USPLASH(8mandos)

📦
version 1.8.19 · 3 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💅 USPLASH — the Mandos plugin (8mandos) ✨

okay bestie, buckle up, because this one is a little niche but so fun once you get it. this is usplash(8mandos), a Mandos plugin whose whole personality is "get a password using usplash(8)". she's giving helper energy, she's giving fallback, she's giving 🎀

✨ SYNOPSIS ✨

usplash

that's it. that's the whole thing. no flags, no args, she simply is. 💅

🦋 DESCRIPTION 🦋

so, what does she actually do? she prompts for a password using usplash(8), and then she outputs whatever password she got to standard output. that's the vibe.

but — and this is important, no cap — if no usplash(8) process can be found, she will immediately exit with an exit code indicating failure. she doesn't wait around, she doesn't beg, she just leaves. 😭

ngl, this program is not very useful on its own. like, at all. she's really meant to run as a plugin in the Mandos client-side system, where she serves as a fallback and an alternative to retrieving passwords from a Mandos server. so she's the understudy, the backup dancer, the "if everything else fails, call her" girlie. 🫶

now here's the messy part. if this program gets killed — presumably by plugin-runner(8mandos) because some other plugin already provided the password — she cannot tell usplash(8) to abort requesting a password, because usplash(8) does not support this. not her fault, it's giving "the API said no". 💀

so what does she do instead? iconic behaviour, honestly: she will then kill the running usplash(8) process and start a new one using the same command line arguments as the old one was using. dramatic? yes. necessary? also yes. periodt.

🌸 OPTIONS 🌸

This program takes no options.

(no options. zero. none. she's low-maintenance, your honour. 👑)

⭐ EXIT STATUS ⭐

  • if exit status is 0, the output from the program is the password as it was read. slay, she did it. ✨
  • otherwise, if exit status is other than 0, the program was interrupted or encountered an error, and any output so far could be corrupt and/or truncated, and should therefore be ignored.
bestie do NOT trust the output in the non-zero case. it's giving false confidence. ignore it. 🙈

💜 ENVIRONMENT 💜

  • cryptsource, crypttarget — if set, these environment variables will be assumed to contain the source device name and the target device mapper name, respectively, and will be shown as part of the prompt.

These variables will normally be inherited from plugin-runner(8mandos), which might have in turn inherited them from its calling process.

This behavior is meant to exactly mirror the behavior of askpass, the default password prompter.

so she's just matching her sister's outfit. cute. matching outfits, matching behaviour. 🎀

🧚 FILES 🧚

  • /dev/.initramfs/usplash_fifo — this is the FIFO to where this program will write the commands for usplash(8). See fifo(7).
  • /dev/.initramfs/usplash_outfifo — this is the FIFO where this program will read the password from usplash(8). See fifo(7).
  • /proc — to find the running usplash(8), this directory will be searched for numeric entries which will be assumed to be directories. In all those directories, the exe and cmdline entries will be used to determine the name of the running binary, effective user and group ID, and the command line arguments. See proc(5).
  • /sbin/usplash — this is the name of the binary which will be searched for in the process list. See usplash(8).

she's a detective 🔍, digging through /proc looking for her girl.

😭 BUGS 😭

Killing usplash(8) and starting a new one is ugly, but necessary as long as it does not support aborting a password request. it's giving "we tried to fix it and we couldn't, so here we are". 💀

Please report bugs to the Mandos development mailing list: <mandos-dev@recompile.se> (subscription required). Note that this list is public. The developers can be reached privately at <mandos@recompile.se> (OpenPGP key fingerprint 153A 37F1 0BBA 0435 987F 2C4A 7223 2973 CA34 C2C4 for encrypted mail).

🔥 EXAMPLE 🔥

Note that normally, this program will not be invoked directly, but instead started by the Mandos plugin-runner(8mandos).

This program takes no options.

usplash

yeah. that's the example. she takes no options, bestie, what did you expect 😭

👑 SECURITY 👑

okay this section is the serious one, so put your phone down for a sec. 🫶

If this program is killed by a signal, it will kill the process ID which at the start of this program was determined to run usplash(8) as root (see also the section called "FILES"). There is a very slight risk that, in the time between those events, that process ID was freed and then taken up by another process; the wrong process would then be killed.

Now, this program can only be killed by the user who started it; see plugin-runner(8mandos). This program should therefore be started by a completely separate non-privileged user, and no other programs should be allowed to run as that special user. This means that it is not recommended to use the user "nobody" to start this program, as other possibly less trusted programs could be running as "nobody", and they would then be able to kill this program, triggering the killing of the process ID which may or may not be usplash(8).

fr fr, do not use "nobody" for this. that's the whole point of the warning. 🚨

The only other thing that could be considered worthy of note is this: This program is meant to be run by plugin-runner(8mandos), and will, when run standalone, outside, in a normal environment, immediately output on its standard output any presumably secret password it just received. Therefore, when running this program standalone (which should never normally be done), take care not to type in any real secret password by force of habit, since it would then immediately be shown as output.

the way she'd just blurt your password out loud the second you type it 😭 muscle memory will betray you. be careful.

🌈 SEE ALSO 🌈

Copyright © 2008-2019 Teddy Hogeborn, Björn Påhlsson

This manual page is part of Mandos.

Mandos is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Mandos is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Mandos. If not, see http://www.gnu.org/licenses/.

and that's the whole page, bestie 💅 this was Mandos 1.8.19, dated 2019-02-10 — go forth and slay your initramfs password prompts, and remember: never run her standalone, and never trust non-zero output. mwah 🫶✨🎀

📦 where this page comes from