SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

meson: unlock imds network by default

Browse Source 
Enabling locking by default would constitute a major footgun and
compatibility break on upgrades. This functionality is useful, but it
requires the rest of the system to be "ported" to use systemd-imds
first. The user or distro should opt in to "locked" mode only after
doing the integration work.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2026-03-26 17:32:43 +01:00
parent c3e4e8a527
commit 6240d420d6
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+7 -7
View File
@@ -13,13 +13,13 @@ CHANGES WITH 261 in spe:
attestation environments which use hardware CC registers and not the attestation environments which use hardware CC registers and not the
TPM quote. TPM quote.
* By default networking to cloud IMDS services is now locked down, for New features:
recognized clouds. This is recommended for secure installations, but
typically conflicts with traditional IMDS clients such as cloud-init, * Networking to cloud IMDS services may be locked down for recognized
which require direct IMDS access currently. The new meson option clouds. This is recommended for secure installations, but typically
"imds-network" can be used to change the default networking mode to conflicts with traditional IMDS clients such as cloud-init, which
"unlocked" at build-time, for compatibility. This is probably what require direct IMDS access. The new meson option "-Dimds-network="
general purpose distributions should set for now. can be used to change the default mode to "locked" at build-time.
CHANGES WITH 260: CHANGES WITH 260:
meson_options.txt
+1 -1
View File
@@ -144,7 +144,7 @@ option('timesyncd', type : 'boolean',
description : 'install the systemd-timesyncd daemon') description : 'install the systemd-timesyncd daemon')
option('imds', type : 'feature', option('imds', type : 'feature',
description : 'install the systemd-imds stack') description : 'install the systemd-imds stack')
option('imds-network', type : 'combo', choices : [ 'locked', 'unlocked' ], option('imds-network', type : 'combo', choices : ['unlocked', 'locked'],
description : 'whether to default to locked/unlocked IMDS network mode') description : 'whether to default to locked/unlocked IMDS network mode')
option('journal-storage-default', type : 'combo', choices : ['persistent', 'auto', 'volatile', 'none'], option('journal-storage-default', type : 'combo', choices : ['persistent', 'auto', 'volatile', 'none'],
description : 'default storage mode for journald (main namespace)') description : 'default storage mode for journald (main namespace)')