diff options
| author | Lennart Poettering <lennart@poettering.net> | 2023-01-26 22:30:27 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2023-01-27 10:03:38 +0100 |
| commit | b6033b706028a64e9affb79050ced1ad9a4f5b43 (patch) | |
| tree | 478234569f348324018bf55f2b4cf284009ebbeb /tmpfiles.d | |
| parent | Merge pull request #26228 from DaanDeMeyer/resolve-cap (diff) | |
| download | systemd-b6033b706028a64e9affb79050ced1ad9a4f5b43.tar.xz systemd-b6033b706028a64e9affb79050ced1ad9a4f5b43.zip | |
tmpfiles: automatically create /etc/credstore/ and friends
This adds a tmpfiles.d/ snippet for LoadCredential= style credentials
directories in /etc/ and /run/.
This is done primarily to ensure that the access modes for the dirs are
set up properly, in the most restrictive ways. Specifically these are
set to 0000, so that CAP_DAC_OVERRIDE is necessary to enumerate and read
the credentials, and being UID=0 is not sufficient to do so.
This creates /etc/credstore/, but leaves /run/credstore/ absent if
missing, for now. Thinking is: the latter being non-persistent is
created by software usually, not manually by users, and hence more
likely right. But dunno, we might want to revisit this sooner or later.
This is ultimately an exercise to advertise the LoadCredential= concept
a bit, and do so in a reasonably secure way, underlining the safety of
the concept.
Diffstat (limited to 'tmpfiles.d')
| -rw-r--r-- | tmpfiles.d/credstore.conf | 13 | ||||
| -rw-r--r-- | tmpfiles.d/meson.build | 1 |
2 files changed, 14 insertions, 0 deletions
diff --git a/tmpfiles.d/credstore.conf b/tmpfiles.d/credstore.conf new file mode 100644 index 0000000000..fb1ccf82d2 --- /dev/null +++ b/tmpfiles.d/credstore.conf @@ -0,0 +1,13 @@ +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +# See tmpfiles.d(5) for details + +d /etc/credstore 0000 root root +d /etc/credstore.encrypted 0000 root root +z /run/credstore 0000 root root +z /run/credstore.encrypted 0000 root root diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build index ca1abbf3fe..4d94e3743f 100644 --- a/tmpfiles.d/meson.build +++ b/tmpfiles.d/meson.build @@ -15,6 +15,7 @@ files = [['README', ''], ['tmp.conf', ''], ['x11.conf', ''], ['provision.conf', ''], + ['credstore.conf', ''], ] foreach pair : files |