mirrors/systemd
0
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-05 08:13:48 +08:00
Code Issues Packages Projects Releases Wiki Activity
3304a029b8
systemd/man/systemd.system-credentials.xml

462 lines
21 KiB
XML
Raw Normal View History

man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<?xml version='1.0'?> <!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
man: use same version in public and system ident.
2023-12-25 22:48:33 +08:00
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
man: Add xinclude namespace This will be used by the next commit to add version information to the nodes.
2023-08-23 00:52:02 +08:00
<refentry id="systemd.system-credentials" xmlns:xi="http://www.w3.org/2001/XInclude">
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<refentryinfo>
<title>systemd.system-credentials</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>systemd.system-credentials</refentrytitle>
<manvolnum>7</manvolnum>
</refmeta>
<refnamediv>
<refname>systemd.system-credentials</refname>
<refpurpose>System Credentials</refpurpose>
</refnamediv>
<refsect1>
<title>Description</title>
<para><ulink url="https://systemd.io/CREDENTIALS">System and Service Credentials</ulink> are data objects
that may be passed into booted systems or system services as they are invoked. They can be acquired from
various external sources, and propagated into the system and from there into system services. Credentials
may optionally be encrypted with a machine-specific key and/or locked to the local TPM2 device, and are
only decrypted when the consuming service is invoked.</para>
<para>System credentials may be used to provision and configure various aspects of the system. Depending
on the consuming component credentials are only used on initial invocations or are needed for all
invocations.</para>
<para>Credentials may be used for any kind of data, binary or text, and may carry passwords, secrets,
certificates, cryptographic key material, identity information, configuration, and more.</para>
</refsect1>
<refsect1>
<title>Well known system credentials</title>
man: make sure credentials properly show up in directives index
2023-06-30 16:22:35 +08:00
<variablelist class='system-credentials'>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<varlistentry>
<term><varname>firstboot.keymap</varname></term>
<listitem>
<para>The console key mapping to set (e.g. <literal>de</literal>). Read by
<citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
and only honoured if no console keymap has been configured before.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>firstboot.locale</varname></term>
man: make sure credentials properly show up in directives index
2023-06-30 16:22:35 +08:00
<term><varname>firstboot.locale-messages</varname></term>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<listitem>
<para>The system locale to set (e.g. <literal>de_DE.UTF-8</literal>). Read by
<citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
and only honoured if no locale has been configured before. <varname>firstboot.locale</varname> sets
<literal>LANG</literal>, while <varname>firstboot.locale-message</varname> sets
<literal>LC_MESSAGES</literal>.</para>
man: update version information As I noticed a lot of missing information when trying to implement checking for missing info. I reimplemented the version information script to be more robust, and here is the result. Follow up to ec07c3c80b2b1bfa6788500202006ff85f5ae4f4
2023-09-18 23:03:38 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>firstboot.timezone</varname></term>
<listitem>
<para>The system timezone to set (e.g. <literal>Europe/Berlin</literal>). Read by
<citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
and only honoured if no system timezone has been configured before.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>login.issue</varname></term>
<listitem>
<para>The data of this credential is written to
man: fix links to man pages Done using linkchecker as usual.
2023-02-09 21:30:43 +08:00
<filename>/etc/issue.d/50-provision.conf</filename>, if the file doesn't exist yet.
<citerefentry project='man-pages'><refentrytitle>agetty</refentrytitle><manvolnum>8</manvolnum></citerefentry>
reads this file and shows its contents at the login prompt of terminal logins. See
<citerefentry project='man-pages'><refentrytitle>issue</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details.</para>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<para>Consumed by <filename>/usr/lib/tmpfiles.d/provision.conf</filename>, see
<citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>login.motd</varname></term>
<listitem>
<para>The data of this credential is written to <filename>/etc/motd.d/50-provision.conf</filename>,
man: fix links to man pages Done using linkchecker as usual.
2023-02-09 21:30:43 +08:00
if the file doesn't exist yet.
<citerefentry project='man-pages'><refentrytitle>pam_motd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
reads this file and shows its contents as "message of the day" during terminal logins. See
man: fix links to man pages Done using linkchecker as usual.
2023-02-09 21:30:43 +08:00
<citerefentry project='man-pages'><refentrytitle>motd</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details.</para>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<para>Consumed by <filename>/usr/lib/tmpfiles.d/provision.conf</filename>, see
<citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>network.hosts</varname></term>
<listitem>
<para>The data of this credential is written to <filename>/etc/hosts</filename>, if the file
man: fix links to man pages Done using linkchecker as usual.
2023-02-09 21:30:43 +08:00
doesn't exist yet. See
<citerefentry project='man-pages'><refentrytitle>hosts</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details.</para>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<para>Consumed by <filename>/usr/lib/tmpfiles.d/provision.conf</filename>, see
<citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
resolved: read DNS conf also from creds and kernel cmdline Note that this drops ProtectProc=invisible from systemd-resolved.service. This is done because othewise access to the booted "kernel" command line is not necessarily available. That's because in containers we want to read /proc/1/cmdline for that. Fixes: #24103
2023-01-05 22:35:20 +08:00
<varlistentry>
<term><varname>network.dns</varname></term>
<term><varname>network.search_domains</varname></term>
<listitem>
<para>DNS server information and search domains. Read by
<citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v253"/>
resolved: read DNS conf also from creds and kernel cmdline Note that this drops ProtectProc=invisible from systemd-resolved.service. This is done because othewise access to the booted "kernel" command line is not necessarily available. That's because in containers we want to read /proc/1/cmdline for that. Fixes: #24103
2023-01-05 22:35:20 +08:00
</listitem>
</varlistentry>
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<varlistentry>
network-generator: also copy drop-ins for networkd.conf from credential Follow-up for 1a30285590c2f40f256d0628950ef9243b2c1938.
2024-04-16 10:57:23 +08:00
<term><varname>network.conf.*</varname></term>
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<term><varname>network.link.*</varname></term>
network-generator: also copy drop-ins for networkd.conf from credential Follow-up for 1a30285590c2f40f256d0628950ef9243b2c1938.
2024-04-16 10:57:23 +08:00
<term><varname>network.netdev.*</varname></term>
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<term><varname>network.network.*</varname></term>
<listitem>
<para>Configures network devices. Read by
network-generator: also copy drop-ins for networkd.conf from credential Follow-up for 1a30285590c2f40f256d0628950ef9243b2c1938.
2024-04-16 10:57:23 +08:00
<citerefentry><refentrytitle>systemd-network-generator.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
These credentials should contain valid
<citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
network-generator: also copy drop-ins for networkd.conf from credential Follow-up for 1a30285590c2f40f256d0628950ef9243b2c1938.
2024-04-16 10:57:23 +08:00
<citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
network-generator: also copy drop-ins for networkd.conf from credential Follow-up for 1a30285590c2f40f256d0628950ef9243b2c1938.
2024-04-16 10:57:23 +08:00
configuration data. From each matching credential a separate file is created. Example: the contents
of a credential <filename>network.link.50-foobar</filename> will be copied into a file
<filename>50-foobar.link</filename>.</para>
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<para>Note that the resulting files are created world-readable, it's hence recommended to not include
secrets in these credentials, but supply them via separate credentials directly to
networkd/wireguard: support network.wireguard.* credentials Closes #26702
2023-12-27 21:38:32 +08:00
<filename>systemd-networkd.service</filename>, e.g. <varname>network.wireguard.*</varname>
as described below.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>network.wireguard.*</varname></term>
<listitem>
<para>Configures secrets for WireGuard netdevs. Read by
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
For more information, refer to the <option>[WireGuard]</option> section of
<citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para>
network-generator: pick up .netdev/.link/.network configuration via credentials To me this is the last major basic functionality that couldn't be configured via credentials: the network. We do not invent any new format for this, but simply copy relevant creds 1:1 into /run/systemd/network/ to open up the full functionality of networkd to VM hosts.
2024-01-08 18:25:56 +08:00
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<varlistentry>
<term><varname>passwd.hashed-password.root</varname></term>
<term><varname>passwd.plaintext-password.root</varname></term>
<listitem>
<para>May contain the password (either in UNIX hashed format, or in plaintext) for the root users.
Read by both
<citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
and
<citerefentry><refentrytitle>systemd-sysusers</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
and only honoured if no root password has been configured before.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>passwd.shell.root</varname></term>
<listitem>
<para>The path to the shell program (e.g. <literal>/bin/bash</literal>) for the root user. Read by
both
<citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
and
<citerefentry><refentrytitle>systemd-sysusers</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
and only honoured if no root shell has been configured before.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>ssh.authorized_keys.root</varname></term>
<listitem>
<para>The data of this credential is written to <filename>/root/.ssh/authorized_keys</filename>, if
the file doesn't exist yet. This allows provisioning SSH access for the system's root user.</para>
<para>Consumed by <filename>/usr/lib/tmpfiles.d/provision.conf</filename>, see
<citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
ssh-generator: add simple new generator
2024-01-05 01:39:03 +08:00
<varlistentry>
<term><varname>ssh.listen</varname></term>
<listitem>
<para>May be used to configure SSH sockets the system shall be reachable on. See
<citerefentry><refentrytitle>systemd-ssh-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
for details.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
<varlistentry>
<term><varname>sysusers.extra</varname></term>
<listitem>
<para>Additional
<citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
lines to process during boot.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>sysctl.extra</varname></term>
<listitem>
<para>Additional
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> lines
to process during boot.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
<varlistentry>
<term><varname>tmpfiles.extra</varname></term>
<listitem>
<para>Additional
<citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
lines to process during boot.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v252"/>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</listitem>
</varlistentry>
fstab-generator: optional read addtional fstab lines from credentials Fixes: #27260
2023-06-24 03:51:12 +08:00
<varlistentry>
<term><varname>fstab.extra</varname></term>
<listitem>
<para>Additional mounts to establish at boot. For details, see
<citerefentry><refentrytitle>systemd-fstab-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v254"/>
fstab-generator: optional read addtional fstab lines from credentials Fixes: #27260
2023-06-24 03:51:12 +08:00
</listitem>
</varlistentry>
vconsole: permit configuration of vconsole settings via credentials
2023-01-03 20:05:32 +08:00
<varlistentry>
<term><varname>vconsole.keymap</varname></term>
<term><varname>vconsole.keymap_toggle</varname></term>
<term><varname>vconsole.font</varname></term>
<term><varname>vconsole.font_map</varname></term>
<term><varname>vconsole.font_unimap</varname></term>
<listitem>
<para>Console settings to apply, see
<citerefentry><refentrytitle>systemd-vconsole-setup.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v253"/>
vconsole: permit configuration of vconsole settings via credentials
2023-01-03 20:05:32 +08:00
</listitem>
</varlistentry>
getty-generator: allow configuring additional gettys via credentials
2023-06-24 04:50:34 +08:00
<varlistentry>
<term><varname>getty.ttys.serial</varname></term>
<term><varname>getty.ttys.container</varname></term>
<listitem><para>Used for spawning additional login prompts, see
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<citerefentry><refentrytitle>systemd-getty-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details.</para>
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
getty-generator: allow configuring additional gettys via credentials
2023-06-24 04:50:34 +08:00
</varlistentry>
journald: implement socket forwarding This commit adds a new way of forwarding journal messages - forwarding over a socket. The socket can be any of AF_INET, AF_INET6, AF_UNIUX or AF_VSOCK. The address to connect to is retrieved from the "journald.forward_address" credential. It can also be specified in systemd-journald's unit file with ForwardAddress=
2023-12-21 23:32:15 +08:00
<varlistentry>
<term><varname>journal.forward_to_socket</varname></term>
<listitem>
<para>Used by
<citerefentry><refentrytitle>systemd-journald</refentrytitle><manvolnum>8</manvolnum></citerefentry>
to determine where to forward log messages for socket forwarding, see
<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
journal: Add journal.storage credential In mkosi CI, we want persistent journals when running interactively and runtime journals when running in CI, so let's add a credential that allows us to configure which one to use.
2024-04-30 18:26:27 +08:00
<varlistentry>
<term><varname>journal.storage</varname></term>
<listitem>
<para>Used by
<citerefentry><refentrytitle>systemd-journald</refentrytitle><manvolnum>8</manvolnum></citerefentry>
to determine where to store journal files, see
<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
creds: import 'vmm.notify_socket' and use it to set This is intended to be used with VSOCK, to notify the hypervisor/VMM, eg on the host: qemu <...> -smbios type=11,value=io.systemd.credential:vmm.notify_socket=vsock:2:1234 -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=42 (vsock:2:1234 -> send to host on vsock port 1234, default is to send to 0 which is the hypervisor itself) Also on the host: $ socat - VSOCK-LISTEN:1234,socktype=5 READY=1 STATUS=Ready.
2023-01-04 01:11:04 +08:00
<varlistentry>
<term><varname>vmm.notify_socket</varname></term>
<listitem>
man: document vmm.notify_socket credential in systemd(1) man page Let's move the long explanation to the man page of the component that interprets the credential, and keep only a brief summary in systemd.system-credentials(7).
2023-06-29 00:20:01 +08:00
<para>Configures an
<citerefentry><refentrytitle>sd_notify</refentrytitle><manvolnum>3</manvolnum></citerefentry>
compatible <constant>AF_VSOCK</constant> socket the service manager will report status information,
ready notification and exit status on. For details see
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v253"/>
creds: import 'vmm.notify_socket' and use it to set This is intended to be used with VSOCK, to notify the hypervisor/VMM, eg on the host: qemu <...> -smbios type=11,value=io.systemd.credential:vmm.notify_socket=vsock:2:1234 -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=42 (vsock:2:1234 -> send to host on vsock port 1234, default is to send to 0 which is the hypervisor itself) Also on the host: $ socat - VSOCK-LISTEN:1234,socktype=5 READY=1 STATUS=Ready.
2023-01-04 01:11:04 +08:00
</listitem>
shell: define three system credentials we can propagate into shell prompts and welcome messages
2024-09-06 22:30:54 +08:00
</varlistentry>
<varlistentry>
<term><varname>shell.prompt.prefix</varname></term>
<term><varname>shell.prompt.suffix</varname></term>
<listitem>
<para>Defines strings to prefix and suffix any interactive UNIX shell prompt with. For details see
<citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v257"/>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>shell.welcome</varname></term>
<listitem>
<para>Define a string to print when an interactive UNIX shell initializes. For details see
<citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v257"/>
</listitem>
creds: import 'vmm.notify_socket' and use it to set This is intended to be used with VSOCK, to notify the hypervisor/VMM, eg on the host: qemu <...> -smbios type=11,value=io.systemd.credential:vmm.notify_socket=vsock:2:1234 -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=42 (vsock:2:1234 -> send to host on vsock port 1234, default is to send to 0 which is the hypervisor itself) Also on the host: $ socat - VSOCK-LISTEN:1234,socktype=5 READY=1 STATUS=Ready.
2023-01-04 01:11:04 +08:00
</varlistentry>
core: consult credentials for machine ID to use for host Let's hook up one more thing with credentials: the machine ID to use when none is initialized yet. This requires some reordering of initialization steps in PID 1: we need to import credentials first, and only then initialize the machine ID.
2023-06-29 00:11:15 +08:00
<varlistentry>
<term><varname>system.machine_id</varname></term>
<listitem>
<para>Takes a 128bit ID to initialize the machine ID from (if it is not set yet). Interpreted by
the service manager (PID 1). For details see
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
hostname-setup: read hostname from system.hostname credential `system.hostname` credential is treated similarly to the pre-existing `system.machine_id` credential. It is considered after /etc/hostname, but prior to the kernel defaults or os-release defaults. Fixes #30667. Signed-off-by: Ivan Shapovalov <intelfx@intelfx.name>
2024-01-07 10:01:28 +08:00
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>system.hostname</varname></term>
<listitem>
<para>Accepts a (transient) hostname to configure during early boot. The static hostname specified
in <filename>/etc/hostname</filename>, if configured, takes precedence over this setting.
Interpreted by the service manager (PID 1). For details see
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
man: add version info This tries to add information about when each option was added. It goes back to version 183. The version info is included from a separate file to allow generating it, which would allow more control on the formatting of the final output.
2023-08-23 00:52:36 +08:00
<xi:include href="version-info.xml" xpointer="v254"/>
core: consult credentials for machine ID to use for host Let's hook up one more thing with credentials: the machine ID to use when none is initialized yet. This requires some reordering of initialization steps in PID 1: we need to import credentials first, and only then initialize the machine ID.
2023-06-29 00:11:15 +08:00
</listitem>
</varlistentry>
homectl: add "firstboot" command This extends what systemd-firstboot does and runs on first boots only and either processes user records passed in via credentials to create, or asks the user interactively to create one (only if no regular user exists yet).
2023-11-22 17:58:14 +08:00
<varlistentry>
<term><varname>home.create.*</varname></term>
<listitem>
<para>Creates a home area for the specified user with the user record data passed in. For details see
<citerefentry><refentrytitle>homectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
man: tweak cryptsetup credentials docs a bit Let's bring the credentials into a better order, in order of relevance. Also, let's clarify what the generic LUKS PIN is about. Finally, list the credentials in system-credentials(7) too, after all people might want to unlock a disk with this via SMBIOS Type 11 or so.
2024-02-20 01:21:31 +08:00
<varlistentry>
<term><varname>cryptsetup.passphrase</varname></term>
<term><varname>cryptsetup.tpm2-pin</varname></term>
<term><varname>cryptsetup.fido2-pin</varname></term>
<term><varname>cryptsetup.pkcs11-pin</varname></term>
<term><varname>cryptsetup.luks2-pin</varname></term>
<listitem>
<para>Specifies the passphrase/PINs to use for unlock encrypted storage volumes. For details see
<citerefentry><refentrytitle>systemd-cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
debug-generator: Add unit and drop-in credentials These allow adding extra units and drop-ins via credentials.
2024-04-01 04:18:19 +08:00
<varlistentry>
<term><varname>systemd.extra-unit.*</varname></term>
<term><varname>systemd.unit-dropin.*</varname></term>
<listitem><para>These credentials specify extra units and drop-ins to add to the system. For details
see <citerefentry><refentrytitle>systemd-debug-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
</varlistentry>
units: introduce systemd-udev-load-credentials.service
2024-04-05 03:04:31 +08:00
<varlistentry>
<term><varname>udev.conf.*</varname></term>
<term><varname>udev.rules.*</varname></term>
<listitem>
<para>Configures udev configuration file and udev rules. Read by
<filename>systemd-udev-load-credentials.service</filename>, which invokes
<command>udevadm control --load-credentials</command>. These credentials directly translate to a
matching
<citerefentry><refentrytitle>udev.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> or
<citerefentry><refentrytitle>udev</refentrytitle><manvolnum>7</manvolnum></citerefentry> rules
file. Example: the contents of a credential
<filename>udev.conf.50-foobar</filename> will be copied into a file
<filename>/run/udev/udev.conf.d/50-foobar.conf</filename>, and
<filename>udev.rules.50-foobar</filename> will be copied into a file
<filename>/run/udev/rules.d/50-foobar.rules</filename>. See
<citerefentry><refentrytitle>udev</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry><refentrytitle>udev.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and
<citerefentry><refentrytitle>udevadm</refentrytitle><manvolnum>8</manvolnum></citerefentry>
for details.</para>
<xi:include href="version-info.xml" xpointer="v256"/>
</listitem>
</varlistentry>
import: add generator that synthesizes download jobs from kernel cmdline
2024-06-25 15:55:16 +08:00
<varlistentry>
<term><varname>import.pull</varname></term>
<listitem>
<para>Specified disk images (tarballs and DDIs) to automatically download and install at boot. For details see
<citerefentry><refentrytitle>systemd-import-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v257"/>
</listitem>
</varlistentry>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</variablelist>
</refsect1>
<refsect1>
<title>See Also</title>
man: use <simplelist> for 'See also' sections This is just a slight markup improvement; there should be no difference in rendering.
2023-12-23 02:09:32 +08:00
<para><simplelist type="inline">
<member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
<member><citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
<member><citerefentry><refentrytitle>smbios-type-11</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
</simplelist></para>
man: add man page decribing well known system credentials
2022-09-16 22:58:00 +08:00
</refsect1>
</refentry>
Reference in New Issue Copy Permalink