meson: unlock imds network by default

Enabling locking by default would constitute a major footgun and
compatibility break on upgrades. This functionality is useful, but it
requires the rest of the system to be "ported" to use systemd-imds
first. The user or distro should opt in to "locked" mode only after
doing the integration work.

diff --git a/NEWS b/NEWS
index c34c55603e46a8b61446833539911aec06f17855..c717a355ecdfa010921562e944a6e1aa469ee21e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,13 +13,13 @@ CHANGES WITH 261 in spe:
           attestation environments which use hardware CC registers and not the
           TPM quote.
 
-        * By default networking to cloud IMDS services is now locked down, for
-          recognized clouds. This is recommended for secure installations, but
-          typically conflicts with traditional IMDS clients such as cloud-init,
-          which require direct IMDS access currently. The new meson option
-          "imds-network" can be used to change the default networking mode to
-          "unlocked" at build-time, for compatibility. This is probably what
-          general purpose distributions should set for now.
+        New features:
+
+        * Networking to cloud IMDS services may be locked down for recognized
+          clouds. This is recommended for secure installations, but typically
+          conflicts with traditional IMDS clients such as cloud-init, which
+          require direct IMDS access. The new meson option "-Dimds-network="
+          can be used to change the default mode to "locked" at build-time.
 
 CHANGES WITH 260:
 

diff --git a/meson_options.txt b/meson_options.txt
index 30c5fd3ab67fe7b7540482111975728de431342f..d61afac519d8470123633d31253d0b28c2e26311 100644 (file)
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -144,7 +144,7 @@ option('timesyncd', type : 'boolean',
        description : 'install the systemd-timesyncd daemon')
 option('imds', type : 'feature',
        description : 'install the systemd-imds stack')
-option('imds-network', type : 'combo', choices : [ 'locked', 'unlocked' ],
+option('imds-network', type : 'combo', choices : ['unlocked', 'locked'],
        description : 'whether to default to locked/unlocked IMDS network mode')
 option('journal-storage-default', type : 'combo', choices : ['persistent', 'auto', 'volatile', 'none'],
        description : 'default storage mode for journald (main namespace)')