<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hello!</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I have a few questions about how systemd credentials feature works.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<ul>
<li><span>I can encrypt an input file using systemd-creds tool but I need privileged permissions to do that. Is there a way of doing it as a non-root user? Maybe ask from a user process to systemd through dbus?<br>
</span></li><li style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
If I pass a credential to a service through <i>SetCredentialEncrypted</i> arg in its unit.file, systemd decrypts it and the service has access to it. I found that using <i>SetCredential
</i>stores the credential in its corresponding $CREDENTIALS_DIRECTORY but when using
<i>SetCredentialEncrypted</i> doesn't. How would be the proper way to access these credentials from the implementation of the service? I've only been able to read SetCredential or SetCredentialEncrypted through dbus.</li><li style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Is there an option to let a specific user only decrypt its specific credentials? From what I've seen, systemd uses a master key to encrypt/decrypt, is there a way of having a different master key for each user? I'm assuming that systemd doesn't consider this
but maybe there is some approach.</li></ul>
<div><br>
</div>
<div>systemctl --version
<div>systemd 249 (249.7+suse.57.g523f32df57)</div>
<span>+PAM +AUDIT +SELINUX +APPARMOR -IMA -SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT
default-hierarchy=unified</span><br>
</div>
<div><span>OS: openSUSE Tubleweed</span></div>
<div><span><br>
</span></div>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I don't have much experience in Linux and I'm trying to learn the best I can.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thank you.</div>
<div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Joan Torres</div>
</div>
</div>
</div>
</body>
</html>