package/skeleton-init-finit: Run the getty in runlevel 9

Normally, no logins are actually possible, but this will have two desirable effects effects: - /etc/issue will be printed when hitting return over the console, allowing the user to see the bootstrapping errors again, without having to reboot the system. - On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can login as root and debug issues.
Prevent non-essential services from running in runlevels > 6
2026-07-28 11:43:01 +02:00 · 2023-11-30 11:39:42 +01:00 · 2023-11-30 11:39:42 +01:00 · 2023-11-30 11:39:42 +01:00 · 2023-11-30 11:39:42 +01:00 · 2023-11-30 11:03:16 +01:00
36 changed files with 157 additions and 50 deletions
@@ -1,5 +1,5 @@
 set G_MESSAGES_DEBUG=nocolor
-service [2345789] <service/dbus/running> \
+service [2345] <service/dbus/running> \
 	env:-/etc/default/rauc log:prio:user.notice \
 	rauc service $RAUC_ARGS -- Software update service

@@ -0,0 +1,88 @@
+#!/bin/sh
+
+# This file is part of avahi.
+#
+# avahi is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 2 of the
+# License, or (at your option) any later version.
+#
+# avahi is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+# License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with avahi; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+# USA.
+
+set -e
+
+# Command line arguments:
+#   $1 event that happened:
+#          BIND:     Successfully claimed address
+#          CONFLICT: An IP address conflict happened
+#          UNBIND:   The IP address is no longer needed
+#          STOP:     The daemon is terminating
+#   $2 interface name
+#   $3 IP adddress
+
+PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
+
+# Use a different metric for each interface, so that we can set
+# identical routes to multiple interfaces.
+
+METRIC=$((1000 + `cat "/sys/class/net/$2/ifindex" 2>/dev/null || echo 0`))
+
+if [ -x /bin/ip -o -x /sbin/ip ] ; then
+
+    # We have the Linux ip tool from the iproute package
+
+    case "$1" in
+        BIND)
+            ip addr flush dev "$2" label "$2:avahi"
+            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
+            ip route add default dev "$2" metric "$METRIC" scope link proto 17 ||:
+            ;;
+
+        CONFLICT|UNBIND|STOP)
+            ip route del default dev "$2" metric "$METRIC" scope link ||:
+            ip addr del "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2"
+            ;;
+
+        *)
+            echo "Unknown event $1" >&2
+            exit 1
+            ;;
+    esac
+
+elif [ -x /bin/ifconfig -o -x /sbin/ifconfig ] ; then
+
+    # We have the old ifconfig tool
+
+    case "$1" in
+        BIND)
+            ifconfig "$2:avahi" inet "$3" netmask 255.255.0.0 broadcast 169.254.255.255 up
+            route add default dev "$2:avahi" metric "$METRIC" ||:
+            ;;
+
+        CONFLICT|STOP|UNBIND)
+            route del default dev "$2:avahi" metric "$METRIC" ||:
+            ifconfig "$2:avahi" down
+            ;;
+
+        *)
+            echo "Unknown event $1" >&2
+            exit 1
+            ;;
+    esac
+
+else
+
+    echo "No network configuration tool found." >&2
+    exit 1
+
+fi
+
+exit 0
@@ -0,0 +1 @@
+17	zeroconf
@@ -8,11 +8,11 @@ run name:error :1 log:console norestart if:<run/bootstrap/failure> \
 	[S] /usr/libexec/confd/error --

 service name:confd log <run/bootstrap/success> \
-	[S12345789] sysrepo-plugind -f -p /run/confd.pid -n -v3 -- Configuration daemon
+	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -v3 -- Configuration daemon

 # Bootstrap system with startup-config
 run name:startup log:prio:user.notice norestart <pid/confd> \
-	[S] /usr/libexec/confd/load -b startup-config \
+	[S] /usr/libexec/confd/load startup-config \
 	-- Loading startup-config

 # Run if loading startup-config fails for some reason
@@ -24,7 +24,7 @@ run name:error :2 log:console norestart if:<run/failure/failure> \
 	[S] /usr/libexec/confd/error --

 service name:netopeer notify:none log <pid/confd> \
-	[12345789] netopeer2-server -F -t 60 \
+	[12345] netopeer2-server -F -t 60 \
 	-- NETCONF server

 # Create initial /etc/resolv.conf after successful bootstrap
@@ -1 +1 @@
-service <!> log [2345789] /usr/bin/klishd -d -- CLI backend daemon
+service <!> log [2345] /usr/bin/klishd -d -- CLI backend daemon
@@ -21,9 +21,9 @@ define SKELETON_INIT_FINIT_GETTY
 		if [ $(SYSTEM_GETTY_BAUDRATE) -eq 0 ]; then \
 			SYSTEM_GETTY_BAUDRATE=""; \
 		fi; \
-		echo "tty [12345] $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_TERM) noclear passenv"; \
+		echo "tty [12345789] $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_TERM) noclear passenv"; \
 	else \
-		echo "tty [12345] /sbin/getty -L $(SYSTEM_GETTY_OPTIONS) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_TERM)"; \
+		echo "tty [12345789] /sbin/getty -L $(SYSTEM_GETTY_OPTIONS) $(SYSTEM_GETTY_BAUDRATE) $(SYSTEM_GETTY_PORT) $(SYSTEM_GETTY_TERM)"; \
 	fi
 endef

@@ -1 +1 @@
-service [2345789] avahi-dnsconfd -s -- Avahi unicast DNS configuration daemon
+service [2345] avahi-dnsconfd -s -- Avahi unicast DNS configuration daemon
@@ -1 +1 @@
-service [2345789] name:mdns avahi-daemon -s -- Avahi mDNS-SD daemon
+service [2345] name:mdns avahi-daemon -s -- Avahi mDNS-SD daemon
@@ -1,2 +1,2 @@
 # Requires /etc/chrony.conf to start, see https://chrony.tuxfamily.org/doc/3.4/chrony.conf.html
-service [2345789] <!> env:-/etc/default/chronyd chronyd -n $CHRONY_ARGS -- Chrony NTP v3/v4 daemon
+service [2345] <!> env:-/etc/default/chronyd chronyd -n $CHRONY_ARGS -- Chrony NTP v3/v4 daemon
@@ -1 +1 @@
-service [2345789] env:-/etc/default/conntrackd conntrackd $CONNTRACKD_ARGS -- Connection tracking daemon
+service [2345] env:-/etc/default/conntrackd conntrackd $CONNTRACKD_ARGS -- Connection tracking daemon
@@ -1 +1 @@
-service [S12345789] <pid/syslogd> dnsmasq -k -u root -- DHCP/DNS proxy
+service [S12345] <pid/syslogd> dnsmasq -k -u root -- DHCP/DNS proxy
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> babled -A 127.0.0.1 -u frr -g frr -- Babel routing daemon
+service [2345] log:null <!pid/zebra> babled -A 127.0.0.1 -u frr -g frr -- Babel routing daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> bfdd -A 127.0.0.1 -u frr -g frr -- BFD daemon
+service [2345] log:null <!pid/zebra> bfdd -A 127.0.0.1 -u frr -g frr -- BFD daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> bgpd -A 127.0.0.1 -u frr -g frr -- BGP daemon
+service [2345] log:null <!pid/zebra> bgpd -A 127.0.0.1 -u frr -g frr -- BGP daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> eigrpd -A 127.0.0.1 -u frr -g frr -- EIGRP daemon
+service [2345] log:null <!pid/zebra> eigrpd -A 127.0.0.1 -u frr -g frr -- EIGRP daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> isisd -A 127.0.0.1 -u frr -g frr -- IS-IS daemon
+service [2345] log:null <!pid/zebra> isisd -A 127.0.0.1 -u frr -g frr -- IS-IS daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> ldpd -A 127.0.0.1 -u frr -g frr -- LDP daemon
+service [2345] log:null <!pid/zebra> ldpd -A 127.0.0.1 -u frr -g frr -- LDP daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> ospf6d -A 127.0.0.1 -u frr -g frr -- OSPF IPv6 daemon
+service [2345] log:null <!pid/zebra> ospf6d -A 127.0.0.1 -u frr -g frr -- OSPF IPv6 daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> ospfd -A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf-- OSPF daemon
+service [2345] log:null <!pid/zebra> ospfd -A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf-- OSPF daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> pathd -A 127.0.0.1 -u frr -g frr -- PCEP daemon
+service [2345] log:null <!pid/zebra> pathd -A 127.0.0.1 -u frr -g frr -- PCEP daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> pim6d -A 127.0.0.1 -u frr -g frr -- PIM6 daemon
+service [2345] log:null <!pid/zebra> pim6d -A 127.0.0.1 -u frr -g frr -- PIM6 daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> pimd -A 127.0.0.1 -u frr -g frr -- PIM daemon
+service [2345] log:null <!pid/zebra> pimd -A 127.0.0.1 -u frr -g frr -- PIM daemon
@@ -1 +1 @@
-service [2345789] log:null <pid/zebra> ripd -A 127.0.0.1 -u frr -g frr -- RIP daemon
+service [2345] log:null <pid/zebra> ripd -A 127.0.0.1 -u frr -g frr -- RIP daemon
@@ -1 +1 @@
-service [2345789] log:null <pid/zebra> ripngd -A 127.0.0.1 -u frr -g frr -- RIP IPv6 daemon
+service [2345] log:null <pid/zebra> ripngd -A 127.0.0.1 -u frr -g frr -- RIP IPv6 daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> staticd -A 127.0.0.1 -u frr -g frr -f /etc/frr/staticd.conf -- Static routing daemon
+service [2345] log:null <!pid/zebra> staticd -A 127.0.0.1 -u frr -g frr -f /etc/frr/staticd.conf -- Static routing daemon
@@ -1 +1 @@
-service [2345789] log:null <!pid/zebra> vrrpd -A 127.0.0.1 -u frr -g frr -- VRRP daemon
+service [2345] log:null <!pid/zebra> vrrpd -A 127.0.0.1 -u frr -g frr -- VRRP daemon
@@ -1 +1 @@
-service [2345789] <!> pid:!/run/frr/zebra.pid zebra -A 127.0.0.1 -u frr -g frr -- Zebra routing daemon
+service [2345] <!> pid:!/run/frr/zebra.pid zebra -A 127.0.0.1 -u frr -g frr -- Zebra routing daemon
@@ -1 +1 @@
-service [2345789] env:-/etc/default/lldpd lldpd -d $LLDPD_ARGS -- LLDP daemon (IEEE 802.1ab)
+service [2345] env:-/etc/default/lldpd lldpd -d $LLDPD_ARGS -- LLDP daemon (IEEE 802.1ab)
@@ -1,4 +1,4 @@
 # Make sure to configure the bridge to run on before starting mstpd
 # Note: all 'sysv' type services are handed an extra 'start' or 'stop'
 # argument when starting and stopping.
-sysv name:mstpd [0123456789] pid:!/run/mstpd.pid bridge-stp br0 -- MSTP daemon
+sysv name:mstpd [0123456] pid:!/run/mstpd.pid bridge-stp br0 -- MSTP daemon
@@ -1 +1 @@
-service [2345789] env:-/etc/default/querierd querierd -sn $QUERIERD_ARGS -- Multicast query daemon
+service [2345] env:-/etc/default/querierd querierd -sn $QUERIERD_ARGS -- Multicast query daemon
@@ -1,2 +1,2 @@
-service [2345789] env:-/etc/default/smcrouted \
+service [2345] env:-/etc/default/smcrouted \
 	smcrouted -ns $SMCROUTE_OPTS $SMCROUTE_ARGS -- Static multicast routing daemon
@@ -1 +1 @@
-service name:statd log [S12345789] <pid/confd> statd -f -p /run/statd.pid -n -- Status daemon
+service name:statd log [S12345] <pid/confd> statd -f -p /run/statd.pid -n -- Status daemon
@@ -80,9 +80,11 @@ console_error()
    [ -z "$STATUS" ] || return
    STATUS="CRITICAL ERROR: $1"

-    printf "\n$PRETTY_NAME\n%s\n\n" "$STATUS" | tee /etc/banner > /etc/issue.net
-    printf "\n$PRETTY_NAME (console)\n%s\n\n" "$STATUS"         > /etc/issue
-
+    printf "\n$STATUS\n" | tee -a \
+			       /etc/banner \
+			       /etc/issue \
+			       /etc/issue.net \
+			       >/dev/null
    return 0
 }

@@ -2,4 +2,3 @@
 # Override using an overlay in your br2-external to change the behavior

 logger -sik -p user.error "The device has reached an unrecoverable error, please RMA."
-exec sleep infinity
@@ -9,16 +9,20 @@
 #
 set -e

+banner_append()
+{
+    printf "\n$@\n" | tee -a \
+			  /etc/banner \
+			  /etc/issue \
+			  /etc/issue.net \
+			  >/dev/null
+    return 0
+}
+
+
 # shellcheck disable=SC1091
 . /etc/confdrc

-if [ "$1" = "-b" ]; then
-    bootstrap=true
-    shift
-else
-    bootstrap=false
-fi
-
 config=$1
 if [ -f "$config" ]; then
    fn="$config"
@@ -36,12 +40,20 @@ if [ ! -f "$fn" ]; then
 fi

 if ! sysrepocfg -v3 -I"$fn" -f json; then
-    if eval $bootstrap; then
-	logger -sik -p user.error "Failed bootstrapping system, reverting to Fail Secure mode!"
-	initctl -nbq runlevel 9
-    else
-	logger -sik -p user.error "Failed loading $fn, aborting!"
-    fi
+    case "$config" in
+	startup-config)
+	    logger -sik -p user.error "Failed loading $fn, reverting to Fail Secure mode!"
+	    ;;
+	failure-config)
+	    logger -sik -p user.error "Failed loading $fn, aborting!"
+	    banner_append "CRITICAL ERROR: Logins are disabled, no credentials available"
+	    initctl -nbq runlevel 9
+	    ;;
+    esac
+
    exit 1
 fi
 logger -sik -p user.notice "Loaded $fn successfully."
+if [ "$config" = "failure-config" ]; then
+    banner_append "ERROR: Corrupt startup-config, system has reverted to default login credentials"
+fi
@@ -68,6 +68,11 @@ module infix-routing {
      description "DHCP added route";
      base infix-source-protocol;
    }
+    identity zeroconf {
+      description "ZeroConf added route";
+      base infix-source-protocol;
+    }
+
    deviation "/ietf-r:routing/ietf-r:control-plane-protocols/ietf-r:control-plane-protocol/ietf-r:name" {
      description "Limitation: Only one routing instance per protocol.";
      deviate replace {
Author	SHA1	Message	Date
Tobias Waldekranz	769b7c2ba1	package/skeleton-init-finit: Run the getty in runlevel 9 Normally, no logins are actually possible, but this will have two desirable effects effects: - /etc/issue will be printed when hitting return over the console, allowing the user to see the bootstrapping errors again, without having to reboot the system. - On devleoper builds, with CONFIG_TARGET_ENABLE_ROOT_LOGIN, we can login as root and debug issues.	2023-11-30 11:39:42 +01:00
Tobias Waldekranz	f4a604f63c	Prevent non-essential services from running in runlevels > 6 In case failure-config fails to load, we park the system in runlevel 9. In this state, we only want the most essential services running.	2023-11-30 11:39:42 +01:00
Tobias Waldekranz	445fbf7873	confd: Notify user of all bootstrapping issues via login banners Collect all bootstrapping issues in all banner-like files during boot, so that they are presented to the user when logging in. This should make it harder to miss overlook the fact that a system is running in a degraded state.	2023-11-30 11:39:42 +01:00
Tobias Waldekranz	af2b1f95a9	confd: Only move to runlevel 9 if failure-config fails to load Before this change, the system would move to runlevel 9 as soon as startup-config failed to load, in which no getty is allowed to run. Instead, we want to reserve that runlevel for when failure-config itself also fails to load, since the system will have no valid login credentials at that point.	2023-11-30 11:39:42 +01:00
Joachim Wiberg	f0c99b14dd	src/confd: add support for routes set by ZeroConf agent This fixes [ERR] from CLI `show routes`, and broken operational status in setups with DHCP client enabled by default. Feature (static routing) introduced in release cycle, no need to bring up in release notes. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2023-11-30 11:03:16 +01:00