Commit Graph

60 Commits

Author SHA1 Message Date
Peter Marko
da007b8f01 rootfs-postcommands.bbclass: make opkg status reproducible
opkg stores the current time as Installed-Time in its status file when
installing packages to the rootfs. Make this reproducible by replacing
Installed-Time with ${REPRODUCIBLE_TIMESTAMP_ROOTFS}, which then also
matches the files' datestamps.

Based on OpenWrt's approach for the issue [1].

[1] https://github.com/openwrt/openwrt/blob/main/include/rootfs.mk#L103

(From OE-Core rev: 61a9b1b1cb618ce90ba7886036f41263075c07df)

(From OE-Core rev: bfa9c2f15ac275fceccf22084bed9a064304eb6e)

Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-16 05:58:03 -08:00
Michael Glembotzki
2b21c6009a rootfs-postcommands.bbclass: Only set DROPBEAR_RSAKEY_DIR once
If DROPBEAR_RSAKEY_DIR has already been set before, e.g. by overwriting
the file dropbear.default, the line will still be appended a second time.

DROPBEAR_RSAKEY_DIR="/path/to/dropbear"
DROPBEAR_EXTRA_ARGS="-B"
DROPBEAR_RSAKEY_DIR=/var/lib/dropbear

(Backport of rev: 6045314d29)

(From OE-Core rev: 8a502301209ef144932ef5071c1a9b738db23270)

Signed-off-by: Michael Glembotzki <Michael.Glembotzki@iris-sensing.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-05-02 06:21:09 -07:00
Peter Bergin
2355735060 rootfs-postcommands.bbclass: avoid moving ssh host keys if etc is writable
When using IMAGE_FEATURE read-only-rootfs ssh host keys are moved to volatile
storage. If the feature overlayfs-etc is used in addition to read-only-rootfs
/etc is writable and the move is not wanted. But in the case also the IMAGE_FEATURE
stateless-rootfs is used the keys will be moved as storage of keys should not
be wanted in a stateless-rootfs.

This change only takes effect in the case IMAGE_FEATURE contains read-only-rootfs.
In adddition the following cases are handled:

  IMAGE_FEATURES = "read-only-rootfs" --> ssh keys/config handled as ro root
  IMAGE_FEATURES = "read-only-rootfs overlayfs-etc" --> ssh keys/config handled as rw root
  IMAGE_FEATURES = "read-only-rootfs stateless-rootfs" --> ssh keys/config handled as ro root
  IMAGE_FEATURES = "read-only-rootfs overlayfs-etc stateless-rootfs" --> ssh keys/config handled as ro root

(From OE-Core rev: 31cff4d182faed31747d00cc82c1cf0a05a81431)

Signed-off-by: Peter Bergin <peter@berginkonsult.se>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d2ad7aa1f2153955adc044ea4eb11c48086a01d1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-16 17:53:22 +01:00
Ming Liu
b581f10189 rootfs-postcommands.bbclass: move host-user-contaminated.txt to ${S}
This is to ensure host-user-contaminated.txt would be removed before
do_rootfs runs, since ${S} is in cleandirs of do_rootfs, otherwise, a
host-user-contaminated.txt file that generated from previous builds
could be used which is wrong.

(From OE-Core rev: 96215d6d45d2cae59c9e36e6a77bbbada410b259)

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 54a3fd63e684d070fad962be97e549f3af7ac111)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:30 +01:00
Michael Opdenacker
460dd9529d rootfs-postcommands.bbclass: correct comments
(From OE-Core rev: f0770686b36c08d99915a8d1b4d0e4450e831be4)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 41ade8e9a14c867e146a545be8d2d9c151b6855f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-24 23:57:42 +01:00
Claudius Heine
ec7da0e068 classes: rootfs-postcommands: add skip option to overlayfs_qa_check
The overlayfs_qa_check checks if the current root file system has a
mount configured for each overlayfs, when the overlayfs class is used.

However there are certain instances where this mount point is created at
runtime and not static in a fstab entry or systemd mount unit.

One such case would be if overlayfs-etc is used, where the device is
mounted in the preinit script and not via a mount unit or fstab entry.

However there are other possibilities for this as well, like startup
scripts that support a dynamic partition layout. For instance when
systemd-repart is used.

This adds the `OVERLAYFS_QA_SKIP` variable, which allows to define QA
skips via its flags. In principle it supports multiple QA skip flags
separated by whitespace, but only one (`mount-configured`) is
implemented here. To skip this QA check simply add `mount-configured` to
the flag of `OVERLAYFS_QA_SKIP` with the same name. For instance if a
overlayfs is configured as:

	OVERLAYFS_MOUNT_POINT[data] = "/data"

Skipping this QA check can be done by setting:

	OVERLAYFS_QA_SKIP[data] = "mount-configured"

Also add a testcase and fix a typo (fstat -> fstab).

(From OE-Core rev: 34b6d6b5f078c6948e53815af3c7b61de43d851c)

Signed-off-by: Claudius Heine <ch@denx.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2ce9173169a2a86392c4a85fe9be7fbbd7353b7f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-25 22:45:50 +01:00
Davide Gardenal
c5580a0571 rootfs-postcommands: fix symlinks where link and output path are equal
When creating the manifest and the testdata.json links, if the link
name is equal to the output name the link is not created, otherwise
it is. This prevents a link-to-self in the first case.

(From OE-Core rev: e69a1533dfb8ceb5b91610f2ab8b3da575fcc36e)

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bed63756c56f296ff3d5a7eef66e978bd19f1008)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-12 16:44:06 +01:00
Stefan Herbrechtsmeier
2126584d61 classes: rootfs-postcommands: include /etc/fstab in overlayfs_qa_check
The systemd init manager support mount point configuration via mount
units and /etc/fstab. 'Mounts listed in /etc/fstab will be converted
into native units dynamically at boot and when the configuration of
the system manager is reloaded. In general, configuring mount points
through /etc/fstab is the preferred approach.' [1]

Read mount points from /etc/fstab to determine dynamic mount units.

[1] https://www.freedesktop.org/software/systemd/man/systemd.mount.html

(From OE-Core rev: 9db988dae6dbf6da7b066728bc13b59a5c45b75c)

Signed-off-by: Stefan Herbrechtsmeier <stefan.herbrechtsmeier@weidmueller.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-04 17:14:15 +00:00
Tean Cunningham
a559a2cba9 rootfs-postcommands: amend systemd_create_users add user to group check
Currently when adding a user to a group ('m' type), the conditional
check to only create a user/group if it does not exist always resolves
to true. This causes a build exit failure if the user and/or group
defined in the sysusers configuration file were already created prior to
the execution of systemd_create_users().

This logic has been updated to instead fail silently (consistent with
'u' and 'g' type). Additionally, if a user doesn't exist it will be
created without the default group.

(From OE-Core rev: 65649be6b2196ab964c69605d0306bfc2481da33)

Signed-off-by: Tean Cunningham <tean.cunningham@digi.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-02 18:43:25 +00:00
Stefan Herbrechtsmeier
4fee926120 classes: rootfs-postcommands: avoid exception in overlayfs_qa_check
The overlayfs_qa_check in the rootfs-postcommands class throws an
exception if the overlayfs distro feature is enabled but no global
OVERLAYFS_MOUNT_POINT is specifived.

File: '/home/stefan/dalos-linutronix/poky/meta/classes/rootfs-postcommands.bbclass', lineno: 389, function: overlayfs_qa_check
     0385:    searchpaths = [oe.path.join(imagepath, d.getVar("sysconfdir"), "systemd", "system"),
     0386:                   oe.path.join(imagepath, d.getVar("systemd_system_unitdir"))]
     0387:
     0388:    allUnitExist = True;
 *** 0389:    for mountPoint in overlayMountPoints:
     0390:        path = d.getVarFlag('OVERLAYFS_MOUNT_POINT', mountPoint)
     0391:        unit = mountUnitName(path)
     0392:
     0393:        if not any(os.path.isfile(oe.path.join(dirpath, unit))
Exception: TypeError: 'NoneType' object is not iterable

(From OE-Core rev: 4396348c24efb1185d68876d3cf6ade90324dee5)

Signed-off-by: Stefan Herbrechtsmeier <stefan.herbrechtsmeier@weidmueller.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-25 12:41:24 +00:00
Peter Kjellerstedt
97726d1b87 rootfs-postcommands.bbclass: Make two comments use the new variable syntax
(From OE-Core rev: cb17cccaf2f51558bd1d320559bd792d5869688e)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-11 15:48:11 +00:00
Vyacheslav Yurkov
e7666d7cb8 rootfs-postcommands: update systemd_create_users
Process all systemd-sysusers configuration files in order to create
users/groups at build time. systemd-sysusers would try to create them at
run-time, but for read-only rootfs that's not possible and results in
warnings from different services:

systemd-udevd[166]: /lib/udev/rules.d/50-udev-default.rules:39 Unknown group 'render', ignoring
systemd-udevd[166]: /lib/udev/rules.d/50-udev-default.rules:40 Unknown group 'render', ignoring
systemd-udevd[166]: /lib/udev/rules.d/50-udev-default.rules:42 Unknown group 'sgx', ignoring

(From OE-Core rev: f86ffdb1b77c6ba32ec250545a40c1c54f983f21)

Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-23 10:53:15 +00:00
Robert P. J. Day
abeb2e95c6 systemd: '${systemd_unitdir}/system' => '${systemd_system_unitdir}'
Repo-wide replacement to use newer variable to represent systemd
system unitdir directory.

(From OE-Core rev: 5ace3ada5c54500c71becc8e0c6eddeb8bc053e3)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-07 21:54:11 +01:00
Vyacheslav Yurkov
550511e446 rootfs-postcommands: add QA check for overlayfs
The check is conditional and only enabled when overlayfs is set in
DISTRO_FEATURES

(From OE-Core rev: 4734799bacf0a5d2487e1cde3ae1c00223b032b2)

Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-12 06:26:15 +01:00
Richard Purdie
bb6ddc3691 Convert to new override syntax
This is the result of automated script conversion:

scripts/contrib/convert-overrides.py <oe-core directory>

converting the metadata to use ":" as the override character instead of "_".

(From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-02 15:44:10 +01:00
Alexander Kanavin
d8b2c8cee9 rootfs-postcommands: correctly set systemd target for weston images
Otherwise, weston wouldn't actually start when systemd is in use.

(From OE-Core rev: 6b6287b7e5190d1af2e3aefddb2f72a8d0d79968)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-06 22:39:04 +00:00
Martin Jansa
43f1cf2d3d image-artifact-names: introduce new bbclass and move some variables into it
* similar to kernel-artifact-names for other recipes/bbclasses which
  need to use some deployed artifacts

* bitbake.conf: move IMAGE_BASENAME, IMAGE_VERSION_SUFFIX, IMAGE_NAME,
  IMAGE_LINK_NAME variables

* image_types.bbclass: move IMAGE_NAME_SUFFIX variable

* currently IMAGE_NAME_SUFFIX is used only by image.bbclass,
  image_types.bbclass and meta/recipes-core/images/build-appliance-image_15.0.0.bb
  but if it's needed by some recipe which isn't itself an image, then
  it's useful in bitbake.conf, e.g. we have a recipe for creating
  VirtualBox appliances which combines .wic.vmdk with .ovf file to
  create .zip with appliance, but for that we need the filename of
  .wic.vmdk which now contains IMAGE_NAME_SUFFIX
  4980ce52a4/meta-luneos/recipes-core/images/luneos-emulator-appliance.inc (L24)

* we were hardcoding .rootfs suffix where needed, but for quite long
  time it's configurable with IMAGE_NAME_SUFFIX since:

  commit 380ee36811939d947024bf78de907e3c071b834f
  Author: Patrick Ohly <patrick.ohly@intel.com>
  Date:   Mon Mar 7 18:07:52 2016 +0100

    image creation: allow overriding .rootfs suffix

  and might not match with hardcoded .rootfs, so make it easier to
  use IMAGE_NAME_SUFFIX where needed even without inheritting whole
  image_types.bbclass

[YOCTO #12937]

(From OE-Core rev: 456b700d51a5052a285a8477304f902c335223be)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-09-17 09:47:45 +01:00
Konrad Weihmann
7d82155fd5 rootfs-post: remove traling blanks from tasks
remove the traling blanks before the ;-delimiter, so one could use
"_remove" to avoid running tasks like 'rootfs_update_timestamp',
which are currently hardcoded and not bound to any
configurable feature flag

(From OE-Core rev: 8c835f63c2bca0a66385eb7ea5ec021d86265777)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-27 10:37:57 +01:00
Richard Purdie
4a2370583b rootfs-postcommands: Improve/fix rootfs_check_host_user_contaminated
Currently if the find command finds /home it stops checking the other
files. Tweak the find expression to fix this.

Also, from Alex Kiernan <alex.kiernan@gmail.com>, generate output for
each contaminated path so it's visible in the main log file.

When matches are found, dump the data from the group and passwd files
so useful debugging can be done based on the results.

(From OE-Core rev: 504f1d158bf7c6ad08fbce755021db2b14565231)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-07-03 20:17:29 +01:00
Peter Kjellerstedt
b645630090 Revert "rootfs: Make BUILDNAME a weak default in reproducible_build_simple"
This reverts commit 8380df6566.

Giving BUILDNAME a static default in reproducible_build_simple.bbclass
to have /etc/version be generated with that name lead to other users
of BUILDNAME no longer working as expected. E.g., buildstats.bcclass
would now write its information in a single directory, overwriting the
statistics for each build.

(From OE-Core rev: dcd1fbe153369634c73370cbe22e1dbdac080146)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-21 17:48:09 +00:00
Alex Kiernan
8380df6566 rootfs: Make BUILDNAME a weak default in reproducible_build_simple
11e45082ad00 ("rootfs-postcommands.bbclass: improve binary
reproducibility") fixed binary reproducibility of /etc/version, but with
the move to reproducibilty in all builds, setting /etc/version to
anything other than the default fixed timestamp is tricky because
rootfs_reproducible() runs very late.

rootfs.py uses BUILDNAME if set for /etc/version, so introduce a weak
default for BUILDNAME of "REPRODUCIBLE_TIMESTAMP_ROOTFS", when enabling
reproducible builds hence allowing BUILDNAME to be overridden elsewhere.

(From OE-Core rev: bbf28ea9100a4f86b052c5cd53c77f9e1c03fb09)

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-19 23:49:39 +00:00
Alessio Igor Bogani
a558e507ae rootfs-postcommands: Avoid use of an hard-coded value
(From OE-Core rev: 520c6f30cd571166a0d890d86b461f24f7a6998f)

Signed-off-by: Alessio Igor Bogani <alessio.bogani@elettra.eu>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-02 20:22:25 +01:00
Ross Burton
f3977f03a1 rootfs-postcommands: check /etc/gconf exists before working on it
Check that /etc/gconf exists before trying to find files under it, to avoid
writing find error messages to the rootfs log.

Also use ${sysconfdir}/gconf instead of hardcoding /etc/gconf.

(From OE-Core rev: 70a77b91031388ea29eff6b8885fd25cc35b1dae)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-19 10:54:32 +01:00
Andre McCurdy
ba6898d1b2 rootfs-postcommands.bbclass: add inittab tweak to read_only_rootfs_hook()
It's not clear that we actually need to call mount -o remount,XX from
the busybox-inittab inittab at all, but as we currently do, let's
respect read-only-rootfs in IMAGE_FEATURES and not remount / as rw.

(From OE-Core rev: 8840a831d47a94f36bb2e173164dbaf9b955e809)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-28 11:31:22 +01:00
Mike Crowe
2381806f26 rootfs-postcommands: Cope with empty IMAGE_LINK_NAME in write_image_test_data
Ensure that we don't create an image test data symlink named
".testdata.json" when IMAGE_LINK_NAME is empty.

(From OE-Core rev: 97e1af51814c63963dc6eee003e0cf0e4dead024)

Signed-off-by: Mike Crowe <mac@mcrowe.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-16 13:53:17 +01:00
Mike Crowe
3e1938f6d2 rootfs-postcommands: Cope with empty IMAGE_LINK_NAME in write_image_manifest
Ensure that we don't create a symlink named ".manifest" if IMAGE_LINK_NAME
is empty.

(From OE-Core rev: 267697f5e1c931e39fd81dd1b14691e364be64f3)

Signed-off-by: Mike Crowe <mac@mcrowe.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-16 13:53:17 +01:00
Jonas Bonn
119d310f36 systemd: do not create machine-id
There is no reason to have an emtpy machine-id as part of the systemd
package.  Either:

i)  the filesystem is writable and the file will be created
automatically; or
ii) the filesystem is read-only, in which case the empty machine-id file
should be created as part of the read-only-rootfs tweaks.

(From OE-Core rev: 76444b63e614baea33c044851a5859f6d1e69729)

Signed-off-by: Jonas Bonn <jonas@norrbonn.se>
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-03 06:11:57 +01:00
grygorii tertychnyi via Openembedded-core
bc8f229366 lib/oe/utils: add eol to format_pkg_list()
Append '\n' to the non-empty formatted string before return. If you
write it to the (manifest) file, it will ensure file ends with a newline.

Many GNU utilities have problems processing the last line of a file
if it is not '\n' terminated. E.g. if the last line is not terminated
by a newline character, then "read" will read it but return false,
leaving the broken partial line in the read variable(s).
It can also break or adversely affect some text processing tools,
that operate on the file.

(From OE-Core rev: ee4d0c879713ba50dc6cc3300f44647faebee2e0)

Signed-off-by: grygorii tertychnyi <gtertych@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-11 23:06:35 +01:00
André Draszik
8f16469e97 rootfs-postcommands: put image testdata under sstate control
The testdata.json is being written to DEPLOY_DIR_IMAGE directly,
thus bypassing sstate, which results in an ever growing list
of files.

Write them to IMGDEPLOYDIR instead, so as to benefit from the
automatic management via sstate.

(From OE-Core rev: 1f7399a5e5d12b7ca3faf399a70c1613d522c28d)

Signed-off-by: André Draszik <andre.draszik@jci.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-21 14:49:42 +01:00
Jackie Huang
7c1adcc6d7 rootfs-postcommands: split ssh_allow_empty_password
"allow root login" should not be bundled in ssh_allow_empty_password,
because some distro may want only one of "allow root login" and "allow
empty password", so split it out into ssh_allow_root_login and add new
imagefeature allow-root-login so they can be controlled separately,
debug-tweaks will still include both of them.

(From OE-Core rev: 1ab494f06a12548a902298afabd0a842161ef10d)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-09 22:48:38 +01:00
Andre McCurdy
89cbaca359 rootfs-postcommands.bbclass: drop obsolete sshd UseDNS rootfs postprocessing
The sshd UseDNS option has defaulted to "no" since openssh 6.8p1,
so it's no longer necessary to postprocess the rootfs to force the
option:

  https://www.openssh.com/txt/release-6.8

(From OE-Core rev: 0cb4f11614bd3b17db8e6b3516761193cd45d082)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:25 +01:00
Andre McCurdy
762a3f229c dropbear: drop run time detection of read-only rootfs
Previously, when dropbear was started via its init script, relocation
of DROPBEAR_RSAKEY_DIR to support read-only rootfs was handled at
run time from within the init script.

Update the init script to take advantage of the read-only rootfs
config setup by read_only_rootfs_hook() and therefore be consistent
with startup under systemd (where relocation of DROPBEAR_RSAKEY_DIR
is handled by the read_only_rootfs_hook() at build time).

(From OE-Core rev: 4990f87b2f6a8b30c8d1c767636e7f5527f595ba)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-04 15:15:00 +01:00
Juro Bystricky
b8ce7d0800 rootfs-postcommands.bbclass: improve binary reproducibility
Conditionally support binary reproducibility of rootfs images.
If REPRODUCIBLE_TIMESTAMP_ROOTFS is specified then:

1. set /etc/timestamp to a reproducible value
2. set /etc/version to a reproducible value
3. set /etc/gconf: set mtime in all %gconf.xml to reproducible values

The reproducible value is taken from the variable REPRODUCIBLE_TIMESTAMP_ROOTFS.

[YOCTO #11176]
[YOCTO #12422]

(From OE-Core rev: 11e45082ad00b9c172e59bf6b2a76dd613773f5a)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-18 18:57:06 +01:00
Patrick Ohly
10865f77b9 rootfs-postcommands.bbclass: ensure that rootfs gets mounted ro
When read-only-rootfs is active, we need to ensure that the rootfs
does not get mounted read/write by the kernel or initramfs. Adding
"ro" to the boot parameters achieves that.

(From OE-Core rev: cfc09de06ecc12bb42181004689e881c75072665)

Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-12-10 22:45:18 +00:00
Ming Liu
307f25c23e meta: drop True option to getVar calls
Search made with the following regex: getVar ?\((.*), True\).

(From OE-Core rev: dbc0eaf478feb3f752ae22fd184984494fc85d0a)

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-09-26 11:05:01 +01:00
Paul Eggleton
5532c4d72e classes: drop image dependencies on TOPDIR variable
We don't need a dependency on this variable changing, and having one
causes locked signature warnings during eSDK installation if you have
INITRAMFS_IMAGE_* set (since TOPDIR will always be different between
the eSDK and the environment in which it was built).

Relates to [YOCTO #12102].

(From OE-Core rev: 073610af04be326f9245ca91714526b390fb72cd)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-09-25 14:15:15 +01:00
Jose Alarcon
f30adee451 rootfs-postcommands: add test for unsatisfied RRECOMMENDS
The do_rootfs log contains a number of unsatisfied package
recommendations. At the moment those are only visible when
reviewing the rootfs log.

This patch adds an extra check to surface any unsatisfied
recommendation  as WARNINGS to the build output.

Enable this check with:
ROOTFS_POSTPROCESS_COMMAND += "rootfs_log_check_recommends;"

(From OE-Core rev: 9d049bf7941f30e35c51775684559e95185fba96)

Signed-off-by: Jose Alarcon <jose.alarcon@ge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-09-05 15:01:01 +01:00
Jose Alarcon
ab44ad3fdf rootfs-postcommands: remove empty line
(From OE-Core rev: 76a801da7fe5651d9e8310a2b32c275e1700daf3)

Signed-off-by: Jose Alarcon <jose.alarcon@ge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-09-05 15:01:01 +01:00
Khem Raj
ad140e7788 rootfs-postcommands.bbclass: Filter out dangling symlinks in ssh_allow_empty_password()
In images built with pam in DISTRO_FEATURES, we end up with dangling symlinks
if su is not packaged into image

$ ls /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/rootfs/etc/pam.d/su-l -l
lrwxrwxrwx 1 kraj users 2 Aug  9 07:56 /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/rootfs/etc/pam.d/su-l -> su

This causes image do_rootfs to fail

| sed: can't read /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/rootfs/etc/pam.d/s
u-l: No such file or directory
| WARNING: /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi/core-image-minimal/1.0-r0/temp/run.ssh_allow_empty_
password.19238:1 exit 2 from 'sed -i 's/nullok_secure/nullok/' /mnt/a/oe/build/tmp/work/raspberrypi3-bec-linux-gnueabi
/core-image-minimal/1.0-r0/rootfs/etc/pam.d/*'

Therefore we need to filter out dangling symlinks before sed'ing
things out

(From OE-Core rev: b92105e5a085c8cd3c650579644922ed97163e73)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18 23:46:38 +01:00
Mike Looijmans
88a82e7489 rootfs-postcommands.bbclass: Prevent linking testdata to itself
testdata and testdata_link may point to the same file, in particular
when IMAGE_LINK_NAME and IMAGE_NAME are equal.

Check if this is the case before creating a symlink that points to
itself and makes the next build fail.

(From OE-Core rev: b516394f9e7858062aa7b042aa4a1bdef9d3a941)

Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-18 23:46:37 +01:00
André Draszik
00e83cb029 openssh: allow to override OpenSSL HostKeys when read-only-rootfs
With these changes it is possible to have a .bbappend that
- sets SYSCONFDIR to some persistent storage
- modifies SYSCONFDIR/sshd_config to use ssh host keys from
  the (writable) sysconfdir

(From OE-Core rev: 106b59d9f96f70d133fa1421091ad280d27a5b6a)

Signed-off-by: André Draszik <adraszik@tycoint.com>
Reviewed-by: Stephane Ayotte <sayotte@tycoint.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-06-12 15:08:31 +01:00
Panagiotis Tamtamis
6830a969f2 rootfs-postcommands.bbclass: Check if "/etc/fstab" exists
Using "read-only-rootfs" feature in minimal or special
purpose images (eg mounted images) makes build to fail
because ${IMAGE_ROOTFS}/etc/fstab file does not exist.

(From OE-Core rev: 43714514fb29a40830e6619552980d7f88d77fb7)

Signed-off-by: Panagiotis Tamtamis <panagiotis.tamtamis@unify.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-16 14:08:28 +01:00
brian avery
a6275df081 rootfs-postcommands.bbclass: save relative paths
We pass the TOPDIR to do a search/replace in export2json so that we save
relative paths in the testdata.json file rather than absolute paths.
This is to allow the images and kernels to be relocated yet still allow
testimage to work.

[YOCTO #11375]

(From OE-Core rev: 7f9f1bdd714fbc6b2adc62f64bf0e4fd1d98ce05)

Signed-off-by: brian avery <brian.avery@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-04-20 07:55:26 +01:00
Ming Liu
5707949f03 rootfs-postcommands.bbclass: drop insert_feed_uris function
The source makes no reference to insert_feed_uris any more, simply drop
the unused reference, to avoid confusing the developers.

(From OE-Core rev: 26dddb7d4a4945abaaefd460a342de6abd609594)

Signed-off-by: Ming Liu <peter.x.liu@external.atlascopco.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-31 14:43:02 +00:00
Ming Liu
e2280b9e12 meta: remove remaining True option to getVar calls
This is a complementary fix to commit 7c552996:
[ meta: remove True option to getVar calls ]

it intended to remove all True option to getVar calls, but there are
still some remaining.

Search made with the following regex: getVar ?\((.*), True\)

(From OE-Core rev: 87d03ffe03d6f01e360bfd51714be96e62506e0a)

Signed-off-by: Ming Liu <peter.x.liu@external.atlascopco.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-31 14:43:02 +00:00
Aníbal Limón
60e5310f56 classes/rootfs-postcommands: Add write_image_test_data
This function will generates testdata.json by image type.

[YOCTO #10231]

(From OE-Core rev: 4c0061422df472395ca0caa76ef92adb860f1167)

Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-23 12:05:19 +00:00
Patrick Ohly
753471db45 rootfs-postcommands.bbclass: sort passwd entries
The /etc passwd files in a rootfs consist of the default entries from
base-passwd plus anything that gets added via package installation,
EXTRA_USERS_PARAMS and/or system sysusers.

The execution order of preinst scripts is not perfectly deterministic,
or at least unrelated changes caused it to change in a
non-deterministic way, resulting in irrelevant changes in the order of
passwd entries.

useradd-staticids.bbclass ensures that the numeric IDs don't change,
but re-ordering can still occur, which is bad for reproducible builds
and file-based update mechanisms like swupd which work best if changes
are as minimal as possible.

To achieve that, the files get sorted in a post-processing command,
enabled by default. Sorting is based primarily on the numeric IDs, so
for example, the "root" user continues to be listed first. "nobody"
now is at the end, which wasn't the case before.

The order of the entries should not matter, but in obscure cases where
it does (like having multiple entries for the same numeric ID) this
behavior can be disabled by setting SORT_PASSWD_POSTPROCESS_COMMAND to
an empty string.

Fixes: YOCTO #10520

(From OE-Core rev: ba684f436908ac2300a00c174d5aa06b4f824367)

Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-16 18:05:12 +00:00
Joshua Lock
c4e2c59088 meta: remove True option to getVar calls
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.

Search made with the following regex: getVar ?\(( ?[^,()]*), True\)

(From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-12-16 10:23:23 +00:00
Joshua Lock
751cb2c894 Remove RM_OLD_IMAGE, it's no longer useful
Since the move to put image deployment under sstate control in
d54339d4b1a7e884de636f6325ca60409ebd95ff old images are automatically
removed before a new image is deployed (the default behaviour of the
sstate logic).

RM_OLD_IMAGE is therefore no longer required to provide this
behaviour, remove the variable and its users.

(From OE-Core rev: 93631befe8b962bf99524746b49f4ebca336175c)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-15 10:01:42 +01:00
Ed Bartosh
9cc4492732 image: Deploy images to IMGDEPLOYDIR
Changed deployment directory from DEPLOY_DIR_IMAGE to
IMGDEPLOYDIR to make sstate machinery to do final deployment and
generate manifest.

Renamed variable deploy_dir to deploy_dir_image in selftest code
to avoid confusion with DEPLOYDIR variable.

Updated the code of rootfs.py:Rootfs class to use IMGDEPLOYDIR variable
as it's now used as a new deployment destination.

(From OE-Core rev: 6d969bacc718e21a5246d4da9bf9639dcae29b02)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-04 00:07:28 +01:00