diff --git a/docs/CREDENTIALS.md b/docs/CREDENTIALS.md index 2f6bdd44b2..50100cc5b6 100644 --- a/docs/CREDENTIALS.md +++ b/docs/CREDENTIALS.md @@ -78,7 +78,7 @@ Within unit files, there are four settings to configure service credentials. 2. `SetCredential=` may be used to set a credential to a literal string encoded in the unit file. Because unit files are world-readable (both on disk and via D-Bus), this should only be used for credentials that aren't sensitive, - i.e. public keys/certificates – but not private keys. + e.g. public keys or certificates, but not private keys. 3. `LoadCredentialEncrypted=` is similar to `LoadCredential=` but will load an encrypted credential, and decrypt it before passing it to the service. For diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 847a11f0e0..e4537a5c13 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -1545,8 +1545,9 @@ After=sys-subsystem-net-devices-ens1.device with a focus on implementing stateless operating system images. + - + Input/Output Options @@ -1592,57 +1593,57 @@ After=sys-subsystem-net-devices-ens1.device - - Credentials + + + Credentials - - - ID:PATH - ID:VALUE + + + ID:PATH + ID:VALUE - Pass a credential to the container. These two options correspond to the - LoadCredential= and SetCredential= settings in unit files. See - systemd.exec5 for - details about these concepts, as well as the syntax of the option's arguments. + Pass a credential to the container. These two options correspond to the + LoadCredential= and SetCredential= settings in unit files. See + systemd.exec5 for + details about these concepts, as well as the syntax of the option's arguments. - Note: when systemd-nspawn runs as systemd system service it can propagate - the credentials it received via LoadCredential=/SetCredential= - to the container payload. A systemd service manager running as PID 1 in the container can further - propagate them to the services it itself starts. It is thus possible to easily propagate credentials - from a parent service manager to a container manager service and from there into its payload. This - can even be done recursively. + Note: when systemd-nspawn runs as systemd system service it can propagate + the credentials it received via LoadCredential=/SetCredential= + to the container payload. A systemd service manager running as PID 1 in the container can further + propagate them to the services it itself starts. It is thus possible to easily propagate credentials + from a parent service manager to a container manager service and from there into its payload. This + can even be done recursively. - In order to embed binary data into the credential data for - use C-style escaping (i.e. \n to embed a newline, or \x00 to - embed a NUL byte. Note that the invoking shell might already apply unescaping - once, hence this might require double escaping!). + In order to embed binary data into the credential data for , + use C-style escaping (i.e. \n to embed a newline, or \x00 to + embed a NUL byte). Note that the invoking shell might already apply unescaping + once, hence this might require double escaping!. - The - systemd-sysusers.service8 - and - systemd-firstboot1 - services read credentials configured this way for the purpose of configuring the container's root - user's password and shell, as well as system locale, keymap and timezone during the first boot - process of the container. This is particularly useful in combination with - where every single boot appears as first boot, since configuration - applied to /etc/ is lost on container reboot cycles. See the respective man - pages for details. Example: + The + systemd-sysusers.service8 + and + systemd-firstboot1 + services read credentials configured this way for the purpose of configuring the container's root + user's password and shell, as well as system locale, keymap and timezone during the first boot + process of the container. This is particularly useful in combination with + where every single boot appears as first boot, since configuration + applied to /etc/ is lost on container reboot cycles. See the respective man + pages for details. Example: - # systemd-nspawn -i image.raw \ - --volatile=yes \ - --set-credential=firstboot.locale:de_DE.UTF-8 \ - --set-credential=passwd.hashed-password.root:'$y$j9T$yAuRJu1o5HioZAGDYPU5d.$F64ni6J2y2nNQve90M/p0ZP0ECP/qqzipNyaY9fjGpC' \ - -b + # systemd-nspawn -i image.raw \ + --volatile=yes \ + --set-credential=firstboot.locale:de_DE.UTF-8 \ + --set-credential=passwd.hashed-password.root:'$y$j9T$yAuRJu1o5HioZAGDYPU5d.$F64ni6J2y2nNQve90M/p0ZP0ECP/qqzipNyaY9fjGpC' \ + -b - The above command line will invoke the specified image file image.raw in - volatile mode, i.e. with empty /etc/ and /var/. The - container payload will recognize this as a first boot, and will invoke - systemd-firstboot.service, which then reads the two passed credentials to - configure the system's initial locale and root password. - + The above command line will invoke the specified image file image.raw in + volatile mode, i.e. with empty /etc/ and /var/. The + container payload will recognize this as a first boot, and will invoke + systemd-firstboot.service, which then reads the two passed credentials to + configure the system's initial locale and root password. + - - + Other diff --git a/man/systemd-stub.xml b/man/systemd-stub.xml index 497f51c4f9..f172de447c 100644 --- a/man/systemd-stub.xml +++ b/man/systemd-stub.xml @@ -160,7 +160,7 @@ revoked with a SBAT policy update, without requiring blocklisting via DBX/MOKX. The ukify1 tool will add a SBAT policy by default if none is passed when building addons. For more information on SBAT see - Shim's documentation. + Shim's documentation. Addons are supposed to be used to pass additional kernel command line parameters, regardless of the kernel image being booted, for example to allow platform vendors to ship platform-specific configuration. The loaded command line addon files are sorted, loaded, measured into TPM PCR 12 (if a @@ -179,7 +179,7 @@ cpio archive and placed in the /.extra/global_credentials/ directory of the initrd file hierarchy. This is supposed to be used to pass additional credentials to the initrd, regardless of the kernel being booted. The generated cpio archive is - measured into TPM PCR 12 (if a TPM is present) + measured into TPM PCR 12 (if a TPM is present). Additionally, files /loader/addons/*.addon.efi are loaded and verified as PE binaries, and a .cmdline section is parsed from them. This is diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index b70b90d667..938a3c87a9 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -3302,7 +3302,7 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX When multiple credentials of the same name are found, credentials found by LoadCredential= and LoadCredentialEncrypted= take priority over - credentials found by ImportCredential=. + credentials found by ImportCredential=. diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c index 8d7d464a4a..1298c3818e 100644 --- a/src/machine/machinectl.c +++ b/src/machine/machinectl.c @@ -1705,7 +1705,7 @@ static int start_machine(int argc, char *argv[], void *userdata) { r = bus_wait_for_jobs_new(bus, &w); if (r < 0) - return log_oom(); + return log_error_errno(r, "Could not watch jobs: %m"); for (int i = 1; i < argc; i++) { _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL; diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c index 366f59ee82..61144ce0b6 100644 --- a/src/shared/mount-util.c +++ b/src/shared/mount-util.c @@ -459,7 +459,7 @@ static int mount_switch_root_pivot(int fd_newroot, const char *path) { /* Change into the new rootfs. */ if (fchdir(fd_newroot) < 0) - return log_debug_errno(errno, "Failed to change into new rootfs '%s': %m", path); + return log_debug_errno(errno, "Failed to chdir into new rootfs '%s': %m", path); /* Let the kernel tuck the new root under the old one. */ if (pivot_root(".", ".") < 0) @@ -479,13 +479,13 @@ static int mount_switch_root_move(int fd_newroot, const char *path) { /* Change into the new rootfs. */ if (fchdir(fd_newroot) < 0) - return log_debug_errno(errno, "Failed to change into new rootfs '%s': %m", path); + return log_debug_errno(errno, "Failed to chdir into new rootfs '%s': %m", path); /* Move the new root fs */ if (mount(".", "/", NULL, MS_MOVE, NULL) < 0) return log_debug_errno(errno, "Failed to move new rootfs '%s': %m", path); - /* Also change chroot dir */ + /* Also change root dir */ if (chroot(".") < 0) return log_debug_errno(errno, "Failed to chroot to new rootfs '%s': %m", path);