Allow logging in to rescue/emergency shell as root #526
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #526 +/- ##
==========================================
+ Coverage 70.14% 70.57% +0.42%
==========================================
Files 3 3
Lines 469 469
==========================================
+ Hits 329 331 +2
+ Misses 140 138 -2 ☔ View full report in Codecov by Sentry. |
|
Should those drop-ins be included in initramfs (when generated in VM) too? Or maybe they already are there? |
Yes, they should. Dracut module? |
DemiMarie
force-pushed
the
sulogin-force
branch
2 times, most recently
from
757ef06
to
9e612aa
Compare
|
In Qubes OS guests, the console is _always_ the Xen console. There are _never_ untrusted entities with access to this under _any_ circumstances. The only supported way to get access to this from a VM is the admin.vm.Console service, which is (by design) equivalent to root access in the destination VM. Therefore, set SYSTEMD_SULOGIN_FORCE=1 to tell systemd-sulogin-shell to pass --force to sulogin(8). Since the root account is locked in Qubes VMs, this causes sulogin(8) to allow login as root without a password.
This was recommended on Fedora's Matrix channel.
DemiMarie
force-pushed
the
sulogin-force
branch
from
9e612aa
to
958f43d
Compare
|
Should this be conditional on the VM not being |
Similar issue may apply to other VM too. Can you make it specifically for hvc0 console only instead? |
But actually does other consoles matter here? Isn't rescue/emergency started only on the primary console (as configured with |
It should be indeed. I can check. |
In Qubes OS guests, the console is always the Xen console. There are never untrusted entities with access to this under any circumstances. The only supported way to get access to this from a VM is the admin.vm.Console service, which is (by design) equivalent to root access in the destination VM.
Therefore, set SYSTEMD_SULOGIN_FORCE=1 to tell systemd-sulogin-shell to pass --force to sulogin(8). Since the root account is locked in Qubes VMs, this causes sulogin(8) to allow login as root without a password.