SD_VARLINK_SERVER_ROOT_ONLY: only allow connections from UID 0 (i.e. the root user). This has two effects: any incoming connections is authenticated via SO_PEERCRED ensuring the UID reported by the kernel is zero. If this check fails the connection is immediately terminated. Moreover, when binding a socket inode in the file system, the access mode is set to 0600 (rather than 0666). If this option is used connections on non-AF_UNIX sockets or via pipes are never permitted.

SD_VARLINK_SERVER_MYSELF_ONLY: this is very similar to SD_VARLINK_SERVER_ROOT_ONLY but enforces that the connecting client's UID must match the server's UID (i.e. the UID this function is invoked as). For servers that run as UID 0 the flags are equivalent. If both flags are specified in combination, connections are allowed by both UID 0 and the server's own UID.

SD_VARLINK_SERVER_ACCOUNT_UID: if set connection accounting per client UID is enabled, and a limit on concurrent connections from the same UID is enforced. The limit can be set via sd_varlink_server_set_connections_per_uid_max(), and defaults to 3/4th of the total concurrent connection limit, as settable via sd_varlink_server_set_connections_max().

SD_VARLINK_SERVER_INHERIT_USERDATA: if set the user data field for incoming connection (i.e. sd_varlink) objects (as settable via sd_varlink_set_userdata()) is automatically set to the userdata field of the server (i.e. sd_varlink_server) object (as settable via sd_varlink_server_set_userdata()). If this flag is not specified the connection's user data field will default to NULL.

SD_VARLINK_SERVER_INPUT_SENSITIVE: mark all incoming method call parameters as security sensitive (equivalent to calling sd_json_variant_sensitive()). This is useful for services that deal with secrets and similar, as it ensures that the parameters are kept out of debug logging, and memory used by the parameters is erased after use.

SD_VARLINK_SERVER_ALLOW_FD_PASSING_INPUT: if set, allow receiving UNIX file descriptors via the connections, equivalent to calling sd_varlink_set_allow_fd_passing_input() immediately for each incoming connection. Note that this only has an effect if AF_UNIX sockets are used for communication.

SD_VARLINK_SERVER_ALLOW_FD_PASSING_OUTPUT: similar, but controls sending of UNIX file descriptors.

SD_VARLINK_SERVER_FD_PASSING_INPUT_STRICT: this flag can be used in conjunction with SD_VARLINK_SERVER_ALLOW_FD_PASSING_INPUT. If so, file descriptor passing is turned off on the listening sockets already, ensuring that the connection sockets derived from it at no time have file descriptor passing enabled. If SD_VARLINK_SERVER_ALLOW_FD_PASSING_INPUT is used without SD_VARLINK_SERVER_FD_PASSING_INPUT_STRICT then a choice when to prohibit or allow file descriptor passing can still be made after the connection came in, however permitting a time window where file descriptors might already be enqueued, that then need to be dropped again.

SD_VARLINK_SERVER_HANDLE_SIGINT: if set, and sd_varlink_server_loop_auto() is used, incoming SIGINT process signals will be caught gracefully and cause the event loop to exit cleanly.

SD_VARLINK_SERVER_HANDLE_SIGTERM: similar, but does the same for SIGTERM.