Lennart Poettering
4b9a4b0179
Let's beef up our system credential game a bit, and explicitly import creds from sd-stub, from qemu fw_cfg and the kernel cmdline and expose them in the same way as those passed in from nspawn. Specifically, this will imprt such credentials to /run/credentials/@system (if the source can be trusted, as in the qemu/kernel cmdline case) and /run/credentials/@encrypted (otherwise, such as sd-stub provided ones). Once imported we'll set the $CREDENTIALS_PATH env var for PID 1, like it would be done by a container manager for the payload. (Conversely, we'll also creat a symlink from /run/credentials/@system to whatever is set in $CREDENTIALS_PATH in case we are invoked by a container manager, thus providing a fixed path where system credentials are found).
5 lines
93 B
C
5 lines
93 B
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
#pragma once
|
|
|
|
int import_credentials(void);
|