SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make imds networking unlocked by default (#41359)

Browse Source
This commit is contained in:
Mike Yuan
2026-03-26 20:08:17 +01:00
committed by GitHub
parent 2d2dc38f00 6240d420d6
commit be176c0c91
4 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+7 -7
View File
@@ -13,13 +13,13 @@ CHANGES WITH 261 in spe:
attestation environments which use hardware CC registers and not the
TPM quote.
* By default networking to cloud IMDS services is now locked down, for
recognized clouds. This is recommended for secure installations, but
typically conflicts with traditional IMDS clients such as cloud-init,
which require direct IMDS access currently. The new meson option
"imds-network" can be used to change the default networking mode to
"unlocked" at build-time, for compatibility. This is probably what
general purpose distributions should set for now.
New features:
* Networking to cloud IMDS services may be locked down for recognized
clouds. This is recommended for secure installations, but typically
conflicts with traditional IMDS clients such as cloud-init, which
require direct IMDS access. The new meson option "-Dimds-network="
can be used to change the default mode to "locked" at build-time.
CHANGES WITH 260:
meson.build
+1 -1
View File
@@ -1544,7 +1544,7 @@ have = get_option('imds').require(
conf.get('HAVE_LIBCURL') == 1,
error_message : 'curl required').allowed()
conf.set10('ENABLE_IMDS', have)
conf.set10('IMDS_NETWORK_LOCKED_DEFAULT', get_option('imds-network') == 'locked')
conf.set('IMDS_NETWORK_DEFAULT', 'IMDS_NETWORK_@0@'.format(get_option('imds-network')).to_upper())
have = get_option('importd').require(
conf.get('HAVE_LIBCURL') == 1 and
meson_options.txt
+1 -1
View File
@@ -144,7 +144,7 @@ option('timesyncd', type : 'boolean',
description : 'install the systemd-timesyncd daemon')
option('imds', type : 'feature',
description : 'install the systemd-imds stack')
option('imds-network', type : 'combo', choices : [ 'locked', 'unlocked' ],
option('imds-network', type : 'combo', choices : ['unlocked', 'locked'],
description : 'whether to default to locked/unlocked IMDS network mode')
option('journal-storage-default', type : 'combo', choices : ['persistent', 'auto', 'volatile', 'none'],
description : 'default storage mode for journald (main namespace)')
src/imds/imds-generator.c
+1 -2
View File
@@ -15,8 +15,7 @@
static int arg_enabled = -1; /* Whether we shall offer local IMDS APIs */
static bool arg_import = true; /* Whether we shall import IMDS credentials, SSH keys, … into the local system */
static ImdsNetworkMode arg_network_mode =
IMDS_NETWORK_LOCKED_DEFAULT ? IMDS_NETWORK_LOCKED : IMDS_NETWORK_UNLOCKED;
static ImdsNetworkMode arg_network_mode = IMDS_NETWORK_DEFAULT;
static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
int r;