Non-privileged users in the sys-cli group can now access sysrepo data.
The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.
Fixes#932
Signed-off-by: Richard Alpe <richard@bit42.se>
The reason for this is:
1) We want to use the same fetch tool for all operational data, to
avoid having duplicated xpaths scattered across the repo.
2) We want to call this directly from the CLI, which means it need to
be escape safe. A unprivileged user shall be able to use it but not
escape into a shell or do other malicious stuff.
Signed-off-by: Richard Alpe <richard@bit42.se>
- Bump kernel to 6.12.21, same as other tier one boards
- Fix#1006 byt enabling netlink for ethtool (now works!)
- Sync defconfigs:
- LIBXCRYPT now in an rdep of another package
- Disable FORCE check hashes for now
- Drop patches for 6.10 tree (r2s kernel)
- Port RTL8153b patch for R2S LAN LED support
Fixes#1006
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
Fixes issue with netopeer2-server failing to load its host certificate.
Follow-up to 8b75022 for the NanoPi R2S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Declare that confd-test-mode depends on confd, otherwise with 'select',
a call to `make update-defconfig` will remove BR2_PACKAGE_CONFD=y, which
we feel is very confusing -- in particular when comparing any defconfig
that does not have test-mode package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync (make update-defconfig)
- test-mode selects confd
- gencert seclets openssl which in turn selects LIBSSH*_OPENSSL
- rest is relocaations according to Config.in
- Add LIBMNL to x86_64 targets, otherwise iproute2 does not install devlink
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This intoduce a new sysrepo plugin to handle a new YANG
model 'infix-test'. Today only contains the actions.
This is required to run tests on infix using infamy.
This is a part of #561
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport pam-lastlog build fix from latest Buildroot master and enable
in all defconfigs to fix syslog warning:
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so)
Fixes#542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows us to define the rauc manifest compatibility string with
menuconfig. The INFIX_IMAGE_ID is a direct replacement for the previously
composed "infix-$ARCH" in mkrauc.sh.
For example, the compatibility string "infix-aarch64" is replaced for the
NanoPi R2S with "infix-r2s" to ensure users get a proper warning if they
try upgrading to an image that maybe boots, but is not likely to work.
The CLI upgrade command gets a 'force' flag to override the compat string.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch further cleans up the r2s kernel config and also enables the
input event framework for the gpio0 reset button on the device.
The very simple input-event-daemon is introduced, with the only purpose
of listening to /dev/input/event1 for KEY_RESTART and trigger reboot.
Some helpful tooling is also added to help debug events (evtest).
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES for R2S
- Relocate VisionFive2 patches to global patch dir for sharing with R2S
- Add hash for ATF v2.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump kernel to 6.10.3
- Initial defconfig sync with aarch64
- Enable kprobes, ksyms, and function tracer
- Enable missing file systems for parity with Infix
- Enable bridging, netfilter, and other Infix requirements
- Initial virtion support for running in Qemu (untested)
- Enable device mapper, required for rauc bundle install
- Make dummy and tunnel drivers modules to be able to drop dummy0
and tunl0 interfaces that otherwise mess up "show interfaces"
- Disable suspend and hibernation, not supported in Infix
- Disable unused GPIO, PHY, MDIO, and USB drivers
- Disable RK3328 watchdog driver, cannot perform reset on R2S,
enablle softdog instead as a seamless replacement for Infix.
Even though not optimal (since it's software) reboot works
- Disable ethtool netlink support, does not work and breaks
interface configuration completely on R2S!
- Enable netdev LED triggers, for LAN and WAN LEDs
- Bump u-boot to 2024.07
- Hard code developer mode to allow shell access
- Disable factory reset button support (not yet supported)
- Bump ATF to v2.9
- Enable squashfs for rootfs image
- Enable signing of images
- Add secondary partition
- Add dedicated var partition
- Add aux partition for signatures and uboot env
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change builds on top of the earlier work to bootstrap Infix YANG
modules at build time. Adding a step at the end of post-build.sh to
call the yangdoc tool. The resulting yangdoc.html is a stand-alone HTML
file of (almost) all YANG nodes. Almost because some top-level nodes
are unused by Infix atm. and have been filtered out for readability.
Fixes#432
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sync after `make update-defconfig`:
- avahi selected by mdns-alias package (all)
- iptables and ca-certs selected by other packages (r2s)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Relocate the default landing page from the rootfs overlay to a package
so that customer repos can override it.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Finit @console construct detects what your actual serial console is
by looking it up in /sys/class/tty/console/active. This to avoid any
weird problems that might occur when using /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Converting to gunicorn, which is the recommended production server for
Flask apps, means app main() function is no longer called at startup, so
we have to factor out the mDNS CNAME functionality for infix.local and
network.local to a separate app.
We take this opportunity to collapse the structure, move non-class
methods to __init.py__, and rename the AvahiAlias class. A prototype
for replacing the overhead of mdns-alias with a C daemon is in its
early stages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Advertises the build-time $hostname.local as a CNAME to the A and
AAAA records already advertised by Avahi
- Advertises a special network.local CNAME and provides a fastcgi
service on unix:/tmp/netbrowse.sock for browsing mDNS services
This commit also activates netbrowse by default with nginx listeing
to port 80 on IPv4 and IPv6 /browse by default but also / if called
with server name network.local.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sending SIGTERM to conmon is not a safe shutdown of a podman container.
To handle gracefully handle shutdown, restarting and provide an orderly
start of dependencies, we use the Finit sysv trick via container script
wrapper to call 'podman stop foo'.
However, since podman does not support syslog as output for containers
we employ an old FIFO trick with another program, k8s-logger, to allow
logs to reach syslog. Please note that k8s-logger must have properly
started before we call `podman start` -- this makes us fully dependent
on the 'container' wrapper script. Hence the documentation update.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ahmed Karic