Merge cf9cafd47d into 5bed97dd57

key-data might be NULL. Fixes crash:

0  0x0000559c62120530 in attach_luks_or_plain_or_bitlk (cd=0x559c6b192830, name=0x7ffd57981dc4 "root", token_type=TOKEN_FIDO2, key_file=0x0, key_data=0x0, passwords=0x0, flags=524296, until=0)
    at ../src/cryptsetup/cryptsetup.c:2234
        pass_volume_key = false
        r = 1469577760
        __func__ = '\000' <repeats 29 times>
1  0x0000559c6212279c in run (argc=6, argv=0x7ffd5797fe98) at ../src/cryptsetup/cryptsetup.c:2597
        discovered_key_data = {iov_base = 0x0, iov_len = 0}
        key_data = 0x0
        token_type = TOKEN_FIDO2
        destroy_key_file = 0x0
        flags = 524296
        until = 0
        passphrase_type = PASSPHRASE_NONE
        volume = 0x7ffd57981dc4 "root"
        source = 0x7ffd57981dc9 "/dev/disk/by-uuid/8372fb39-9ba4-461a-a618-07dcaae66280"
        status = CRYPT_INACTIVE
        tries = 0
        key_file = 0x0
        config = 0x7ffd57981e05 "luks,discard,fido2-device=auto,x-initrd.attach"
        use_cached_passphrase = true
        try_discover_key = true
        discovered_key_fn = 0x7ffd5797fa70 "root.key"
        passwords = 0x0
        cd = 0x559c6b192830
        verb = 0x7ffd57981dbd "attach"
        r = 0
        __func__ = "\000\000\000"
2  0x0000559c621231e6 in main (argc=6, argv=0x7ffd5797fe98) at ../src/cryptsetup/cryptsetup.c:2674
        r = 32553
        __func__ = "\000\000\000\000"

Follow-up for 53b6c99018

man/daemon.xml

@@ -684,6 +684,15 @@ fi</programlisting>
     <citerefentry><refentrytitle>file-hierarchy</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
   </refsect1>
 
+  <refsect1>
+    <title>Notes</title>
+
+    <para>
+       All example codes in this page are licensed under <literal>MIT No Attribution</literal>
+      (SPDX-License-Identifier: MIT-0).
+    </para>
+  </refsect1>
+
   <refsect1>
     <title>See Also</title>
     <para><simplelist type="inline">

man/systemd-system.conf.xml

@@ -302,7 +302,7 @@
         and running in an initrd equivalent to true, otherwise false. This implements a restricted subset of
         the per-unit setting of the same name, see
         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
-        details: currently, the <literal>full</literal> or <literal>struct</literal> values are not
+        details: currently, the <literal>full</literal> or <literal>strict</literal> values are not
         supported.</para>
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>

meson.build

@@ -27,6 +27,8 @@ conf = configuration_data()
 conf.set_quoted('PROJECT_URL', 'https://systemd.io/')
 conf.set('PROJECT_VERSION', project_major_version,
          description : 'Numerical project version (used where a simple number is expected)')
+conf.set_quoted('PROJECT_VERSION_STR', project_major_version,
+        description: 'Stringified project version (used where a simple string is expected)')
 conf.set_quoted('PROJECT_VERSION_FULL', meson.project_version(), description : 'Full project version')
 
 # This is to be used instead of meson.source_root(), as the latter will return

src/basic/log.c

@@ -1471,6 +1471,12 @@ int log_get_max_level(void) {
         return log_max_level;
 }
 
+int log_get_target_max_level(LogTarget target) {
+        assert(target >= 0);
+        assert(target < _LOG_TARGET_SINGLE_MAX);
+        return log_target_max_level[target];
+}
+
 void log_show_color(bool b) {
         show_color = b;
 }

src/basic/log.h

@@ -59,6 +59,7 @@ void log_settle_target(void);
 int log_set_max_level(int level);
 int log_set_max_level_from_string(const char *e);
 int log_get_max_level(void) _pure_;
+int log_get_target_max_level(LogTarget target);
 int log_max_levels_to_string(int level, char **ret);
 
 void log_set_facility(int facility);

src/core/core-varlink.c

@@ -3,13 +3,19 @@
 #include "sd-varlink.h"
 
 #include "core-varlink.h"
+#include "format-util.h"
 #include "json-util.h"
+#include "manager-varlink.h"
 #include "mkdir-label.h"
 #include "strv.h"
+#include "unit-varlink.h"
 #include "user-util.h"
 #include "varlink-internal.h"
+#include "varlink-serialize.h"
+#include "varlink-io.systemd.Unit.h"
 #include "varlink-io.systemd.UserDatabase.h"
 #include "varlink-io.systemd.ManagedOOM.h"
+#include "varlink-io.systemd.Manager.h"
 #include "varlink-util.h"
 
 typedef struct LookupParameters {
@@ -579,15 +585,31 @@ int manager_setup_varlink_server(Manager *m) {
         if (m->varlink_server)
                 return 0;
 
-        if (!MANAGER_IS_SYSTEM(m))
-                return -EINVAL;
+        sd_varlink_server_flags_t flags = SD_VARLINK_SERVER_INHERIT_USERDATA;
+        if (MANAGER_IS_SYSTEM(m))
+                flags |= SD_VARLINK_SERVER_ACCOUNT_UID;
 
-        r = sd_varlink_server_new(&s, SD_VARLINK_SERVER_ACCOUNT_UID|SD_VARLINK_SERVER_INHERIT_USERDATA);
+        r = sd_varlink_server_new(&s, flags);
         if (r < 0)
                 return log_debug_errno(r, "Failed to allocate varlink server object: %m");
 
         sd_varlink_server_set_userdata(s, m);
 
+        r = sd_varlink_server_add_interface_many(s,
+                        &vl_interface_io_systemd_Manager,
+                        &vl_interface_io_systemd_Unit);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to add interfaces to varlink server: %m");
+
+        r = sd_varlink_server_bind_method_many(
+                        s,
+                        "io.systemd.Manager.Describe", vl_method_describe_manager,
+                        "io.systemd.Unit.List",        vl_method_list_units,
+                        "io.systemd.Unit.Start",       vl_method_start_unit);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to register varlink methods: %m");
+
+        if (MANAGER_IS_SYSTEM(m)) {
                 r = sd_varlink_server_add_interface_many(
                                 s,
                                 &vl_interface_io_systemd_UserDatabase,
@@ -607,6 +629,7 @@ int manager_setup_varlink_server(Manager *m) {
                 r = sd_varlink_server_bind_disconnect(s, vl_disconnect);
                 if (r < 0)
                         return log_debug_errno(r, "Failed to register varlink disconnect handler: %m");
+        }
 
         r = sd_varlink_server_attach_event(s, m->event, EVENT_PRIORITY_IPC);
         if (r < 0)
@@ -630,22 +653,22 @@ static int manager_varlink_init_system(Manager *m) {
         bool fresh = r > 0;
 
         if (!MANAGER_IS_TEST_RUN(m)) {
-                (void) mkdir_p_label("/run/systemd/userdb", 0755);
+                FOREACH_STRING(dir,
+                               "/run/systemd/userdb",
+                               "/run/systemd/unit") {
+                        r = mkdir_p_label(dir, 0755);
+                        if (r < 0)
+                                log_debug_errno(r, "Failed to create dir '%s', ignoring: %m", dir);
+                }
 
-                FOREACH_STRING(address, "/run/systemd/userdb/io.systemd.DynamicUser", VARLINK_ADDR_PATH_MANAGED_OOM_SYSTEM) {
-                        if (!fresh) {
+                FOREACH_STRING(address,
+                               "/run/systemd/userdb/io.systemd.DynamicUser",
+                               VARLINK_ADDR_PATH_MANAGED_OOM_SYSTEM,
+                               "/run/systemd/io.systemd.Manager",
+                               "/run/systemd/unit/io.systemd.Unit") {
                         /* We might have got sockets through deserialization. Do not bind to them twice. */
-
-                                bool found = false;
-                                LIST_FOREACH(sockets, ss, m->varlink_server->sockets)
-                                        if (path_equal(ss->address, address)) {
-                                                found = true;
-                                                break;
-                                        }
-
-                                if (found)
+                        if (!fresh && varlink_server_contains_socket(m->varlink_server, address))
                                 continue;
-                        }
 
                         r = sd_varlink_server_listen_address(m->varlink_server, address, 0666);
                         if (r < 0)
@@ -657,6 +680,8 @@ static int manager_varlink_init_system(Manager *m) {
 }
 
 static int manager_varlink_init_user(Manager *m) {
+        int r;
+
         assert(m);
 
         if (!MANAGER_IS_USER(m))
@@ -665,6 +690,34 @@ static int manager_varlink_init_user(Manager *m) {
         if (MANAGER_IS_TEST_RUN(m))
                 return 0;
 
+        r = manager_setup_varlink_server(m);
+        if (r < 0)
+                return log_error_errno(r, "Failed to set up varlink server: %m");
+        bool fresh = r > 0;
+
+        FOREACH_STRING(a,
+                       "systemd/io.systemd.Manager",
+                       "systemd/unit/io.systemd.Unit") {
+                _cleanup_free_ char *address = NULL, *dir = NULL;
+                address = path_join(m->prefix[EXEC_DIRECTORY_RUNTIME], a);
+                if (!address)
+                        return -ENOMEM;
+                /* We might have got sockets through deserialization. Do not bind to them twice. */
+                if (fresh || !varlink_server_contains_socket(m->varlink_server, address)) {
+                        r = path_extract_directory(address, &dir);
+                        if (r < 0)
+                                log_debug_errno(r, "Failed to extract directory from path '%s', ignoring: %m", address);
+
+                        r = mkdir_p_label(dir, 0755);
+                        if (r < 0)
+                                log_debug_errno(r, "Failed to create dir '%s', ignoring: %m", dir);
+
+                        r = sd_varlink_server_listen_address(m->varlink_server, address, 0666);
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to bind to varlink socket '%s': %m", address);
+                }
+        }
+
         return manager_varlink_managed_oom_connect(m);
 }
 

src/core/manager-serialize.c

@@ -497,7 +497,7 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
                         if (r < 0)
                                 return r;
                 } else if ((val = startswith(l, "varlink-server-socket-address="))) {
-                        if (!m->varlink_server && MANAGER_IS_SYSTEM(m)) {
+                        if (!m->varlink_server) {
                                 r = manager_setup_varlink_server(m);
                                 if (r < 0) {
                                         log_warning_errno(r, "Failed to setup varlink server, ignoring: %m");

src/core/manager-varlink.c

@@ -0,0 +1,203 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include <sys/prctl.h>
+
+#include "build.h"
+#include "confidential-virt.h"
+#include "json-util.h"
+#include "manager-varlink.h"
+#include "manager.h"
+#include "syslog-util.h"
+#include "taint.h"
+#include "version.h"
+#include "varlink-common.h"
+#include "virt.h"
+#include "watchdog.h"
+
+static int manager_environment_build_json(sd_json_variant **ret, const char *name, void *userdata) {
+        _cleanup_strv_free_ char **l = NULL;
+        Manager *m = ASSERT_PTR(userdata);
+        int r;
+
+        assert(ret);
+
+        r = manager_get_effective_environment(m, &l);
+        if (r < 0)
+                return r;
+
+        if (strv_isempty(l))
+                return 0;
+
+        return sd_json_variant_new_array_strv(ret, l);
+}
+
+static int log_level_build_json(sd_json_variant **ret, const char *name, void *userdata, int log_max_level) {
+        _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
+        int r;
+
+        assert(ret);
+        assert(log_max_level >= 0);
+
+        for (int log_target = 0; log_target < _LOG_TARGET_SINGLE_MAX; log_target++) {
+                _cleanup_free_ char *log_level_string = NULL;
+
+                int target_max_level = log_get_target_max_level(log_target);
+                const char *log_target_string = log_target_to_string(log_target);
+
+                int log_level = MIN(log_max_level, target_max_level);
+                r = log_level_to_string_alloc(log_level, &log_level_string);
+                if (r < 0)
+                        return r;
+
+                r = sd_json_variant_set_field_string(&v, log_target_string, log_level_string);
+                if (r < 0)
+                        return r;
+        }
+
+        *ret = TAKE_PTR(v);
+        return 0;
+}
+
+static int log_level_build_context_json(sd_json_variant **ret, const char *name, void *userdata) {
+        Manager *m = ASSERT_PTR(userdata);
+        int log_level = m->log_level_overridden ? m->original_log_level : log_get_max_level();
+        return log_level_build_json(ret, name, userdata, log_level);
+}
+
+static int log_level_build_runtime_json(sd_json_variant **ret, const char *name, void *userdata) {
+        Manager *m = ASSERT_PTR(userdata);
+        if (!m->log_level_overridden)
+                return 0;
+
+        return log_level_build_json(ret, name, userdata, log_get_max_level());
+}
+
+static int manager_context_build_json(sd_json_variant **ret, const char *name, void *userdata) {
+        Manager *m = ASSERT_PTR(userdata);
+
+        return sd_json_buildo(ASSERT_PTR(ret),
+                        SD_JSON_BUILD_PAIR_STRING("Version", GIT_VERSION),
+                        SD_JSON_BUILD_PAIR_STRING("Architecture", architecture_to_string(uname_architecture())),
+                        SD_JSON_BUILD_PAIR_STRING("Features", systemd_features),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("ShowStatus", show_status_on(MANAGER_IS_USER(m) ? _SHOW_STATUS_INVALID : m->show_status)),
+                        SD_JSON_BUILD_PAIR_STRV("UnitPath", m->lookup_paths.search_path),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("LogLevel", log_level_build_context_json, m),
+                        SD_JSON_BUILD_PAIR_STRING("LogTarget", log_target_to_string(m->log_target_overridden ? m->original_log_target : log_get_target())),
+                        JSON_BUILD_PAIR_STRV_NON_EMPTY("Environment", m->transient_environment),
+                        SD_JSON_BUILD_PAIR_STRING("DefaultStandardOutput", exec_output_to_string(m->defaults.std_output)),
+                        SD_JSON_BUILD_PAIR_STRING("DefaultStandardError", exec_output_to_string(m->defaults.std_error)),
+                        JSON_BUILD_PAIR_FINITE_USEC("RuntimeWatchdogUSec", manager_get_watchdog(m, WATCHDOG_RUNTIME)),
+                        JSON_BUILD_PAIR_FINITE_USEC("RuntimeWatchdogPreUSec", manager_get_watchdog(m, WATCHDOG_PRETIMEOUT)),
+                        JSON_BUILD_PAIR_STRING_NON_EMPTY("RuntimeWatchdogPreGovernor", m->watchdog_pretimeout_governor),
+                        JSON_BUILD_PAIR_FINITE_USEC("RebootWatchdogUSec", manager_get_watchdog(m, WATCHDOG_REBOOT)),
+                        JSON_BUILD_PAIR_FINITE_USEC("KExecWatchdogUSec", manager_get_watchdog(m, WATCHDOG_KEXEC)),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("ServiceWatchdogs", m->service_watchdogs),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultTimerAccuracyUSec", m->defaults.timer_accuracy_usec),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultTimeoutStartUSec", m->defaults.timeout_start_usec),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultTimeoutStopUSec", m->defaults.timeout_stop_usec),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultTimeoutAbortUSec", manager_default_timeout_abort_usec(m)),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultDeviceTimeoutUSec", m->defaults.device_timeout_usec),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultRestartUSec", m->defaults.restart_usec),
+                        JSON_BUILD_PAIR_RATELIMIT("DefaultStartLimit", &m->defaults.start_limit),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("DefaultCPUAccounting", m->defaults.cpu_accounting),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("DefaultBlockIOAccounting", m->defaults.blockio_accounting),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("DefaultIOAccounting", m->defaults.io_accounting),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("DefaultIPAccounting", m->defaults.ip_accounting),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("DefaultMemoryAccounting", m->defaults.memory_accounting),
+                        SD_JSON_BUILD_PAIR_BOOLEAN("DefaultTasksAccounting", m->defaults.tasks_accounting),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitCPU", rlimit_build_json, m->defaults.rlimit[RLIMIT_CPU]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitFSIZE", rlimit_build_json, m->defaults.rlimit[RLIMIT_FSIZE]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitDATA", rlimit_build_json, m->defaults.rlimit[RLIMIT_DATA]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitSTACK", rlimit_build_json, m->defaults.rlimit[RLIMIT_STACK]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitCORE", rlimit_build_json, m->defaults.rlimit[RLIMIT_CORE]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitRSS", rlimit_build_json, m->defaults.rlimit[RLIMIT_RSS]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitNOFILE", rlimit_build_json, m->defaults.rlimit[RLIMIT_NOFILE]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitAS", rlimit_build_json, m->defaults.rlimit[RLIMIT_AS]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitNPROC", rlimit_build_json, m->defaults.rlimit[RLIMIT_NPROC]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitMEMLOCK", rlimit_build_json, m->defaults.rlimit[RLIMIT_MEMLOCK]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitLOCKS", rlimit_build_json, m->defaults.rlimit[RLIMIT_LOCKS]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitSIGPENDING", rlimit_build_json, m->defaults.rlimit[RLIMIT_SIGPENDING]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitMSGQUEUE", rlimit_build_json, m->defaults.rlimit[RLIMIT_MSGQUEUE]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitNICE", rlimit_build_json, m->defaults.rlimit[RLIMIT_NICE]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitRTPRIO", rlimit_build_json, m->defaults.rlimit[RLIMIT_RTPRIO]),
+                        JSON_BUILD_PAIR_CALLBACK_NON_NULL("DefaultLimitRTTIME", rlimit_build_json, m->defaults.rlimit[RLIMIT_RTTIME]),
+                        SD_JSON_BUILD_PAIR_UNSIGNED("DefaultTasksMax", cgroup_tasks_max_resolve(&m->defaults.tasks_max)),
+                        JSON_BUILD_PAIR_FINITE_USEC("DefaultMemoryPressureThresholdUSec", m->defaults.memory_pressure_threshold_usec),
+                        SD_JSON_BUILD_PAIR_STRING("DefaultMemoryPressureWatch", cgroup_pressure_watch_to_string(m->defaults.memory_pressure_watch)),
+                        JSON_BUILD_PAIR_FINITE_USEC("TimerSlackNSec", (uint64_t) prctl(PR_GET_TIMERSLACK)),
+                        SD_JSON_BUILD_PAIR_STRING("DefaultOOMPolicy", oom_policy_to_string(m->defaults.oom_policy)),
+                        SD_JSON_BUILD_PAIR_INTEGER("DefaultOOMScoreAdjust", m->defaults.oom_score_adjust),
+                        SD_JSON_BUILD_PAIR_STRING("CtrlAltDelBurstAction", emergency_action_to_string(m->cad_burst_action)));
+}
+
+static int manager_runtime_build_json(sd_json_variant **ret, const char *name, void *userdata) {
+        Manager *m = ASSERT_PTR(userdata);
+        dual_timestamp watchdog_last_ping = {
+                .monotonic = watchdog_get_last_ping(CLOCK_MONOTONIC),
+                .realtime = watchdog_get_last_ping(CLOCK_REALTIME),
+        };
+        _cleanup_strv_free_ char **taints = NULL;
+
+        taints = taint_strv();
+        if (!taints)
+                return -ENOMEM;
+
+        return sd_json_buildo(ASSERT_PTR(ret),
+                SD_JSON_BUILD_PAIR_STRING("Virtualization", virtualization_to_string(detect_virtualization())),
+                SD_JSON_BUILD_PAIR_STRING("ConfidentialVirtualization", confidential_virtualization_to_string(detect_confidential_virtualization())),
+                SD_JSON_BUILD_PAIR_STRV("Taints", taints),
+                JSON_BUILD_PAIR_STRING_NON_EMPTY("ConfirmSpawn", manager_get_confirm_spawn(m)),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("FirmwareTimestamp", &m->timestamps[MANAGER_TIMESTAMP_FIRMWARE]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("LoaderTimestamp", &m->timestamps[MANAGER_TIMESTAMP_LOADER]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("KernelTimestamp", &m->timestamps[MANAGER_TIMESTAMP_KERNEL]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("UserspaceTimestamp", &m->timestamps[MANAGER_TIMESTAMP_USERSPACE]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("FinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_FINISH]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("SecurityStartTimestamp", &m->timestamps[MANAGER_TIMESTAMP_SECURITY_START]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("SecurityFinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_SECURITY_FINISH]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("GeneratorsStartTimestamp", &m->timestamps[MANAGER_TIMESTAMP_GENERATORS_START]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("GeneratorsFinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_GENERATORS_FINISH]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("UnitsLoadStartTimestamp", &m->timestamps[MANAGER_TIMESTAMP_UNITS_LOAD_START]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("UnitsLoadFinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_UNITS_LOAD_FINISH]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("UnitsLoadTimestamp", &m->timestamps[MANAGER_TIMESTAMP_UNITS_LOAD]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDSecurityStartTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD_SECURITY_START]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDSecurityFinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD_SECURITY_FINISH]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDGeneratorsStartTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD_GENERATORS_START]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDGeneratorsFinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD_GENERATORS_FINISH]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDUnitsLoadStartTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD_UNITS_LOAD_START]),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("InitRDUnitsLoadFinishTimestamp", &m->timestamps[MANAGER_TIMESTAMP_INITRD_UNITS_LOAD_FINISH]),
+                SD_JSON_BUILD_PAIR_CONDITION(m->show_status_overridden != _SHOW_STATUS_INVALID, "ShowStatus", SD_JSON_BUILD_BOOLEAN(manager_get_show_status_on(m))),
+                JSON_BUILD_PAIR_CALLBACK_NON_NULL("LogLevel", log_level_build_runtime_json, m),
+                SD_JSON_BUILD_PAIR_CONDITION(m->log_target_overridden, "LogTarget", SD_JSON_BUILD_STRING(log_target_to_string(log_get_target()))),
+                SD_JSON_BUILD_PAIR_UNSIGNED("NNames", hashmap_size(m->units)),
+                SD_JSON_BUILD_PAIR_UNSIGNED("NFailedUnits", set_size(m->failed_units)),
+                SD_JSON_BUILD_PAIR_UNSIGNED("NJobs", hashmap_size(m->jobs)),
+                SD_JSON_BUILD_PAIR_UNSIGNED("NInstalledJobs", m->n_installed_jobs),
+                SD_JSON_BUILD_PAIR_UNSIGNED("NFailedJobs", m->n_failed_jobs),
+                SD_JSON_BUILD_PAIR_REAL("Progress", manager_get_progress(m)),
+                JSON_BUILD_PAIR_CALLBACK_NON_NULL("Environment", manager_environment_build_json, m),
+                JSON_BUILD_PAIR_STRING_NON_EMPTY("WatchdogDevice", watchdog_get_device()),
+                JSON_BUILD_PAIR_DUAL_TIMESTAMP_NON_NULL("WatchdogLastPingTimestamp", &watchdog_last_ping),
+                JSON_BUILD_PAIR_STRING_NON_EMPTY("ControlGroup", m->cgroup_root),
+                SD_JSON_BUILD_PAIR_STRING("SystemState", manager_state_to_string(manager_state(m))),
+                SD_JSON_BUILD_PAIR_UNSIGNED("ExitCode", m->return_value));
+}
+
+int vl_method_describe_manager(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata) {
+        _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
+        Manager *manager = ASSERT_PTR(userdata);
+        int r;
+
+        assert(parameters);
+
+        if (sd_json_variant_elements(parameters) > 0)
+                return sd_varlink_error_invalid_parameter(link, parameters);
+
+        r = sd_json_buildo(&v,
+                        SD_JSON_BUILD_PAIR_CALLBACK("Context", manager_context_build_json, manager),
+                        SD_JSON_BUILD_PAIR_CALLBACK("Runtime", manager_runtime_build_json, manager));
+        if (r < 0)
+                return log_error_errno(r, "Failed to build manager JSON data: %m");
+
+        return sd_varlink_reply(link, v);
+}

src/core/manager-varlink.h

@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-json.h"
+#include "sd-varlink.h"
+
+int vl_method_describe_manager(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata);

src/core/meson.build

@@ -45,6 +45,7 @@ libcore_sources = files(
         'load-fragment.c',
         'manager-dump.c',
         'manager-serialize.c',
+        'manager-varlink.c',
         'manager.c',
         'mount.c',
         'namespace.c',
@@ -63,7 +64,9 @@ libcore_sources = files(
         'unit-dependency-atom.c',
         'unit-printf.c',
         'unit-serialize.c',
+        'unit-varlink.c',
         'unit.c',
+        'varlink-common.c',
 )
 
 if conf.get('BPF_FRAMEWORK') == 1

src/core/selinux-access.c

@@ -15,6 +15,7 @@
 
 #include "alloc-util.h"
 #include "audit-fd.h"
+#include "bus-creds.h"
 #include "bus-util.h"
 #include "errno-util.h"
 #include "format-util.h"
@@ -23,6 +24,7 @@
 #include "selinux-util.h"
 #include "stdio-util.h"
 #include "strv.h"
+#include "varlink-util.h"
 
 static bool initialized = false;
 
@@ -174,23 +176,22 @@ static int access_init(sd_bus_error *error) {
    If the machine is in permissive mode it will return ok.  Audit messages will
    still be generated if the access would be denied in enforcing mode.
 */
-int mac_selinux_access_check_internal(
-                sd_bus_message *message,
+
+static int mac_selinux_access_check_implementation(
+                sd_bus_creds *creds,
                 const char *unit_path,
                 const char *unit_context,
                 const char *permission,
                 const char *function,
                 sd_bus_error *error) {
-
-        _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
         const char *tclass, *scon, *acon;
         _cleanup_free_ char *cl = NULL;
         _cleanup_freecon_ char *fcon = NULL;
         char **cmdline = NULL;
         bool enforce;
-        int r = 0;
+        int r;
 
-        assert(message);
+        assert(creds);
         assert(permission);
         assert(function);
 
@@ -201,16 +202,6 @@ int mac_selinux_access_check_internal(
         /* delay call until we checked in `access_init()` if SELinux is actually enabled */
         enforce = mac_selinux_enforcing();
 
-        r = sd_bus_query_sender_creds(
-                        message,
-                        SD_BUS_CREDS_PID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_EGID|
-                        SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_AUDIT_LOGIN_UID|
-                        SD_BUS_CREDS_SELINUX_CONTEXT|
-                        SD_BUS_CREDS_AUGMENT /* get more bits from /proc */,
-                        &creds);
-        if (r < 0)
-                return r;
-
         /* The SELinux context is something we really should have gotten directly from the message or sender,
          * and not be an augmented field. If it was augmented we cannot use it for authorization, since this
          * is racy and vulnerable. Let's add an extra check, just in case, even though this really shouldn't
@@ -271,6 +262,84 @@ int mac_selinux_access_check_internal(
         return enforce ? r : 0;
 }
 
+int mac_selinux_access_check_internal(
+                sd_bus_message *message,
+                const char *unit_path,
+                const char *unit_context,
+                const char *permission,
+                const char *function,
+                sd_bus_error *error) {
+        _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
+        int r;
+
+        assert(message);
+
+        /* this is not necessary but provides an early exit if SELinux is not in use */
+        r = access_init(error);
+        if (r <= 0)
+                return r;
+
+        r = sd_bus_query_sender_creds(
+                        message,
+                        SD_BUS_CREDS_PID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_EGID|
+                        SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_AUDIT_LOGIN_UID|
+                        SD_BUS_CREDS_SELINUX_CONTEXT|
+                        SD_BUS_CREDS_AUGMENT /* get more bits from /proc */,
+                        &creds);
+        if (r < 0)
+                return r;
+
+        return mac_selinux_access_check_implementation(
+                creds,
+                unit_path,
+                unit_context,
+                permission,
+                function,
+                error);
+}
+
+int mac_selinux_access_check_varlink_internal(
+                sd_varlink *link,
+                const char *unit_path,
+                const char *unit_context,
+                const char *permission,
+                const char *function,
+                sd_bus_error *error) {
+        _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
+        _cleanup_(pidref_done) PidRef peer = PIDREF_NULL;
+        int r;
+
+        assert(link);
+
+        /* this is not necessary but provides an early exit if SELinux is not in use */
+        r = access_init(error);
+        if (r <= 0)
+                return r;
+
+        r = varlink_get_peer_pidref(link, &peer);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to get peer pidref: %m");
+        if (r == 0) /* if we couldn't get a pidfd this returns == 0 */
+                return log_debug_errno(SYNTHETIC_ERRNO(EPERM), "Failed to get peer pidfd, cannot securely authenticate.");
+
+        r = bus_creds_new_from_pidref(
+                        &creds,
+                        &peer,
+                        SD_BUS_CREDS_EUID|SD_BUS_CREDS_EGID|
+                        SD_BUS_CREDS_CMDLINE|SD_BUS_CREDS_AUDIT_LOGIN_UID|
+                        SD_BUS_CREDS_SELINUX_CONTEXT|
+                        SD_BUS_CREDS_AUGMENT /* get more bits from /proc */);
+        if (r < 0)
+                return log_debug_errno(r, "Failed to get credentials from peer: %m");
+
+        return mac_selinux_access_check_implementation(
+                creds,
+                unit_path,
+                unit_context,
+                permission,
+                function,
+                error);
+}
 #else /* HAVE_SELINUX */
 
 int mac_selinux_access_check_internal(
@@ -283,5 +352,13 @@ int mac_selinux_access_check_internal(
 
         return 0;
 }
+int mac_selinux_access_check_varlink_internal(
+                sd_varlink *link,
+                const char *unit_path,
+                const char *unit_context,
+                const char *permission,
+                const char *function) {
+        return 0;
+}
 
 #endif /* HAVE_SELINUX */

src/core/selinux-access.h

@@ -2,13 +2,19 @@
 #pragma once
 
 #include "sd-bus.h"
+#include "sd-varlink.h"
 
 #include "manager.h"
 
 int mac_selinux_access_check_internal(sd_bus_message *message, const char *unit_path, const char *unit_label, const char *permission, const char *function, sd_bus_error *error);
 
+int mac_selinux_access_check_varlink_internal(sd_varlink *link, const char *unit_path, const char *unit_context, const char *permission, const char *function, sd_bus_error *error);
+
 #define mac_selinux_access_check(message, permission, error) \
         mac_selinux_access_check_internal((message), NULL, NULL, (permission), __func__, (error))
 
 #define mac_selinux_unit_access_check(unit, message, permission, error) \
         mac_selinux_access_check_internal((message), (unit)->fragment_path, (unit)->access_selinux_context, (permission), __func__, (error))
+
+#define mac_selinux_access_check_varlink(unit, link, permission, error) \
+        mac_selinux_access_check_varlink_internal((link), (unit)->fragment_path, (unit)->access_selinux_context, (permission), __func__, (error))

src/core/unit-varlink.h

@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink.h"
+
+int vl_method_list_units(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata);
+int vl_method_start_unit(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata);

src/core/varlink-common.c

@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "json-util.h"
+#include "rlimit-util.h"
+#include "varlink-common.h"
+
+int rlimit_build_json(sd_json_variant **ret, const char *name, void *userdata) {
+        const struct rlimit *rl = userdata;
+        struct rlimit buf = {};
+        int r;
+
+        assert(ret);
+        assert(name);
+
+        if (!rl) {
+                const char *p;
+                int z;
+
+                /* Skip over any prefix, such as "Default" */
+                assert_se(p = strstrafter(name, "Limit"));
+
+                z = rlimit_from_string(p);
+                assert(z >= 0 && z < _RLIMIT_MAX);
+
+                r = getrlimit(z, &buf);
+                if (r < 0) {
+                        log_debug_errno(errno, "Failed to getrlimit(%s), ignoring: %m", name);
+                        return 0;
+                }
+
+                rl = &buf;
+        }
+
+        if (rl->rlim_cur == RLIM_INFINITY && rl->rlim_max == RLIM_INFINITY)
+                return 0;
+
+        /* rlim_t might have different sizes, let's map RLIMIT_INFINITY to UINT64_MAX, so that it is the same
+         * on all archs */
+        return sd_json_buildo(ret,
+                        JSON_BUILD_PAIR_UNSIGNED_NOT_EQUAL("soft", rl->rlim_cur, RLIM_INFINITY),
+                        JSON_BUILD_PAIR_UNSIGNED_NOT_EQUAL("hard", rl->rlim_max, RLIM_INFINITY));
+}

src/core/varlink-common.h

@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-json.h"
+#include "sd-varlink.h"
+
+int rlimit_build_json(sd_json_variant **ret, const char *name, void *userdata);

src/cryptsetup/cryptsetup-pkcs11.c

@@ -16,6 +16,7 @@
 #include "fileio.h"
 #include "format-util.h"
 #include "hexdecoct.h"
+#include "iovec-util.h"
 #include "macro.h"
 #include "memory-util.h"
 #include "parse-util.h"
@@ -31,8 +32,7 @@ int decrypt_pkcs11_key(
                 const char *key_file,         /* We either expect key_file and associated parameters to be set (for file keys) … */
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const void *key_data,         /* … or key_data and key_data_size (for literal keys) */
-                size_t key_data_size,
+                const struct iovec *key_data, /* … or literal keys via key_data */
                 usec_t until,
                 AskPasswordFlags askpw_flags,
                 void **ret_decrypted_key,
@@ -47,15 +47,15 @@ int decrypt_pkcs11_key(
 
         assert(friendly_name);
         assert(pkcs11_uri);
-        assert(key_file || key_data);
+        assert(key_file || iovec_is_set(key_data));
         assert(ret_decrypted_key);
         assert(ret_decrypted_key_size);
 
         /* The functions called here log about all errors, except for EAGAIN which means "token not found right now" */
 
-        if (key_data) {
-                data.encrypted_key = (void*) key_data;
-                data.encrypted_key_size = key_data_size;
+        if (iovec_is_set(key_data)) {
+                data.encrypted_key = (void*) key_data->iov_base;
+                data.encrypted_key_size = key_data->iov_len;
 
                 data.free_encrypted_key = false;
         } else {

src/cryptsetup/cryptsetup-pkcs11.h

@@ -16,8 +16,7 @@ int decrypt_pkcs11_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 AskPasswordFlags askpw_flags,
                 void **ret_decrypted_key,
@@ -39,8 +38,7 @@ static inline int decrypt_pkcs11_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 AskPasswordFlags askpw_flags,
                 void **ret_decrypted_key,

src/cryptsetup/cryptsetup.c

@@ -1471,8 +1471,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
                 struct crypt_device *cd,
                 const char *name,
                 const char *key_file,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 uint32_t flags,
                 bool pass_volume_key) {
@@ -1489,7 +1488,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
         assert(name);
         assert(arg_fido2_device || arg_fido2_device_auto);
 
-        if (arg_fido2_cid && !key_file && !key_data)
+        if (arg_fido2_cid && !key_file && !iovec_is_set(key_data))
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                         "FIDO2 mode with manual parameters selected, but no keyfile specified, refusing.");
 
@@ -1513,7 +1512,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
                                                 arg_fido2_rp_id,
                                                 arg_fido2_cid, arg_fido2_cid_size,
                                                 key_file, arg_keyfile_size, arg_keyfile_offset,
-                                                key_data, key_data_size,
+                                                key_data,
                                                 until,
                                                 arg_fido2_manual_flags,
                                                 "cryptsetup.fido2-pin",
@@ -1623,8 +1622,7 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
                 struct crypt_device *cd,
                 const char *name,
                 const char *key_file,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 uint32_t flags,
                 bool pass_volume_key) {
@@ -1635,6 +1633,7 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
         _cleanup_(erase_and_freep) void *decrypted_key = NULL;
         _cleanup_(sd_event_unrefp) sd_event *event = NULL;
         _cleanup_free_ void *discovered_key = NULL;
+        struct iovec discovered_key_data = {};
         int keyslot = arg_key_slot, r;
         const char *uri = NULL;
         bool use_libcryptsetup_plugin = use_token_plugins();
@@ -1653,13 +1652,13 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
                                 return r;
 
                         uri = discovered_uri;
-                        key_data = discovered_key;
-                        key_data_size = discovered_key_size;
+                        discovered_key_data = IOVEC_MAKE(discovered_key, discovered_key_size);
+                        key_data = &discovered_key_data;
                 }
         } else {
                 uri = arg_pkcs11_uri;
 
-                if (!key_file && !key_data)
+                if (!key_file && !iovec_is_set(key_data))
                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "PKCS#11 mode selected but no key file specified, refusing.");
         }
 
@@ -1682,7 +1681,7 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
                                         friendly,
                                         uri,
                                         key_file, arg_keyfile_size, arg_keyfile_offset,
-                                        key_data, key_data_size,
+                                        key_data,
                                         until,
                                         arg_ask_password_flags,
                                         &decrypted_key, &decrypted_key_size);
@@ -2231,9 +2230,9 @@ static int attach_luks_or_plain_or_bitlk(
         if (token_type == TOKEN_TPM2)
                 return attach_luks_or_plain_or_bitlk_by_tpm2(cd, name, key_file, key_data, until, flags, pass_volume_key);
         if (token_type == TOKEN_FIDO2)
-                return attach_luks_or_plain_or_bitlk_by_fido2(cd, name, key_file, key_data->iov_base, key_data->iov_len, until, flags, pass_volume_key);
+                return attach_luks_or_plain_or_bitlk_by_fido2(cd, name, key_file, key_data, until, flags, pass_volume_key);
         if (token_type == TOKEN_PKCS11)
-                return attach_luks_or_plain_or_bitlk_by_pkcs11(cd, name, key_file, key_data->iov_base, key_data->iov_len, until, flags, pass_volume_key);
+                return attach_luks_or_plain_or_bitlk_by_pkcs11(cd, name, key_file, key_data, until, flags, pass_volume_key);
         if (key_data)
                 return attach_luks_or_plain_or_bitlk_by_key_data(cd, name, key_data, flags, pass_volume_key);
         if (key_file)

src/libsystemd/sd-bus/bus-creds.c

@@ -144,7 +144,7 @@ sd_bus_creds* bus_creds_new(void) {
         return c;
 }
 
-static int bus_creds_new_from_pidref(sd_bus_creds **ret, PidRef *pidref, uint64_t mask) {
+int bus_creds_new_from_pidref(sd_bus_creds **ret, PidRef *pidref, uint64_t mask) {
         _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *c = NULL;
         int r;
 

src/libsystemd/sd-bus/bus-creds.h

@@ -86,3 +86,4 @@ void bus_creds_done(sd_bus_creds *c);
 int bus_creds_add_more(sd_bus_creds *c, uint64_t mask, PidRef *pidref, pid_t tid);
 
 int bus_creds_extend_by_pid(sd_bus_creds *c, uint64_t mask, sd_bus_creds **ret);
+int bus_creds_new_from_pidref(sd_bus_creds **ret, PidRef *pidref, uint64_t mask);

src/shared/cryptsetup-fido2.c

@@ -24,8 +24,7 @@ int acquire_fido2_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 Fido2EnrollFlags required,
                 const char *askpw_credential,
@@ -45,10 +44,10 @@ int acquire_fido2_key(
                                         "Local verification is required to unlock this volume, but the 'headless' parameter was set.");
 
         assert(cid);
-        assert(key_file || key_data);
+        assert(key_file || iovec_is_set(key_data));
 
-        if (key_data)
-                salt = IOVEC_MAKE(key_data, key_data_size);
+        if (iovec_is_set(key_data))
+                salt = *key_data;
         else {
                 if (key_file_size > 0)
                         log_debug("Ignoring 'keyfile-size=' option for a FIDO2 salt file.");
@@ -252,7 +251,7 @@ int acquire_fido2_key_auto(
                                 /* key_file= */ NULL, /* salt is read from LUKS header instead of key_file */
                                 /* key_file_size= */ 0,
                                 /* key_file_offset= */ 0,
-                                salt, salt_size,
+                                &IOVEC_MAKE(salt, salt_size),
                                 until,
                                 required,
                                 "cryptsetup.fido2-pin",

src/shared/cryptsetup-fido2.h

@@ -20,8 +20,7 @@ int acquire_fido2_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 Fido2EnrollFlags required,
                 const char *askpw_credential,
@@ -52,8 +51,7 @@ static inline int acquire_fido2_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const void *key_data,
-                size_t key_data_size,
+                const struct iovec *key_data,
                 usec_t until,
                 Fido2EnrollFlags required,
                 const char *askpw_credential,

src/shared/meson.build

@@ -185,6 +185,7 @@ shared_sources = files(
         'varlink-io.systemd.Machine.c',
         'varlink-io.systemd.MachineImage.c',
         'varlink-io.systemd.ManagedOOM.c',
+        'varlink-io.systemd.Manager.c',
         'varlink-io.systemd.MountFileSystem.c',
         'varlink-io.systemd.NamespaceResource.c',
         'varlink-io.systemd.Network.c',
@@ -192,6 +193,7 @@ shared_sources = files(
         'varlink-io.systemd.PCRLock.c',
         'varlink-io.systemd.Resolve.c',
         'varlink-io.systemd.Resolve.Monitor.c',
+        'varlink-io.systemd.Unit.c',
         'varlink-io.systemd.UserDatabase.c',
         'varlink-io.systemd.oom.c',
         'varlink-io.systemd.service.c',

src/shared/nsflags.c

@@ -7,6 +7,7 @@
 #include "namespace-util.h"
 #include "nsflags.h"
 #include "string-util.h"
+#include "strv.h"
 
 int namespace_flags_from_string(const char *name, unsigned long *ret) {
         unsigned long flags = 0;
@@ -42,17 +43,19 @@ int namespace_flags_from_string(const char *name, unsigned long *ret) {
 }
 
 int namespace_flags_to_string(unsigned long flags, char **ret) {
+        _cleanup_strv_free_ char **l = NULL;
         _cleanup_free_ char *s = NULL;
-        unsigned i;
+        int r;
 
-        for (i = 0; namespace_info[i].proc_name; i++) {
-                if ((flags & namespace_info[i].clone_flag) != namespace_info[i].clone_flag)
-                        continue;
+        r = namespace_flags_to_strv(flags, &l);
+        if (r < 0)
+                return r;
 
-                if (!strextend_with_separator(&s, " ", namespace_info[i].proc_name))
+        s = strv_join(l, NULL);
+        if (!s)
                 return -ENOMEM;
-        }
 
+        if (ret)
                 *ret = TAKE_PTR(s);
 
         return 0;
@@ -65,3 +68,23 @@ const char* namespace_single_flag_to_string(unsigned long flag) {
 
         return NULL;
 }
+
+int namespace_flags_to_strv(unsigned long flags, char ***ret) {
+        _cleanup_strv_free_ char **s = NULL;
+        unsigned i;
+        int r;
+
+        for (i = 0; namespace_info[i].proc_name; i++) {
+                if ((flags & namespace_info[i].clone_flag) != namespace_info[i].clone_flag)
+                        continue;
+
+                r = strv_extend(&s, namespace_info[i].proc_name);
+                if (r < 0)
+                        return r;
+        }
+
+        if (ret)
+                *ret = TAKE_PTR(s);
+
+        return 0;
+}

src/shared/nsflags.h

@@ -20,4 +20,5 @@
 
 int namespace_flags_from_string(const char *name, unsigned long *ret);
 int namespace_flags_to_string(unsigned long flags, char **ret);
+int namespace_flags_to_strv(unsigned long flags, char ***ret);
 const char* namespace_single_flag_to_string(unsigned long flag);

src/shared/varlink-idl-common.c

@@ -19,3 +19,17 @@ SD_VARLINK_DEFINE_STRUCT_TYPE(
                 SD_VARLINK_DEFINE_FIELD(pidfdId, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("Boot ID of the system the inode number belongs to"),
                 SD_VARLINK_DEFINE_FIELD(bootId, SD_VARLINK_INT, SD_VARLINK_NULLABLE));
+
+SD_VARLINK_DEFINE_STRUCT_TYPE(
+                RateLimit,
+                SD_VARLINK_FIELD_COMMENT("The ratelimit interval"),
+                SD_VARLINK_DEFINE_FIELD(intervalUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("The ratelimit burst"),
+                SD_VARLINK_DEFINE_FIELD(burst, SD_VARLINK_INT, 0));
+
+SD_VARLINK_DEFINE_STRUCT_TYPE(
+                ResourceLimit,
+                SD_VARLINK_FIELD_COMMENT("The soft resource limit"),
+                SD_VARLINK_DEFINE_FIELD(soft, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The hard resource limit"),
+                SD_VARLINK_DEFINE_FIELD(hard, SD_VARLINK_INT, SD_VARLINK_NULLABLE));

src/shared/varlink-idl-common.h

@@ -5,3 +5,5 @@
 
 extern const sd_varlink_symbol vl_type_Timestamp;
 extern const sd_varlink_symbol vl_type_ProcessId;
+extern const sd_varlink_symbol vl_type_RateLimit;
+extern const sd_varlink_symbol vl_type_ResourceLimit;

src/shared/varlink-io.systemd.Manager.c

@@ -0,0 +1,224 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "build.h"
+#include "varlink-idl-common.h"
+#include "varlink-io.systemd.Manager.h"
+
+static SD_VARLINK_DEFINE_STRUCT_TYPE(
+                LogLevelStruct,
+                SD_VARLINK_FIELD_COMMENT("'console' target log level"),
+                SD_VARLINK_DEFINE_FIELD(console, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("'kmsg' target log level"),
+                SD_VARLINK_DEFINE_FIELD(kmsg, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("'syslog' target log level"),
+                SD_VARLINK_DEFINE_FIELD(syslog, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("'journal' target log level"),
+                SD_VARLINK_DEFINE_FIELD(journal, SD_VARLINK_STRING, 0));
+
+/* The split between ManagerContext and ManagerRuntime follows the rule:
+ * - Context is what cannot change once configuration is loaded. You can think about context settings as constants.
+ * - Runtime is changable settings at runtime, in other words - variables. */
+
+static SD_VARLINK_DEFINE_STRUCT_TYPE(
+                ManagerContext,
+                SD_VARLINK_FIELD_COMMENT("The version string of the running systemd instance"),
+                SD_VARLINK_DEFINE_FIELD(Version, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("A short ID string describing the architecture the systemd instance is running on"),
+                SD_VARLINK_DEFINE_FIELD(Architecture, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("The features that have been enabled and disabled for this build"),
+                SD_VARLINK_DEFINE_FIELD(Features, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("Whether systemd will show status messages on the system console"),
+                SD_VARLINK_DEFINE_FIELD(ShowStatus, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("The unit search path"),
+                SD_VARLINK_DEFINE_FIELD(UnitPath, SD_VARLINK_STRING, SD_VARLINK_ARRAY),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#LogColor="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(LogLevel, LogLevelStruct, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/latest/systemd-system.conf.html#LogColor="),
+                SD_VARLINK_DEFINE_FIELD(LogTarget, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/latest/systemd-system.conf.html#ManagerEnvironment="),
+                SD_VARLINK_DEFINE_FIELD(Environment, SD_VARLINK_STRING, SD_VARLINK_ARRAY|SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultStandardOutput="),
+                SD_VARLINK_DEFINE_FIELD(DefaultStandardOutput, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultStandardError="),
+                SD_VARLINK_DEFINE_FIELD(DefaultStandardError, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#RuntimeWatchdogSec="),
+                SD_VARLINK_DEFINE_FIELD(RuntimeWatchdogUSec, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#RuntimeWatchdogPreSec="),
+                SD_VARLINK_DEFINE_FIELD(RuntimeWatchdogPreUSec, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#RuntimeWatchdogPreGovernor="),
+                SD_VARLINK_DEFINE_FIELD(RuntimeWatchdogPreGovernor, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#RebootWatchdogSec="),
+                SD_VARLINK_DEFINE_FIELD(RebootWatchdogUSec, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#KExecWatchdogSec="),
+                SD_VARLINK_DEFINE_FIELD(KExecWatchdogUSec, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#ServiceWatchdogs="),
+                SD_VARLINK_DEFINE_FIELD(ServiceWatchdogs, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultTimerAccuracySec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultTimerAccuracyUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultTimeoutStartSec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultTimeoutStartUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultTimeoutStopSec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultTimeoutStopUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultTimeoutAbortSec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultTimeoutAbortUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultDeviceTimeoutSec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultDeviceTimeoutUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultRestartSec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultRestartUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultStartLimit="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultStartLimit, RateLimit, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultCPUAccounting="),
+                SD_VARLINK_DEFINE_FIELD(DefaultCPUAccounting, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultBlockIOAccounting="),
+                SD_VARLINK_DEFINE_FIELD(DefaultBlockIOAccounting, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultIOAccounting="),
+                SD_VARLINK_DEFINE_FIELD(DefaultIOAccounting, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultIPAccounting="),
+                SD_VARLINK_DEFINE_FIELD(DefaultIPAccounting, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultMemoryAccounting="),
+                SD_VARLINK_DEFINE_FIELD(DefaultMemoryAccounting, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultTasksAccounting="),
+                SD_VARLINK_DEFINE_FIELD(DefaultTasksAccounting, SD_VARLINK_BOOL, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitCPU="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitCPU, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitFSIZE="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitFSIZE, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitDATA="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitDATA, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitSTACK="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitSTACK, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitCORE="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitCORE, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitRSS="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitRSS, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitNOFILE="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitNOFILE, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitAS="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitAS, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitNPROC="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitNPROC, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitMEMLOCK="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitMEMLOCK, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitLOCKS="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitLOCKS, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitSIGPENDING="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitSIGPENDING, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitMSGQUEUE="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitMSGQUEUE, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitNICE="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitNICE, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitRTPRIO="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitRTPRIO, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultLimitRTTIME="),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(DefaultLimitRTTIME, ResourceLimit, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultTasksMax="),
+                SD_VARLINK_DEFINE_FIELD(DefaultTasksMax, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultMemoryPressureThresholdUSec="),
+                SD_VARLINK_DEFINE_FIELD(DefaultMemoryPressureThresholdUSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultMemoryPressureWatch="),
+                SD_VARLINK_DEFINE_FIELD(DefaultMemoryPressureWatch, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#TimerSlackNSec="),
+                SD_VARLINK_DEFINE_FIELD(TimerSlackNSec, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultOOMPolicy="),
+                SD_VARLINK_DEFINE_FIELD(DefaultOOMPolicy, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#DefaultOOMScoreAdjust="),
+                SD_VARLINK_DEFINE_FIELD(DefaultOOMScoreAdjust, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("https://www.freedesktop.org/software/systemd/man/"PROJECT_VERSION_STR"/systemd-system.conf.html#CtrlAltDelBurstAction="),
+                SD_VARLINK_DEFINE_FIELD(CtrlAltDelBurstAction, SD_VARLINK_STRING, 0));
+
+static SD_VARLINK_DEFINE_STRUCT_TYPE(
+                ManagerRuntime,
+                SD_VARLINK_FIELD_COMMENT("A short ID string describing the virtualization technology the system runs in"),
+                SD_VARLINK_DEFINE_FIELD(Virtualization, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("A short ID string describing the confidential virtualization technology the system runs in"),
+                SD_VARLINK_DEFINE_FIELD(ConfidentialVirtualization, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("An array of strings describing the taints applied to the running system"),
+                SD_VARLINK_DEFINE_FIELD(Taints, SD_VARLINK_STRING, SD_VARLINK_ARRAY),
+                SD_VARLINK_FIELD_COMMENT("The console on which systemd asks for confirmation when spawning processes"),
+                SD_VARLINK_DEFINE_FIELD(ConfirmSpawn, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the firmware first began execution"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(FirmwareTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the boot loader first began execution"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(LoaderTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the kernel first began execution"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(KernelTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the initrd first began execution"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the initrd first began execution"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(UserspaceTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the system finished booting up"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(FinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager started uploading security policies to the kernel"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(SecurityStartTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager finished uploading security policies to the kernel"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(SecurityFinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager started executing generators"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(GeneratorsStartTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager finished executing generators"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(GeneratorsFinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager first started loading units"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(UnitsLoadStartTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager first finished loading units"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(UnitsLoadFinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager last started loading units"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(UnitsLoadTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager started uploading security policies to the kernel in the initrd"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDSecurityStartTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager finished uploading security policies to the kernel in the initrd"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDSecurityFinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager started executing generators in the initrd"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDGeneratorsStartTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager finished executing generators in the initrd"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDGeneratorsFinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager first started loading units in the initrd"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDUnitsLoadStartTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the manager first finished loading units in the initrd"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(InitRDUnitsLoadFinishTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The current show status of the manager"),
+                SD_VARLINK_DEFINE_FIELD(ShowStatus, SD_VARLINK_BOOL, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The current log level of the manager"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(LogLevel, LogLevelStruct, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The current log target of the manager"),
+                SD_VARLINK_DEFINE_FIELD(LogTarget, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The amount of unique unit names currently loaded"),
+                SD_VARLINK_DEFINE_FIELD(NNames, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("The amount of failed units"),
+                SD_VARLINK_DEFINE_FIELD(NFailedUnits, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("The amount of currently queued jobs"),
+                SD_VARLINK_DEFINE_FIELD(NJobs, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("The total amount of queued jobs"),
+                SD_VARLINK_DEFINE_FIELD(NInstalledJobs, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("The total amount of failed jobs"),
+                SD_VARLINK_DEFINE_FIELD(NFailedJobs, SD_VARLINK_INT, 0),
+                SD_VARLINK_FIELD_COMMENT("Boot progress as a floating point value between 0.0 and 1.0"),
+                SD_VARLINK_DEFINE_FIELD(Progress, SD_VARLINK_FLOAT, 0),
+                SD_VARLINK_FIELD_COMMENT("The manager environment variables"),
+                SD_VARLINK_DEFINE_FIELD(Environment, SD_VARLINK_STRING, SD_VARLINK_ARRAY),
+                SD_VARLINK_FIELD_COMMENT("The hardware watchdog device currently in use"),
+                SD_VARLINK_DEFINE_FIELD(WatchdogDevice, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Timestamp when the hardware watchdog was last pinged"),
+                SD_VARLINK_DEFINE_FIELD_BY_TYPE(WatchdogLastPingTimestamp, Timestamp, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Root of the control group hierarchy that the manager is running in"),
+                SD_VARLINK_DEFINE_FIELD(ControlGroup, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("Current state of the system"),
+                SD_VARLINK_DEFINE_FIELD(SystemState, SD_VARLINK_STRING, 0),
+                SD_VARLINK_FIELD_COMMENT("Exit code of the manager"),
+                SD_VARLINK_DEFINE_FIELD(ExitCode, SD_VARLINK_INT, 0));
+
+static SD_VARLINK_DEFINE_METHOD(
+                Describe,
+                SD_VARLINK_FIELD_COMMENT("Configuration of the manager"),
+                SD_VARLINK_DEFINE_OUTPUT_BY_TYPE(Context, ManagerContext, 0),
+                SD_VARLINK_FIELD_COMMENT("Runtime information of the manager"),
+                SD_VARLINK_DEFINE_OUTPUT_BY_TYPE(Runtime, ManagerRuntime, 0));
+
+SD_VARLINK_DEFINE_INTERFACE(
+                io_systemd_Manager,
+                "io.systemd.Manager",
+                &vl_method_Describe,
+                &vl_type_ManagerContext,
+                &vl_type_ManagerRuntime,
+                &vl_type_Timestamp,
+                &vl_type_ResourceLimit,
+                &vl_type_RateLimit,
+                &vl_type_LogLevelStruct);

src/shared/varlink-io.systemd.Manager.h

@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink-idl.h"
+
+extern const sd_varlink_interface vl_interface_io_systemd_Manager;

src/shared/varlink-io.systemd.Unit.h

@@ -0,0 +1,6 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "sd-varlink-idl.h"
+
+extern const sd_varlink_interface vl_interface_io_systemd_Unit;

src/shared/varlink-serialize.c

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "parse-util.h"
+#include "path-util.h"
 #include "varlink-internal.h"
 #include "varlink-serialize.h"
 
@@ -83,3 +84,14 @@ int varlink_server_deserialize_one(sd_varlink_server *s, const char *value, FDSe
         LIST_PREPEND(sockets, s->sockets, TAKE_PTR(ss));
         return 0;
 }
+
+int varlink_server_contains_socket(sd_varlink_server *s, const char *address) {
+        assert(s);
+        assert(address);
+
+        LIST_FOREACH(sockets, ss, s->sockets)
+                if (path_equal(ss->address, address))
+                        return true;
+
+        return false;
+}

src/shared/varlink-serialize.h

@@ -9,3 +9,5 @@
 
 int varlink_server_serialize(sd_varlink_server *s, FILE *f, FDSet *fds);
 int varlink_server_deserialize_one(sd_varlink_server *s, const char *value, FDSet *fds);
+
+int varlink_server_contains_socket(sd_varlink_server *s, const char *address);

src/sysupdate/updatectl.c

@@ -1414,7 +1414,7 @@ static int verb_enable(int argc, char **argv, void *userdata) {
                                        "SetFeatureEnabled",
                                        &error,
                                        /* reply= */ NULL,
-                                       "sbt",
+                                       "sit",
                                        *feature,
                                        (int) enable,
                                        UINT64_C(0));

src/test/test-varlink-idl.c

@@ -16,6 +16,7 @@
 #include "varlink-io.systemd.Journal.h"
 #include "varlink-io.systemd.Machine.h"
 #include "varlink-io.systemd.MachineImage.h"
+#include "varlink-io.systemd.Manager.h"
 #include "varlink-io.systemd.ManagedOOM.h"
 #include "varlink-io.systemd.MountFileSystem.h"
 #include "varlink-io.systemd.NamespaceResource.h"
@@ -24,6 +25,7 @@
 #include "varlink-io.systemd.PCRLock.h"
 #include "varlink-io.systemd.Resolve.h"
 #include "varlink-io.systemd.Resolve.Monitor.h"
+#include "varlink-io.systemd.Unit.h"
 #include "varlink-io.systemd.UserDatabase.h"
 #include "varlink-io.systemd.oom.h"
 #include "varlink-io.systemd.service.h"
@@ -193,6 +195,10 @@ TEST(parse_format) {
         print_separator();
         test_parse_format_one(&vl_interface_io_systemd_MachineImage);
         print_separator();
+        test_parse_format_one(&vl_interface_io_systemd_Manager);
+        print_separator();
+        test_parse_format_one(&vl_interface_io_systemd_Unit);
+        print_separator();
         test_parse_format_one(&vl_interface_xyz_test);
 }
 

src/udev/udev-ctrl.c

@@ -292,7 +292,7 @@ int udev_ctrl_start(UdevCtrl *uctrl, udev_ctrl_handler_t callback, void *userdat
 
 int udev_ctrl_send(UdevCtrl *uctrl, UdevCtrlMessageType type, const void *data) {
         UdevCtrlMessageWire ctrl_msg_wire = {
-                .version = "udev-" STRINGIFY(PROJECT_VERSION),
+                .version = "udev-" PROJECT_VERSION_STR,
                 .magic = UDEV_CTRL_MAGIC,
                 .type = type,
         };

src/udev/udevadm.h

@@ -19,6 +19,6 @@ int lock_main(int argc, char *argv[], void *userdata);
 
 static inline int print_version(void) {
         /* Dracut relies on the version being a single integer */
-        puts(STRINGIFY(PROJECT_VERSION));
+        puts(PROJECT_VERSION_STR);
         return 0;
 }

test/units/TEST-74-AUX-UTILS.varlinkctl.sh

@@ -160,3 +160,24 @@ done
 varlinkctl info /run/systemd/io.systemd.Hostname
 varlinkctl introspect /run/systemd/io.systemd.Hostname io.systemd.Hostname
 varlinkctl call /run/systemd/io.systemd.Hostname io.systemd.Hostname.Describe '{}'
+
+# test io.systemd.Manager
+varlinkctl info /run/systemd/io.systemd.Manager
+varlinkctl introspect /run/systemd/io.systemd.Manager io.systemd.Manager
+varlinkctl call /run/systemd/io.systemd.Manager io.systemd.Manager.Describe '{}'
+
+# test io.system.Unit
+varlinkctl info /run/systemd/unit/io.systemd.Unit
+varlinkctl introspect /run/systemd/unit/io.systemd.Unit io.systemd.Unit
+varlinkctl --more call /run/systemd/unit/io.systemd.Unit io.systemd.Unit.List '{}'
+
+# test io.systemd.Manager in user manager
+systemctl start user@4711
+varlinkctl info /run/user/4711/systemd/io.systemd.Manager
+varlinkctl introspect /run/user/4711/systemd/io.systemd.Manager
+varlinkctl call /run/user/4711/systemd/io.systemd.Manager io.systemd.Manager.Describe '{}'
+
+# test io.systemd.Unit in user manager
+varlinkctl info /run/user/4711/systemd/unit/io.systemd.Unit
+varlinkctl introspect /run/user/4711/systemd/unit/io.systemd.Unit
+varlinkctl --more call /run/user/4711/systemd/unit/io.systemd.Unit io.systemd.Unit.List '{}'