From 05eb6a773814d88b8240cd24beff3ddd8bd08da2 Mon Sep 17 00:00:00 2001
From: dongshengyuan <545258830@qq.com>
Date: Mon, 6 Jul 2026 14:05:28 +0800
Subject: [PATCH] core: connect to sockets in credential directories

Recursive credential directory loading intentionally
includes socket entries, but load_credential()
only enabled AF_UNIX socket handling for absolute paths.

Let the recursive directory path request socket
connections explicitly, and update the stale comment for directory-fd reads.

Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit 944b1600073447043f193566ef2ac1b26791f10f)
(cherry picked from commit 3b3b4692a83873aa1b626240ae0500f8521021eb)
---
 src/core/exec-credential.c | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/src/core/exec-credential.c b/src/core/exec-credential.c
index c1b2fcda85c..b7361c6a2da 100644
--- a/src/core/exec-credential.c
+++ b/src/core/exec-credential.c
@@ -619,7 +619,8 @@ static int load_credential(
                 LoadCredentialArguments *args,
                 const char *id,
                 int read_dfd,
-                const char *path) {
+                const char *path,
+                bool connect_socket) {
 
         ReadFullFileFlags flags = READ_FULL_FILE_SECURE|READ_FULL_FILE_FAIL_WHEN_LARGER;
         _cleanup_strv_free_ char **search_path = NULL;
@@ -639,10 +640,8 @@ static int load_credential(
         assert(path);
 
         if (read_dfd >= 0) {
-                /* If a directory fd is specified, then read the file directly from that dir. In this case we
-                 * won't do AF_UNIX stuff (we simply don't want to recursively iterate down a tree of AF_UNIX
-                 * IPC sockets). It's OK if a file vanishes here in the time we enumerate it and intend to
-                 * open it. */
+                /* If a directory fd is specified, then read the credential directly from that dir. It's OK
+                 * if an entry vanishes in the time between enumeration and opening it. */
 
                 if (!filename_is_valid(path)) /* safety check */
                         return -EINVAL;
@@ -657,13 +656,7 @@ static int load_credential(
                 if (!path_is_valid(path)) /* safety check */
                         return -EINVAL;
 
-                flags |= READ_FULL_FILE_CONNECT_SOCKET;
-
-                /* Pass some minimal info about the unit and the credential name we are looking to acquire
-                 * via the source socket address in case we read off an AF_UNIX socket. */
-                if (asprintf(&bindname, "@%" PRIx64 "/unit/%s/%s", random_u64(), args->context->unit, id) < 0)
-                        return -ENOMEM;
-
+                connect_socket = true;
                 missing_ok = false;
                 source = path;
 
@@ -686,6 +679,15 @@ static int load_credential(
         } else
                 maxsz = CREDENTIAL_SIZE_MAX;
 
+        if (connect_socket) {
+                flags |= READ_FULL_FILE_CONNECT_SOCKET;
+
+                /* Pass some minimal info about the unit and the credential name we are looking to acquire
+                 * via the source socket address in case we read off an AF_UNIX socket. */
+                if (asprintf(&bindname, "@%" PRIx64 "/unit/%s/%s", random_u64(), args->context->unit, id) < 0)
+                        return -ENOMEM;
+        }
+
         if (search_path)
                 STRV_FOREACH(d, search_path) {
                         _cleanup_free_ char *j = NULL;
@@ -774,7 +776,8 @@ static int load_cred_recurse_dir_cb(
 
         r = load_credential(args,
                             sub_id,
-                            dir_fd, de->d_name);
+                            dir_fd, de->d_name,
+                            de->d_type == DT_SOCK);
         if (r < 0)
                 return r;
 
@@ -844,7 +847,8 @@ static int acquire_credentials(
                         /* Regular file (incl. a credential passed in from higher up) */
                         r = load_credential(&args,
                                             lc->id,
-                                            AT_FDCWD, lc->path);
+                                            AT_FDCWD, lc->path,
+                                            /* connect_socket= */ false);
                 else
                         /* Directory */
                         r = recurse_dir(sub_fd,