mirror of
https://github.com/systemd/systemd.git
synced 2026-08-09 09:32:04 +00:00
eb6e5b07f1
This service's job is to talk to a VM associated IMDS service provided by the local Cloud. It tries to abstract the protocol differences various IMDS implementations implement, but does *not* really try to abstract more than a few basic fields of the actual IMDS metadata. IMDS access is wrapped in a Varlink API that local clients can talk to. If possible this makes use of the IMDS endpoint information that has been added to hwdb in the preceeding commit. However, endpoint info can also be provided via kernel command line and credentials. For debugging purposes we also accept them via environment variables and command line arguments. This adds a concept of early-boot networking, just enough to be able to talk to the IMDS service. It is minimally configurable via a kernel cmdline option (and a build-time option): the user may choose between "locked" and "unlocked" mode. In the former mode direct access to IMDS via HTTPS is blocked via a prohibit route (and thus all IMDS communication has to be done via systemd-imdsd@.service). In the latter case no such lockdown takes place, and IMDS may be acquired both via this new service and directly. The latter is typically a good idea for compatibility with current systems, the former is preferable for secure installations. Access to IMDS fields is controlled via PK.
29 lines
1008 B
SYSTEMD
29 lines
1008 B
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Cloud Instance Metadata Access (IMDS)
|
|
Documentation=man:systemd-imdsd@.service(8)
|
|
DefaultDependencies=no
|
|
Conflicts=shutdown.target initrd-switch-root.target
|
|
Before=shutdown.target initrd-switch-root.target
|
|
After=sys-devices-virtual-dmi-id.device
|
|
|
|
[Service]
|
|
ExecStart=-{{LIBEXECDIR}}/systemd-imdsd
|
|
User=systemd-imds
|
|
RuntimeDirectory=systemd/imds
|
|
RuntimeDirectoryPreserve=yes
|
|
# CAP_NET_ADMIN is required to set SO_FWMARK and bypass the routing restrictions, and CAP_NET_BIND_SERVICE to bind to a low port
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
ImportCredential=imds.*
|