peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-08-06 23:43:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

package/skeleton-init-finit: hardening, no login services in RMA

Browse Source 
When Infix Fail Secure Mode ends up in RMA state, runlevel 9, we should
not allow Finit to "time out" and give us a login prompt.  Instead we
disable all login services in runlevels 7-9, reserving these extra
levels for future failure modes.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2023-11-13 10:28:47 +01:00
committed by Mattias Walström
parent 54ae8aaf8b
commit 9f792d56d6
6 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package/skeleton-init-finit/skeleton-init-finit.mk
+2 -2
View File
@@ -21,9 +21,9 @@ define SKELETON_INIT_FINIT_GETTY
if [ $(SYSTEM_GETTY_BAUDRATE) -eq 0 ]; then \
SYSTEM_GETTY_BAUDRATE=""; \
fi; \
echo "tty [12345789] $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_TERM) noclear passenv"; \
echo "tty [12345] $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_TERM) noclear passenv"; \
else \
echo "tty [12345789] /sbin/getty -L $(SYSTEM_GETTY_OPTIONS) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_TERM)"; \
echo "tty [12345] /sbin/getty -L $(SYSTEM_GETTY_OPTIONS) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_TERM)"; \
fi
endef
package/skeleton-init-finit/skeleton/etc/finit.d/available/dropbear.conf
+1 -1
View File
@@ -1,4 +1,4 @@
# <!>: dropbear does not honor SIGHUP.
# -R: Create hostkeys if needed.
# -F: Run in foreground.
service [2345789] <!> env:-/etc/default/dropbear dropbear -F -R $DROPBEAR_ARGS -- Dropbear SSH daemon
service [2345] <!> env:-/etc/default/dropbear dropbear -F -R $DROPBEAR_ARGS -- Dropbear SSH daemon
package/skeleton-init-finit/skeleton/etc/finit.d/available/mini-snmpd.conf
+1 -1
View File
@@ -1 +1 @@
service [2345789] env:-/etc/default/mini-snmpd /usr/sbin/mini-snmpd -sn $MINI_SNMPD_ARGS -- Mini snmpd
service [2345] env:-/etc/default/mini-snmpd /usr/sbin/mini-snmpd -sn $MINI_SNMPD_ARGS -- Mini snmpd
package/skeleton-init-finit/skeleton/etc/finit.d/available/nginx.conf
+1 -1
View File
@@ -1 +1 @@
service [2345789] env:-/etc/default/nginx nginx -g 'daemon off;' $NGINX_ARGS -- Web server
service [2345] env:-/etc/default/nginx nginx -g 'daemon off;' $NGINX_ARGS -- Web server
package/skeleton-init-finit/skeleton/etc/finit.d/available/snmpd.conf
+2 -2
View File
@@ -1,5 +1,5 @@
# Also needs the /var/run/agentx directory before starting
service [2345789] env:-/etc/default/snmpd /usr/sbin/snmpd -f -LOw \
-I -system_mib,smux,mteTrigger,mteTriggerConf \
service [2345] env:-/etc/default/snmpd /usr/sbin/snmpd -f -LOw \
-I -system_mib,smux,mteTrigger,mteTriggerConf \
-p /run/snmpd.pid $SNMPD_ARGS \
-- Net-SNMP daemon
package/skeleton-init-finit/skeleton/etc/finit.d/available/sshd.conf
+1 -1
View File
@@ -1,4 +1,4 @@
task <pid/syslogd> \
[S] /usr/bin/ssh-hostkeys -- Verifying SSH host keys
service <task/ssh-hostkeys/success> env:-/etc/default/sshd \
[2345789] /usr/sbin/sshd -D $SSHD_OPTS -- OpenSSH daemon
[2345] /usr/sbin/sshd -D $SSHD_OPTS -- OpenSSH daemon