SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
68,862 Commits 2 Branches 1 Tag
f5bb0a316316dfa1de2bc5e34cbe21cc0bf8a30b
Commit Graph
68862 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Luca Boccassi 1af46aecf5 Merge pull request #29508 from CodethinkLabs/systemd-vmspawn-pr 
systemd-vmspawn implementation that only supports disk images
 2023-11-03 16:04:38 +00:00
Lennart Poettering 2037642930 Merge pull request #29840 from poettering/cryptsetup-tweaks-nore 
two cryptsetup bugfixes and some clean-ups
 2023-11-03 14:40:15 +01:00
Lennart Poettering 41de458aed nspawn: fix two failure paths 
We need to go to "finish" rather than just return.

All our exit paths got this right, except two.
 2023-11-03 14:39:46 +01:00
Yu Watanabe b75b8e1d02 Merge pull request #29836 from poettering/libiptc-dlopen 
make libiptc dep a dlopen() one
 2023-11-03 21:15:29 +09:00
Lennart Poettering 2259a452d7 update TODO 2023-11-03 12:14:38 +01:00
Lennart Poettering fe1f83e559 Merge pull request #29827 from yuwata/network-install-default-configs 
network: add meson option to install default configs
 2023-11-03 11:37:04 +01:00
Lennart Poettering e43f87a7a6 update TODO 2023-11-03 11:25:20 +01:00
Lennart Poettering 3e6a25a6f3 test: add pcrlock integration test 
(Contains various test additions added by @mrc0mmand)
 2023-11-03 11:25:14 +01:00
Lennart Poettering e206210909 man: document pcrlock 2023-11-03 11:24:58 +01:00
Lennart Poettering 809def1940 units: add units that put together and install a TPM2 PCR policy at boot 
(This is disabled by default, for now)
 2023-11-03 11:24:45 +01:00
Lennart Poettering 8e35338d09 pcrlock: add pre-defined pcrlock files 
These cover well-known measurements done by the UEFI firmware or
systemd.
 2023-11-03 11:24:31 +01:00
Lennart Poettering 404aea7815 tree-wide: hook everything up with pcrlock policy 
Make sure cryptenroll and repart can enroll TPM2 policies with pcrlock
logic.

Make sure cryptsetup can unlock TPM2 policies with pcrlock in effect.
 2023-11-03 11:24:24 +01:00
Lennart Poettering a434270139 pcrlock: add new pcrlock tool 2023-11-03 11:23:54 +01:00
Lennart Poettering b52e950598 tpm2-util: add common array for TPM2 hash algorithms 
This is useful to enumerate all hash algorithms we want to predict
measurements for.
 2023-11-03 11:23:34 +01:00
Lennart Poettering 40ce73214a tpm2-util: make various marshalling/unmarshalling calls static, as we only use them internally in tpm2-util.c 
Note, some of these were just added in this same PR. We only exported
them initially to make sure gcc doesn't complained about unused local
symbols.
 2023-11-03 11:23:14 +01:00
Lennart Poettering ce80da02b8 tpm2-util: add generic helpers for sealing/unsealing data 
These helpers tpm2_seal_data()/tpm2_unseal_data() are useful for
sealing/unsealing data without any further semantics around them. This
is different from the existing tpm2_seal()/tpm2_unseal() which seal with
a specific policy and serialize in a specific way, as we use it for disk
encryption.

These new helpers are more generic, they do not serialize in a specific
way or imply policy, they are just the core of the sealing/unsealing.

(We should look into porting tpm2_seal()/tpm2_unseal() onto these new
helpers, but this isn#t trivial, since the classic serialization we use
uses a merged marshalling of private/public key, which we'd have to
change in one way or another)
 2023-11-03 11:22:55 +01:00
Lennart Poettering 48d060564a tpm2-util: add helper for creating/removing/updating NV index with stored policy 
This is the primary core of what pcrlock is supposed to do eventually:
maintain a TPM2 policy hash inside an NV index which we then can
reference via a PolicyAuthorizeNV expression to lock other objects
against it.
 2023-11-03 11:22:35 +01:00
Lennart Poettering 2cd8f75316 tpm2-util: add calls for calculating/submitting PolicyAuthorizeNV + PolicyOR TPM2 policies 2023-11-03 11:22:16 +01:00
Lennart Poettering 34657b1f0b tpm2-util: add helper that calculates name of NV index 2023-11-03 11:21:55 +01:00
Lennart Poettering f7be7a245e tpm2-util: add helper for setting TPM2B_AUTH in binary 2023-11-03 11:21:35 +01:00
Lennart Poettering 360062095d tpm2-util: add helpers for marshalling NV index public areas 2023-11-03 11:21:16 +01:00
Lennart Poettering 9fe3b63672 tpm2-util: add helpers for marshalling public/private keys 
Note: we export these new symbols for now. A later commit in this PR
will make them static again. The only reason they are exported here is
to make sure gcc doesn't complain about unused static symbols, and I
really wanted to commit them in a separate commit.
 2023-11-03 11:20:56 +01:00
Lennart Poettering 8f3f9c2bf5 tpm2-util: export a couple of functions we'd like to use for pcrlock 2023-11-03 11:20:36 +01:00
Lennart Poettering 199d758879 tpm2-util: pick up a few new symbols from tpm2-tss 2023-11-03 11:20:30 +01:00
Lennart Poettering f88f929470 tpm2-util: add helper for returning path to EFI event log blob 2023-11-03 11:20:11 +01:00
Lennart Poettering a63b260166 tpm2-util: add various uefi event log definitions 2023-11-03 11:19:46 +01:00
Lennart Poettering 981f76278f efivars: add UEFI 'database' variable uuid 2023-11-03 11:19:19 +01:00
Yu Watanabe 45a7ef454e man: mention DHCPv4 Router option is ignored when Classless Static Routes option is received 
For #29564.
 2023-11-03 10:14:59 +00:00
Lennart Poettering a758a12870 cryptsetup: pass AskPasswordFlags down into pkcs11 module 
The pkcs11 cryptsetup token module is a bit different from the tpm2 +
fido2 ones: it asks for the PIN itself, rather than bubbling up a
request to get a PIN. That's because it might need multiple, and because
we don't want to destroy a the pkcs11 session half-way and thus risk
increasing pin counters.

Hence, we sometimes ask for PINs from our code, rather than let the
libcryptsetup caller do that. So far we didn't pass the AskPasswordFlags
field down into the module though. Fix that.

Fixes: #28665
 2023-11-03 09:51:53 +01:00
Lennart Poettering 11d5043993 update TODO 2023-11-03 09:34:02 +01:00
Lennart Poettering d54c747f7e firewall: allow selecting firewall backend via env var 2023-11-03 09:34:02 +01:00
Lennart Poettering f643dd1f24 firewall: make sure firewall-util-private.h includes everythin it needs 2023-11-03 09:30:24 +01:00
Lennart Poettering 5b5f8f8b9a firewall: make libiptc dependency a dlopen() one 2023-11-03 09:30:24 +01:00
Lennart Poettering 9519b94796 dlfcn-util: add two new macros for making it easier to create "sym_xyz" indirect function call variables 
Let's use "typeof" to make it easier to generate "sym_xyz" wrappers of
functions exposed by libraries.
 2023-11-03 09:30:24 +01:00
Yu Watanabe 08752450c7 Update NEWS 2023-11-03 12:02:51 +09:00
Yu Watanabe 6256c65aad meson: /etc/systemd/network is also used by udevd 2023-11-03 12:02:51 +09:00
Yu Watanabe 9b7a624267 network: add meson option to rename .example files on install 
Also this renames 80-ethernet.network.example -> 89-ethernet.network.example,
to make it have lower precedence over other default .network files for
Ethernet interfaces.

Closes #29765.
 2023-11-03 11:57:46 +09:00
Yu Watanabe 2c4534854a man: mention that network files should be prefixed with number smaller than 70 2023-11-03 11:42:19 +09:00
Yu Watanabe b94f59b9d5 network: make generated configs have higher precedence over default configs 
We use 80- for default .network files. So, the generated files from the
kernel command line should have smaller prefix.
 2023-11-03 11:42:19 +09:00
Yu Watanabe 71164ee9fe network: disable IPv6AcceptRA= in several default config 
Also,
- drop DHCP=no, as it is the default setting,
- enable IPv6SendRA= for wifi access point,
- enable MulticastDNS= for wifi adhoc mode.
 2023-11-03 11:41:52 +09:00
Yu Watanabe bae0bd0024 meson: install newly added example .network file 
Follow-up for e6ba085398.
 2023-11-03 11:27:18 +09:00
Lennart Poettering 00392b1437 cryptsetup: disable activation via token plugin if we shall measure the volume key 
if we allow cryptsetup to activate a volume via token plugin we never
get access to the volume key, which we'd like to measure. Hence disable
token plugins in that case.

(I tempted to say we probably should disable them entirely, and only use
them if classic cryptsetup is used, but that's a discussion for another
day.)

Fixes: #29790
 2023-11-02 22:37:52 +01:00
Lennart Poettering 58925605e7 cryptsetup: honour configured ask password flags also when activating via token 
See: #28665 (this is not a fix for that PR though)
 2023-11-02 22:37:46 +01:00
Lennart Poettering c50a7776c1 cryptsetup: rename usrptr to userdata 
Across our codebase we call the generic pointer "userdata", not
"userptr". Do so here too.
 2023-11-02 22:37:17 +01:00
Frantisek Sumsal 69d17e23db varlink: limit the maximum nesting depth 
Let's limit the maximum nesting depth for structure definitions to 64 to
avoid stack overflows with very deep definitions.

Resolves: #29589
 2023-11-02 20:43:38 +00:00
Luca Boccassi d2e99d288e Merge pull request #29792 from poettering/resolved-monitor-packet 
resolved: make sure "resolvectl monitor" can properly deal with stub …
 2023-11-02 20:43:19 +00:00
Lennart Poettering 0631eac96d crytsetup: allow overriding the token .so library path via an env var 
I tried to get something similar upstream:

https://gitlab.com/cryptsetup/cryptsetup/-/issues/846

But no luck, it was suggested I use ELF interposition instead. Hence,
let's do so (but not via ugly LD_PRELOAD, but simply by overriding the
relevant symbol natively in our own code).

This makes debugging tokens a ton easier.
 2023-11-02 18:18:00 +00:00
Lennart Poettering 2bdd7a8ac9 meson: make sure we never actually link to libxenctrl 
We don't make use of any of its symbols, we just want the headers, hence
make sure we never try to link against it.
 2023-11-02 17:27:07 +00:00
Lennart Poettering 707de94cbf tree-wide: never link directly against p11kit 
We go via dlopen() at most places, but forgot some. Cover the missing
cases too.
 2023-11-02 17:26:46 +00:00
Luca Boccassi 918ef2eeeb Merge pull request #29748 from poettering/tgtmode 
Storage target mode, inspired by "target disk mode" á la MacOS, but with NVMe-TCP
 2023-11-02 17:26:05 +00:00