With increased use of augeas to manage users, groups, and permissions,
we seem to have reached peak complexity. Because when re-running the
same test[1] over and over, somtimes the aug_save() function fails to
actually save the changes to /etc/shadow to disk!
We have already experienced weird behavior with augeas, see comment in
deleted code, and these latest problems became the last straw. We have
decided to replace it with standard C APIs.
As a spin-off, thanks to the requried refactoring, the check_shell()
function, used by the change_nacm() callback, could be replaced with a
call to set_shell() for both "is-admin" and "non-admin" cases. This
means we now also restore Bash privileges (and not just take them away)
when modifying nacm group memberships.
Fixes#468
[1]: test/case/ietf_system/user_admin.py
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Checking if a user is an administratr we cannot rely solely on the
return value of sr_get_items() but also ensure at least one group
matches the search criteria.
Fixes#469
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This to hopefully speed up boot, do as little as possible
during boot.
* New modules needs to be added to src/confd/scripts/setup.sh
* Permission needs to be changed post-build for YANG files,
see CONFD_PERMISSIONS in confd.mk
This patch adds support for setting the mac address already when
creating veth interfaces. Necessary to cooperate with containers.
Fixes#453
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The confd `gen-interfaces` script is called for some customers with a
default to create a bridge with all, or a subset of all, ports. The
safe default, which incidentally coincides with the same customer's
requirements, is to have IGMP/MLD snooping enabled by default.
Fixes#454
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a CLI user performs the following command, the DNS resolver was
left in an undefined state.
admin@infix-00-00-00:/config/> no system
admin@infix-00-00-00:/config/> leave
admin@infix:/>
The avahi-daemon reported the missing /etc/resolv.conf and the fix is to
ensure `resolvconf -u` runs on every major change ot ietf-system, even
if there is no new resolv.conf to roll in. At bootstrap this has been
handled by another mechanism so has not been seen by most users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sr_get_data() API may return SR_ERR_OK and still set the cfg pointer
to NULL! This happens when, e.g., executing 'no system' from the CLI.
This patch adds a check for this in all occurrences of sr_get_data().
Also, in ietf-routing.c there was *no* error handling for this API, this
required some restructuring to ensure a FILE *fp was closed properly in
all cases.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the sysrepo patch from the previous commit, we can now properly
detect if a callback failed to apply its changes in SR_EV_DONE. When
this occurs the system may be in an undefined state, so we must try
to recover it before loading failure-config.
This patch tries to perform a factory-default RPC, which is an Infix
specifc RPC that does "copy factory-config running-config". We give
sysrepocfg some time to clean up any stale SHM connections before we
do a hard scratch of the db state and restart sysrepo-plugind.
Fixes#429
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fix regression introduced in 3f87945, which tries to map a user to an
existing home directory. The root cause for the problem is basically an
invalid check of the /home/admin UID being in use by any system account
or not. This patch uses the same check used by the BusyBox adduser
command.
In addition to the uid-already-in-use fix, several other checks have
been added to ensure we do not end up with an invalid system state:
- If reusing an existing /home/admin fails in the 'adduser admin'
command, wipe out /home/admin and retry adding the user cleanly
- Always delete any group with the same name before trying to add
the user, regardless if /home/$user exists or not, this prevents
issues with stale group records if we end up failing to load the
startup-config and need to load failure-config
- For the same reason (failure-config), make sure to always clean
up any stale user in the retry step. The same step is used when
there is a uid:gid mismapping (the original bug)
Fixes#428
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having a chown process started by Finit in runlevel S, we can
just chown in the confd load script instead.
Issue #415
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of hard-coding the fallback hostname we can now use the one
generated to /etc/os-release (for netbrowse).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The dagger tool is a helper for scripts generated by confd and should
therefore be installed by confd instead of the rootfs overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the 34fa6a3 refactor we lost announcement of mDNS completely:
- The type of all services was set to 'all', instead of, e.g., _ssh._tcp
- The web console service was not added properly
- Web services for plain HTTP/HTTPS were not created at all
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
UNIX home directories are persistent across reboots, but user accounts
are not. If multiple users exist in startup-config and one or more are
removed, we must use the UID of their $HOME on the next reboot to ensure
they do not lose their files.
If a home directory exists and its UID is already in /etc/passwd we have
triggered an unsupported use-case and must remove the home directory on
disk before recreating it empty. This should not happen, but may occur
on upgrades from a time before UIDs started at 1000 and instead shared
the UID range with reserved system accounts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In review discussions we've decided to go for Augeas to modify the file
/etc/group instead of relying on the BusyBox tools adduser and delgroup,
which check for the existence of the user in /etc/passwd -- which we, at
the point in time the NACM callback runs, cannot guarantee.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user that is not part of the 'admin' group may only have /bin/false or
/bin/clish as login shells for ssh/console. Any POSIX shell is reserved
for administrators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds basic NACM support to detect users assigned to a group
granting full access privileges. Full privileges require membership of
at least one group listed in an ACL rule with:
module-name=*
access-operations=*
action=permit
This matches the `admin-acl` rule in factory-config, which the 'admin'
group is part of, and in turn the 'admin' *user* is a member of.
Also, drop unused guest and limited ACLs from factory-config. Added
from the RFC as an example, but is likely more confusing than helpful.
Note: this does not add all NACM groups to the system, it maps users
with administrator privileges to the UNIX 'wheel' group, which
grants access to all IPC sockets (klish, finit, mctl), and sudo
access to all other parts of the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the upgrade to Buildroot 2024.02 a new system user was added to
/etc/passwd, sshd. Used for drop-privs sshd. This caused files that
were previously owned by the 'admin' user to now be owned by 'sshd'.
This patch drops the `-S` flag from adduser for the adin user, ensuring
no future clashes with system system users and instead mapping the uid
to a range starting from uid 1000 (default for BusyBox adduser).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unless some configuration has changed that affects flow-control (only
auto-neg for now, until we allow actual configuration of flow-control
itself), do not issue any commands that might trigger a link down/up
cycle.
Additionally, make sure that we always configure it on boot, as the
driver defaults might not necessarily line up with our defaults.
As detailed in the block comment in iface_uses_autoneg(), we make some
special considerations around this, so make sure we always reach the
same conclusion.
We have previously stated configuration and status flow-control as not
supported, see infix-ethernet-interface.yang. This is also the default
for flow-control in the ieee-ethernet-interface.yang model.
This patch change the actual value to disabled, so that devices properly
advertise flow-control as disabled/not-supported in auto-negotiation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for overriding the default hostname generation
on Qemu systems with the /sys/firmware/qemu_fw_cfg/by_name/opt/hostname
file. E.g., virtual Infamy test systems using Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As described in issue #396, multicast filtering on VLAN filtering
bridges did not work at all. This because bridge_mcast_settings()
exited when no global multicast settings were found -- a change to
the YANG model made previously triggered this fauled behavior.
Also, the initial IGMP/MLD versions were set to 2/1 (kernel default)
instead of 3/2 (Infix default).
Fixes#396
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
