|
1 | 1 | <?xml version='1.0'?> <!--*-nxml-*--> |
2 | | -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" |
| 2 | +<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
3 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
4 | | - |
5 | | -<!-- |
6 | | - SPDX-License-Identifier: LGPL-2.1+ |
7 | | -
|
8 | | - This file is part of systemd. |
9 | | -
|
10 | | - Copyright 2014 Lennart Poettering |
11 | | -
|
12 | | - systemd is free software; you can redistribute it and/or modify it |
13 | | - under the terms of the GNU Lesser General Public License as published by |
14 | | - the Free Software Foundation; either version 2.1 of the License, or |
15 | | - (at your option) any later version. |
16 | | -
|
17 | | - systemd is distributed in the hope that it will be useful, but |
18 | | - WITHOUT ANY WARRANTY; without even the implied warranty of |
19 | | - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
20 | | - Lesser General Public License for more details. |
21 | | -
|
22 | | - You should have received a copy of the GNU Lesser General Public License |
23 | | - along with systemd; If not, see <http://www.gnu.org/licenses/>. |
24 | | ---> |
| 4 | +<!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
25 | 5 |
|
26 | 6 | <refentry id="systemd-sysusers" |
27 | 7 | xmlns:xi="http://www.w3.org/2001/XInclude"> |
28 | 8 |
|
29 | 9 | <refentryinfo> |
30 | 10 | <title>systemd-sysusers</title> |
31 | 11 | <productname>systemd</productname> |
32 | | - |
33 | | - <authorgroup> |
34 | | - <author> |
35 | | - <contrib>Developer</contrib> |
36 | | - <firstname>Lennart</firstname> |
37 | | - <surname>Poettering</surname> |
38 | | - <email>lennart@poettering.net</email> |
39 | | - </author> |
40 | | - </authorgroup> |
41 | 12 | </refentryinfo> |
42 | 13 |
|
43 | 14 | <refmeta> |
|
97 | 68 | paths. </para></listitem> |
98 | 69 | </varlistentry> |
99 | 70 |
|
| 71 | + <varlistentry> |
| 72 | + <term><option>--image=<replaceable>image</replaceable></option></term> |
| 73 | + |
| 74 | + <listitem><para>Takes a path to a disk image file or block device node. If specified all operations |
| 75 | + are applied to file system in the indicated disk image. This is similar to <option>--root=</option> |
| 76 | + but operates on file systems stored in disk images or block devices. The disk image should either |
| 77 | + contain just a file system or a set of file systems within a GPT partition table, following the |
| 78 | + <ulink url="https://systemd.io/DISCOVERABLE_PARTITIONS">Discoverable Partitions |
| 79 | + Specification</ulink>. For further information on supported disk images, see |
| 80 | + <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s |
| 81 | + switch of the same name.</para></listitem> |
| 82 | + </varlistentry> |
| 83 | + |
100 | 84 | <varlistentry> |
101 | 85 | <term><option>--replace=<replaceable>PATH</replaceable></option></term> |
102 | | - <listitem><para>When this option is given, one ore more positional arguments |
| 86 | + <listitem><para>When this option is given, one or more positional arguments |
103 | 87 | must be specified. All configuration files found in the directories listed in |
104 | 88 | <citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
105 | 89 | will be read, and the configuration given on the command line will be |
|
124 | 108 | placing <filename>/etc/sysusers.d/radvd.conf</filename> or even |
125 | 109 | <filename>/etc/sysusers.d/00-overrides.conf</filename>.</para> |
126 | 110 |
|
127 | | - <para>Note that this is the expanded from, and when used in a package, this |
| 111 | + <para>Note that this is the expanded form, and when used in a package, this |
128 | 112 | would be written using a macro with "radvd" and a file containing the |
129 | 113 | configuration line as arguments.</para> |
130 | 114 | </example> |
131 | 115 | </listitem> |
132 | 116 | </varlistentry> |
133 | 117 |
|
| 118 | + <varlistentry> |
| 119 | + <term><option>--dry-run</option></term> |
| 120 | + <listitem><para>Process the configuration and figure out what entries would be created, but don't |
| 121 | + actually write anything.</para></listitem> |
| 122 | + </varlistentry> |
| 123 | + |
134 | 124 | <varlistentry> |
135 | 125 | <term><option>--inline</option></term> |
136 | 126 | <listitem><para>Treat each positional argument as a separate configuration |
137 | 127 | line instead of a file name.</para></listitem> |
138 | 128 | </varlistentry> |
139 | 129 |
|
| 130 | + <xi:include href="standard-options.xml" xpointer="cat-config" /> |
| 131 | + <xi:include href="standard-options.xml" xpointer="no-pager" /> |
140 | 132 | <xi:include href="standard-options.xml" xpointer="help" /> |
141 | 133 | <xi:include href="standard-options.xml" xpointer="version" /> |
142 | 134 | </variablelist> |
| 135 | + </refsect1> |
| 136 | + |
| 137 | + <refsect1> |
| 138 | + <title>Credentials</title> |
| 139 | + |
| 140 | + <para><command>systemd-sysusers</command> supports the service credentials logic as implemented by |
| 141 | + <varname>LoadCredential=</varname>/<varname>SetCredential=</varname> (see |
| 142 | + <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>1</manvolnum></citerefentry> for |
| 143 | + details). The following credentials are used when passed in:</para> |
| 144 | + |
| 145 | + <variablelist> |
| 146 | + <varlistentry> |
| 147 | + <term><literal>passwd.hashed-password.<replaceable>user</replaceable></literal></term> |
| 148 | + <listitem><para>A UNIX hashed password string to use for the specified user, when creating an entry |
| 149 | + for it. This is particularly useful for the <literal>root</literal> user as it allows provisioning |
| 150 | + the default root password to use via a unit file drop-in or from a container manager passing in this |
| 151 | + credential. Note that setting this credential has no effect if the specified user account already |
| 152 | + exists. This credential is hence primarily useful in first boot scenarios or systems that are fully |
| 153 | + stateless and come up with an empty <filename>/etc/</filename> on every boot.</para></listitem> |
| 154 | + </varlistentry> |
| 155 | + |
| 156 | + <varlistentry> |
| 157 | + <term><literal>passwd.plaintext-password.<replaceable>user</replaceable></literal></term> |
| 158 | + |
| 159 | + <listitem><para>Similar to <literal>passwd.hashed-password.<replaceable>user</replaceable></literal> |
| 160 | + but expect a literal, plaintext password, which is then automatically hashed before used for the user |
| 161 | + account. If both the hashed and the plaintext credential are specified for the same user the |
| 162 | + former takes precedence. It's generally recommended to specify the hashed version; however in test |
| 163 | + environments with weaker requirements on security it might be easier to pass passwords in plaintext |
| 164 | + instead.</para></listitem> |
| 165 | + </varlistentry> |
| 166 | + |
| 167 | + <varlistentry> |
| 168 | + <term><literal>passwd.shell.<replaceable>user</replaceable></literal></term> |
| 169 | + |
| 170 | + <listitem><para>Specifies the shell binary to use for the specified account when creating it.</para></listitem> |
| 171 | + </varlistentry> |
| 172 | + |
| 173 | + <varlistentry> |
| 174 | + <term><literal>sysusers.extra</literal></term> |
| 175 | + |
| 176 | + <listitem><para>The contents of this credential may contain additional lines to operate on. The |
| 177 | + credential contents should follow the same format as any other <filename>sysusers.d/</filename> |
| 178 | + drop-in. If this credential is passed it is processed after all of the drop-in files read from the |
| 179 | + file system.</para></listitem> |
| 180 | + </varlistentry> |
| 181 | + </variablelist> |
| 182 | + |
| 183 | + <para>Note that by default the <filename>systemd-sysusers.service</filename> unit file is set up to |
| 184 | + inherit the <literal>passwd.hashed-password.root</literal>, |
| 185 | + <literal>passwd.plaintext-password.root</literal>, <literal>passwd.shell.root</literal> and |
| 186 | + <literal>sysusers.extra</literal> credentials from the service manager. Thus, when invoking a container |
| 187 | + with an unpopulated <filename>/etc/</filename> for the first time it is possible to configure the root |
| 188 | + user's password to be <literal>systemd</literal> like this:</para> |
| 189 | + |
| 190 | + <para><programlisting># systemd-nspawn --image=… --set-credential=passwd.hashed-password.root:'$y$j9T$yAuRJu1o5HioZAGDYPU5d.$F64ni6J2y2nNQve90M/p0ZP0ECP/qqzipNyaY9fjGpC' …</programlisting></para> |
| 191 | + |
| 192 | + <para>Note again that the data specified in this credential is consulted only when creating an account |
| 193 | + for the first time, it may not be used for changing the password or shell of an account that already |
| 194 | + exists.</para> |
143 | 195 |
|
| 196 | + <para>Use <citerefentry project='man-pages'><refentrytitle>mkpasswd</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
| 197 | + for generating UNIX password hashes from the command line.</para> |
144 | 198 | </refsect1> |
145 | 199 |
|
146 | 200 | <refsect1> |
|
154 | 208 | <title>See Also</title> |
155 | 209 | <para> |
156 | 210 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
157 | | - <citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| 211 | + <citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| 212 | + <ulink url="https://systemd.io/UIDS-GIDS">Users, Groups, UIDs and GIDs on systemd systems</ulink>, |
| 213 | + <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
| 214 | + <citerefentry project='man-pages'><refentrytitle>mkpasswd</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
158 | 215 | </para> |
159 | 216 | </refsect1> |
160 | 217 |
|
|
0 commit comments