dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-03 14:40:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

creds-util: add helper for querying system credential dirs

Browse Source 
The dirs are constant string, but let's make them overridable via env
vars for debugging purposes.
This commit is contained in:
Lennart Poettering
2024-06-10 14:53:38 +02:00
parent c30e3d7290
commit ffe958b98f
4 changed files with 40 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/creds/creds.c
View File

@@ -148,17 +148,14 @@ static int open_credential_directory(
if (arg_system)
/* PID 1 ensures that system credentials are always accessible under the same fixed path. It
* will create symlinks if necessary to guarantee that. */
p = encrypted ?
ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY :
SYSTEM_CREDENTIALS_DIRECTORY;
else {
r = (encrypted ? get_encrypted_system_credentials_dir : get_system_credentials_dir)(&p);
else
/* Otherwise take the dirs from the env vars we got passed */
r = (encrypted ? get_encrypted_credentials_dir : get_credentials_dir)(&p);
if (r == -ENXIO) /* No environment variable? */
goto not_found;
if (r < 0)
return log_error_errno(r, "Failed to get credentials directory: %m");
}
if (r == -ENXIO) /* No environment variable? */
goto not_found;
if (r < 0)
return log_error_errno(r, "Failed to get credentials directory: %m");
d = opendir(p);
if (!d) {

24
src/shared/creds-util.c
View File

@@ -125,6 +125,30 @@ int open_credentials_dir(void) {
return RET_NERRNO(open(d, O_CLOEXEC|O_DIRECTORY));
}
int get_system_credentials_dir(const char **ret) {
int r;
/* Note that for system credentials the environment variable we honour is just for debugging purpose
* (unlike for the per-service credential path env var where it's key part of the protocol). */
r = get_credentials_dir_internal("SYSTEMD_SYSTEM_CREDENTIALS_DIRECTORY", ret);
if (r >= 0 || r != -ENXIO)
return r;
*ret = SYSTEM_CREDENTIALS_DIRECTORY;
return 0;
}
int get_encrypted_system_credentials_dir(const char **ret) {
int r;
r = get_credentials_dir_internal("SYSTEMD_ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY", ret);
if (r >= 0 || r != -ENXIO)
return r;
*ret = ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY;
return 0;
}
int read_credential(const char *name, void **ret, size_t *ret_size) {
_cleanup_free_ char *fn = NULL;
const char *d;

4
src/shared/creds-util.h
View File

@@ -33,6 +33,10 @@ int open_credentials_dir(void);
#define SYSTEM_CREDENTIALS_DIRECTORY "/run/credentials/@system"
#define ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY "/run/credentials/@encrypted"
/* Where system creds have been passed */
int get_system_credentials_dir(const char **ret);
int get_encrypted_system_credentials_dir(const char **ret);
int read_credential(const char *name, void **ret, size_t *ret_size); /* use in services! */
int read_credential_with_decryption(const char *name, void **ret, size_t *ret_size); /* use in generators + pid1! */

9
src/shared/tpm2-util.c
View File

@@ -7065,9 +7065,12 @@ int tpm2_pcrlock_policy_from_credentials(
* multi-boot), hence we use the SRK and NV data from the LUKS2 header as search key, and parse all
* such JSON policies until we find a matching one. */
const char *cp = secure_getenv("SYSTEMD_ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY") ?: ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY;
const char *dp;
r = get_encrypted_system_credentials_dir(&dp);
if (r < 0)
return log_error_errno(r, "Failed to get encrypted system credentials directory: %m");
dfd = open(cp, O_CLOEXEC|O_DIRECTORY);
dfd = open(dp, O_CLOEXEC|O_DIRECTORY);
if (dfd < 0) {
if (errno == ENOENT) {
log_debug("No encrypted system credentials passed.");
@@ -7100,7 +7103,7 @@ int tpm2_pcrlock_policy_from_credentials(
if (r == -ENOENT)
continue;
if (r < 0) {
log_warning_errno(r, "Failed to read credentials file %s/%s, skipping: %m", ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY, d->d_name);
log_warning_errno(r, "Failed to read credentials file %s/%s, skipping: %m", dp, d->d_name);
continue;
}