Lennart Poettering 5cead3f269
credentials: add policy that can allow key=null creds from the ESP ( #42555 ) ...
This PR only sets the default to "relaxed" - I can change the default
to "tofu" if desired. But for that we will also need to update the NEWS
file to ensure everyone is aware of this new default.
---
This PR adds a new `systemd.credentials-boot=` kernel
commandline that allows to control if credentials with
a `null` key are accepted.
The possible options are:
* strict: always insist on tpm encryption
* tofu: allow null encryption in firstboot mode and when no tpm is
available
* relaxed: allow null encryption when sb is off, or no tpm is available
* off: allow null encryption always
The default is `relaxed` which is exactly the behavior we had before.
This replaces the initial idea of using plaintext credentials
at firstboot (thanks to Lennart for this nicer and simpler design).
---
With that we can drop `- firstboot: optionally accept credentials at
firstboot without authentication` from TODO.md
2026-07-10 14:43:12 +02:00
2026-01-31 01:11:11 +09:00
2026-04-14 17:32:37 +01:00
2022-05-21 18:09:50 +02:00
2026-02-12 17:49:19 +00:00
2019-12-11 17:04:20 +01:00
2024-11-29 14:18:15 +01:00
2024-04-17 20:53:49 +02:00
2021-10-18 09:43:18 +02:00
2021-06-24 10:20:29 +02:00
2026-01-31 01:11:11 +09:00
2024-07-12 14:38:09 +01:00
2026-02-09 11:01:15 +01:00
2026-01-31 01:11:11 +09:00
2025-11-12 23:01:35 +00:00
2026-01-31 01:11:11 +09:00
2026-05-21 21:44:06 +01:00
2024-02-23 09:48:47 +01:00
2026-02-18 03:28:12 +09:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2025-04-25 00:42:24 +01:00
2024-03-27 07:11:55 +01:00
2026-03-24 17:55:26 +01:00
2026-06-01 10:55:40 +01:00
2026-04-13 16:41:33 +01:00
2026-06-17 09:59:34 +00:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2024-12-19 15:35:55 +01:00
2026-01-31 01:11:11 +09:00
2026-07-09 16:48:26 +02:00
2024-06-03 15:22:54 +09:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2022-11-02 07:31:18 +09:00
2025-07-07 17:28:47 +00:00
2026-01-31 01:11:11 +09:00
2025-11-19 20:00:25 +01:00
2024-12-19 15:35:55 +01:00
2026-07-10 14:01:24 +02:00
2025-03-05 12:38:30 +01:00
2026-01-31 01:11:11 +09:00
2019-12-11 17:04:20 +01:00
2026-02-12 17:49:19 +00:00
2026-05-21 10:14:08 +01:00
2025-09-24 08:48:17 +02:00
2025-05-14 18:06:04 +02:00
2025-12-28 09:31:47 +00:00
2026-05-19 13:35:19 +01:00
2026-02-09 02:36:50 +01:00
2026-01-16 22:56:08 +09:00
2026-06-06 13:44:49 +01:00
2024-04-17 21:21:23 +02:00
2026-01-31 01:11:11 +09:00
2026-03-12 09:37:24 +01:00
2026-01-31 01:11:11 +09:00
2026-04-09 22:47:10 +02:00
2025-10-24 01:52:59 +09:00
2025-11-25 22:52:10 +09:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2025-12-18 10:50:23 +01:00
2025-11-19 20:00:25 +01:00
2025-12-31 10:59:41 -05:00
2026-01-29 00:40:18 +09:00
2026-02-01 09:40:10 +01:00
2026-01-31 01:11:11 +09:00
2025-11-23 17:16:09 +01:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2026-07-02 15:05:14 +01:00
2026-01-31 01:11:11 +09:00
2026-02-09 09:36:53 +01:00
2026-01-31 01:11:11 +09:00
2025-07-22 18:03:39 +01:00
2026-01-29 00:40:18 +09:00
2026-02-12 17:49:19 +00:00
2026-06-01 15:06:20 +01:00
2024-04-17 21:21:23 +02:00
2026-03-12 09:38:03 +01:00
2026-01-31 01:11:11 +09:00
2024-03-27 07:17:08 +01:00
2026-01-30 13:19:33 +09:00
2026-01-31 01:11:11 +09:00
2025-04-16 08:30:25 +09:00
2026-01-31 01:11:11 +09:00
2024-04-17 21:21:23 +02:00
2026-07-02 21:51:54 +02:00
2026-05-14 08:55:44 +02:00
2024-02-23 09:48:47 +01:00
2026-02-24 18:29:37 +01:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2024-04-17 21:21:23 +02:00
2026-03-18 17:33:22 -04:00
2026-01-31 01:11:11 +09:00
2026-04-14 13:37:02 +02:00
2024-03-15 04:04:01 +09:00
2026-01-31 01:11:11 +09:00
2026-01-31 01:11:11 +09:00
2024-03-27 07:31:54 +01:00
2024-03-27 07:11:50 +01:00
2026-04-02 12:55:33 +02:00
5cead3f269
