From a7e7b75a977f9ffedadcaf3e3dab7eb7ae576835 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Wed, 23 Oct 2024 07:59:48 +0200
Subject: [PATCH] board/aarch64: update r2s factory-config

 - add default-deny-all rule from 2341e07
 - enable iburst for the ntp client (quicker initial sync)
 - bump meta version (to skip .cfg migration at boot)

Fix #750 [skip ci]

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 .../aarch64/r2s/rootfs/etc/factory-config.cfg | 21 +++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/board/aarch64/r2s/rootfs/etc/factory-config.cfg b/board/aarch64/r2s/rootfs/etc/factory-config.cfg
index ca97d4c1..766c7c4f 100644
--- a/board/aarch64/r2s/rootfs/etc/factory-config.cfg
+++ b/board/aarch64/r2s/rootfs/etc/factory-config.cfg
@@ -58,6 +58,7 @@
     }
   },
   "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
     "groups": {
       "group": [
         {
@@ -83,6 +84,21 @@
             "comment": "Allow 'admin' group complete access to all operations and data."
           }
         ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
       }
     ]
   },
@@ -123,7 +139,8 @@
           "name": "ntp.org",
           "udp": {
             "address": "pool.ntp.org"
-          }
+          },
+	  "iburst": true
         }
       ]
     },
@@ -169,7 +186,7 @@
     ]
   },
   "infix-meta:meta": {
-    "infix-meta:version": "1.0"
+    "infix-meta:version": "1.2"
   },
   "infix-services:mdns": {
     "enabled": true