1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY COMMANDNAME "plymouth">
5
<!ENTITY TIMESTAMP "2019-02-10">
6
<!ENTITY % common SYSTEM "../common.ent">
10
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
<title>Mandos Manual</title>
13
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
16
<date>&TIMESTAMP;</date>
19
<firstname>Björn</firstname>
20
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
26
<firstname>Teddy</firstname>
27
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
44
<holder>Teddy Hogeborn</holder>
45
<holder>Björn Påhlsson</holder>
47
<xi:include href="../legalnotice.xml"/>
51
<refentrytitle>&COMMANDNAME;</refentrytitle>
52
<manvolnum>8mandos</manvolnum>
56
<refname><command>&COMMANDNAME;</command></refname>
57
<refpurpose>Mandos plugin to use plymouth to get a
58
password.</refpurpose>
63
<command>&COMMANDNAME;</command>
67
<refsect1 id="description">
68
<title>DESCRIPTION</title>
70
This program prompts for a password using <citerefentry>
71
<refentrytitle>plymouth</refentrytitle><manvolnum>8</manvolnum>
72
</citerefentry> and outputs any given password to standard
73
output. If no <citerefentry><refentrytitle
74
>plymouth</refentrytitle><manvolnum>8</manvolnum></citerefentry>
75
process can be found, this program will immediately exit with an
76
exit code indicating failure.
79
This program is not very useful on its own. This program is
80
really meant to run as a plugin in the <application
81
>Mandos</application> client-side system, where it is used as a
82
fallback and alternative to retrieving passwords from a
83
<application >Mandos</application> server.
86
If this program is killed (presumably by
87
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
88
<manvolnum>8mandos</manvolnum></citerefentry> because some other
89
plugin provided the password), it cannot tell <citerefentry>
90
<refentrytitle>plymouth</refentrytitle><manvolnum>8</manvolnum>
91
</citerefentry> to abort requesting a password, because
92
<citerefentry><refentrytitle>plymouth</refentrytitle>
93
<manvolnum>8</manvolnum></citerefentry> does not support this.
94
Therefore, this program will then <emphasis>kill</emphasis> the
95
running <citerefentry><refentrytitle>plymouth</refentrytitle>
96
<manvolnum>8</manvolnum></citerefentry> process and start a
97
<emphasis>new</emphasis> one using the same command line
98
arguments as the old one was using.
102
<refsect1 id="options">
103
<title>OPTIONS</title>
105
This program takes no options.
109
<refsect1 id="exit_status">
110
<title>EXIT STATUS</title>
112
If exit status is 0, the output from the program is the password
113
as it was read. Otherwise, if exit status is other than 0, the
114
program was interrupted or encountered an error, and any output
115
so far could be corrupt and/or truncated, and should therefore
120
<refsect1 id="environment">
121
<title>ENVIRONMENT</title>
124
<term><envar>cryptsource</envar></term>
125
<term><envar>crypttarget</envar></term>
128
If set, these environment variables will be assumed to
129
contain the source device name and the target device
130
mapper name, respectively, and will be shown as part of
134
These variables will normally be inherited from
135
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
136
<manvolnum>8mandos</manvolnum></citerefentry>, which will
137
normally have inherited them from
138
<filename>/scripts/local-top/cryptroot</filename> in the
139
initial <acronym>RAM</acronym> disk environment, which will
140
have set them from parsing kernel arguments and
141
<filename>/conf/conf.d/cryptroot</filename> (also in the
142
initial RAM disk environment), which in turn will have been
143
created when the initial RAM disk image was created by
145
>/usr/share/initramfs-tools/hooks/cryptroot</filename>, by
146
extracting the information of the root file system from
147
<filename >/etc/crypttab</filename>.
150
This behavior is meant to exactly mirror the behavior of
151
<command>askpass</command>, the default password prompter.
158
<refsect1 id="files">
162
<term><filename>/bin/plymouth</filename></term>
165
This is the command run to retrieve a password from
166
<citerefentry><refentrytitle>plymouth</refentrytitle>
167
<manvolnum>8</manvolnum></citerefentry>.
172
<term><filename class="directory">/proc</filename></term>
175
To find the running <citerefentry><refentrytitle
176
>plymouth</refentrytitle><manvolnum>8</manvolnum>
177
</citerefentry>, this directory will be searched for
178
numeric entries which will be assumed to be directories.
179
In all those directories, the <filename>exe</filename> and
180
<filename>cmdline</filename> entries will be used to
181
determine the name of the running binary, effective user
182
and group <abbrev>ID</abbrev>, and the command line
183
arguments. See <citerefentry><refentrytitle
184
>proc</refentrytitle><manvolnum>5</manvolnum>
190
<term><filename>/sbin/plymouthd</filename></term>
193
This is the name of the binary which will be searched for
194
in the process list. See <citerefentry><refentrytitle
195
>plymouth</refentrytitle><manvolnum>8</manvolnum>
206
Killing the <citerefentry><refentrytitle
207
>plymouth</refentrytitle><manvolnum>8</manvolnum></citerefentry>
208
daemon and starting a new one is ugly, but necessary as long as
209
it does not support aborting a password request.
211
<xi:include href="../bugs.xml"/>
214
<refsect1 id="example">
215
<title>EXAMPLE</title>
217
Note that normally, this program will not be invoked directly,
218
but instead started by the Mandos <citerefentry><refentrytitle
219
>plugin-runner</refentrytitle><manvolnum>8mandos</manvolnum>
224
This program takes no options.
227
<userinput>&COMMANDNAME;</userinput>
232
<refsect1 id="security">
233
<title>SECURITY</title>
235
If this program is killed by a signal, it will kill the process
236
<abbrev>ID</abbrev> which at the start of this program was
237
determined to run <citerefentry><refentrytitle
238
>plymouth</refentrytitle><manvolnum>8</manvolnum></citerefentry>
239
as root (see also <xref linkend="files"/>). There is a very
240
slight risk that, in the time between those events, that process
241
<abbrev>ID</abbrev> was freed and then taken up by another
242
process; the wrong process would then be killed. Now, this
243
program can only be killed by the user who started it; see
244
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
245
<manvolnum>8mandos</manvolnum></citerefentry>. This program
246
should therefore be started by a completely separate
247
non-privileged user, and no other programs should be allowed to
248
run as that special user. This means that it is not recommended
249
to use the user "nobody" to start this program, as other
250
possibly less trusted programs could be running as "nobody", and
251
they would then be able to kill this program, triggering the
252
killing of the process <abbrev>ID</abbrev> which may or may not
253
be <citerefentry><refentrytitle>plymouth</refentrytitle>
254
<manvolnum>8</manvolnum></citerefentry>.
257
The only other thing that could be considered worthy of note is
258
this: This program is meant to be run by <citerefentry>
259
<refentrytitle>plugin-runner</refentrytitle><manvolnum
260
>8mandos</manvolnum></citerefentry>, and will, when run
261
standalone, outside, in a normal environment, immediately output
262
on its standard output any presumably secret password it just
263
received. Therefore, when running this program standalone
264
(which should never normally be done), take care not to type in
265
any real secret password by force of habit, since it would then
266
immediately be shown as output.
270
<refsect1 id="see_also">
271
<title>SEE ALSO</title>
273
<citerefentry><refentrytitle>intro</refentrytitle>
274
<manvolnum>8mandos</manvolnum></citerefentry>,
275
<citerefentry><refentrytitle>crypttab</refentrytitle>
276
<manvolnum>5</manvolnum></citerefentry>,
277
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
278
<manvolnum>8mandos</manvolnum></citerefentry>,
279
<citerefentry><refentrytitle>proc</refentrytitle>
280
<manvolnum>5</manvolnum></citerefentry>,
281
<citerefentry><refentrytitle>plymouth</refentrytitle>
282
<manvolnum>8</manvolnum></citerefentry>
286
<!-- Local Variables: -->
287
<!-- time-stamp-start: "<!ENTITY TIMESTAMP [\"']" -->
288
<!-- time-stamp-end: "[\"']>" -->
289
<!-- time-stamp-format: "%:y-%02m-%02d" -->
added
removed
plugins.d/plymouth.xml
