Limiting the rules is always good, so I went back to the repro setup. I was trying various limitations for userdb- like:
@Seth - Thanks for the hint to check the addr element, now that I've found the root cause in systemd we can be sure what the pattern will look like.
I have found that the following rule works just as much and is much more fine grained:
unix (bind) type=dgram addr=@userdb-*,
So whatever way we go, this should be the rule to use.
Limiting the rules is always good, so I went back to the repro setup.
I was trying various limitations for userdb- like:
@Seth - Thanks for the hint to check the addr element, now that I've found the root cause in systemd we can be sure what the pattern will look like.
I have found that the following rule works just as much and is much more fine grained:
unix (bind) type=dgram addr=@userdb-*,
So whatever way we go, this should be the rule to use.