From 032881fbf85cfb4e475778b8c2e2260b9638abdf Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 20 Jul 2023 14:22:35 +0200 Subject: [PATCH] board/netconf: chmod 444 (read-only) generated factory-config Prevent tampering and unintentional overwrite by users. Signed-off-by: Joachim Wiberg --- board/netconf/rootfs/lib/infix/cfg-bootstrap | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/board/netconf/rootfs/lib/infix/cfg-bootstrap b/board/netconf/rootfs/lib/infix/cfg-bootstrap index 3ef3d887..b2610872 100755 --- a/board/netconf/rootfs/lib/infix/cfg-bootstrap +++ b/board/netconf/rootfs/lib/infix/cfg-bootstrap @@ -13,11 +13,15 @@ gen-interfaces >$FACTORY_D/20-auto-interfaces.json [ -s $GENCFG_D/20-auto-hostkey.json ] || gen-hostkeys >$GENCFG_D/20-auto-hostkey.json +# Allow regenerating default factory-config, but keep it read-ony +# to prevent it from being overwritten by mistake by users. +rm -f $CFG_D/auto-factory-config.cfg # shellcheck disable=SC2046 jq -s 'reduce .[] as $item ({}; . * $item)' \ $(find $FACTORY_D -name '*.json') \ $(find $GENCFG_D -name '*.json') \ - >$CFG_D/auto-factory-config.cfg + >$CFG_D/auto-factory-config.cfg +chmod 444 $CFG_D/auto-factory-config.cfg # TODO: Look for statically defined factory-config, based on the # system's product ID.