SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5cead3f2695f8b3b9ff149482e2daea4f0021d33
systemd/src
T
History
Lennart Poettering 5cead3f269 credentials: add policy that can allow key=null creds from the ESP (#42555) 
This PR only sets the default to "relaxed" - I can change the default
to "tofu" if desired. But for that we will also need to update the NEWS
file to ensure everyone is aware of this new default.

---

This PR adds a new `systemd.credentials-boot=` kernel
commandline that allows to control if credentials with
a `null` key are accepted.

The possible options are:
* strict: always insist on tpm encryption
* tofu: allow null encryption in firstboot mode and when no tpm is
available
* relaxed: allow null encryption when sb is off, or no tpm is available
* off: allow null encryption always

The default is `relaxed` which is exactly the behavior we had before.

This replaces the initial idea of using plaintext credentials
at firstboot (thanks to Lennart for this nicer and simpler design).

---

With that we can drop `- firstboot: optionally accept credentials at
firstboot without authentication` from TODO.md
2026-07-10 14:43:12 +02:00
..
ac-power
…
analyze
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
ask-password
polkit: check if user authenticated as admin
2026-06-25 10:39:11 +01:00
backlight
…
basic
credentials: add policy that can allow key=null creds from the ESP (#42555)
2026-07-10 14:43:12 +02:00
battery-check
…
binfmt
…
bless-boot
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
boot
stub: Set up all detected consoles
2026-07-10 03:36:04 +02:00
bootctl
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
bpf
…
busctl
meson: adjust naming of '*extract*' variables
2026-07-07 13:40:13 +02:00
cgls
…
cgtop
…
clonesetup
clonesetup: add support to clone devices via /etc/clonetab
2026-07-10 14:01:24 +02:00
core
credentials: add policy that can allow key=null creds from the ESP (#42555)
2026-07-10 14:43:12 +02:00
coredump
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
coverage
…
creds
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
cryptenroll
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
cryptsetup
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
debug-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
delta
…
detect-virt
…
dissect
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
environment-d-generator
…
escape
…
factory-reset
…
firstboot
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
fsck
fsck: don't apply invalid mode or repair values
2026-07-08 12:13:43 +01:00
fstab-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
fundamental
sd-dlopen: introduce _dlopen_loader_ macro to prevent inlining and cloning
2026-07-10 16:35:19 +09:00
fuzz
tree-wide: check if necessary cflags dependencies are set
2026-07-03 21:50:45 +09:00
getty-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
gpt-auto-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
growfs
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
hibernate-resume
meson: rename extract+objects to export+import
2026-07-07 13:40:13 +02:00
home
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
hostname
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
hwdb
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
id128
…
imds
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
import
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
include
include: add hwcaps missing from glibc and musl
2026-07-10 12:02:01 +02:00
integritysetup
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
journal
compress: split compress_blob() and friends to minimize dlopen dependencies
2026-07-10 16:35:19 +09:00
journal-remote
compress: split compress_blob() and friends to minimize dlopen dependencies
2026-07-10 16:35:19 +09:00
kernel-install
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
keyutil
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
libc
…
libsystemd
compress: split compress_blob() and friends to minimize dlopen dependencies
2026-07-10 16:35:19 +09:00
libsystemd-network
meson: rename extract+objects to export+import
2026-07-07 13:40:13 +02:00
libudev
…
locale
sd-dlopen: introduce _dlopen_loader_ macro to prevent inlining and cloning
2026-07-10 16:35:19 +09:00
login
compress: split compress_blob() and friends to minimize dlopen dependencies
2026-07-10 16:35:19 +09:00
machine
compress: split compress_blob() and friends to minimize dlopen dependencies
2026-07-10 16:35:19 +09:00
machine-id-setup
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
measure
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
modules-load
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
mount
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
mountfsd
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
mstack
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
mute-console
…
network
condition: split condition_test_list() to minimize dlopen dependencies
2026-07-10 16:35:19 +09:00
notify
…
nspawn
Optimize dlopen ELF notes via anchoring and explicitly embed them into executables (#42908)
2026-07-10 17:37:39 +09:00
nsresourced
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
nss-myhostname
…
nss-mymachines
…
nss-resolve
nss-resolve: use resolve-varlink-util.h helpers
2026-06-26 16:03:18 -04:00
nss-systemd
nss-systemd: avoid ELF TLS for recursion guard
2026-06-20 15:14:14 +02:00
oom
meson: adjust naming of '*extract*' variables
2026-07-07 13:40:13 +02:00
path
…
pcrextend
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
pcrlock
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
portable
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
pstore
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
ptyfwd
…
quotacheck
quotacheck: don't apply an invalid quotacheck.mode= value
2026-07-01 18:18:00 +01:00
random-seed
basic: update in_first_boot() to return an error
2026-07-09 16:48:26 +02:00
remount-fs
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
repart
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
reply-password
…
report
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
resolve
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
rfkill
…
rpm
…
run
run: recognize clock change timer properties (#42949)
2026-07-10 17:35:19 +09:00
run-generator
…
sbsign
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
shared
credentials: add policy that can allow key=null creds from the ESP (#42555)
2026-07-10 14:43:12 +02:00
shutdown
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
sleep
meson: rename extract+objects to export+import
2026-07-07 13:40:13 +02:00
socket-activate
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
socket-proxy
…
ssh-generator
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
stdio-bridge
…
storage
recurse-dir: optionally, only enumerate dentries of a specific type
2026-06-22 14:40:16 +02:00
storagetm
misc: fix minor error handling issues
2026-06-16 11:44:08 +01:00
sulogin-shell
…
sysctl
…
sysext
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
sysinstall
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
system-update-generator
…
systemctl
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
systemd
sd-dlopen: introduce SD_ELF_NOTE_DLOPEN_ANCHORED() macro
2026-07-10 16:29:54 +09:00
sysupdate
sysupdate: Evaluate all patterns before descending into a subdir
2026-07-10 14:25:38 +02:00
sysusers
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
test
credentials: add policy that can allow key=null creds from the ESP (#42555)
2026-07-10 14:43:12 +02:00
timedate
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
timesync
meson: automate .standalone variant generation via extended 'install' field
2026-07-10 16:29:53 +09:00
tmpfiles
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
tpm2-setup
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
tty-ask-password-agent
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
udev
udev: require exact builtin command matches
2026-07-10 20:41:13 +09:00
ukify
measure: Support binding signed policies to individual phases
2026-07-02 21:28:42 +02:00
update-done
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
update-utmp
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
user-sessions
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
userdb
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
validatefs
dlopen-note: move all dlopen notes to dlopen-note.h
2026-07-10 16:34:26 +09:00
varlinkctl
varlinkctl: add 'list-sockets' verb
2026-06-23 23:10:01 +02:00
vconsole
…
veritysetup
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
version
…
vmspawn
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
volatile-root
tree-wide: embed dlopen notes into individual executables
2026-07-10 16:35:19 +09:00
vpick
vpick: take separate root_fd and dir_fd arguments
2026-06-24 12:59:55 +02:00
xdg-autostart-generator
meson: rename extract+objects to export+import
2026-07-07 13:40:13 +02:00