mirrors/systemd
0
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-30 13:53:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #34548 from SimonPilkington/fix-creds-cat

Browse Source 
creds: fix cat with encrypted credentials
This commit is contained in:
Mike Yuan 2024-09-27 20:51:57 +02:00 committed by GitHub
commit 6fd58537e5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
NEWS
View File

@ -11,7 +11,12 @@ CHANGES WITH 257 in spe:
be updated accordingly. This change has been made to make it harder
to accidentally delete too many files when using --purge incorrectly.
Announcements of Future Feature Removals and Incompatible Changes:
* The systemd-creds 'cat' verb now expects base64-encoded encrypted
credentials for consistency with the 'decrypt' verb and the
LoadCredentialEncrypted= service setting. Previously it could only
read raw binary data.
Announcements of Future Feature Removals and Incompatible Changes:
* Support for automatic flushing of the nscd user/group database caches
has been dropped.

6
src/creds/creds.c
View File

@ -434,10 +434,14 @@ static int verb_cat(int argc, char **argv, void *userdata) {
if (!d) /* Not set */
continue;
ReadFullFileFlags flags = READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE;
if (encrypted)
flags |= READ_FULL_FILE_UNBASE64;
r = read_full_file_full(
dirfd(d), *cn,
UINT64_MAX, SIZE_MAX,
READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE,
flags,
NULL,
(char**) &data, &size);
if (r == -ENOENT) /* Not found */

4
test/units/TEST-54-CREDS.sh
View File

@ -43,8 +43,8 @@ CRED_DIR="$(mktemp -d)"
ENC_CRED_DIR="$(mktemp -d)"
echo foo >"$CRED_DIR/secure-or-weak"
echo foo >"$CRED_DIR/insecure"
echo foo | systemd-creds --name="encrypted" encrypt - - | base64 -d >"$ENC_CRED_DIR/encrypted"
echo foo | systemd-creds encrypt - - | base64 -d >"$ENC_CRED_DIR/encrypted-unnamed"
echo foo | systemd-creds --name="encrypted" encrypt - "$ENC_CRED_DIR/encrypted"
echo foo | systemd-creds encrypt - "$ENC_CRED_DIR/encrypted-unnamed"
chmod -R 0400 "$CRED_DIR" "$ENC_CRED_DIR"
chmod -R 0444 "$CRED_DIR/insecure"
mkdir /tmp/empty/