shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Code
d51236d833
systemd/mime/io.systemd.xml

47 lines
1.9 KiB
XML
Raw Normal View History

mime: register confext/sysext images in shared-mime-info This make them recognized by file managers and stuff. Maybe one day we should properly register mime types in the "vnd." namespace with IANA, but I am too lazy to deal with the bureaucracy for that, hence let's stick with the x. namespace for now. This defines confext/sysext DDIs as subtype of: https://www.iana.org/assignments/media-types/application/vnd.efi.img Which is what everyone appears to use for raw disk images, in particular if they contain a GPT partition table.
2023-11-20 13:51:47 +03:00
<?xml version="1.0" encoding="UTF-8"?>
<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
<mime-type type="application/x.systemd-sysext">
<sub-class-of type="application/vnd.efi.img"/>
<comment>System Extension DDI</comment>
<glob pattern="*.sysext.raw"/>
</mime-type>
<mime-type type="application/x.systemd-confext">
<sub-class-of type="application/vnd.efi.img"/>
<comment>Configuration Extension DDI</comment>
<glob pattern="*.confext.raw"/>
</mime-type>
mime: also add magic-based mime type rules for our other binary files No immediate usecase, it's just nice that if you browser these files with a graphical file manager you see them recognized as what they are.
2024-01-15 17:01:24 +03:00
<mime-type type="application/x.systemd-journal">
<comment>Journal Log File</comment>
<magic>
<match type="string" value="LPKSHHRH" offset="0"/>
</magic>
</mime-type>
<mime-type type="application/x.systemd-catalog">
<comment>Journal Message Catalog</comment>
<magic>
<match type="string" value="RHHHKSLP" offset="0"/>
</magic>
</mime-type>
<mime-type type="application/x.systemd-hwdb">
<comment>Hardware Database</comment>
<magic>
<match type="string" value="KSLPHHRH" offset="0"/>
</magic>
</mime-type>
mime: expose a mime type for encrypted credentials Let's make things nice for desktops, and provide a mime type for credential files. This uses the 128bit header identifier that our credential files start with. However, the files are always base64 encoded, hence we have to match the base64 string, hence add a small test case that generates them properly for us, and truncates them at the right place (since 128 is not evently divisable by 6).
2024-01-15 15:44:39 +03:00
<mime-type type="application/x.systemd-credential">
<comment>Encrypted Credential</comment>
<generic-icon name="security-high"/>
<magic>
<match type="string" value="Whxqht+dQJax1aZeCGLxm" offset="0"/>
creds-util: add a concept of "user-scoped" credentials So far credentials are a concept for system services only: to encrypt or decrypt credential you must be privileged, as only then you can access the TPM and the host key. Let's break this up a bit: let's add a "user-scoped" credential, that are specific to users. Internally this works by adding another step to the acquisition of the symmetric encryption key for the credential: if a "user-scoped" credential is used we'll generate an symmetric encryption key K as usual, but then we'll use it to calculate K' = HMAC(K, flags || uid || machine-id || username) and then use the resulting K' as encryption key instead. This basically includes the (public) user's identity in the encryption key, ensuring that only if the right user credentials are specified the correct key can be acquired.
2024-01-15 19:36:44 +03:00
<match type="string" value="VbntHThZTUOoMZ0uuzMqx" offset="0"/>
mime: expose a mime type for encrypted credentials Let's make things nice for desktops, and provide a mime type for credential files. This uses the 128bit header identifier that our credential files start with. However, the files are always base64 encoded, hence we have to match the base64 string, hence add a small test case that generates them properly for us, and truncates them at the right place (since 128 is not evently divisable by 6).
2024-01-15 15:44:39 +03:00
<match type="string" value="DHzAexF2RZGcSwvqCLwg/" offset="0"/>
<match type="string" value="+vfrk0HjQSyhpDb5Wik2L" offset="0"/>
<match type="string" value="k6iUCUh0RJCQyvL8k8q1U" offset="0"/>
creds-util: add a concept of "user-scoped" credentials So far credentials are a concept for system services only: to encrypt or decrypt credential you must be privileged, as only then you can access the TPM and the host key. Let's break this up a bit: let's add a "user-scoped" credential, that are specific to users. Internally this works by adding another step to the acquisition of the symmetric encryption key for the credential: if a "user-scoped" credential is used we'll generate an symmetric encryption key K as usual, but then we'll use it to calculate K' = HMAC(K, flags || uid || machine-id || username) and then use the resulting K' as encryption key instead. This basically includes the (public) user's identity in the encryption key, ensuring that only if the right user credentials are specified the correct key can be acquired.
2024-01-15 19:36:44 +03:00
<match type="string" value="70rBNnmpSA6n22iJf58WX" offset="0"/>
mime: expose a mime type for encrypted credentials Let's make things nice for desktops, and provide a mime type for credential files. This uses the 128bit header identifier that our credential files start with. However, the files are always base64 encoded, hence we have to match the base64 string, hence add a small test case that generates them properly for us, and truncates them at the right place (since 128 is not evently divisable by 6).
2024-01-15 15:44:39 +03:00
<match type="string" value="r0lQqEkTTrGnOEYwT/MMB" offset="0"/>
creds-util: add a concept of "user-scoped" credentials So far credentials are a concept for system services only: to encrypt or decrypt credential you must be privileged, as only then you can access the TPM and the host key. Let's break this up a bit: let's add a "user-scoped" credential, that are specific to users. Internally this works by adding another step to the acquisition of the symmetric encryption key for the credential: if a "user-scoped" credential is used we'll generate an symmetric encryption key K as usual, but then we'll use it to calculate K' = HMAC(K, flags || uid || machine-id || username) and then use the resulting K' as encryption key instead. This basically includes the (public) user's identity in the encryption key, ensuring that only if the right user credentials are specified the correct key can be acquired.
2024-01-15 19:36:44 +03:00
<match type="string" value="rbxMo++2QgG6iBtvLkCV6" offset="0"/>
mime: expose a mime type for encrypted credentials Let's make things nice for desktops, and provide a mime type for credential files. This uses the 128bit header identifier that our credential files start with. However, the files are always base64 encoded, hence we have to match the base64 string, hence add a small test case that generates them properly for us, and truncates them at the right place (since 128 is not evently divisable by 6).
2024-01-15 15:44:39 +03:00
<match type="string" value="BYRp2vb1QySABUnaD46i+" offset="0"/>
</magic>
</mime-type>
mime: register confext/sysext images in shared-mime-info This make them recognized by file managers and stuff. Maybe one day we should properly register mime types in the "vnd." namespace with IANA, but I am too lazy to deal with the bureaucracy for that, hence let's stick with the x. namespace for now. This defines confext/sysext DDIs as subtype of: https://www.iana.org/assignments/media-types/application/vnd.efi.img Which is what everyone appears to use for raw disk images, in particular if they contain a GPT partition table.
2023-11-20 13:51:47 +03:00
</mime-info>
Copy Permalink