From 474820c44b6dfc636f548e917e8ffd009b8392b2 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Thu, 2 May 2024 20:06:26 +0200 Subject: [PATCH] Fix #424: regression, root user can log in without password This fixes a serious security regression introduced late in the v24.04 release cycle. The root cause is the placement of the shadow file in the rootfs overlay, which causes any changes made by the Buildroot setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just before creating the squashfs image. The fix in this commit relocates all files from b4eb450 to the skeleton in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the first packages to be installed when starting a build. Signed-off-by: Joachim Wiberg --- .../rootfs => package/skeleton-init-finit/skeleton}/etc/group | 0 .../rootfs => package/skeleton-init-finit/skeleton}/etc/passwd | 0 .../rootfs => package/skeleton-init-finit/skeleton}/etc/shadow | 0 3 files changed, 0 insertions(+), 0 deletions(-) rename {board/common/rootfs => package/skeleton-init-finit/skeleton}/etc/group (100%) rename {board/common/rootfs => package/skeleton-init-finit/skeleton}/etc/passwd (100%) rename {board/common/rootfs => package/skeleton-init-finit/skeleton}/etc/shadow (100%) diff --git a/board/common/rootfs/etc/group b/package/skeleton-init-finit/skeleton/etc/group similarity index 100% rename from board/common/rootfs/etc/group rename to package/skeleton-init-finit/skeleton/etc/group diff --git a/board/common/rootfs/etc/passwd b/package/skeleton-init-finit/skeleton/etc/passwd similarity index 100% rename from board/common/rootfs/etc/passwd rename to package/skeleton-init-finit/skeleton/etc/passwd diff --git a/board/common/rootfs/etc/shadow b/package/skeleton-init-finit/skeleton/etc/shadow similarity index 100% rename from board/common/rootfs/etc/shadow rename to package/skeleton-init-finit/skeleton/etc/shadow