Yu Watanabe
eca248640b
netlink: fix size of fib rule messages
2020-12-18 13:27:44 +09:00
Yu Watanabe
8940baac4d
meson: sort files
2020-12-18 13:27:44 +09:00
Yu Watanabe
479667c497
nspawn: sort headers
2020-12-18 13:27:44 +09:00
Yu Watanabe
ce9dc1fd8b
netlink: fix indentation
2020-12-18 13:27:44 +09:00
Yu Watanabe
a73f080727
netlink: drop unnecessary error handling
2020-12-18 13:27:44 +09:00
Yu Watanabe
faa0d69c6c
netlink: use whitespace instead of tab
2020-12-18 13:27:44 +09:00
Yu Watanabe
f6dab7489e
sd-netlink: add several assertions
2020-12-18 13:27:40 +09:00
Yu Watanabe
2d1ad72456
sd-netlink: replace *messages[] -> **messages
2020-12-18 13:11:06 +09:00
Yu Watanabe
ec87f63c0e
meson: add missing headers
2020-12-18 13:05:19 +09:00
Yu Watanabe
517fdd61ed
network: move variable declaration
2020-12-18 13:00:57 +09:00
Yu Watanabe
458610429f
tree-wide: fix typo
2020-12-18 12:59:29 +09:00
Susant Sahani
d7d1d18fd2
network: Allow to configure unreachable/blackhole RoutingPolicyRule ( #17984 )
2020-12-18 12:21:15 +09:00
Lennart Poettering
5cd35a171c
Merge pull request #17741 from poettering/cryptsetup-fido2
...
cryptsetup: add support for unlocking cryptsetup volumes via FIDO2 + TPM2 + add systemd-cryptenroll tool + more
2020-12-17 22:37:22 +01:00
Lennart Poettering
80670e748d
update TODO
2020-12-17 20:03:04 +01:00
Lennart Poettering
5e85016b1f
mkosi: add TPM2 packages to debian/ubuntu/fedora mkosi files
...
As suggested: https://github.com/systemd/systemd/pull/17741#issuecomment-743479834
2020-12-17 20:03:00 +01:00
Lennart Poettering
cf1e172d58
man: document new features
2020-12-17 20:02:32 +01:00
Lennart Poettering
1abaa19781
fido2: when listing fido2/hmac-secret devices, actually validate feature set
2020-12-17 20:02:28 +01:00
Lennart Poettering
a60d5b2f38
test: add tpm2 and fido2 libs to dlopen test
2020-12-17 20:02:24 +01:00
Lennart Poettering
889914ef6c
repart: optionally lock encrypted partitions to TPM2
...
This useful for bootstrapping encrypted systems: on first boot let's
create a /var/ partition that is locked to the local TPM2.
2020-12-17 20:02:20 +01:00
Lennart Poettering
5f0ab16198
string-table: add private version of lookup macro with boolean fallback
2020-12-17 20:02:14 +01:00
Lennart Poettering
18843ecc2a
cryptsetup: add support for TPM2 unlocking of volumes
2020-12-17 20:02:03 +01:00
Lennart Poettering
d2fafc423d
cryptenroll: support listing and wiping tokens
2020-12-17 20:01:52 +01:00
Lennart Poettering
5e521624f2
cryptenroll: add support for TPM2 enrolling
2020-12-17 20:01:31 +01:00
Lennart Poettering
2d64d2b955
json: add APIs for quickly inserting hex blobs into as JSON strings
...
This is similar to the base64 support, but fixed-size hash values are
typically preferably presented as series of hex values, hence store them
here like that too.
2020-12-17 20:01:17 +01:00
Lennart Poettering
1403d48d61
sort-util: make cmp_int() generic, so that we can reuse it elsewhere
2020-12-17 20:01:02 +01:00
Lennart Poettering
8710a6818e
cryptenroll: add new "systemd-cryptenroll" tool for enrolling FIDO2+PKCS#11 security tokens
2020-12-17 20:00:51 +01:00
Lennart Poettering
2bc5c425e6
cryptsetup: add fido2 support
2020-12-17 20:00:41 +01:00
Lennart Poettering
e3fb662b67
fido2: don't use up/uv/rk when device doesn't support it
...
Apparently devices are supposed to generate failures if we try to turn
off features they don't have. Thus don't.
Prompted-by: https://github.com/systemd/systemd/issues/17784#issuecomment-737730395
2020-12-17 20:00:27 +01:00
Lennart Poettering
ebcb3f38d2
homed: split out HMAC-HASH fido2 decode code into src/shared/
...
That way we can use it later on in systemd-cryptsetup to unlock devices
with FIDO2 tokens.
2020-12-17 20:00:15 +01:00
Lennart Poettering
17599e129b
homed: move fido2 setup code to src/shared/
...
That way we can reuse it from systemd-cryptenroll
2020-12-17 20:00:03 +01:00
Lennart Poettering
fb2d839c06
homed: move fido2 device enumeration logic to shared code
2020-12-17 19:59:50 +01:00
Lennart Poettering
69cb28965b
homed: turn libfido2 into a dlopen() type dependency
2020-12-17 19:59:32 +01:00
Lennart Poettering
b8c80b56d1
cryptsetup: split up attach_luks_or_plain_or_bitlk() into smaller functions
...
Just some refactoring.
2020-12-17 19:59:28 +01:00
Lennart Poettering
b997d1115b
cryptsetup: read PKCS#11 key and token info from LUKS2 metadata
...
Optionally, embedd PKCS#11 token URI and encrypted key in LUKS2 JSON
metadata header. That way it becomes very easy to unlock properly set up
PKCS#11-enabled LUKS2 volumes, a simple /etc/crypttab line like the
following suffices:
mytest /dev/disk/by-partuuid/41c1df55-e628-4dbb-8492-bc69d81e172e - pkcs11-uri=auto
Such a line declares that unlocking via PKCS#11 shall be attempted, and
the token URI and the encrypted key shall be read from the LUKS2 header.
An external key file for the encrypted PKCS#11 key is hence no longer
necessary, nor is specifying the precise URI to use.
2020-12-17 19:59:24 +01:00
Lennart Poettering
d3ad474f0c
cryptsetup: be more careful with erasing key material from memory
2020-12-17 19:59:20 +01:00
Lennart Poettering
8414cd48e9
cryptsetup: split code that allocates udev security device monitor into its own function
2020-12-17 19:59:17 +01:00
Lennart Poettering
4760384d53
cryptsetup-util: add helper for setting minimal PBKDF
2020-12-17 19:59:04 +01:00
Lennart Poettering
4098bc134e
cryptsetup-util: add helper call for extracting/parsing token JSON
2020-12-17 19:58:52 +01:00
Lennart Poettering
f240cbb645
homed: move code to list and resolve "auto" pkcs#11 URL into common code
...
That way we can reuse it from systemd-cryptenroll.
2020-12-17 19:58:39 +01:00
Lennart Poettering
d041e4fc4a
homed: split out code that determines suitable LUKS passphrase size from RSA key
...
We can use this in cryptenroll later on, hence let's make this generic.
2020-12-17 19:58:26 +01:00
Lennart Poettering
2289a78473
homed: move pkcs11 LUKS glue into shared code
...
That way we can lter reuse it from cryptsetup/cryptenroll too.
2020-12-17 19:58:14 +01:00
Lennart Poettering
f2d5df8a30
homed: move helper calls for RSA encryption to shared code
2020-12-17 19:57:57 +01:00
Lennart Poettering
73d874bacd
homed: move homectl's recovery key generation/modhex code to src/shared/
...
This allows us to later reuse the code to generate recovery keys for
traditional LUKS volumes, too and share the code.
2020-12-17 19:57:18 +01:00
Lennart Poettering
95231c7215
test: fix fd_is_mount_point() check
...
So the currentl and only fd_is_mount_point() check is actually entirely
bogus: it passes "/" as filename argument, but that's not actually a
a valid filename, but an absolute path.
fd_is_mount_point() is written in a way tha the fd refers to a directory
and the specified path is a file directly below it that shall be
checked. The test call actually violated that rule, but still expected
success.
Let's fix this, and check for this explicitly, and refuse it.
Let's extend the test and move it to test-mountpoint-util.c where the
rest of the tests for related calls are placed.
Replaces: #18004
Fixes : #17950
2020-12-17 19:29:24 +01:00
Lennart Poettering
8b08be4052
tree-wide: suggest meson command lines instead of ninja ones
...
This only changes documentation. In various places we call "ninja"
directly. I figured it would be safer to leave those in place for now,
given the meson replacement commands lines appears to be supported in
newer meson versions only.
2020-12-17 16:51:48 +01:00
Zbigniew Jędrzejewski-Szmek
68f18549c5
Merge pull request #18001 from systemd/wip/hadess/unsupported-dmi
...
meson: Disable dmi_memory_id on arches without DMI
2020-12-17 09:16:33 +01:00
Lennart Poettering
ddbf960574
terminal-util: use 256 color mode for PID 1 output, too
...
Follow-up for: #17702
Alsoe, see earlier review comment: https://github.com/systemd/systemd/pull/17702#pullrequestreview-552329600
2020-12-17 09:15:26 +01:00
Frantisek Sumsal
0ce96f4152
Merge pull request #17998 from mrc0mmand/qemu-drop-trailing-whitespace
...
test: drop the trailing whitespace from the QEMU version check
2020-12-16 23:48:17 +01:00
Lennart Poettering
e4dde4e87d
Merge pull request #17702 from rnhmjoj/master
...
Extend $SYSTEMD_COLORS to switch colors mode
2020-12-16 19:26:40 +01:00
Bastien Nocera
2bfb92a978
meson: Disable dmi_memory_id on arches without DMI
2020-12-16 19:21:19 +01:00