mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 05:17:24 +00:00
Michael Vogt
7321925477
With the varlink protocol upgrade feature we can use provide
file system access via varlink easily by re-using the existing
sftp standard. SFTP is independant of ssh and provides a well
defined and widely used file transfer protocol.
So here we add two new (optional) varlink interfaces:
- io.systemd.Sftp.Root.Connect
- io.systemd.Sftp.RootReadOnly.Connect
They are behind polkit auth as io.systemd.sftp.root{,-read-only}.
Note that handing this is out is equivalent for giving root
access: even ReadOnly mode will allow to read secrets like
/etc/shadow so its inherently risky. The two actions mostly
exist to prevent accidents not as a (strong) protection
boundary. The unit description warns about this and the polkit
prompt also describes the full implications.
The use cases are:
- file access via the varlink-http-bridge [1]
- file access over AF_VSOCK
The install is optional and turned off by default.
[1] https://github.com/systemd/varlink-http-bridge
25 lines
722 B
Plaintext
25 lines
722 B
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Varlink SFTP Server Socket (root, read-write)
|
|
Documentation=man:varlinkctl(1)
|
|
ConditionPathExists={{SFTP_SERVER}}
|
|
|
|
[Socket]
|
|
ListenStream=/run/systemd/io.systemd.Sftp.Root
|
|
Symlinks=/run/varlink/registry/io.systemd.Sftp.Root
|
|
SocketMode=0666
|
|
RemoveOnStop=yes
|
|
XAttrEntryPoint=user.varlink=entrypoint
|
|
XAttrListen=user.varlink=listen
|
|
|
|
[Install]
|
|
WantedBy=sockets.target
|