Ensure Finit installs its files to /usr/lib/finit when building with the
merged-usr config option. For consistency we adjust --exec-prefix, which
is the base for $libdir, meaning also /libexec is moved to /usr/libexec.
Finit tracks the paths internally, we only need to update runparts probe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
~/src/infix/x-riscv(riscv)$ make
Makefile:574: *** nghttp2-asio is in the dependency chain of rousette that has added it to its _DEPENDENCIES variable without selecting it or depending on it from Config.in. Stop.
Fixes#536
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replaces:
Error: Illegal command
with:
Error: Command not found, or incomplete. Try ? for help or Tab for completion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First, actually remove setup.sh. No reason to have the old version
lingering in the repo confusing devs. Also simplify script heading
dropping previous netopeer2 text and distilling the comment before
sourcing the .inc file.
Silence the install/update, dropping -v -- no need to be overly verbose
now that we now the new yang loader works at build time.
Crucially -- fix a bug in UPDATE_MODULE(), missing closing '
Simplify naming and location of .inc files. No need for the long
filenames, or the new directory, the directory name gives plenty of
context.
Add reminder of duplicate infix-interfaces.yang in .inc files -- this
duplication is unfortunate and we should try to fix this better. We
will forget to update one or the other any day ...
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finalize support for IETF System YANG incl. all IANA crypt-hash types.
This patch builds on the earlier work adding yescrypt and $factory$ key
word. The YANG description for the crypt-hash type override has been
significantly udpated to discourage use of $0$cleartext passwords.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With this patch, users not in the NACM admin group and a login shell set
to clish can now log in to the CLI. Prior to this change only members
of the UNIX group 'wheel' could open the klishd socket.
The patch adds another group, 'sys-cli', which acts as a capability for
users. An admin user (member of the admin group) will now be member of
both the UNIX 'wheel' and 'sys-cli' groups. A non-admin user that has
shell set to 'clish' will only be member of the 'sys-cli' group. Other
users will not be mapped to any UNIX group and have only permissions set
in NACM.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugins-sysrepo to fix the annoying issue with
the CLI not supporting, e.g. "show hostname" in system config context.
Details: https://github.com/kernelkit/klish-plugin-sysrepo/issues/3
The problem was two-fold, first we used the wrong ptype for 'show'
(and 'diff') commands, so srp_show() was not even called. Then the
klish-plugin-sysrepo code did not account for show being called for
leaf nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Fix indentations:
- Corrected indentations in confd.mk to adhere to Buildroot coding
standards
- Relocate YANG Modules List Files:
- Moved the YANG modules list files (.inc) from package/confd to
src/confd
- Add Missing YANG Module:
- Included infix-interfaces@2024-01-15.yang in
yang_modules_confd.inc
- This module was missing in the non-containerized build and is now
correctly added
- Moved setup.sh and yang_modules files from infix/src/confd/scripts/ to infix/utils/ to streamline the repository structure
- Updated confd.mk to correctly reference the new location of the setup script
- Introduced yang_modules_<type>.inc file to list all YANG modules for improved clarity and maintainability
- Modified the new setup script to dynamically source module lists from yang_modules_<type>.inc
This makes it easier to add more scripts without having to update the
finit config file, and it clarifies which of the scripts in
/libexec/infix only execute at boot.
This to hopefully speed up boot, do as little as possible
during boot.
* New modules needs to be added to src/confd/scripts/setup.sh
* Permission needs to be changed post-build for YANG files,
see CONFD_PERMISSIONS in confd.mk
Plain openssl is a meta-package, gencert requires libopenssl v3.x and
later, and use pkg-config to detect its presence.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Error messages from system() calls, like adduser, should be logged with
severity LOG_ERR to not arrive out of sequence with ERROR() messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This fixes a serious security regression introduced late in the v24.04
release cycle. The root cause is the placement of the shadow file in
the rootfs overlay, which causes any changes made by the Buildroot
setting BR2_TARGET_ENABLE_ROOT_LOGIN to be discarded/overwritten just
before creating the squashfs image.
The fix in this commit relocates all files from b4eb450 to the skeleton
in Infix, package/skeleton-init-finit/skeleton/etc, which is one of the
first packages to be installed when starting a build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The CNI directories must be created before the podman tmpfiles
are called, so move our tmpfiles to /lib/tmpfiles.d
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the first listed console in /sys/class/tty/console/active starts
properly, the remaining one(s) were registered using the wrong :ID and
no arguments to getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Actually a part of statd, but had to make
a separarate package to get it to work.
Statd helper-scripts are now pre-compiled instead of doing it
in runtime.
Fixes#379
Joachim Wiberg