When using IMAGE_FEATURE read-only-rootfs ssh host keys are moved to volatile
storage. If the feature overlayfs-etc is used in addition to read-only-rootfs
/etc is writable and the move is not wanted. But in the case also the
IMAGE_FEATURE
stateless-roots is used the keys will be moved as storage of keys should not
be wanted in a stateless-rootfs.
This change only takes effect in the case IMAGE_FEATURE contains
read-only-rootfs.
In adddition the following cases are handled:
IMAGE_FEATURES = "read-only-rootfs" --> ssh keys/config handled as ro root
IMAGE_FEATURES = "read-only-rootfs overlayfs-etc" --> ssh keys/config handled
as rw root
IMAGE_FEATURES = "read-only-rootfs stateless-rootfs" --> ssh keys/config
handled as ro root
IMAGE_FEATURES = "read-only-rootfs overlayfs-etc stateless-rootfs" --> ssh
keys/config handled as ro root
Signed-off-by: Peter Bergin <pe...@berginkonsult.se>
---
.../rootfs-postcommands.bbclass | 32 +++++++++++--------
1 file changed, 18 insertions(+), 14 deletions(-)
diff --git a/meta/classes-recipe/rootfs-postcommands.bbclass
b/meta/classes-recipe/rootfs-postcommands.bbclass
index 215e38e33d..367fe07c09 100644
--- a/meta/classes-recipe/rootfs-postcommands.bbclass
+++ b/meta/classes-recipe/rootfs-postcommands.bbclass
@@ -22,7 +22,7 @@ ROOTFS_POSTPROCESS_COMMAND +=
'${@bb.utils.contains_any("IMAGE_FEATURES", [ 'deb
# Create /etc/timestamp during image construction to give a reasonably sane
default time setting
ROOTFS_POSTPROCESS_COMMAND += "rootfs_update_timestamp; "
-# Tweak the mount options for rootfs in /etc/fstab if read-only-rootfs is
enabled
+# Tweak files in /etc if read-only-rootfs is enabled
ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES",
"read-only-rootfs", "read_only_rootfs_hook; ", "",d)}'
# We also need to do the same for the kernel boot parameters,
@@ -111,21 +111,25 @@ read_only_rootfs_hook () {
# If we're using openssh and the /etc/ssh directory has no
pre-generated keys,
# we should configure openssh to use the configuration file
/etc/ssh/sshd_config_readonly
# and the keys under /var/run/ssh.
- if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
- if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
- echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >>
${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
- else
- echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >>
${IMAGE_ROOTFS}/etc/default/ssh
- echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >>
${IMAGE_ROOTFS}/etc/default/ssh
+ # If overlayfs-etc is used this is not done as /etc is treated as
writable
+ # If stateless-rootfs is enabled this is always done as we don't want
to save keys then
+ if ${@ 'false;' if bb.utils.contains('IMAGE_FEATURES', 'overlayfs-etc',
True, False, d) and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs',
True, False, d) else 'true;'} then
+ if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
+ if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
+ echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >>
${IMAGE_ROOTFS}/etc/default/ssh
+ echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
+ else
+ echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >>
${IMAGE_ROOTFS}/etc/default/ssh
+ echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'"
>> ${IMAGE_ROOTFS}/etc/default/ssh
+ fi
fi
- fi
- # Also tweak the key location for dropbear in the same way.
- if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then
- if [ ! -e ${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ];
then
- echo "DROPBEAR_RSAKEY_DIR=/var/lib/dropbear" >>
${IMAGE_ROOTFS}/etc/default/dropbear
- fi
+ # Also tweak the key location for dropbear in the same way.
+ if [ -d ${IMAGE_ROOTFS}/etc/dropbear ]; then
+ if [ ! -e
${IMAGE_ROOTFS}/etc/dropbear/dropbear_rsa_host_key ]; then
+ echo "DROPBEAR_RSAKEY_DIR=/var/lib/dropbear" >>
${IMAGE_ROOTFS}/etc/default/dropbear
+ fi
+ fi
fi
if ${@bb.utils.contains("DISTRO_FEATURES", "sysvinit", "true", "false",
d)}; then
--
2.34.1
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#170316):
https://lists.openembedded.org/g/openembedded-core/message/170316
Mute This Topic: https://lists.openembedded.org/mt/93479678/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
