From c3e4e8a527316b125572a70a00dd401bfdf0329a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 26 Mar 2026 17:28:21 +0100 Subject: [PATCH 1/2] meson: simplify setting of ImdsNetworkMode default This follows the pattern used for dnssec default mode right above. --- meson.build | 2 +- src/imds/imds-generator.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/meson.build b/meson.build index 2893bea332..03e337dccb 100644 --- a/meson.build +++ b/meson.build @@ -1544,7 +1544,7 @@ have = get_option('imds').require( conf.get('HAVE_LIBCURL') == 1, error_message : 'curl required').allowed() conf.set10('ENABLE_IMDS', have) -conf.set10('IMDS_NETWORK_LOCKED_DEFAULT', get_option('imds-network') == 'locked') +conf.set('IMDS_NETWORK_DEFAULT', 'IMDS_NETWORK_@0@'.format(get_option('imds-network')).to_upper()) have = get_option('importd').require( conf.get('HAVE_LIBCURL') == 1 and diff --git a/src/imds/imds-generator.c b/src/imds/imds-generator.c index 9cb48688a8..42399783fa 100644 --- a/src/imds/imds-generator.c +++ b/src/imds/imds-generator.c @@ -15,8 +15,7 @@ static int arg_enabled = -1; /* Whether we shall offer local IMDS APIs */ static bool arg_import = true; /* Whether we shall import IMDS credentials, SSH keys, … into the local system */ -static ImdsNetworkMode arg_network_mode = - IMDS_NETWORK_LOCKED_DEFAULT ? IMDS_NETWORK_LOCKED : IMDS_NETWORK_UNLOCKED; +static ImdsNetworkMode arg_network_mode = IMDS_NETWORK_DEFAULT; static int parse_proc_cmdline_item(const char *key, const char *value, void *data) { int r; From 6240d420d6ee8fea574200c327a2da583b823249 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Thu, 26 Mar 2026 17:32:43 +0100 Subject: [PATCH 2/2] meson: unlock imds network by default Enabling locking by default would constitute a major footgun and compatibility break on upgrades. This functionality is useful, but it requires the rest of the system to be "ported" to use systemd-imds first. The user or distro should opt in to "locked" mode only after doing the integration work. --- NEWS | 14 +++++++------- meson_options.txt | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/NEWS b/NEWS index c34c55603e..c717a355ec 100644 --- a/NEWS +++ b/NEWS @@ -13,13 +13,13 @@ CHANGES WITH 261 in spe: attestation environments which use hardware CC registers and not the TPM quote. - * By default networking to cloud IMDS services is now locked down, for - recognized clouds. This is recommended for secure installations, but - typically conflicts with traditional IMDS clients such as cloud-init, - which require direct IMDS access currently. The new meson option - "imds-network" can be used to change the default networking mode to - "unlocked" at build-time, for compatibility. This is probably what - general purpose distributions should set for now. + New features: + + * Networking to cloud IMDS services may be locked down for recognized + clouds. This is recommended for secure installations, but typically + conflicts with traditional IMDS clients such as cloud-init, which + require direct IMDS access. The new meson option "-Dimds-network=" + can be used to change the default mode to "locked" at build-time. CHANGES WITH 260: diff --git a/meson_options.txt b/meson_options.txt index 30c5fd3ab6..d61afac519 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -144,7 +144,7 @@ option('timesyncd', type : 'boolean', description : 'install the systemd-timesyncd daemon') option('imds', type : 'feature', description : 'install the systemd-imds stack') -option('imds-network', type : 'combo', choices : [ 'locked', 'unlocked' ], +option('imds-network', type : 'combo', choices : ['unlocked', 'locked'], description : 'whether to default to locked/unlocked IMDS network mode') option('journal-storage-default', type : 'combo', choices : ['persistent', 'auto', 'volatile', 'none'], description : 'default storage mode for journald (main namespace)')