Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

systemd-homed: various fixups #839

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

systemd-homed: various fixups #839

wants to merge 9 commits into from
+69 −1

Commits on Nov 28, 2024

  1. systemd_stream_connect_homed: new interface to access account info 

    systemd-homed provides a varlink API with a unix socket at
/run/systemd/userdb/io.systemd.Home to query user account records. As
quite a few things will need to be able to query this API for basic
functionality to work - such as `groups(1)` being able to operate on
systemd-homed user accounts - let's make an interface for this.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    c90195b View commit details
    Browse the repository at this point in the history

  2. locallogin: allow talking to systemd-homed user record APIs 

    systemd-homed user records rely on being able to talk to the dbus and
varlink APIs provided to obtain basic account information such as user
id, name, group membership, etc as they do not have /etc/passwd,
/etc/group or /etc/shadow fields. For tty login to work for homed user
accounts, local_login_t needs to be able to lookup this information, so
let's grant it the ability to.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    0b129ea View commit details
    Browse the repository at this point in the history

  3. systemd_homed_t, systemd_homework_t: allow reading of /etc/machine-id 

    systemd-homed user records stored in identity files are machine-id
specific and signed, so systemd-homed needs access to /etc/machine-id to
create those records properly.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    8ee5070 View commit details
    Browse the repository at this point in the history

  4. systemd-homed: label LUKS home images as systemd_homed_storage_t 

    systemd-homed stores LUKS home images as `/home/username.home`, so let's
label that appropriately.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    5a6334a View commit details
    Browse the repository at this point in the history

  5. authlogin: connect to homed 

    For commands such as `groups(1)` to work, nsswitch_domain needs to be
able to talk to /run/systemd/userdb/io.systemd.Home to obtain
information on systemd-homed users.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    5b382a4 View commit details
    Browse the repository at this point in the history

  6. systemd_homed_runtime_work_dir_t: new type for systemd-homed workdir 

    As systemd-homed's workdir is an internal one, and external domains may
be (reasonably) expected to connect to systemd_homed_runtime_t in the
future, let's create a new domain for systemd-homed's internal work to
differentiate between the two.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    b1babb9 View commit details
    Browse the repository at this point in the history

  7. lvm_manage_runtime_dirs: new interface for managing LVM runtime dirs 

    Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    a74dd7b View commit details
    Browse the repository at this point in the history

  8. systemd_homework_t: allow managing of lvm_runtime_t files and dirs 

    systemd-homed needs access to `/run/cryptsetup` to properly setup and
unlock LUKS encrypted home directories.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    76febf5 View commit details
    Browse the repository at this point in the history

  9. systemd_homed_record_t: new type for user records 

    As systemd identity files contain sensitive data, such as password
hashes, let's create a new type systemd_homed_record_t for them. As
systemd_homework_t needs to be able to read, create, and delete these
files, let's give it permissions to do so.

Signed-off-by: Rahul Sandhu <[email protected]>
    @WavyEbuilder
    WavyEbuilder committed Nov 28, 2024
    Configuration menu
    Copy the full SHA
    cfeefc0 View commit details
    Browse the repository at this point in the history