Re: [systemd-devel] PCR signing / enrolling on UKI and validation by systemd-cryptenroll

2024-05-30 Thread Demi Marie Obenour
On Thu, May 30, 2024 at 11:22:56PM +0200, Lennart Poettering wrote: > On Do, 30.05.24 22:43, Lennart Poettering (lenn...@poettering.net) wrote: > > > > What about combining two different secrets, such that _both_ must be > > > accessible? At a minimum, something like HASH(SECRET1||SECRET2) is > >

Re: [systemd-devel] PCR signing / enrolling on UKI and validation by systemd-cryptenroll

2024-05-30 Thread Lennart Poettering
On Do, 30.05.24 17:08, Demi Marie Obenour (d...@invisiblethingslab.com) wrote: > > Hmm, this is an interesting idea, I kinda like it. But I am not sure > > how far this will get us, because I think even for FDE we eventually > > want to store asymmetric keys, not symmetric ones (i.e. I think we >

Re: [systemd-devel] PCR signing / enrolling on UKI and validation by systemd-cryptenroll

2024-05-30 Thread Lennart Poettering
On Do, 30.05.24 22:43, Lennart Poettering (lenn...@poettering.net) wrote: > > What about combining two different secrets, such that _both_ must be > > accessible? At a minimum, something like HASH(SECRET1||SECRET2) is > > guaranteed to be available if and only if both SECRET1 and SECRET2 are > >

Re: [systemd-devel] PCR signing / enrolling on UKI and validation by systemd-cryptenroll

2024-05-30 Thread Demi Marie Obenour
On Thu, May 30, 2024 at 10:43:48PM +0200, Lennart Poettering wrote: > On Mi, 29.05.24 14:48, Demi Marie Obenour (d...@invisiblethingslab.com) wrote: > > > > > > (you can of course include PolicyAuthorizeNV in the policy you sign > > > > > for PolicyAuthorize, but that doesn#t work, since we want t

Re: [systemd-devel] PCR signing / enrolling on UKI and validation by systemd-cryptenroll

2024-05-30 Thread Lennart Poettering
On Mi, 29.05.24 14:48, Demi Marie Obenour (d...@invisiblethingslab.com) wrote: > > > > (you can of course include PolicyAuthorizeNV in the policy you sign > > > > for PolicyAuthorize, but that doesn#t work, since we want to pin the > > > > local nvindex really, and allocate it localy, and the sign

Re: [systemd-devel] PCR signing / enrolling on UKI and validation by systemd-cryptenroll

2024-05-30 Thread Lennart Poettering
On Mi, 29.05.24 14:42, Demi Marie Obenour (d...@invisiblethingslab.com) wrote: > > Hence, maybe tickets aren't the way to go, they bring complexity, they > > would make a pretty relevant feature of our policies go down the drain > > – even though they would combine the two relevant policies correc

Re: [systemd-devel] confusion with systemd-repart

2024-05-30 Thread Nils Kattenbeck
> Am I supposed to create file for PrimaryRootfs also, even > if it does already exist, so that repart understand SecondaryRootfs has > to be created? What, exactly, am I doing incorrectly, because I'm sure > it is me not using the tool properly here, and no actual bug... Yes, repartd tries to mat

[systemd-devel] Help with suspend-then-hibernate

2024-05-30 Thread Guido
Hi Can anyone explain me what would be the expected behaviour of systemctl suspend-then-hibernate if I have the following content on /etc/systemd/sleep.conf.d/overrides.conf [Sleep] AllowSuspend=yes AllowHibernation=yes AllowSuspendThenHibernate=yes HibernateMode=shutdown platform HibernateDelayS

[systemd-devel] confusion with systemd-repart

2024-05-30 Thread Xogium
So, I use systemd-repart in an embedded system of mine. This system runs systemd 254.9 and is custom made using buildroot. I am attempting to do the following: * Create a second root-arm partition with SecondaryRootfs label of 128 MB, and fill it with the content of the PrimaryRootfs partition.

[systemd-devel] systemd appears to lock up

2024-05-30 Thread Robert Landers
Hello systemd developers, On WSL2 + Ubuntu 24, I'm seeing systemd locking up. There doesn't appear to be any log messages once it locks up, it stops reaping zombie/defunct processes and responding to socket requests. I can reliably reproduce it (just wait about 10 minutes), but I haven't the sligh

[systemd-devel] Fixed with 256-rc3 (#30092): Journal file disk usage on frequently rebooted systems

2024-05-30 Thread Jens Schmidt
On 2024-05-27 23:16, Jens Schmidt wrote: > 2. A completely different approach would be to have journald reuse >journal files across reboots, which does not seem to happen in my >(default) journal configuration. Is that possible at all? And that was the *real* question, solved with syste