diff options
| author | Lennart Poettering <lennart@poettering.net> | 2023-11-24 13:24:49 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2024-01-04 15:32:14 +0100 |
| commit | c16167ea10241292aa6d0c1cdc31e525da21e754 (patch) | |
| tree | d92615b9b60346d5091e20cc2281cb41a68e61b0 | |
| parent | logind: don't make idle action timer accuracy more coarse than timeout (diff) | |
| download | systemd-c16167ea10241292aa6d0c1cdc31e525da21e754.tar.xz systemd-c16167ea10241292aa6d0c1cdc31e525da21e754.zip | |
update TODO
| -rw-r--r-- | TODO | 11 |
1 files changed, 6 insertions, 5 deletions
@@ -147,6 +147,12 @@ Features: * use udev rule networkd ownership property to take ownership of network interfaces nspawn creates +* support encrypted credentials in user context too. This is complicated by the + fact that the user does not have access to the TPM nor the system + credential. Implementation idea: extend the systemd-creds Varlink interface + to allow this: user must supply some per-user secret, that we'll include in + the encryption key. + * add a kernel cmdline switch (and cred?) for marking a system to be "headless", in which case we never open /dev/console for reading, only for writing. This would then mean: systemd-firstboot would process creds but not @@ -306,7 +312,6 @@ Features: - coredumpcl - systemd-bless-boot - systemd-measure - - systemd-creds (allowing clients to encrypt credentials locally) - systemd-cryptenroll (to allow UIs to enroll FIDO2 keys and such) - systemd-dissect - systemd-sysupdate @@ -314,9 +319,6 @@ Features: - systemd-pcrlock (to allow fwupd to relax policy) - kernel-install -* Varlink: add glue code to allow varlink clients to be authenticated via - Polkit by passing client pidfd over. - * in the service manager, pick up ERRNO= + BUSERROR= + VARLINKERROR= error identifiers, and store them along with the exit status of a server and report via "systemctl status". @@ -367,7 +369,6 @@ Features: - sd_bus_creds - unit_attach_pid_to_cgroup_via_bus() - cg_attach() – requires new kernel feature - - varlink_get_peer_pid() * ddi must be listed as block device fstype |