diff options
author | Peter Bergin <peter@berginkonsult.se> | 2022-09-05 20:40:40 +0200 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-09-16 17:53:22 +0100 |
commit | 23557350608cc49d2251b8240038b3d9d093c393 (patch) | |
tree | 27e71de27a568e597118a307bfe302dc994fb046 /meta | |
parent | f604ff9de4b3a77f88bd662030ffb34e8a55633d (diff) | |
download | poky-23557350608cc49d2251b8240038b3d9d093c393.tar.gz |
rootfs-postcommands.bbclass: avoid moving ssh host keys if etc is writable
When using IMAGE_FEATURE read-only-rootfs ssh host keys are moved to volatile
storage. If the feature overlayfs-etc is used in addition to read-only-rootfs
/etc is writable and the move is not wanted. But in the case also the IMAGE_FEATURE
stateless-rootfs is used the keys will be moved as storage of keys should not
be wanted in a stateless-rootfs.
This change only takes effect in the case IMAGE_FEATURE contains read-only-rootfs.
In adddition the following cases are handled:
IMAGE_FEATURES = "read-only-rootfs" --> ssh keys/config handled as ro root
IMAGE_FEATURES = "read-only-rootfs overlayfs-etc" --> ssh keys/config handled as rw root
IMAGE_FEATURES = "read-only-rootfs stateless-rootfs" --> ssh keys/config handled as ro root
IMAGE_FEATURES = "read-only-rootfs overlayfs-etc stateless-rootfs" --> ssh keys/config handled as ro root
(From OE-Core rev: 31cff4d182faed31747d00cc82c1cf0a05a81431)
Signed-off-by: Peter Bergin <peter@berginkonsult.se>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d2ad7aa1f2153955adc044ea4eb11c48086a01d1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/classes/rootfs-postcommands.bbclass | 30 |
1 files changed, 17 insertions, 13 deletions
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass index a59d9b5878..5c0b3ec37c 100644 --- a/meta/classes/rootfs-postcommands.bbclass +++ b/meta/classes/rootfs-postcommands.bbclass | |||
@@ -14,7 +14,7 @@ ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains_any("IMAGE_FEATURES", [ 'deb | |||
14 | # Create /etc/timestamp during image construction to give a reasonably sane default time setting | 14 | # Create /etc/timestamp during image construction to give a reasonably sane default time setting |
15 | ROOTFS_POSTPROCESS_COMMAND += "rootfs_update_timestamp; " | 15 | ROOTFS_POSTPROCESS_COMMAND += "rootfs_update_timestamp; " |
16 | 16 | ||
17 | # Tweak the mount options for rootfs in /etc/fstab if read-only-rootfs is enabled | 17 | # Tweak files in /etc if read-only-rootfs is enabled |
18 | ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", "read_only_rootfs_hook; ", "",d)}' | 18 | ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES", "read-only-rootfs", "read_only_rootfs_hook; ", "",d)}' |
19 | 19 | ||
20 | # We also need to do the same for the kernel boot parameters, | 20 | # We also need to do the same for the kernel boot parameters, |
@@ -103,20 +103,24 @@ read_only_rootfs_hook () { | |||
103 | # If we're using openssh and the /etc/ssh directory has no pre-generated keys, | 103 | # If we're using openssh and the /etc/ssh directory has no pre-generated keys, |
104 | # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly | 104 | # we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly |
105 | # and the keys under /var/run/ssh. | 105 | # and the keys under /var/run/ssh. |
106 | if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then | 106 | # If overlayfs-etc is used this is not done as /etc is treated as writable |
107 | if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then | 107 | # If stateless-rootfs is enabled this is always done as we don't want to save keys then |
108 | echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh | 108 | if ${@ 'true' if not bb.utils.contains('IMAGE_FEATURES', 'overlayfs-etc', True, False, d) or bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, False, d) else 'false'}; then |
109 | echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh | 109 | if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then |
110 | else | 110 | if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then |
111 | echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh | 111 | echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh |
112 | echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh | 112 | echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh |
113 | else | ||
114 | echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh | ||
115 | echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh | ||
116 | fi | ||
113 | fi | 117 | fi |
114 | fi | ||
115 | 118 | ||
116 | # Also tweak the key location for dropbear in the same way. | 119 | # Also tweak the key location for dropbear in the same way. |
117 | if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then | 120 | if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then |
118 | if [ ! -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then | 121 | if [ ! -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then |
119 | echo "DROPBEAR_RSAKEY_DIR=/var/lib/dropbear" >> ${IMAGE_ROOTFS}/etc/default/dropbear | 122 | echo "DROPBEAR_RSAKEY_DIR=/var/lib/dropbear" >> ${IMAGE_ROOTFS}/etc/default/dropbear |
123 | fi | ||
120 | fi | 124 | fi |
121 | fi | 125 | fi |
122 | 126 | ||