Fixes issues with logger not exiting gracefully on signals (at all)
and busy-looping on stale FIFO.
Related to issue #375
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the pivot from having the CLI as default login to Bash (for remote
scripting and production purposes) there is no need for "user friendly"
access to a UNIX shell from the CLI. This provides the possiblity of
limiting users to only the CLI, e.g. a user with only guest or operator
privileges.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since Infix supports per-VLAN querier parameters, like query interval,
we currently need to run a separate querierd per VLAN interface. The
replacement, mcd, will handle this automatically in its .conf file.
Also, ensure we install the daemon configuration file as an example, and
thus creating the /etc/querierd/ directory for where .conf files for
each interface will be generated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
in container: default-route-advertise
Obsolete leaf: enable
Add new leaf: enabled
enable is preferred if exist, else it use enabled.
Also update klish-plugin-sysrepo to not show the obsoleted node
in autocompletion.
This fixes#331
Some customers do not need, or do not want, to be able to run
containers, so all NETCONF related daemons and applications
need to take this into consideration.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When available, show the default value of a leaf node after the
description when issuing 'help leaf-node'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is an example of how to create a package that downloads an OCI
archive and installs it to /lib/oci
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new klish symbol, shell@infix, which performs proper
droprivs before calling the configured shell.
Fix#298: track user id so shell command gets correct user
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some customers don't want unprivileged CLI users to be able to exit to
a shell. The shell is currently hard-coded to bash, but should be one
of the ietf-system shells, configurable --with-shell=foo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. add support for extracting, and finding the directory holding the
index.json metadata file in, OCI images. An archive in Infix is either
a .tar or .tar.gz archive, which we need to unpack for this version of
podman to be able to load them.
2. new RPC '/infix-containers:oci-load' calls 'container load' of an
OCI archive (tarball), optionally gzipped. The resulting image uses
the directory name of the unpacked tarball, so the container script
offers a way to retag the image after loading it.
First class citizens in container transport are docker:// and the OCI
family of URI:s. A docker:// URL, or a local docker-archive:path, is
assumed to be well formed, in which case we leave it up to podman to
handle.
Note: 'podman import' does not fully understand OCI formats. It drops
ENTRYPOINT and COMMAND, while 'podman load' handles things a lot
better. Only letdown is it does not support nameing the image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Not all customers want Container support in their Ínfix builds. This
patch adds build-time support for detecting if podman is enabled in
the configuration.
- Klish container commands have been broken out to their own xml file
- infix-interfaces have been given a 'containers' feature
- ietf-interfces.c enables 'containers' feature on an #ifdef
- infix-container.c is only built if --enable-containers
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the container configuration context:
edit file ntp.conf
set path /etc/ntp.conf
set content
The last command opens a text editor where you can paste the contents
of the file. This is stored base64 encoded in the datastore as well
as in JSON/XML.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new CLI command 'container upgrade foo', where 'foo'
is the name of the container. If more than one container use the same
image, multiple upgrades must be done because a container runs not on
the 'image:tag' but on the hash of the 'image:tag' it was created from.
Rename "done" queue to "active", since we want to recreate an active
container after fetching an updated base image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows containers created with "podman create" to surivce
rebots, and even reconfigurations at runtime, as long as their config
has not changed. Allowing some level of persistence in the writable
layer given to containers.
For even more persistency, support for volumes (they sync with dir in
container on first use) and mounts (creates empty writable dirs in the
container) must be added. A third option, a variant of mounts, is to
allow a leaf-list "file", where binary content can be added and then
mounted into the container, e.g.
/run/containers/files/$name/file.ext -> container://$name/etc/file.ext
None of this is available yet, but seems likely we need to add in the
very near term.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be replaced with native support for generating container network
interfaces and running under finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This bump adds support for 'set foo' to set foo=true, but also two new
commands from srp_helper@: 'change password', 'text-editor content'.
- ietf-system: 'change password' now starts an interactive session that
results in a random-salted sha512 encrypted hash.
- 'text-editor <node-of-binary-type>', starts 'editor file | base64'
- 'set <node-of-bool-type>', sets node=true
A prototype askpass script has been added as a proof-of-concept. It
follows the design of other askpass style programs, like ssh-askpass,
that pass the resulting password on stdout. With the additional support
for also writing it to an output file, e.g., a pipe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On every system reconf (initctl reload) the .conf files are evaluated
again and log notices about skipping alternative syslogd enties are
logged.
We know that we run the udevd dependend syslogd entry, and everything
else basically in runlevel S depends on it, so not much else would work
if syslogd didn't start. So we can safely set 'nowarn'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Classic builds don't have udev but rather mdev or mdevd. This patch
imports support from myLinux for conditionally starting sysklogd on
classiic builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since watchdogd may need to run with SCHED_RR, when the supervisor is enabled,
which is not supported by cgroupsv2, we ask Finit to always runs it in the
root cgroup. We must also raise the limit for rtprio to all possible values
for SCHED_RR that a user can set in /etc/watchdogd.conf
Finally, add support for reading extra args from /etc/default/watchdogd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very limited part of the YANG model is implemented so far, basicly it is OSPFv2 with multiple areas and you can change timers
for the interfaces. Limited operational support.
admin@infix-00-00-00:/config/> edit routing control-plane-protocol ietf-ospf:ospfv2 name default
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> set ospf area 0.0.0.0 interface e0 enabled true
admin@infix-00-00-00:/config/routing/control-plane-protocol/ietf-ospf:ospfv2/name/default/> leave
Normally, no logins are actually possible, but this will have two
desirable effects effects:
- /etc/issue will be printed when hitting return over the console,
allowing the user to see the bootstrapping errors again, without
having to reboot the system.
- On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can
login as root and debug issues.
Joachim Wiberg