diff options
author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2020-08-26 10:32:30 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-08-26 10:32:30 +0200 |
commit | b6abc2acb4a56344db90eefa36a989e6b7ded34d (patch) | |
tree | 06886aa661c18d7acfdd0b1d95a8b9ec9a449997 /TODO | |
parent | 8b5cb69bc8b70d1dcc39ed2165907723099bd9d8 (diff) | |
parent | fabece9ccb77e773bd5e9ac91edfa841e2d78f38 (diff) | |
download | systemd-b6abc2acb4a56344db90eefa36a989e6b7ded34d.tar.gz |
Merge pull request #16568 from poettering/creds-store
credentials logic to pass privileged data to services
Diffstat (limited to 'TODO')
-rw-r--r-- | TODO | 20 |
1 files changed, 12 insertions, 8 deletions
@@ -119,14 +119,18 @@ Features: * seccomp: maybe merge all filters we install into one with that libseccomp API that allows merging. -* per-service credential system. Specifically: add LoadCredential= (for loading - cred from file), AcquireCredential= (for asking user for cred, via - ask-password), PassCredential= (for passing on credential systemd itself - got). Then, place credentials in a per-service, immutable ramfs instance (so - that it cannot be swapped out), destroy after use. Also pass via keyring - (with graceful fallback to cover for containers). Define CredentialPath= for - defining subdir of /run/credentials/ where to place it. Set $CREDENTIAL_PATH - env var for services to the result. Also pass via fd passing (optionally). +* credentials system: + - maybe add AcquireCredential= for querying a cred via ask-password + - maybe try to acquire creds via keyring? + - maybe try to pass creds via keyring? + - maybe optionally pass creds via memfd + - maybe add support for decrypting creds via TPM + - maybe add support for decrypting/importing creds via pkcs11 + - make systemd-cryptsetup acquire pw via creds logic + - make PAMName= acquire pw via creds logic + - make macsec/wireguard code in networkd read key via creds logic + - make gatwayd/remote read key via creds logic + - add sd_notify() command for flushing out creds not needed anymore * homed: during login resize fs automatically towards size goal. Specifically, resize to diskSize if possible, but leave a certain amount (configured by a |