summaryrefslogtreecommitdiffstats
path: root/src/creds (follow)
Commit message (Collapse)AuthorAgeFilesLines
* sd-json,tree-wide: add sd_json_format_enabled() and use it everwhereZbigniew Jędrzejewski-Szmek2024-10-281-2/+2
| | | | | | | | | | | | | | | | | | | We often used a pattern like if (!FLAGS_SET(flags, SD_JSON_FORMAT_OFF)), which is rather verbose and also contains a double negative, which we try to avoid. Add a little helper to avoid an explicit bit check. This change clarifies an aditional thing: in some cases we treated SD_JSON_FORMAT_OFF as a flag (flags & SD_JSON_FORMAT_OFF), while in other cases we treated it as an independent enum value (flags == SD_JSON_FORMAT_OFF). In the first form, flags like SD_JSON_FORMAT_SSE do _not_ turn the json output on, while in the second form they do. Let's use the first form everywhere. No functional change intended. Initially I wasn't sure if this helper should be made public or just internal, but it seems such a common pattern that if we expose the flags, we might just as well expose it too, to make life easier for any consumers.
* creds: fix cat with encrypted credentialsSimon Pilkington2024-09-251-1/+5
| | | | Fixes: https://github.com/systemd/systemd/issues/34547
* creds: move -h/--help and --version to correct section in the help messageYu Watanabe2024-09-141-1/+1
|
* creds: add short comment that has-tpm2 is movedYu Watanabe2024-09-141-1/+1
| | | | Follow-up for 58e359604ffdca12bb4d2c5807b96e070611c0f6.
* creds: align tableYu Watanabe2024-09-141-4/+4
|
* creds: drop unnecessary include of build-path.hYu Watanabe2024-09-141-1/+0
| | | | Follow-up for 58e359604ffdca12bb4d2c5807b96e070611c0f6.
* analyze: move "has-tpm2" from systemd-creds to systemd-analyzeLennart Poettering2024-09-121-30/+4
| | | | | | The verb s not really specific to credential management, it was always a bit misplaced. Hence move it to systemd-analyze, where we already have some general TPM related verbs such as "srk" and "pcrs"
* man: fix help text for systemd-creds tool's "list" verbLennart Poettering2024-09-111-2/+2
| | | | | I guess this was copy/pasted from sysupdate? Weird though. Fix it. And also reword "cat" help text to make it more precise.
* sd-varlink: make our internal Varlink API public as sd-varlink.[ch]Lennart Poettering2024-07-161-29/+29
| | | | | | | | | | It's time. sd-json was already done earlier in this cycle, let's now make sd-varlink public too. This is mostly just a search/replace job of epical proportions. I left some functions internal (mostly IDL handling), and I turned some static inline calls into regular calls.
* tree-wide: port over to new builder apisLennart Poettering2024-06-191-2/+2
|
* libsystemd: turn json.[ch] into a public APILennart Poettering2024-06-121-29/+31
| | | | | | | | | | | | | | | This is preparation for making our Varlink API a public API. Since our Varlink API is built on top of our JSON API we need to make that public first (it's a nice API, but JSON APIs there are already enough, this is purely about the Varlink angle). I made most of the json.h APIs public, and just placed them in sd-json.h. Sometimes I wasn't so sure however, since the underlying data structures would have to be made public too. If in doubt I didn#t risk it, and moved the relevant API to src/libsystemd/sd-json/json-util.h instead (without any sd_* symbol prefixes). This is mostly a giant search/replace patch.
* creds-util: fix "weak" vs. "secure" display for tmpfs/noswap backed credentialsLennart Poettering2024-06-122-5/+42
| | | | | | | | | | | | When we display passed credentials we show a brief safety level based on how the credential is pass in: if it's backed by swappable memory we give it a "weak" level. This check was so far done by checking if the file is backed by ramfs. However, since 1155f44f48f8fd59c863d71b3938e34a0b2fec2a we actually prefer tmpfs with the new "noswap" option for this. Hence, fix this, and explicitly look for "noswap" among the mount options in case we detect tmpfs.
* tree-wise: several cleanups for loggingYu Watanabe2024-04-301-10/+3
| | | | | | | | | | | - drop unnecessary SYNTHETIC_ERRNO() when the logger does not propagate error code, - drop unnecessary '%m' in error message when the error code is specified with SYNTHETIC_ERRNO(), - add missing full stop at the end of log message, - use RET_GATHER(), - add missing ", ignoring.", - upeercase the first letter, etc., etc...
* creds: update --help text regarding tpm2-absent → null renameLennart Poettering2024-04-151-1/+1
| | | | | | This was forgotten when "tpm2-absent" was renamed to "null". Follow-up-for: 6d78dc282721b3b40e8474222ff8c6e0aebb6d10
* creds: allow null when decryptingLudwig Nussel2024-04-111-1/+9
| | | | | pcrlock writes a credential file using null key. Make sure systemd-creds can show the file
* Merge pull request #31721 from aafeijoo-suse/service-util-help-fixLuca Boccassi2024-03-111-6/+7
|\ | | | | shared/service-util: actually use the `bus_introspect` argument in `help()`
| * tree-wide: drop custom formatting for print() help messagesAntonio Alvarez Feijoo2024-03-111-6/+7
| | | | | | | | Follow-up for bc556335b1c568c98688cc1f586b5f753fcddac6
* | polkit: turn "interactive" flag to polkit APIs into a proper flags field ↵Lennart Poettering2024-03-111-2/+0
|/ | | | | | | | | | | | (#31715) This adds for both the D-Bus and the Varlink flavours of our polkit client api a flags parameter. And then folds the "bool interactive" flag that the D-Bus version so far had, into a flag, and also adds support for it in the Varlink API. Since this means the Varlink API gained another parameter, let's do what we already did for the D-Bus API and add a _full() version of the API that has the flags and the good_uid parameter, and one without both.
* creds: fix typoAntonio Alvarez Feijoo2024-02-081-1/+1
|
* creds: fix typoYu Watanabe2024-02-021-1/+1
| | | | Follow-up for 8464f7cbd652af75566017c62bec5308d1c30775.
* creds: go via IPC service when unprivileged and trying to access servicesLennart Poettering2024-01-301-31/+59
| | | | Fixes: #30191
* creds: allow Varlink clients to encrypt/decrypt their own credentials ↵Lennart Poettering2024-01-301-30/+173
| | | | | | | | without polkit authentication Now that we have the concept of scoped credentials, we can allow unprivileged clients to encrypt/decrypt them as longed as they are scoped to them.
* creds-tool: add --user/--uid= to operate with scoped credentialsLennart Poettering2024-01-301-5/+53
|
* creds-util: add a concept of "user-scoped" credentialsLennart Poettering2024-01-301-1/+6
| | | | | | | | | | | | | | | | | | | So far credentials are a concept for system services only: to encrypt or decrypt credential you must be privileged, as only then you can access the TPM and the host key. Let's break this up a bit: let's add a "user-scoped" credential, that are specific to users. Internally this works by adding another step to the acquisition of the symmetric encryption key for the credential: if a "user-scoped" credential is used we'll generate an symmetric encryption key K as usual, but then we'll use it to calculate K' = HMAC(K, flags || uid || machine-id || username) and then use the resulting K' as encryption key instead. This basically includes the (public) user's identity in the encryption key, ensuring that only if the right user credentials are specified the correct key can be acquired.
* varlink: optionally, mark all incoming message's "parameters" field as sensitiveLennart Poettering2024-01-161-6/+1
| | | | | | | | | | | So far the varlink logic honoured the "sensitive" flag of output messages. Let's add something similar for input messages. Since we don't really know incoming messages, the flag simply controls whether the "parmaeters" field of all incoming messages should be marked as sensitive. Then, turn this on in the credentials logic and in homed, since both deal with credentials.
* creds-util: optionally, allow NULL credentials even with TPMLennart Poettering2024-01-051-0/+5
|
* tpm2-util: more iovec'ificationLennart Poettering2024-01-051-29/+25
| | | | | | | Let's move more code to using struct iovec for passing around binary chunks of data. No real changes in behaviour, just refactoring.
* creds: rename "tpm2-absent" encryption to "null" encryptionLennart Poettering2024-01-041-2/+2
| | | | | | | | | | | This is what it is after all: encryption with a NULL key. This is more descriptive, but also relevant since we want to use this kind of credentials in a different context soon: for carrying pcrlock data into a UKI. In that case we don#t want encryption, since the pcrlock data is intended to help unlocking secrets, hence should not be a secret itself. This only changes the code labels and the way this is labelled in the output. We retain compat with the old name.
* creds: open up access to clients via PolkitLennart Poettering2024-01-033-6/+75
| | | | | Use auth_admin_keep, so that users don't have to re-auth interactively again and again when encrypting/decrypting batches of credentials.
* format-table: introduce table_isempty and use it where appropriateMike Yuan2023-12-251-1/+1
|
* various: clean up isatty() handlingMike Yuan2023-12-221-1/+1
| | | | As per https://github.com/systemd/systemd/pull/30547#discussion_r1434371627
* creds: add varlink API for encrypting/decrypting credentialsLennart Poettering2023-12-211-0/+180
|
* various: don't log synthetic EIO for fwriteMike Yuan2023-12-081-1/+1
| | | | Follow-up for f9568765d4d3d57de1ec01d85f0a0682920f4d10
* variuos: fwrite() does not set errnoZbigniew Jędrzejewski-Szmek2023-12-051-3/+4
| | | | | | | | The man page doesn't even mention errno. It just says that ferror() should be used to check for errors. Those writes are unlikely to fail, but if they do, errno might even be 0. Also, we have fflush_and_check() which does additional paranoia around errno, because we apparently do not trust that errno will always be set correctly.
* tree-wide: explicitly compare return value of fd_is_fs_type with 0Mike Yuan2023-09-191-2/+2
| | | | According to our coding style.
* fundamental: rename tpm-pcr.h → tpm2-pcr.hLennart Poettering2023-08-241-1/+1
| | | | | | | | | I always found it confusing that most of our TPM related definitions are in tpm2-util.h, but the PCR names in tpm-pcr.h, without the "2". Let's fix that and make this systematic, in particular as the definitions in the file all start with TPM2_ already. No code flow changes, just some renaming.
* tpm2: unify symbolic name infra for PCRsLennart Poettering2023-08-241-1/+1
| | | | | | | | | | | | | We so far maintained two places for symboic names for PCRs. One in tpm2-util.h and one in tpm-pcr.h. Let's unify this into one, i.e. move the full list from tpm2-util.h into tpm-pcr.h, replacing the short list placed so far there. Systematically prefix the definitions with TPM2_ or tpm2_, to follow how we do this for all other defines in this context. No change in behaviour, just unification of tables.
* meson: use install_emptydir() and drop meson-make-symlink.shYu Watanabe2023-08-081-3/+5
| | | | | | The script is mostly equivalent to 'mkdir -p' and 'ln -sfr'. Let's replace it with install_emptydir() builtin function and inline meson call.
* tpm2: change tpm2_parse_pcr_argument() parameters to parse to Tpm2PCRValue arrayDan Streetman2023-08-041-2/+2
| | | | | | | In order to allow users to specify expected PCR values, change the tpm2_parse_pcr_argument() to parse the text argument into an array of Tpm2PCRValue objects, which provide not only the selected PCR indexes, but also (optionally) the hash algorithm and hash value for each PCR index.
* meson: move declarations of delta, escape, notify, creds, and battery-checkYu Watanabe2023-08-011-0/+23
|
* tpm2-util: Check for dlopen() when calculating tpm2 supportDaan De Meyer2023-07-101-2/+4
|
* tree-wide: use _cleanup_set_free_ and friendsYu Watanabe2023-05-311-2/+2
| | | | Instead of _cleanup_(set_freep) or so.
* creds: make --pretty behave in a slightly more expected mannerFrantisek Sumsal2023-04-251-7/+8
|
* various: simplify calls to parse_boolean_argument()Zbigniew Jędrzejewski-Szmek2023-04-051-4/+2
| | | | | parse_boolean_argument() returns the same information via both the output argument and normal return.
* string-util: add common implementation of function that converts sized ↵Lennart Poettering2023-01-211-7/+3
| | | | character buffers to NUL terminated C strings
* creds: use empty_or_dash() where appropriateLennart Poettering2022-12-211-1/+1
|
* tree-wide: use -EBADF for fd initializationZbigniew Jędrzejewski-Szmek2022-12-191-1/+1
| | | | | | | | | | | | | | | | -1 was used everywhere, but -EBADF or -EBADFD started being used in various places. Let's make things consistent in the new style. Note that there are two candidates: EBADF 9 Bad file descriptor EBADFD 77 File descriptor in bad state Since we're initializating the fd, we're just assigning a value that means "no fd yet", so it's just a bad file descriptor, and the first errno fits better. If instead we had a valid file descriptor that became invalid because of some operation or state change, the other errno would fit better. In some places, initialization is dropped if unnecessary.
* basic: move version() to build.h+cZbigniew Jędrzejewski-Szmek2022-11-081-0/+1
|
* condition: Check that subsystem is enabled in ConditionSecurity=tpm2Daan De Meyer2022-11-011-2/+4
| | | | | | | | | Instead of succeeding when either the firmware reports a TPM device or we find a TPM device, let's check that the firmware reports a TPM device and the TPM subsystem is enabled in the kernel. To check whether the subsystem enabled, we check if the relevant subdirectory in /sys exists at all.
* creds-tool: expose new signed PCR policies in creds tool, tooLennart Poettering2022-09-081-22/+68
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-01 20:14:46 +0100