SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tree-wide: use READ_FULL_FILE_CONNECT_SOCKET at various places

Browse Source 
Let's use the new flag wherever we read key material/passphrases/hashes
off disk, so that people can plug in their own IPC service as backend if
they like, easily.

(My main goal was actually to support this for crypttab key files — i.e.
that you can specify AF_UNIX sockets as third column in crypttab — but
that's harder to implement, since the keys are read via libcryptsetup's
API, not ours.)
This commit is contained in:
Lennart Poettering
2020-07-21 10:32:01 +02:00
parent c668aa8b35
commit 49f16281c9
8 changed files with 52 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.netdev.xml
+16 -12
View File
@@ -1028,11 +1028,13 @@
<varlistentry>
<term><varname>KeyFile=</varname></term>
<listitem>
<para>Takes a absolute path to a file which contains a 128-bit key encoded in a hexadecimal
string, which will be used in the transmission channel. When this option is specified,
<para>Takes a absolute path to a file which contains a 128-bit key encoded in a hexadecimal string,
which will be used in the transmission channel. When this option is specified,
<varname>Key=</varname> is ignored. Note that the file must be readable by the user
<literal>systemd-network</literal>, so it should be, e.g., owned by
<literal>root:systemd-network</literal> with a <literal>0640</literal> file mode.</para>
<literal>root:systemd-network</literal> with a <literal>0640</literal> file mode. If the path
refers to an <constant>AF_UNIX</constant> stream socket in the file system a connection is made to
it and the key read from it.</para>
</listitem>
</varlistentry>
<varlistentry>
@@ -1518,11 +1520,12 @@
<varlistentry>
<term><varname>PrivateKeyFile=</varname></term>
<listitem>
<para>Takes an absolute path to a file which contains the Base64 encoded private key for the interface.
When this option is specified, then <varname>PrivateKey=</varname> is ignored.
Note that the file must be readable by the user <literal>systemd-network</literal>, so it
should be, e.g., owned by <literal>root:systemd-network</literal> with a
<literal>0640</literal> file mode.</para>
<para>Takes an absolute path to a file which contains the Base64 encoded private key for the
interface. When this option is specified, then <varname>PrivateKey=</varname> is ignored. Note
that the file must be readable by the user <literal>systemd-network</literal>, so it should be,
e.g., owned by <literal>root:systemd-network</literal> with a <literal>0640</literal> file mode. If
the path refers to an <constant>AF_UNIX</constant> stream socket in the file system a connection is
made to it and the key read from it.</para>
</listitem>
</varlistentry>
<varlistentry>
@@ -1577,10 +1580,11 @@
<term><varname>PresharedKeyFile=</varname></term>
<listitem>
<para>Takes an absolute path to a file which contains the Base64 encoded preshared key for the
peer. When this option is specified, then <varname>PresharedKey=</varname> is ignored.
Note that the file must be readable by the user <literal>systemd-network</literal>, so it
should be, e.g., owned by <literal>root:systemd-network</literal> with a
<literal>0640</literal> file mode.</para>
peer. When this option is specified, then <varname>PresharedKey=</varname> is ignored. Note that
the file must be readable by the user <literal>systemd-network</literal>, so it should be, e.g.,
owned by <literal>root:systemd-network</literal> with a <literal>0640</literal> file mode. If the
path refers to an <constant>AF_UNIX</constant> stream socket in the file system a connection is
made to it and the key read from it.</para>
</listitem>
</varlistentry>
<varlistentry>