In the 34fa6a3 refactor we lost announcement of mDNS completely:
- The type of all services was set to 'all', instead of, e.g., _ssh._tcp
- The web console service was not added properly
- Web services for plain HTTP/HTTPS were not created at all
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
UNIX home directories are persistent across reboots, but user accounts
are not. If multiple users exist in startup-config and one or more are
removed, we must use the UID of their $HOME on the next reboot to ensure
they do not lose their files.
If a home directory exists and its UID is already in /etc/passwd we have
triggered an unsupported use-case and must remove the home directory on
disk before recreating it empty. This should not happen, but may occur
on upgrades from a time before UIDs started at 1000 and instead shared
the UID range with reserved system accounts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In review discussions we've decided to go for Augeas to modify the file
/etc/group instead of relying on the BusyBox tools adduser and delgroup,
which check for the existence of the user in /etc/passwd -- which we, at
the point in time the NACM callback runs, cannot guarantee.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A user that is not part of the 'admin' group may only have /bin/false or
/bin/clish as login shells for ssh/console. Any POSIX shell is reserved
for administrators.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds basic NACM support to detect users assigned to a group
granting full access privileges. Full privileges require membership of
at least one group listed in an ACL rule with:
module-name=*
access-operations=*
action=permit
This matches the `admin-acl` rule in factory-config, which the 'admin'
group is part of, and in turn the 'admin' *user* is a member of.
Also, drop unused guest and limited ACLs from factory-config. Added
from the RFC as an example, but is likely more confusing than helpful.
Note: this does not add all NACM groups to the system, it maps users
with administrator privileges to the UNIX 'wheel' group, which
grants access to all IPC sockets (klish, finit, mctl), and sudo
access to all other parts of the system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After the upgrade to Buildroot 2024.02 a new system user was added to
/etc/passwd, sshd. Used for drop-privs sshd. This caused files that
were previously owned by the 'admin' user to now be owned by 'sshd'.
This patch drops the `-S` flag from adduser for the adin user, ensuring
no future clashes with system system users and instead mapping the uid
to a range starting from uid 1000 (default for BusyBox adduser).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Free up 'operator' and 'staff' groups for NETCONF use
- Reserve 'backup' user and group for future auto-backup (Debian)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unless some configuration has changed that affects flow-control (only
auto-neg for now, until we allow actual configuration of flow-control
itself), do not issue any commands that might trigger a link down/up
cycle.
Additionally, make sure that we always configure it on boot, as the
driver defaults might not necessarily line up with our defaults.
As detailed in the block comment in iface_uses_autoneg(), we make some
special considerations around this, so make sure we always reach the
same conclusion.
We have previously stated configuration and status flow-control as not
supported, see infix-ethernet-interface.yang. This is also the default
for flow-control in the ieee-ethernet-interface.yang model.
This patch change the actual value to disabled, so that devices properly
advertise flow-control as disabled/not-supported in auto-negotiation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Our local runners do not allow sudo, e.g., when installing libyang and
the other dependencies.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The massive-parallel build change added recently is a bit shaky still,
so while we stabilze that, we revert it and also take the oppportunity
to tag the new build server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Over the lifetime of Infix, so far, we've run into at least one customer
issue where we had qualms about our use of the local bit causing issues
with 3rd party software. In the end that was not the root cause of our
problems, but we spent way too much time worrying about it. Hence this
patch, which brings our virtual environments another step closer to the
real hardware that Infix runs on.
The OUI used is one of the "private" ones, taken completly at random.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for overriding the default hostname generation
on Qemu systems with the /sys/firmware/qemu_fw_cfg/by_name/opt/hostname
file. E.g., virtual Infamy test systems using Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The base mac address is used by bridges in Infix. This patch adds
support for extracting a base mac from the first interface "- 1",
e.g., if the mac address of e1 is 08:00:20:00:00:01, the base mac
will be 08:00:20:00:00:00.
This works with the Infamy test framework (Qeneth) and also with
the qemu script, included in this patch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As described in issue #396, multicast filtering on VLAN filtering
bridges did not work at all. This because bridge_mcast_settings()
exited when no global multicast settings were found -- a change to
the YANG model made previously triggered this fauled behavior.
Also, the initial IGMP/MLD versions were set to 2/1 (kernel default)
instead of 3/2 (Infix default).
Fixes#396
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
The CNI directories must be created before the podman tmpfiles
are called, so move our tmpfiles to /lib/tmpfiles.d
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Backport fix to allow raw kernel logs to console
- Save 10 rotated (and gzipped) backups of all logs
The latter change was discussed a few weeks ago. We determined it was a
safe number since all active products have eMMC with *lots* of storage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only the first listed console in /sys/class/tty/console/active starts
properly, the remaining one(s) were registered using the wrong :ID and
no arguments to getty.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
