dist: Fully lock the tss system user if supported

Use the `u!` notation to fully lock the system user.
It is highly unlikely that the `tss` user should ever be logged into
(e.g. via SSH).

This sysusers.d feature has been released with systemd 257 on 2024-12-10.
To support older systemd versions, we select a tpm2-tss.conf based on the
systemd version and copy it to the build directory. With PKG_CHECK_MODULES
we select the correct version during cross compilation. Avoid potential
confusion by ensuring the generated file name is distinct from the input.

Related-to: https://github.com/systemd/systemd/releases/tag/v257
Signed-off-by: David Runge <dave@sleepmap.de>
Signed-off-by: Moritz Buhl <moritz.buhl@infineon.com>

Author: dvzrv

Makefile.am

@@ -716,14 +716,23 @@ fapi-config.json: dist/fapi-config.json.in
 		< "$<" > "$@"
 
 if SYSD_SYSUSERS
-sysusers_DATA = dist/sysusers.d/tpm2-tss.conf
+sysusers_DATA = tpm2-tss.conf
+CLEANFILES += tpm2-tss.conf
 endif
 
 if SYSD_TMPFILES
 tmpfiles_DATA = tpm2-tss-fapi.conf
 CLEANFILES += tpm2-tss-fapi.conf
 endif
 
+if SYSD_SYSUSERS_FULLY_LOCKED
+tpm2-tss.conf: dist/sysusers.d/tpm2-tss.conf.fully-locked
+	$(AM_V_GEN) cp "$<" "$@"
+else
+tpm2-tss.conf: dist/sysusers.d/tpm2-tss.conf.not-fully-locked
+	$(AM_V_GEN) cp "$<" "$@"
+endif # SYSD_SYSUSERS_FULLY_LOCKED
+
 # We have to do this ourselves, in order to get absolute paths
 tpm2-tss-fapi.conf: dist/tmpfiles.d/tpm2-tss-fapi.conf.in
 	$(AM_V_GEN) $(SED) \
@@ -759,7 +768,8 @@ EXTRA_DIST +=  \
     dist/fapi-profiles/P_ECCP256SHA256-high-range.json \
     dist/fapi-profiles/P_RSA2048SHA256-low-range.json \
     dist/fapi-profiles/P_ECCP256SHA256-low-range.json \
-    dist/sysusers.d/tpm2-tss.conf \
+    dist/sysusers.d/tpm2-tss.conf.fully-locked \
+    dist/sysusers.d/tpm2-tss.conf.not-fully-locked \
     dist/tmpfiles.d/tpm2-tss-fapi.conf.in \
     doc/fapi-config.md \
     doc/fapi-profile.md \

REUSE.toml

@@ -26,7 +26,7 @@ SPDX-FileCopyrightText = "2019-2022 Fraunhofer SIT sponsored by Infineon"
 SPDX-License-Identifier = "BSD-2-Clause"
 
 [[annotations]]
-path = "dist/sysusers.d/tpm2-tss.conf"
+path = ["dist/sysusers.d/tpm2-tss.conf.fully-locked", "dist/sysusers.d/tpm2-tss.conf.not-fully-locked"]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "2020 Jonas Witschel"
 SPDX-License-Identifier = "BSD-2-Clause"

configure.ac

@@ -655,6 +655,14 @@ AS_IF([test "x$enable_integration" = "xyes" && test "x$enable_self_generated_cer
 # Check for systemd helper tools used by make install
 AC_CHECK_PROG(systemd_sysusers, systemd-sysusers, yes)
 AM_CONDITIONAL([SYSD_SYSUSERS], [test "x$systemd_sysusers" = "xyes" && test "x$sysusersdir" != "xno"])
+
+systemd_sysusers_fully_locked=no
+AS_IF([test "x$systemd_sysusers" = "xyes"],
+      [PKG_CHECK_MODULES([LIBSYSTEMD], [libsystemd >= 257],
+                         [systemd_sysusers_fully_locked=yes],
+                         [systemd_sysusers_fully_locked=no])])
+AM_CONDITIONAL([SYSD_SYSUSERS_FULLY_LOCKED], [test "x$systemd_sysusers_fully_locked" = "xyes"])
+
 AC_CHECK_PROG(systemd_tmpfiles, systemd-tmpfiles, yes)
 AM_CONDITIONAL([SYSD_TMPFILES], [test "x$systemd_tmpfiles" = "xyes" && test "x$tmpfilesdir" != "xno"])
 

dist/sysusers.d/tpm2-tss.conf.fully-locked

@@ -0,0 +1,2 @@
+#Type Name ID GECOS               Home directory Shell
+u!     tss  -  "tss user for tpm2"