mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/petitboot: run UI as non-root user

Browse Source 
Though the petitboot UI is a user application, it is currently being
run by root only because we use getty to display it on the console.

Create an unprivileged user to run the UI instead. The unix socket the
pb-discover daemon sets up is accessible to "petitgroup", so that should
be the gid, with arbitrary uid "petituser" to match.

This is currently the chain of processes leading to the UI:

1. /etc/init.d/pb-console start console
2. /usr/libexec/petitboot/pb-console --getty --detach -- -n -i 0 console linux
3. /sbin/getty -l/usr/libexec/petitboot/pb-console -n -i 0 console linux
4. /usr/libexec/petitboot/pb-console
5. /usr/sbin/petitboot-nc

Instead of (3) running the pb-console helper directly with "getty -l",
we can use "agetty -a" to autologin petituser, and run pb-console via
petituser's login shell:

1. /etc/init.d/pb-console start console
2. /usr/libexec/petitboot/pb-console --getty=/sbin/agetty --detach -- -a petituser -n -i console linux
3. /sbin/agetty -a petituser -n -i console linux
4. /home/petituser/.profile
5. /usr/libexec/petitboot/pb-console
6. /usr/sbin/petiboot-nc

Here, everything from (4) down is running as petituser. In (4), use
$PPID to determine if we're logging in via getty, so that logging in by
other means will give a normal shell. Otherwise we would recurse when
trying to get a shell from the menu.

Signed-off-by: Reza Arbab <arbab@linux.ibm.com>
[Arnout: explicitly select util-linux, even though it comes indirectly
through other dependencies]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
This commit is contained in:
Reza Arbab
2024-02-07 11:51:35 -06:00
committed by Arnout Vandecappelle
parent d5ba2db401
commit eee0a2f226
5 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/petitboot/Config.in
View File

@@ -1,7 +1,7 @@
config BR2_PACKAGE_PETITBOOT
bool "petitboot"
depends on BR2_PACKAGE_KEXEC_ARCH_SUPPORTS || BR2_PACKAGE_KEXEC_LITE_ARCH_SUPPORTS
depends on BR2_USE_MMU # lvm2
depends on BR2_USE_MMU # lvm2, agetty
depends on BR2_USE_WCHAR # elfutils, kexec-lite
depends on !BR2_STATIC_LIBS # elfutils, kexec-lite, lvm2
depends on BR2_TOOLCHAIN_HAS_THREADS # elfutils, kexec-lite, lvm2
@@ -17,6 +17,8 @@ config BR2_PACKAGE_PETITBOOT
select BR2_PACKAGE_LIBXCRYPT if BR2_TOOLCHAIN_USES_GLIBC
select BR2_PACKAGE_NVME if ( BR2_powerpc || BR2_powerpc64 || BR2_powerpc64le )
select BR2_PACKAGE_POWERPC_UTILS if ( BR2_powerpc || BR2_powerpc64 || BR2_powerpc64le )
select BR2_PACKAGE_UTIL_LINUX
select BR2_PACKAGE_UTIL_LINUX_AGETTY
help
Petitboot is a small kexec-based bootloader

4
package/petitboot/S15pb-discover
View File

@@ -12,7 +12,9 @@ fi
start() {
printf 'Starting %s: ' "$DAEMON"
mkdir -p /var/log/petitboot
# shellcheck disable=SC2174 # only apply -m to deepest dir
mkdir -p -m 0775 /var/log/petitboot
chown petituser:petitgroup /var/log/petitboot
# shellcheck disable=SC2086 # we need the word splitting
start-stop-daemon -S -q -b -m -p "$PIDFILE" -x "/usr/sbin/$DAEMON" \

6
package/petitboot/pb-console
View File

@@ -3,14 +3,16 @@
DAEMON="pb-console"
PB_CONSOLE_PORT=${2:-"console"}
PB_CONSOLE_ARGS="--getty --detach -- -n -i 0 $PB_CONSOLE_PORT linux"
PB_CONSOLE_ARGS="--getty=/sbin/agetty --detach -- -a petituser -n -i $PB_CONSOLE_PORT linux"
# shellcheck source=/dev/null
[ -r "/etc/default/petitboot" ] && . "/etc/default/petitboot"
start() {
printf 'Starting %s on %s: ' "$DAEMON" "$PB_CONSOLE_PORT"
mkdir -p /var/log/petitboot
# shellcheck disable=SC2174 # only apply -m to deepest dir
mkdir -p -m 0775 /var/log/petitboot
chown petituser:petitgroup /var/log/petitboot
# shellcheck disable=SC2086 # we need the word splitting
start-stop-daemon -S -q -x "/usr/libexec/petitboot/$DAEMON" \

6
package/petitboot/petitboot.mk
View File

@@ -97,6 +97,8 @@ define PETITBOOT_POST_INSTALL
$(TARGET_DIR)/etc/init.d/pb-console
$(INSTALL) -D -m 0755 $(PETITBOOT_PKGDIR)/pb-shell \
$(TARGET_DIR)/usr/libexec/petitboot/pb-shell
$(INSTALL) -D -m 0755 $(PETITBOOT_PKGDIR)/shell_profile \
$(TARGET_DIR)/home/petituser/.profile
mkdir -p $(TARGET_DIR)/etc/udev/rules.d
for port in $(PETITBOOT_GETTY_PORT); do \
@@ -111,4 +113,8 @@ endef
PETITBOOT_POST_INSTALL_TARGET_HOOKS += PETITBOOT_POST_INSTALL
define PETITBOOT_USERS
petituser -1 petitgroup -1 * /home/petituser /bin/sh - petitboot user
endef
$(eval $(autotools-package))

3
package/petitboot/shell_profile Normal file
View File

@@ -0,0 +1,3 @@
if [ "$PPID" = "1" ]; then
exec /usr/libexec/petitboot/pb-console
fi