linux-credentials / linux-credentials/credentialsd
Run credentialsd as a separate user
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 259
- Forks
- 19
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 12
Description
We need to move credentialsd to run as a separate system user in order to store files on behalf of the user without malicious applications running in the user's session being able to read them directly.
This will require moving credentialsd to run on the D-Bus system bus instance and setting up policies only to allow the system user.
This also means that the credentialsd service will have to check the UID of the caller to determine which files to serve.
We didn't do this at first to make initial development easier. Any pointers on how to develop services on the system bus without constantly being prompted for `sudo` access to install are appreciated. (Maybe that's just the solution.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests; start by locating the credentialsd service startup, D-Bus bus configuration, authorization policies, and file-serving entry points. Trace how the caller identity is currently handled. Done means credentialsd runs as a separate system user on the system bus, policies restrict access appropriately, and file serving checks the caller UID.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, rust
- Domain
- authentication, operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100