(
-        'battery-capacity.c',
-)
-
 executables += [
         libexec_template + {
                 'name' : 'systemd-sleep',
-                'sources' : sleep_sources + sleep_extract_sources,
+                'sources' : files('sleep.c'),
+                'extract' : files('battery-capacity.c'),
                 'include_directories' : [libexec_template['include_directories'], include_directories('.')],
-                'extract' : sleep_extract_sources,
         },
         test_template + {
                 'sources' : files('test-battery-capacity.c'),

src/ssh-generator/meson.build

@@ -3,25 +3,16 @@
 executables += [
         generator_template + {
                 'name' : 'systemd-ssh-generator',
-                'sources' : files(
-                        'ssh-generator.c',
-                        'ssh-util.c',
-                ),
-                'extract' : files(
-                        'ssh-util.c',
-                ),
+                'sources' : files('ssh-generator.c'),
+                'extract' : files('ssh-util.c'),
         },
         libexec_template + {
                 'name' : 'systemd-ssh-proxy',
-                'sources' : files(
-                        'ssh-proxy.c',
-                ),
+                'sources' : files('ssh-proxy.c'),
         },
         libexec_template + {
                 'name' : 'systemd-ssh-issue',
-                'sources' : files(
-                        'ssh-issue.c',
-                ),
+                'sources' : files('ssh-issue.c'),
                 'objects' : ['systemd-ssh-generator'],
         },
 ]

src/systemctl/meson.build

@@ -52,7 +52,7 @@ executables += [
         executable_template + {
                 'name' : 'systemctl',
                 'public' : true,
-                'sources' : systemctl_sources + systemctl_extract_sources,
+                'sources' : systemctl_sources,
                 'extract' : systemctl_extract_sources,
                 'link_with' : systemctl_link_with,
                 'dependencies' : [

src/sysupdate/meson.build

@@ -25,7 +25,7 @@ executables += [
                 'name' : 'systemd-sysupdate',
                 'public' : true,
                 'conditions' : ['ENABLE_SYSUPDATE'],
-                'sources' : systemd_sysupdate_sources + systemd_sysupdate_extract_sources,
+                'sources' : systemd_sysupdate_sources,
                 'extract' : systemd_sysupdate_extract_sources,
                 'link_with' : [
                         libshared,

src/test/meson.build

@@ -1,8 +1,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-awkscript = 'test-hashmap-ordered.awk'
 test_hashmap_ordered_c = custom_target(
-        input : [awkscript, 'test-hashmap-plain.c'],
+        input : ['test-hashmap-ordered.awk', 'test-hashmap-plain.c'],
         output : 'test-hashmap-ordered.c',
         command : [awk, '-f', '@INPUT0@', '@INPUT1@'],
         capture : true,
@@ -382,10 +381,7 @@ executables += [
                 'type' : 'manual',
         },
         test_template + {
-                'sources' : files(
-                        'test-nss-hosts.c',
-                        'nss-test-util.c',
-                ),
+                'sources' : files('test-nss-hosts.c'),
                 'extract' : files('nss-test-util.c'),
                 'dependencies' : [
                         libdl,
@@ -490,13 +486,13 @@ executables += [
         # Symbol tests
         test_template + {
                 'name' : 'test-libsystemd-sym',
-                'sources' : test_libsystemd_sym_c,
+                'sources' : [test_libsystemd_sym_c],
                 'link_with' : libsystemd,
                 'suite' : 'libsystemd',
         },
         test_template + {
                 'name' : 'test-libudev-sym',
-                'sources' : test_libudev_sym_c,
+                'sources' : [test_libudev_sym_c],
                 'include_directories' : libudev_includes,
                 'c_args' : ['-Wno-deprecated-declarations'] + test_cflags,
                 'link_with' : libudev,
@@ -654,7 +650,7 @@ if static_libsystemd != 'false'
         executables += [
                 test_template + {
                         'name' : 'test-libsystemd-static-sym',
-                        'sources' : test_libsystemd_sym_c,
+                        'sources' : [test_libsystemd_sym_c],
                         'link_with' : install_libsystemd_static,
                         'build_by_default' : want_tests != 'false',
                         'install' : install_tests,
@@ -667,7 +663,7 @@ if static_libudev != 'false'
         executables += [
                 test_template + {
                         'name' : 'test-libudev-static-sym',
-                        'sources' : test_libudev_sym_c,
+                        'sources' : [test_libudev_sym_c],
                         'include_directories' : libudev_includes,
                         'c_args' : ['-Wno-deprecated-declarations'] + test_cflags,
                         'link_with' : install_libudev_static,

src/test/test-errno-util.c

@@ -40,10 +40,10 @@ TEST(STRERROR) {
         ASSERT_NOT_NULL(strstr(c, buf));
 }
 
-TEST(STRERROR_OR_ELSE) {
-        log_info("STRERROR_OR_ELSE(0, \"EOF\") → %s", STRERROR_OR_EOF(0));
-        log_info("STRERROR_OR_ELSE(EPERM, \"EOF\") → %s", STRERROR_OR_EOF(EPERM));
-        log_info("STRERROR_OR_ELSE(-EPERM, \"EOF\") → %s", STRERROR_OR_EOF(-EPERM));
+TEST(STRERROR_OR_EOF) {
+        log_info("STRERROR_OR_EOF(0, \"EOF\") → %s", STRERROR_OR_EOF(0));
+        log_info("STRERROR_OR_EOF(EPERM, \"EOF\") → %s", STRERROR_OR_EOF(EPERM));
+        log_info("STRERROR_OR_EOF(-EPERM, \"EOF\") → %s", STRERROR_OR_EOF(-EPERM));
 }
 
 TEST(PROTECT_ERRNO) {

src/test/test-tables.c

@@ -29,6 +29,7 @@
 #include "service.h"
 #include "show-status.h"
 #include "socket.h"
+#include "socket-label.h"
 #include "socket-util.h"
 #include "swap.h"
 #include "test-tables.h"

src/timesync/meson.build

@@ -32,9 +32,9 @@ endif
 executables += [
         libexec_template + {
                 'name' : 'systemd-timesyncd',
-                'sources' : timesyncd_sources + timesyncd_extract_sources,
-                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
+                'sources' : timesyncd_sources,
                 'extract' : timesyncd_extract_sources,
+                'include_directories' : [libexec_template['include_directories'], include_directories('.')],
                 'link_with' : timesyncd_link_with,
                 'dependencies' : [
                         libm,

src/tmpfiles/meson.build

@@ -15,7 +15,7 @@ executables += [
         executable_template + {
                 'name' : 'systemd-tmpfiles',
                 'public' : true,
-                'sources' : systemd_tmpfiles_sources + systemd_tmpfiles_extract_sources,
+                'sources' : systemd_tmpfiles_sources,
                 'extract' : systemd_tmpfiles_extract_sources,
                 'dependencies' : libacl_cflags,
         },

src/udev/meson.build

@@ -144,8 +144,8 @@ udev_binaries_dict = [
                 'name' : 'udevadm',
                 'public' : true,
                 'sources' : udevadm_sources +
-                            udevadm_extract_sources +
                             keyboard_keys_from_name_inc,
+                'extract' : udevadm_extract_sources,
                 'include_directories' : [
                         libexec_template['include_directories'],
                         include_directories('.', 'net'),
@@ -154,7 +154,6 @@ udev_binaries_dict = [
                 'link_with' : udev_link_with,
                 'install_rpath' : udev_rpath,
                 'install_tag' : 'udev',
-                'extract' : udevadm_extract_sources,
         },
         udev_plugin_template + {
                 'name' : 'ata_id',
@@ -171,10 +170,7 @@ udev_binaries_dict = [
         },
         udev_plugin_template + {
                 'name' : 'fido_id',
-                'sources' : files(
-                        'fido_id/fido_id.c',
-                        'fido_id/fido_id_desc.c',
-                ),
+                'sources' : files('fido_id/fido_id.c'),
                 'extract' : files('fido_id/fido_id_desc.c'),
         },
         udev_plugin_template + {

src/vmspawn/meson.build

@@ -19,7 +19,7 @@ executables += [
         executable_template + {
                 'name' : 'systemd-vmspawn',
                 'public' : true,
-                'sources' : vmspawn_sources + vmspawn_extract_sources,
+                'sources' : vmspawn_sources,
                 'extract' : vmspawn_extract_sources,
         },
         test_template + {

src/xdg-autostart-generator/meson.build

@@ -4,19 +4,11 @@ if conf.get('ENABLE_XDG_AUTOSTART') != 1
         subdir_done()
 endif
 
-systemd_xdg_autostart_generator_sources = files(
-        'xdg-autostart-generator.c',
-)
-systemd_xdg_autostart_generator_extract_sources = files(
-        'xdg-autostart-service.c',
-)
-
 executables += [
         executable_template + {
                 'name' : 'systemd-xdg-autostart-generator',
-                'sources' : systemd_xdg_autostart_generator_sources +
-                            systemd_xdg_autostart_generator_extract_sources,
-                'extract' : systemd_xdg_autostart_generator_extract_sources,
+                'sources' : files('xdg-autostart-generator.c'),
+                'extract' : files('xdg-autostart-service.c'),
                 'install_dir' : usergeneratordir,
         },
         libexec_template + {