12
11
<title>Mandos Manual</title>
13
12
<!-- Nwalsh’s docbook scripts use this to generate the footer: -->
14
13
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
14
<productnumber>&VERSION;</productnumber>
16
15
<date>&TIMESTAMP;</date>
19
18
<firstname>Björn</firstname>
20
19
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
21
<email>belorn@fukt.bsnet.se</email>
26
25
<firstname>Teddy</firstname>
27
26
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
28
<email>teddy@fukt.bsnet.se</email>
43
34
<holder>Teddy Hogeborn</holder>
44
35
<holder>Björn Påhlsson</holder>
46
37
<xi:include href="legalnotice.xml"/>
50
41
<refentrytitle>&COMMANDNAME;</refentrytitle>
51
42
<manvolnum>8mandos</manvolnum>
55
46
<refname><command>&COMMANDNAME;</command></refname>
57
Run Mandos plugins, pass data from first to succeed.
48
Run Mandos plugins. Pass data from first succesful one.
63
54
<command>&COMMANDNAME;</command>
64
55
<group rep="repeat">
65
56
<arg choice="plain"><option>--global-env=<replaceable
66
>ENV</replaceable><literal>=</literal><replaceable
57
>VAR</replaceable><literal>=</literal><replaceable
67
58
>value</replaceable></option></arg>
68
<arg choice="plain"><option>-G
69
<replaceable>ENV</replaceable><literal>=</literal><replaceable
59
<arg choice="plain"><option>-e
60
<replaceable>VAR</replaceable><literal>=</literal><replaceable
70
61
>value</replaceable> </option></arg>
152
130
<title>DESCRIPTION</title>
154
132
<command>&COMMANDNAME;</command> is a program which is meant to
155
be specified as a <quote>keyscript</quote> for the root disk in
156
<citerefentry><refentrytitle>crypttab</refentrytitle>
157
<manvolnum>5</manvolnum></citerefentry>. The aim of this
158
program is therefore to output a password, which then
159
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
160
<manvolnum>8</manvolnum></citerefentry> will use to unlock the
133
be specified as <quote>keyscript</quote> in <citerefentry>
134
<refentrytitle>crypttab</refentrytitle>
135
<manvolnum>5</manvolnum></citerefentry> for the root disk. The
136
aim of this program is therefore to output a password, which
137
then <citerefentry><refentrytitle>cryptsetup</refentrytitle>
138
<manvolnum>8</manvolnum></citerefentry> will use to try and
139
unlock the root disk.
164
142
This program is not meant to be invoked directly, but can be in
201
177
<replaceable>PLUGIN</replaceable><literal>:</literal
202
178
><replaceable>ENV</replaceable><literal>=</literal
203
179
><replaceable>value</replaceable></option></term>
205
181
<replaceable>PLUGIN</replaceable><literal>:</literal
206
182
><replaceable>ENV</replaceable><literal>=</literal
207
183
><replaceable>value</replaceable></option></term>
210
This option will add an environment variable setting to
211
the <replaceable>PLUGIN</replaceable> plugin. This will
212
override any inherited environment variables or
213
environment variables specified using
214
<option>--global-env</option>.
253
224
<option>--bar</option> with the option argument
254
225
<quote>baz</quote> is either
255
226
<userinput>--options-for=foo:--bar=baz</userinput> or
256
<userinput>--options-for=foo:--bar,baz</userinput>. Using
257
<userinput>--options-for="foo:--bar baz"</userinput>. will
258
<emphasis>not</emphasis> work.
227
<userinput>--options-for=foo:--bar,baz</userinput>, but
228
<emphasis>not</emphasis>
229
<userinput>--options-for="foo:--bar baz"</userinput>.
264
<term><option>--disable
235
<term><option> --disable
265
236
<replaceable>PLUGIN</replaceable></option></term>
267
238
<replaceable>PLUGIN</replaceable></option></term>
332
<term><option>--plugin-helper-dir
333
<replaceable>DIRECTORY</replaceable></option></term>
336
Specify a different plugin helper directory. The default
337
is <filename>/lib/mandos/plugin-helpers</filename>, which
338
will exist in the initial <acronym>RAM</acronym> disk
339
environment. (This will simply be passed to all plugins
340
via the <envar>MANDOSPLUGINHELPERDIR</envar> environment
341
variable. See <xref linkend="writing_plugins"/>)
347
<term><option>--config-file
348
<replaceable>FILE</replaceable></option></term>
351
Specify a different file to read additional options from.
352
See <xref linkend="files"/>. Other command line options
353
will override options specified in the file.
359
288
<term><option>--debug</option></term>
430
359
code will make this plugin-runner output the password from that
431
360
plugin, stop any other plugins, and exit.
434
<refsect2 id="writing_plugins">
435
<title>WRITING PLUGINS</title>
437
A plugin is simply a program which prints a password to its
438
standard output and then exits with a successful (zero) exit
439
status. If the exit status is not zero, any output on
440
standard output will be ignored by the plugin runner. Any
441
output on its standard error channel will simply be passed to
442
the standard error of the plugin runner, usually the system
446
If the password is a single-line, manually entered passprase,
447
a final trailing newline character should
448
<emphasis>not</emphasis> be printed.
451
The plugin will run in the initial RAM disk environment, so
452
care must be taken not to depend on any files or running
453
services not available there. Any helper executables required
454
by the plugin (which are not in the <envar>PATH</envar>) can
455
be placed in the plugin helper directory, the name of which
456
will be made available to the plugin via the
457
<envar>MANDOSPLUGINHELPERDIR</envar> environment variable.
460
The plugin must exit cleanly and free all allocated resources
461
upon getting the TERM signal, since this is what the plugin
462
runner uses to stop all other plugins when one plugin has
463
output a password and exited cleanly.
466
The plugin must not use resources, like for instance reading
467
from the standard input, without knowing that no other plugin
471
It is useful, but not required, for the plugin to take the
472
<option>--debug</option> option.
477
364
<refsect1 id="fallback">
526
407
everything from a <quote>#</quote> character to the end
527
408
of a line is ignored.
530
This program is meant to run in the initial RAM disk
531
environment, so that is where this file is assumed to
532
exist. The file does not need to exist in the normal
536
This file will be processed <emphasis>before</emphasis>
537
the normal command line options, so the latter can
538
override the former, if need be.
541
This file name is the default; the file to read for
542
arguments can be changed using the
543
<option>--config-file</option> option.
551
416
<refsect1 id="bugs">
552
417
<title>BUGS</title>
554
The <option>--config-file</option> option is ignored when
555
specified from within a configuration file.
557
<xi:include href="bugs.xml"/>
560
422
<refsect1 id="examples">
561
423
<title>EXAMPLE</title>
564
Normal invocation needs no options:
567
<userinput>&COMMANDNAME;</userinput>
572
Run the program, but not the plugins, in debug mode:
576
<!-- do not wrap this line -->
577
<userinput>&COMMANDNAME; --debug</userinput>
583
Run all plugins, but run the <quote>foo</quote> plugin in
588
<!-- do not wrap this line -->
589
<userinput>&COMMANDNAME; --options-for=foo:--debug</userinput>
595
Run all plugins, but not the program, in debug mode:
599
<!-- do not wrap this line -->
600
<userinput>&COMMANDNAME; --global-options=--debug</userinput>
606
Read a different configuration file, run plugins from a
607
different directory, specify an alternate plugin helper
608
directory and add two options to the
609
<citerefentry><refentrytitle >mandos-client</refentrytitle>
610
<manvolnum>8mandos</manvolnum></citerefentry> plugin:
614
<!-- do not wrap this line -->
615
<userinput>cd /etc/keys/mandos; &COMMANDNAME; --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/x86_64-linux-gnu/mandos/plugins.d --plugin-helper-dir /usr/lib/x86_64-linux-gnu/mandos/plugin-helpers --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
620
428
<refsect1 id="security">
621
429
<title>SECURITY</title>
623
This program will, when starting, try to switch to another user.
624
If it is started as root, it will succeed, and will by default
625
switch to user and group 65534, which are assumed to be
626
non-privileged. This user and group is then what all plugins
627
will be started as. Therefore, the only way to run a plugin as
628
a privileged user is to have the set-user-ID or set-group-ID bit
629
set on the plugin executable file (see <citerefentry>
630
<refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum>
634
If this program is used as a keyscript in <citerefentry
635
><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum>
636
</citerefentry>, there is a slight risk that if this program
637
fails to work, there might be no way to boot the system except
638
for booting from another media and editing the initial RAM disk
639
image to not run this program. This is, however, unlikely,
640
since the <citerefentry><refentrytitle
641
>password-prompt</refentrytitle><manvolnum>8mandos</manvolnum>
642
</citerefentry> plugin will read a password from the console in
643
case of failure of the other plugins, and this plugin runner
644
will also, in case of catastrophic failure, itself fall back to
645
asking and outputting a password on the console (see <xref
646
linkend="fallback"/>).
650
434
<refsect1 id="see_also">
651
435
<title>SEE ALSO</title>
653
<citerefentry><refentrytitle>intro</refentrytitle>
654
<manvolnum>8mandos</manvolnum></citerefentry>,
655
437
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
656
438
<manvolnum>8</manvolnum></citerefentry>,
657
<citerefentry><refentrytitle>crypttab</refentrytitle>
658
<manvolnum>5</manvolnum></citerefentry>,
659
<citerefentry><refentrytitle>execve</refentrytitle>
660
<manvolnum>2</manvolnum></citerefentry>,
661
439
<citerefentry><refentrytitle>mandos</refentrytitle>
662
440
<manvolnum>8</manvolnum></citerefentry>,
663
441
<citerefentry><refentrytitle>password-prompt</refentrytitle>
664
442
<manvolnum>8mandos</manvolnum></citerefentry>,
665
<citerefentry><refentrytitle>mandos-client</refentrytitle>
443
<citerefentry><refentrytitle>password-request</refentrytitle>
666
444
<manvolnum>8mandos</manvolnum></citerefentry>