From 9b94ae834b8b11e3ac7d64b11b5f42eb26dbac65 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 25 Oct 2023 22:16:52 +0200
Subject: [PATCH] units: add systemd-capsule@.service

---
 units/capsule.slice        | 13 +++++++++++++
 units/capsule@.service.in  | 33 +++++++++++++++++++++++++++++++++
 units/meson.build          |  2 ++
 units/user/capsule@.target | 15 +++++++++++++++
 units/user/meson.build     |  1 +
 5 files changed, 64 insertions(+)
 create mode 100644 units/capsule.slice
 create mode 100644 units/capsule@.service.in
 create mode 100644 units/user/capsule@.target

diff --git a/units/capsule.slice b/units/capsule.slice
new file mode 100644
index 0000000000..cb8995a03f
--- /dev/null
+++ b/units/capsule.slice
@@ -0,0 +1,13 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Capsule Slice
+Documentation=man:systemd.special(7)
+Before=slices.target
diff --git a/units/capsule@.service.in b/units/capsule@.service.in
new file mode 100644
index 0000000000..f2bb9e3a45
--- /dev/null
+++ b/units/capsule@.service.in
@@ -0,0 +1,33 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Capsule Service Manager for %i
+Documentation=man:capsule@.service(5)
+After=dbus.service systemd-oomd.service
+
+[Service]
+User=c-%i
+DynamicUser=yes
+Type=notify-reload
+ExecStart={{LIBEXECDIR}}/systemd --user --unit=capsule@%i.target
+Environment=HOME=/var/lib/capsules/%i
+Environment=XDG_RUNTIME_DIR=/run/capsules/%i
+StateDirectory=capsules/%i
+RuntimeDirectory=capsules/%i
+LogExtraFields=CAPSULE=%i
+Slice=capsule.slice
+KillMode=mixed
+Delegate=pids memory cpu
+DelegateSubgroup=init.scope
+TasksMax=infinity
+TimeoutStopSec={{ DEFAULT_USER_TIMEOUT_SEC*4//3 }}s
+KeyringMode=inherit
+OOMScoreAdjust=100
+MemoryPressureWatch=skip
diff --git a/units/meson.build b/units/meson.build
index 1458cc5986..5bd2c6774e 100644
--- a/units/meson.build
+++ b/units/meson.build
@@ -745,6 +745,8 @@ units = [
         { 'file' : 'user-runtime-dir@.service.in' },
         { 'file' : 'user.slice' },
         { 'file' : 'user@.service.in' },
+        { 'file' : 'capsule@.service.in' },
+        { 'file' : 'capsule.slice' },
         {
           'file' : 'var-lib-machines.mount',
           'conditions' : ['ENABLE_MACHINED'],
diff --git a/units/user/capsule@.target b/units/user/capsule@.target
new file mode 100644
index 0000000000..986e3ad92e
--- /dev/null
+++ b/units/user/capsule@.target
@@ -0,0 +1,15 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Main Capsule Target for %i
+Documentation=man:systemd.special(7)
+Requires=basic.target
+After=basic.target
+AllowIsolate=yes
diff --git a/units/user/meson.build b/units/user/meson.build
index 850ac2c297..248745d933 100644
--- a/units/user/meson.build
+++ b/units/user/meson.build
@@ -11,6 +11,7 @@ units = [
         'graphical-session.target',
         'paths.target',
         'printer.target',
+        'capsule@.target',
         'session.slice',
         'shutdown.target',
         'smartcard.target',