1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
6 #include "creds-util.h"
9 #include "format-util.h"
11 #include "hexdecoct.h"
12 #include "initrd-util.h"
13 #include "import-creds.h"
15 #include "mkdir-label.h"
16 #include "mount-util.h"
17 #include "mountpoint-util.h"
18 #include "parse-util.h"
19 #include "path-util.h"
20 #include "proc-cmdline.h"
21 #include "recurse-dir.h"
24 /* This imports credentials passed in from environments higher up (VM manager, boot loader, …) and rearranges
25 * them so that later code can access them using our regular credential protocol
26 * (i.e. $CREDENTIALS_DIRECTORY). It's supposed to be minimal glue to unify behaviour how PID 1 (and
27 * generators invoked by it) can acquire credentials from outside, to mimic how we support it for containers,
28 * but on VM/physical environments.
30 * This does four things:
32 * 1. It imports credentials picked up by sd-boot (and placed in the /.extra/credentials/ dir in the initrd)
33 * and puts them in /run/credentials/@encrypted/. Note that during the initrd→host transition the initrd root
34 * file system is cleaned out, thus it is essential we pick up these files before they are deleted. Note
35 * that these credentials originate from an untrusted source, i.e. the ESP and are not
36 * pre-authenticated. They still have to be authenticated before use.
38 * 2. It imports credentials from /proc/cmdline and puts them in /run/credentials/@system/. These come from a
39 * trusted environment (i.e. the boot loader), and are typically authenticated (if authentication is done
40 * at all). However, they are world-readable, which might be less than ideal. Hence only use this for data
41 * that doesn't require trust.
43 * 3. It imports credentials passed in through qemu's fw_cfg logic. Specifically, credential data passed in
44 * /sys/firmware/qemu_fw_cfg/by_name/opt/io.systemd.credentials/ is picked up and also placed in
45 * /run/credentials/@system/.
47 * 4. It imports credentials passed in via the DMI/SMBIOS OEM string tables, quite similar to fw_cfg. It
48 * looks for strings starting with "io.systemd.credential:" and "io.systemd.credential.binary:". Both
49 * expect a key=value assignment, but in the latter case the value is Base64 decoded, allowing binary
50 * credentials to be passed in.
52 * If it picked up any credentials it will set the $CREDENTIALS_DIRECTORY and
53 * $ENCRYPTED_CREDENTIALS_DIRECTORY environment variables to point to these directories, so that processes
54 * can find them there later on. If "ramfs" is available $CREDENTIALS_DIRECTORY will be backed by it (but
55 * $ENCRYPTED_CREDENTIALS_DIRECTORY is just a regular tmpfs).
57 * Net result: the service manager can pick up trusted credentials from $CREDENTIALS_DIRECTORY afterwards,
58 * and untrusted ones from $ENCRYPTED_CREDENTIALS_DIRECTORY. */
60 typedef struct ImportCredentialContext
{
63 unsigned n_credentials
;
64 } ImportCredentialContext
;
66 static void import_credentials_context_free(ImportCredentialContext
*c
) {
69 c
->target_dir_fd
= safe_close(c
->target_dir_fd
);
72 static int acquire_encrypted_credential_directory(ImportCredentialContext
*c
) {
77 if (c
->target_dir_fd
>= 0)
78 return c
->target_dir_fd
;
80 r
= mkdir_safe_label(ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
, 0700, 0, 0, MKDIR_WARN_MODE
);
82 return log_error_errno(r
, "Failed to create " ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
": %m");
84 c
->target_dir_fd
= open(ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
, O_RDONLY
|O_DIRECTORY
|O_CLOEXEC
);
85 if (c
->target_dir_fd
< 0)
86 return log_error_errno(errno
, "Failed to open " ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
": %m");
88 return c
->target_dir_fd
;
91 static int open_credential_file_for_write(int target_dir_fd
, const char *dir_name
, const char *n
) {
94 assert(target_dir_fd
>= 0);
98 fd
= openat(target_dir_fd
, n
, O_WRONLY
|O_CLOEXEC
|O_CREAT
|O_EXCL
|O_NOFOLLOW
, 0400);
100 if (errno
== EEXIST
) /* In case of EEXIST we'll only debug log! */
101 return log_debug_errno(errno
, "Credential '%s' set twice, ignoring.", n
);
103 return log_error_errno(errno
, "Failed to create %s/%s: %m", dir_name
, n
);
109 static bool credential_size_ok(ImportCredentialContext
*c
, const char *name
, uint64_t size
) {
113 if (size
> CREDENTIAL_SIZE_MAX
) {
114 log_warning("Credential '%s' is larger than allowed limit (%s > %s), skipping.", name
, FORMAT_BYTES(size
), FORMAT_BYTES(CREDENTIAL_SIZE_MAX
));
118 if (size
> CREDENTIALS_TOTAL_SIZE_MAX
- c
->size_sum
) {
119 log_warning("Accumulated credential size would be above allowed limit (%s+%s > %s), skipping '%s'.",
120 FORMAT_BYTES(c
->size_sum
), FORMAT_BYTES(size
), FORMAT_BYTES(CREDENTIALS_TOTAL_SIZE_MAX
), name
);
127 static int finalize_credentials_dir(const char *dir
, const char *envvar
) {
133 /* Try to make the credentials directory read-only now */
135 r
= make_mount_point(dir
);
137 log_warning_errno(r
, "Failed to make '%s' a mount point, ignoring: %m", dir
);
139 (void) mount_nofollow_verbose(LOG_WARNING
, NULL
, dir
, NULL
, MS_BIND
|MS_NODEV
|MS_NOEXEC
|MS_NOSUID
|MS_RDONLY
|MS_REMOUNT
, NULL
);
141 if (setenv(envvar
, dir
, /* overwrite= */ true) < 0)
142 return log_error_errno(errno
, "Failed to set $%s environment variable: %m", envvar
);
147 static int import_credentials_boot(void) {
148 _cleanup_(import_credentials_context_free
) ImportCredentialContext context
= {
149 .target_dir_fd
= -EBADF
,
153 /* systemd-stub will wrap sidecar *.cred files from the UEFI kernel image directory into initrd
154 * cpios, so that they unpack into /.extra/. We'll pick them up from there and copy them into /run/
155 * so that we can access them during the entire runtime (note that the initrd file system is erased
156 * during the initrd → host transition). Note that these credentials originate from an untrusted
157 * source (i.e. the ESP typically) and thus need to be authenticated later. We thus put them in a
158 * directory separate from the usual credentials which are from a trusted source. */
164 "/.extra/credentials/", /* specific to this boot menu */
165 "/.extra/global_credentials/") { /* boot partition wide */
167 _cleanup_free_ DirectoryEntries
*de
= NULL
;
168 _cleanup_close_
int source_dir_fd
= -EBADF
;
170 source_dir_fd
= open(p
, O_RDONLY
|O_DIRECTORY
|O_CLOEXEC
|O_NOFOLLOW
);
171 if (source_dir_fd
< 0) {
172 if (errno
== ENOENT
) {
173 log_debug("No credentials passed via %s.", p
);
177 log_warning_errno(errno
, "Failed to open '%s', ignoring: %m", p
);
181 r
= readdir_all(source_dir_fd
, RECURSE_DIR_SORT
|RECURSE_DIR_IGNORE_DOT
, &de
);
183 log_warning_errno(r
, "Failed to read '%s' contents, ignoring: %m", p
);
187 for (size_t i
= 0; i
< de
->n_entries
; i
++) {
188 const struct dirent
*d
= de
->entries
[i
];
189 _cleanup_close_
int cfd
= -EBADF
, nfd
= -EBADF
;
190 _cleanup_free_
char *n
= NULL
;
194 e
= endswith(d
->d_name
, ".cred");
198 /* drop .cred suffix (which we want in the ESP sidecar dir, but not for our internal
200 n
= strndup(d
->d_name
, e
- d
->d_name
);
204 if (!credential_name_valid(n
)) {
205 log_warning("Credential '%s' has invalid name, ignoring.", d
->d_name
);
209 cfd
= openat(source_dir_fd
, d
->d_name
, O_RDONLY
|O_CLOEXEC
);
211 log_warning_errno(errno
, "Failed to open %s, ignoring: %m", d
->d_name
);
215 if (fstat(cfd
, &st
) < 0) {
216 log_warning_errno(errno
, "Failed to stat %s, ignoring: %m", d
->d_name
);
220 r
= stat_verify_regular(&st
);
222 log_warning_errno(r
, "Credential file %s is not a regular file, ignoring: %m", d
->d_name
);
226 if (!credential_size_ok(&context
, n
, st
.st_size
))
229 r
= acquire_encrypted_credential_directory(&context
);
233 nfd
= open_credential_file_for_write(context
.target_dir_fd
, ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
, n
);
239 r
= copy_bytes(cfd
, nfd
, st
.st_size
, 0);
241 (void) unlinkat(context
.target_dir_fd
, n
, 0);
242 return log_error_errno(r
, "Failed to create credential '%s': %m", n
);
245 context
.size_sum
+= st
.st_size
;
246 context
.n_credentials
++;
248 log_debug("Successfully copied boot credential '%s'.", n
);
252 if (context
.n_credentials
> 0) {
253 log_debug("Imported %u credentials from boot loader.", context
.n_credentials
);
255 r
= finalize_credentials_dir(ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
, "ENCRYPTED_CREDENTIALS_DIRECTORY");
263 static int acquire_credential_directory(ImportCredentialContext
*c
) {
268 if (c
->target_dir_fd
>= 0)
269 return c
->target_dir_fd
;
271 r
= path_is_mount_point(SYSTEM_CREDENTIALS_DIRECTORY
, NULL
, 0);
274 return log_error_errno(r
, "Failed to determine if " SYSTEM_CREDENTIALS_DIRECTORY
" is a mount point: %m");
276 r
= mkdir_safe_label(SYSTEM_CREDENTIALS_DIRECTORY
, 0700, 0, 0, MKDIR_WARN_MODE
);
278 return log_error_errno(r
, "Failed to create " SYSTEM_CREDENTIALS_DIRECTORY
" mount point: %m");
280 r
= 0; /* Now it exists and is not a mount point */
283 /* If not a mountpoint yet, try to mount a ramfs there (so that this stuff isn't swapped
284 * out), but if that doesn't work, let's just use the regular tmpfs it already is. */
285 (void) mount_nofollow_verbose(LOG_WARNING
, "ramfs", SYSTEM_CREDENTIALS_DIRECTORY
, "ramfs", MS_NODEV
|MS_NOEXEC
|MS_NOSUID
, "mode=0700");
287 c
->target_dir_fd
= open(SYSTEM_CREDENTIALS_DIRECTORY
, O_RDONLY
|O_DIRECTORY
|O_CLOEXEC
);
288 if (c
->target_dir_fd
< 0)
289 return log_error_errno(errno
, "Failed to open " SYSTEM_CREDENTIALS_DIRECTORY
": %m");
291 return c
->target_dir_fd
;
294 static int proc_cmdline_callback(const char *key
, const char *value
, void *data
) {
295 ImportCredentialContext
*c
= ASSERT_PTR(data
);
296 _cleanup_free_
char *n
= NULL
;
297 _cleanup_close_
int nfd
= -EBADF
;
304 if (!proc_cmdline_key_streq(key
, "systemd.set_credential"))
307 colon
= value
? strchr(value
, ':') : NULL
;
309 log_warning("Credential assignment through kernel command line lacks ':' character, ignoring: %s", value
);
313 n
= strndup(value
, colon
- value
);
317 if (!credential_name_valid(n
)) {
318 log_warning("Credential name '%s' is invalid, ignoring.", n
);
325 if (!credential_size_ok(c
, n
, l
))
328 r
= acquire_credential_directory(c
);
332 nfd
= open_credential_file_for_write(c
->target_dir_fd
, SYSTEM_CREDENTIALS_DIRECTORY
, n
);
338 r
= loop_write(nfd
, colon
, l
, /* do_poll= */ false);
340 (void) unlinkat(c
->target_dir_fd
, n
, 0);
341 return log_error_errno(r
, "Failed to write credential: %m");
347 log_debug("Successfully processed kernel command line credential '%s'.", n
);
352 static int import_credentials_proc_cmdline(ImportCredentialContext
*c
) {
357 r
= proc_cmdline_parse(proc_cmdline_callback
, c
, 0);
359 return log_error_errno(r
, "Failed to parse /proc/cmdline: %m");
364 #define QEMU_FWCFG_PATH "/sys/firmware/qemu_fw_cfg/by_name/opt/io.systemd.credentials"
366 static int import_credentials_qemu(ImportCredentialContext
*c
) {
367 _cleanup_free_ DirectoryEntries
*de
= NULL
;
368 _cleanup_close_
int source_dir_fd
= -EBADF
;
373 source_dir_fd
= open(QEMU_FWCFG_PATH
, O_RDONLY
|O_DIRECTORY
|O_CLOEXEC
);
374 if (source_dir_fd
< 0) {
375 if (errno
== ENOENT
) {
376 log_debug("No credentials passed via fw_cfg.");
380 log_warning_errno(errno
, "Failed to open '" QEMU_FWCFG_PATH
"', ignoring: %m");
384 r
= readdir_all(source_dir_fd
, RECURSE_DIR_SORT
|RECURSE_DIR_IGNORE_DOT
, &de
);
386 log_warning_errno(r
, "Failed to read '" QEMU_FWCFG_PATH
"' contents, ignoring: %m");
390 for (size_t i
= 0; i
< de
->n_entries
; i
++) {
391 const struct dirent
*d
= de
->entries
[i
];
392 _cleanup_close_
int vfd
= -EBADF
, rfd
= -EBADF
, nfd
= -EBADF
;
393 _cleanup_free_
char *szs
= NULL
;
396 if (!credential_name_valid(d
->d_name
)) {
397 log_warning("Credential '%s' has invalid name, ignoring.", d
->d_name
);
401 vfd
= openat(source_dir_fd
, d
->d_name
, O_RDONLY
|O_DIRECTORY
|O_CLOEXEC
);
403 log_warning_errno(errno
, "Failed to open '" QEMU_FWCFG_PATH
"'/%s/, ignoring: %m", d
->d_name
);
407 r
= read_virtual_file_at(vfd
, "size", LINE_MAX
, &szs
, NULL
);
409 log_warning_errno(r
, "Failed to read '" QEMU_FWCFG_PATH
"'/%s/size, ignoring: %m", d
->d_name
);
413 r
= safe_atou64(strstrip(szs
), &sz
);
415 log_warning_errno(r
, "Failed to parse size of credential '%s', ignoring: %s", d
->d_name
, szs
);
419 if (!credential_size_ok(c
, d
->d_name
, sz
))
422 /* Ideally we'd just symlink the data here. Alas the kernel driver exports the raw file as
423 * having size zero, and we'd rather not have applications support such credential
424 * files. Let's hence copy the files to make them regular. */
426 rfd
= openat(vfd
, "raw", O_RDONLY
|O_CLOEXEC
);
428 log_warning_errno(errno
, "Failed to open '" QEMU_FWCFG_PATH
"'/%s/raw, ignoring: %m", d
->d_name
);
432 r
= acquire_credential_directory(c
);
436 nfd
= open_credential_file_for_write(c
->target_dir_fd
, SYSTEM_CREDENTIALS_DIRECTORY
, d
->d_name
);
442 r
= copy_bytes(rfd
, nfd
, sz
, 0);
444 (void) unlinkat(c
->target_dir_fd
, d
->d_name
, 0);
445 return log_error_errno(r
, "Failed to create credential '%s': %m", d
->d_name
);
451 log_debug("Successfully copied qemu fw_cfg credential '%s'.", d
->d_name
);
457 static int parse_smbios_strings(ImportCredentialContext
*c
, const char *data
, size_t size
) {
463 assert(data
|| size
== 0);
465 /* Unpacks a packed series of SMBIOS OEM vendor strings. These are a series of NUL terminated
466 * strings, one after the other. */
468 for (p
= data
, left
= size
; left
> 0; p
+= skip
, left
-= skip
) {
469 _cleanup_free_
void *buf
= NULL
;
470 _cleanup_free_
char *cn
= NULL
;
471 _cleanup_close_
int nfd
= -EBADF
;
472 const char *nul
, *n
, *eq
;
474 size_t buflen
, cdata_len
;
477 nul
= memchr(p
, 0, left
);
479 skip
= (nul
- p
) + 1;
485 if (nul
- p
== 0) /* Skip empty strings */
488 /* Only care about strings starting with either of these two prefixes */
489 if ((n
= memory_startswith(p
, nul
- p
, "io.systemd.credential:")))
491 else if ((n
= memory_startswith(p
, nul
- p
, "io.systemd.credential.binary:")))
494 _cleanup_free_
char *escaped
= NULL
;
496 escaped
= cescape_length(p
, nul
- p
);
497 log_debug("Ignoring OEM string: %s", strnull(escaped
));
501 eq
= memchr(n
, '=', nul
- n
);
503 log_warning("SMBIOS OEM string lacks '=' character, ignoring.");
507 cn
= memdup_suffix0(n
, eq
- n
);
511 if (!credential_name_valid(cn
)) {
512 log_warning("SMBIOS credential name '%s' is not valid, ignoring: %m", cn
);
516 /* Optionally base64 decode the data, if requested, to allow binary credentials */
518 r
= unbase64mem(eq
+ 1, nul
- (eq
+ 1), &buf
, &buflen
);
520 log_warning_errno(r
, "Failed to base64 decode credential '%s', ignoring: %m", cn
);
528 cdata_len
= nul
- (eq
+ 1);
531 if (!credential_size_ok(c
, cn
, cdata_len
))
534 r
= acquire_credential_directory(c
);
538 nfd
= open_credential_file_for_write(c
->target_dir_fd
, SYSTEM_CREDENTIALS_DIRECTORY
, cn
);
544 r
= loop_write(nfd
, cdata
, cdata_len
, /* do_poll= */ false);
546 (void) unlinkat(c
->target_dir_fd
, cn
, 0);
547 return log_error_errno(r
, "Failed to write credential: %m");
550 c
->size_sum
+= cdata_len
;
553 log_debug("Successfully processed SMBIOS credential '%s'.", cn
);
559 static int import_credentials_smbios(ImportCredentialContext
*c
) {
562 /* Parses DMI OEM strings fields (SMBIOS type 11), as settable with qemu's -smbios type=11,value=… switch. */
564 for (unsigned i
= 0;; i
++) {
565 struct dmi_field_header
{
571 } _packed_
*dmi_field_header
;
572 _cleanup_free_
char *p
= NULL
;
573 _cleanup_free_
void *data
= NULL
;
576 assert_cc(offsetof(struct dmi_field_header
, contents
) == 5);
578 if (asprintf(&p
, "/sys/firmware/dmi/entries/11-%u/raw", i
) < 0)
581 r
= read_virtual_file(p
, sizeof(dmi_field_header
) + CREDENTIALS_TOTAL_SIZE_MAX
, (char**) &data
, &size
);
583 /* Once we reach ENOENT there are no more DMI Type 11 fields around. */
584 log_full_errno(r
== -ENOENT
? LOG_DEBUG
: LOG_WARNING
, r
, "Failed to open '%s', ignoring: %m", p
);
588 if (size
< offsetof(struct dmi_field_header
, contents
))
589 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG
), "DMI field header of '%s' too short.", p
);
591 dmi_field_header
= data
;
592 if (dmi_field_header
->type
!= 11 ||
593 dmi_field_header
->length
!= offsetof(struct dmi_field_header
, contents
))
594 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG
), "Invalid DMI field header.");
596 r
= parse_smbios_strings(c
, dmi_field_header
->contents
, size
- offsetof(struct dmi_field_header
, contents
));
600 if (i
== UINT_MAX
) /* Prevent overflow */
607 static int import_credentials_trusted(void) {
608 _cleanup_(import_credentials_context_free
) ImportCredentialContext c
= {
609 .target_dir_fd
= -EBADF
,
613 r
= import_credentials_qemu(&c
);
614 w
= import_credentials_smbios(&c
);
615 q
= import_credentials_proc_cmdline(&c
);
617 if (c
.n_credentials
> 0) {
620 log_debug("Imported %u credentials from kernel command line/smbios/fw_cfg.", c
.n_credentials
);
622 z
= finalize_credentials_dir(SYSTEM_CREDENTIALS_DIRECTORY
, "CREDENTIALS_DIRECTORY");
627 return r
< 0 ? r
: w
< 0 ? w
: q
;
630 static int symlink_credential_dir(const char *envvar
, const char *path
, const char *where
) {
637 if (!path_is_valid(path
) || !path_is_absolute(path
))
638 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "String specified via $%s is not a valid absolute path, refusing: %s", envvar
, path
);
640 /* If the env var already points to where we intend to create the symlink, then most likely we
641 * already imported some creds earlier, and thus set the env var, and hence don't need to do
643 if (path_equal(path
, where
))
646 r
= symlink_idempotent(path
, where
, /* make_relative= */ true);
648 return log_error_errno(r
, "Failed to link $%s to %s: %m", envvar
, where
);
653 int import_credentials(void) {
654 const char *received_creds_dir
= NULL
, *received_encrypted_creds_dir
= NULL
;
655 bool envvar_set
= false;
658 r
= get_credentials_dir(&received_creds_dir
);
659 if (r
< 0 && r
!= -ENXIO
) /* ENXIO → env var not set yet */
660 log_warning_errno(r
, "Failed to determine credentials directory, ignoring: %m");
664 r
= get_encrypted_credentials_dir(&received_encrypted_creds_dir
);
665 if (r
< 0 && r
!= -ENXIO
) /* ENXIO → env var not set yet */
666 log_warning_errno(r
, "Failed to determine encrypted credentials directory, ignoring: %m");
668 envvar_set
= envvar_set
|| r
>= 0;
671 /* Maybe an earlier stage initrd already set this up? If so, don't try to import anything again. */
672 log_debug("Not importing credentials, $CREDENTIALS_DIRECTORY or $ENCRYPTED_CREDENTIALS_DIRECTORY already set.");
674 /* But, let's make sure the creds are available from our regular paths. */
675 if (received_creds_dir
)
676 r
= symlink_credential_dir("CREDENTIALS_DIRECTORY", received_creds_dir
, SYSTEM_CREDENTIALS_DIRECTORY
);
680 if (received_encrypted_creds_dir
) {
681 q
= symlink_credential_dir("ENCRYPTED_CREDENTIALS_DIRECTORY", received_encrypted_creds_dir
, ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY
);
687 _cleanup_free_
char *v
= NULL
;
689 r
= proc_cmdline_get_key("systemd.import_credentials", PROC_CMDLINE_STRIP_RD_PREFIX
, &v
);
691 log_debug_errno(r
, "Failed to check if 'systemd.import_credentials=' kernel command line option is set, ignoring: %m");
693 r
= parse_boolean(v
);
695 log_debug_errno(r
, "Failed to parse 'systemd.import_credentials=' parameter, ignoring: %m");
697 log_notice("systemd.import_credentials=no is set, skipping importing of credentials.");
702 r
= import_credentials_boot();
704 q
= import_credentials_trusted();