The per-interface and per-af setting in the ietf-ip yang module allow
the user to enable a more granular forwarding between interfaces, which
is disabled by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to rely on the kernel command line, we convert all the
kernel functionality in question into modules and rely on the auto-load
feature in the kernel and modprobe to add options at load time.
The fb_tunnels setting is a net core setting, for that we use sysctl.
This commit also syncs the kernel config between our two main archs,
disabling DRM and SOUND for the Amd64 build as a spin-off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds multi-nameserver support using openresolv (resolvconf)
and dnsmasq. This means that a DHCP client (dhcpcd) or VPN client can
be providers of nameservers to the system. Dnsmasq takes over as the
system resolver, except when the user has set up static configuration.
Static nameserver(s), as well as search and options, are always added
first by openresolv to /etc/resolv.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In managed NETCONF mode /etc is always based on the image's read-only
/etc with a read-writable overlay as a RAM disk. We control the image
and know the default rc.local is empty and the interfaces file only
list the loopback interface.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Only disable default services we don't need, prevents touching
services mid-air in runlevel S. Allow nginx now as well
- Enable fcgi based RESTCONF interface via nginx by default
- Enable auth:none for customer demo
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Chrony drops privs after startup to user chrony, when restarting it
writes its state in /var/lib/chrony, so the directory needs to have
the correct permissions for that user.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent `if:<cond>` addition to Finit we can simplify a lot of
the logic for disabling and enabling features in Infix. Standardizing
on conditions that Finit provides.
We create boot/netconf, boot/etc, and boot/profinet conditions early,
after all filesystems have been mounted (and cleaned), so they are all
set before Finit loads its configuration files in runlevel S.
The default is still to boot into a managed NETCONF mode, since the end
goal remains to integrate PROFINET as yet another service. The other
mode, native /etc, should then be the only exception.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split tmpfiles config in two, one for snmpd and one for profeth.
Add logging and redirect profeth logs to /log/profinet.log with
default log rotation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not the full environment used by U-Boot, just the bits needed
for U-Boot to know which slot to boot and for Infix to know how the
boot process went.
U-Boot will selectively import/export only these keys during boot,
which avoids a malicious user from altering the boot in a way that
might bypass signature validation.
Now that we have dialog on target we can add a user-friendly factory
reset dialog. The new `yorn` script handles any form of yes-or-no
question, with or without dialog, to call a command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for setting the system boot mode to native /etc
style for systems where it's difficult, or close to impossible, to set
the Finit boot condition to 'etc'.
Note: this also moves the check for factory reset before we check if we
should use_etc, rather than NETCONF. This to allow clearing out any of
the state files (.use_etc) before proceeding to boot in the default mode
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Keep the transient files in the system's /mnt/tmp, and only persist
startup_db in /cfg.
This design (with a symlink) means that /cfg/startup_db _must_ exist
in order for clixon to start properly. Therefore run
/lib/infix/prep-db to take care of this.
At the moment, this just creates an empty factory config, and copies
it to startup if it doesn't exist. In the future, prep-db could select
a factory config based on some hardware identifier, or even build one
dynamically, based on available ports etc.
- Double quoting to prevent word splitting
- local keyword is undefined in POSIX sh
- `-m 0755` only applies to deepest directory (ignore)
- Useless cat
- Redirect to null, lilke the other mount_rw statements
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In the new model, we have three sources of storage:
- /mnt/var: Mountpoint for a disk with the label "var"
- /mnt/cfg: Mountpoint for a disk with the label "cfg"
- /mnt/tmp: Mountpoint for a ramdisk
These sources are used for the following overlays:
- **/cfg, /home, /root**: /mnt/cfg if available, else /mnt/tmp
- **/etc**: /mnt/cfg if available and the boot/etc finit condition is
set, else /mnt/tmp
- **/var**: /mnt/var if available, else /mnt/tmp
- **/var/lib**: /mnt/var if available, else /mnt/cfg if available,
else /mnt/tmp
See board/common/rootfs/lib/infix/mnt for more information.
