Posts by pid_eins@mastodon.social
(DIR) Post #B7eQmloZmMeeNcEega by pid_eins@mastodon.social
0 likes, 0 repeats
…sysext/confext you can specify to trigger a service manage reload, and then use .upholds/ dependencies to schedule unit jobs. But it's ugly, because we generally want to avoid reloads in the regular start-up paths.With v261 we have made one relevant change in this area: we'll now apply any confext/sysext we can already discover from initrd context *before* transitioning into the rootfs, so that they are available already during generation of the initial transaction of the service manager.
(DIR) Post #B7eQmm5EmPyxDI1xei by pid_eins@mastodon.social
0 likes, 0 repeats
…will have some really nice properties: any executable can be traced back to its image, and thus the cryptographic signature of its file system and thus the vendor where the executable originated. Nice!But – in order to take benefit of the full security benefit of this model – it's also important to enforce that other ways to insert executables into the system are prohibited. Because if that's not prohibited then an attacker could still scp some binary to /tmp/ and run it from there.
(DIR) Post #B7eQmnO3vudPFxqVdY by pid_eins@mastodon.social
0 likes, 0 repeats
With v261 systemd ships with an (optional) BPF-LSM based security policy that can enforce a logic like this, via the new RestrictFileSystemAccess= knob in systemd.conf. If enabled executables can only run off dm-verity backed file systems, and attempts to run binaries from other file systems will be refused. This mechanism we plan to extend in future versions in order to both tighten the rules around this and make it more flexible. For example, ideally we wouldn't even allow mounting…
(DIR) Post #B7eQmoTlsAnMdxWaAq by pid_eins@mastodon.social
0 likes, 0 repeats
…file systems not backed by dm-verity, rather than just prohibit execution of binaries for them. (This requires some kernel changes, which is being worked on, but once that lands, we'll hook this up to systemd too). And on the other hand it makes sense to be this restrictive for the host, but maybe relax the rules for certain user name spaces down the tree, simply because OCI/docker containers geneerally have a "yolo" security model, i.e. are not backed by verity but by a frickin' unsigned…
(DIR) Post #B7eQmqEbLXqi5URUo4 by pid_eins@mastodon.social
0 likes, 0 repeats
…tarball.(Oh and before you ask, the IPE LSM added to the kernel recently, can do something similar, but we believe BPF-LSM is the way to go for things like this, as it allows us to have tighter, more focussed rules in place, without having to change the kernel for every single tightening, but just for some)
(DIR) Post #B7ijmcvpTu88ai743k by pid_eins@mastodon.social
0 likes, 0 repeats
2️⃣7️⃣ Here's the 27th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd systemd-oomd is systemd's subsystem for optimizing system behaviour under memory pressure (i.e. shut down services to remedy memory pressure and similar). So far it has been applying very similar policies for dealing with pressure on all workload services on the system.With v261 we are extending the concepts around this considerably. systemd-oomd can now read a number…
(DIR) Post #B7ijmdPFiVfM3xsYvA by pid_eins@mastodon.social
0 likes, 0 repeats
2️⃣4️⃣ Here's the 24th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd UAPI.1 Boot Loader Type #1 entries permit gluing together various boot artifacts into a boot menu entry. They originate in pre-UKI times, where kernels and initrds were shipped separately without any trust model (well, some distros still do this), but they are still really useful in a UKI world too, since you can reference a UKI in them (which can even…
(DIR) Post #B7ijmdTrRNLuIG2F6W by pid_eins@mastodon.social
0 likes, 0 repeats
2️⃣6️⃣ Here's the 26th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd When dealing with VMs, you have to think about dealing with storage, too: how do you connect your block devices and file systems to your VMs.For a while now systemd has been shipping systemd-vmspawn, a small wrapper around qemu, which integrates it in various ways into the system, for example registers it with systemd-machined and a variety of other things.
(DIR) Post #B7ijmdfClCQUrRLImm by pid_eins@mastodon.social
0 likes, 0 repeats
2️⃣5️⃣ Here's the 25th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd The systemd-socket-proxy tool has been part of the systemd toolset for a long long time, but is probably not known by many. It was originally created to add "fake" socket activation support to daemons that do not support it natively: the tool implements the socket activation, can be wrapped in appropriate socket activation unit files, and when activated…
(DIR) Post #B7ijmdmIKq67DQexpw by pid_eins@mastodon.social
0 likes, 0 repeats
…even be on some HTTP server), and do some minimal parameterization on them (pick a profile number), while getting a separate boot attempt counter or being able to assign a separate title to it.With v262 it comes fundamentally more useful in the UKI world: there's now a new "extra" stanza in them, which takes a path to a system credential, sysext or confext image file. Any file specified that way (you can specify as many as you want) will be passed to the selected UKI as additional…
(DIR) Post #B7ijmdwZicJxjJTArQ by pid_eins@mastodon.social
0 likes, 0 repeats
With v261 systemd-vmspawn gained support for a "storage provider" API that allows you to connect arbitrary storage resources to systemd-vmspawn. More specifically, there's now --bind-volume= – which is inspired by --bind= (which allows you to bind mount any local directory into the VM). --bind-volume= wraps access to a Varlink API, consisting of pretty much one call: io.systemd.StorageProvider.Acquire().
(DIR) Post #B7ijmeAOtDNcQBwDPU by pid_eins@mastodon.social
0 likes, 0 repeats
…those units can activate the daemon in question, and the tool will then proxy the socket communication over to it.Nowadays, thankfully, a lot more services support socket activation natively (it's just cool tech after all), so it's not as important anymore, but it is still useful for a variety of usecases, since it allows to proxy socket traffic from one socket to another (possibly of different families), with full socket activation and exit-on-idle.With v261 it gained one more…
(DIR) Post #B7ijmeXRVXoNZeicKG by pid_eins@mastodon.social
0 likes, 0 repeats
…parameter). Or in other words: it's a way to glue together UKIs and these "extra" files, and give the combination a name and a separate boot attempt counter. It's not just "minimal" parameterization anymore, but "maximal" parameterization. Yay.This feature is in fact used by the new "bootctl link" command discussed in an earlier episode of this series.
(DIR) Post #B7ijmeeB6VCPuXrzpA by pid_eins@mastodon.social
0 likes, 0 repeats
…feature: it now implements the PROXY-v1 protocol when forwarding traffic, which is understood by nginx and similar projects, and let's them know about connection metadata of the original connection that is being proxied.For details about the protocol, see https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
(DIR) Post #B7ijmfGSo9p9pHmZV2 by pid_eins@mastodon.social
0 likes, 0 repeats
You use --bind-volume= by specifying a provider name and a volume name which results in said Varlink call to be made to the Varlink service indicated by the provider name. The call itself is very simple: it takes the volume name, and is supposed to return a file descriptor to the storage in question, either a directory, a regular file or a block device fd.Now the fun part about this is that *any* service can implement this Varlink interface, and thus be trivially connected to a new…
(DIR) Post #B7ijmgeFfCRk7Lv5DU by pid_eins@mastodon.social
0 likes, 0 repeats
…systemd-vmspawn instance, in demand, when the VM is invoked.By default systemd includes two providers of that implement that interface: systemd-storage-block and systemd-storage-fs. The former exposes all local block devices via the API, the latter regular files and dirs in /var/lib/storage/ – but of course the intention here is that the interface becomes generally popular and various storage services could implement it too.In upcoming systemd versions we intend to introduce the concept…
(DIR) Post #B7ijmi5EKNcYZJY8uG by pid_eins@mastodon.social
0 likes, 0 repeats
…also to regular service management (i.e. think BindVolume= in a service unit file that just connects to a volume service of choice) and systemd-nspawn. The idea is not new of course, Kubernetes has something similar, and this does take inspiration from that. The concept in systemd is decidedly more low-level and generic however, and if I may say so technically prettier (i.e. we only deal in fds.).
(DIR) Post #B7ijmioxaMCUr8wfBY by pid_eins@mastodon.social
0 likes, 0 repeats
Anyway: if you maintain a storage stack of some kind, consider implementing the simple Varlink API, please!
(DIR) Post #B8CCPC9EC78xNSf06q by pid_eins@mastodon.social
0 likes, 1 repeats
We are hiring → https://amutable.com/careers ← this time with a technical job posting! #amutable #fedihire
(DIR) Post #BAIMcxKQgAIh1MRawy by pid_eins@mastodon.social
0 likes, 0 repeats
@ariadne yepp, that's why we are designing the spec for the format in the uapi group, so that this could be adopted by other tools too. It's explicitly designed to be generic and abstract so that the various language-specific CLI toolkits can generate it too.