PLYMOUTH(8mandos)

💖 PLYMOUTH — the plymouth(8mandos) bestie page 💖

okay so hi bestie, welcome to the plymouth manual page, section 8mandos of the Mandos Manual. this one's a little plugin that gets a password out of plymouth for you. let's get into it 🎀

---

✨ NAME ✨

plymouth — a Mandos plugin that uses plymouth to get a password. that's it, that's the whole vibe 💅

---

🌸 SYNOPSIS 🌸

plymouth [--prompt PROMPT] [--debug]

plymouth {--help | -?}

plymouth --usage

plymouth {--version | -V}

---

🦋 DESCRIPTION 🦋

so this program prompts you for a password using plymouth(8) and then spits whatever password you gave it out to standard output. and if it can't find any plymouth(8) process running? it just immediately dips, exiting with an exit code that says "failure." no waiting, no drama 🫶

ngl, this program is not very useful on its own. like at all. it's really meant to run as a plugin in the Mandos client-side system, where it serves as a fallback and an alternative to retrieving passwords from a Mandos server. team player energy, fr fr 👑

and here's the messy part, bestie: if this program gets killed — presumably by plugin-runner(8mandos) because some other plugin already provided the password — it cannot tell plymouth(8) to abort requesting a password, because plymouth(8) literally does not support that. so instead? it kills the running plymouth(8) process and starts a brand new one using the exact same command line arguments the old one was using. not me solving problems with more problems 😭

---

💅 OPTIONS 💅

okay so real talk: this program is commonly not invoked from the command line. it's normally started by the Mandos plugin runner — see plugin-runner(8mandos). so any command line options it accepts are normally handed over by the plugin runner, not typed by you directly. iykyk ✨

• --prompt=PROMPT — the password prompt. heads up though: using this option makes this program ignore the cryptsource and crypttarget environment variables. bye bye, env vars 👋
• --debug — turn on debug mode. this enables a lot of output to standard error about what the program is doing. don't worry, it still performs all its other functions normally — it's just loud now 🙈
• --help, -? — gives you a help message about the options and what they mean. the classic 🎀
• --usage — gives a short usage message. short and sweet, periodt.
• --version, -V — prints the program version. gotta know what you're working with 💜

---

⭐ EXIT STATUS ⭐

• if exit status is 0, the output from the program is the password as it was read. slay ✅
• otherwise, if exit status is anything other than 0, the program was interrupted or hit an error — and any output so far could be corrupt and/or truncated, and should therefore be ignored. do not trust it, bestie, throw it away 💀

---

🌈 ENVIRONMENT 🌈

• cryptsource, crypttarget — if these are set, and if the --prompt option is not used, these environment variables are assumed to contain the source device name and the target device mapper name, respectively, and they get shown as part of the prompt.

these variables will normally be inherited from plugin-runner(8mandos), which might have in turn inherited them from its calling process. it's giving generational trauma but make it environment variables 😭

this behavior is meant to exactly mirror the behavior of askpass, the default password prompter from initramfs-tools. matching energies ✨

---

🧚 FILES 🧚

• /bin/plymouth — this is the command run to retrieve a password from plymouth(8).
• /proc — to find the running plymouth(8), this directory will be searched for numeric entries, which will be assumed to be directories. in all those directories, the exe and cmdline entries will be used to determine the name of the running binary, the effective user and group ID, and the command line arguments. see proc(5). detective work fr 🔍
• /sbin/plymouthd — this is the name of the binary which will be searched for in the process list. see plymouth(8).

---

😭 BUGS 😭

killing the plymouth(8) daemon and starting a new one is ugly, but necessary as long as it does not support aborting a password request. we know. we're not happy about it either 🙈

please report bugs to the Mandos development mailing list: <mandos-dev@recompile.se> (subscription required). note that this list is public. the developers can be reached privately at <mandos@recompile.se> (OpenPGP key fingerprint 153A 37F1 0BBA 0435 987F 2C4A 7223 2973 CA34 C2C4 for encrypted mail).

---

🍓 EXAMPLE 🍓

note that normally, this program will not be invoked directly, but instead started by the Mandos plugin-runner(8mandos).

normal invocation needs no options:

plymouth

show a different prompt:

plymouth --prompt=Password

---

👑 SECURITY 👑

okay bestie, this part matters, so listen up 💖

if this program is killed by a signal, it will kill the process ID which — at the start of this program — was determined to run plymouth(8) as root (see also the section called "FILES"). there is a very slight risk that, in the time between those events, that process ID was freed and then taken up by another process; the wrong process would then be killed. 😬

now, this program can only be killed by the user who started it; see plugin-runner(8mandos). this program should therefore be started by a completely separate non-privileged user, and no other programs should be allowed to run as that special user. this means it is not recommended to use the user "nobody" to start this program, as other possibly less trusted programs could be running as "nobody", and they would then be able to kill this program — triggering the killing of the process ID which may or may not be plymouth(8). not the crossover episode we wanted 💀

the only other thing that could be considered worthy of note is this: this program is meant to be run by plugin-runner(8mandos), and will, when run standalone, outside, in a normal environment, immediately output on its standard output any presumably secret password it just received. therefore, when running this program standalone (which should never normally be done), take care not to type in any real secret password by force of habit, since it would then immediately be shown as output. muscle memory betrayal, fr fr 😭

---

🔥 SEE ALSO 🔥

intro(8mandos), plugin-runner(8mandos), proc(5), plymouth(8)

---

💜 COPYRIGHT 💜

Copyright © 2010-2019 Teddy Hogeborn, Björn Påhlsson

this manual page is part of Mandos.

Mandos is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Mandos is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License for more details.

you should have received a copy of the GNU General Public License along with Mandos. if not, see http://www.gnu.org/licenses/.

---

and that's the whole page, bestie!! 🎀✨ this was Mandos version 1.8.19, dated 2019-07-27, and yeah — that's the PLYMOUTH(8mandos) manual. go forth and be iconic 💖🦋