Refuse a glob as a unit, and make wanted-by say only what it saw

systemctl expands *, ? and [ in a unit argument, so reset-failed or stop
of "*" would have acted on every unit. wanted-by called a link dangling on
any stat error, followed a linked .wants anywhere, and missed most of the
manager's load path; it now says each of these, and says nothing names a
unit only of the directories it searched.

modules/systemd/cmd/systemd-tools/client.go

@@ -244,11 +244,11 @@ func (m *Manager) Status(scope Scope, unit string) (map[string]any, error) {
 		return nil, err
 	}
 	props := []string{"LoadState", "ActiveState", "SubState", "UnitFileState", "MainPID", "ExecMainStatus", "Description", "FragmentPath"}
-	args := []string{"show", unit, "--no-pager"}
+	args := []string{"show", "--no-pager"}
 	for _, p := range props {
 		args = append(args, "--property="+p)
 	}
-	out, err := m.call(scope, "systemctl", args...)
+	out, err := m.call(scope, "systemctl", append(args, "--", unit)...)
 	if err != nil {
 		return nil, err
 	}
@@ -277,7 +277,7 @@ func (m *Manager) Act(scope Scope, verb, unit string) (map[string]any, error) {
 	if err := unitArg(unit); err != nil {
 		return nil, err
 	}
-	if _, err := m.call(scope, "systemctl", verb, unit); err != nil {
+	if _, err := m.call(scope, "systemctl", verb, "--", unit); err != nil {
 		return nil, err
 	}
 	after, err := m.Status(scope, unit)
@@ -368,7 +368,7 @@ func (m *Manager) Journal(scope Scope, unit string, q JournalQuery) (map[string]
 // unitSecrets are the values of the unit's own Environment= that must not be answered. Read with
 // systemctl show, which needs no escalation; a unit that does not exist has none.
 func (m *Manager) unitSecrets(scope Scope, unit string) ([]knownSecret, error) {
-	out, err := m.call(scope, "systemctl", "show", unit, "--no-pager", "--property=Environment", "--value")
+	out, err := m.call(scope, "systemctl", "show", "--no-pager", "--property=Environment", "--value", "--", unit)
 	if err != nil {
 		return nil, err
 	}
@@ -402,11 +402,16 @@ func (m *Manager) Failed(scopes ...Scope) map[string]any {
 }
 
 // unitArg refuses a unit name systemctl or journalctl would read as an option — which under sudo would be
-// root's option.
+// root's option — and **a glob** (novox/hq issue 332): systemctl expands *, ? and [ in a unit argument to
+// every loaded unit matching it, so `stop` or `reset-failed` of "*" would act on all of them. Every verb
+// names one unit; `units` alone takes a pattern, as its own argument. The name is also given after "--".
 func unitArg(unit string) error {
 	if unit == "" || strings.HasPrefix(unit, "-") || strings.ContainsAny(unit, " \t\n\r\x00") {
 		return fmt.Errorf("%q is not a unit's name", unit)
 	}
+	if strings.ContainsAny(unit, "*?[") {
+		return fmt.Errorf("%q is a pattern, not one unit's name: the service manager would act on every unit it matches", unit)
+	}
 	return nil
 }