swanctl: Use a custom default plugin list

Loading all libstrongswan plugins isn't necessary as the tool only uses
the plugins to parse/decrypt credentials.  So it's similar to pki, but
it doesn't do (online) certificate validation, access tokens, or need
access to databases.

While it's usually not an issue to load unnecessary plugins, one thing
that came up recently are the new capabilities required by the agent
plugin.  Since Debian's AppArmor policy for swanctl doesn't grant them,
this produces an error message that might confuse users.
This commit is contained in:
Tobias Brunner
2026-02-06 11:21:34 +01:00
parent c649774141
commit 5fe1d71204
2 changed files with 36 additions and 34 deletions
+1 -1
View File
@@ -38,7 +38,7 @@ AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libcharon/plugins/vici \
-DSWANCTLDIR=\""${swanctldir}\"" \
-DPLUGINS=\""${s_plugins}\""
-DPLUGINS=\""${swanctl_plugins}\""
man_MANS = \
swanctl.8 \