shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-08-03 08:22:21 +03:00
Code Activity

ask-password: Allow configuring the keyring timeout via an environment variable

Browse Source 
In mkosi, we want an easy way to set the keyring timeout for every
tool we invoke that might use systemd-ask-password to query for a
password which is then stored in the kernel keyring. Let's make this
possible via a new $SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC environment
variable.

Using an environment variable means we don't have to modify every separate
tool to add a CLI option allowing to specify the timeout. In mkosi specifically,
we'll set up a new session keyring for the mkosi process linked to the user keyring
so that any pins in the user keyring are used if available, and otherwise we'll query
for and store password in mkosi's session keyring with a zero timeout so that they stay
in the keyring until the mkosi process exits at which point they're removed from the
keyring.
This commit is contained in:
Daan De Meyer
2024-10-30 13:53:31 +01:00
committed by Lennart Poettering
parent 14b0fcdf6d
commit d9f4dad986
2 changed files with 37 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/ENVIRONMENT.md
View File

@ -735,3 +735,12 @@ Tools using the Varlink protocol (such as `varlinkctl`) or sd-bus (such as
* `SYSTEMD_EXIT_ON_IDLE` – Takes a boolean. When false, the exit-on-idle logic
of these services is disabled, making it easier to debug them.
`systemd-ask-password`:
* `$SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC` - takes a timespan or `default`,
which controls the expiration time of keys stored in the kernel keyring by
`systemd-ask-password`. If unset or set to `default`, the default expiration
of 150 seconds is used. If set to `0`, keys are not cached in the kernel
keyring. If set to `infinity`, keys are cached without an expiration time in
the kernel keyring.