There's still plenty to do and patches are still very welcome, but the
TODO file departed from reality a very long time ago; better to start
over again.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
utils/pb-console: Use -m to run shell in own process group
Use -m to have the shell spawned by pb-console run it its own process
group, allowing commands such as Ctrl-C (SIGINT) to behave as expected
rather than killing the shell.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Implement device_add() in cui_client_ops and use this interface to
recognise when the server notifies the client of an encrypted device. A
"device header" will be created for this device and added to the menu
with no associated boot options.
The nc-auth prompt is extended to ask for a disk password when the device
header for an encrypted device is selected.
Assuming the password is correct pb-discover will remove the original
device and notify the client about the newly opened device, which will
be reflected in the menu.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover: Recognise and open LUKS encrypted partitions
Handle devices encrypted with LUKS and call cryptsetup to open them if a
client sends the associated password.
If a new device has the "crypto_LUKS" filesystem type it is marked as a
LUKS device and sent to clients but further discovery is not performed.
Once a client sends the device's password cryptsetup is called to open
it. The opened device will appear separately, so the source device is
"forgotten" at this point and then the newly opened device is treated as
a normal partition. On destruction the device is "closed" with
cryptsetup so that discovery can start from the beginning.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Extend the auth_message struct to support the AUTH_MSG_DECRYPT
operation, allowing the existing authentications methods to be used for
passing a disk password from the UI to pb-discover.
In addition add DEVICE_TYPE_LUKS to identify encrypted disk devices.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
If pipe_stdin exists, create a second pipe to write to the child
process's STDIN. This allows Petitboot to pipe information to a process,
for example piping a LUKS password to cryptsetup.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
On kexec all processes will be sent a SIGTERM and SIGKILL. By default
there are messages on the console alerting the user to this, however in
some implementations these messages are disabled. This can have the
effect of the UI seemingly exiting to the shell on boot and hanging for
a short while before the kexec actually jumps into the next kernel.
Trap the SIGTERM sent to the pb-console parent process and print a short
message to the screen instead of momentarily dropping to the shell and
printing the usual help messages.
While here also cleanup the shell help messages below which are now
handled in the shell's .shrc file.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
For some reason our version script removes the leading 'v' from the git
tag. This confuses some other tools such as Buildroot and is different
to most other projects, so include it again.
Additionally now that we have tagged releases just use git describe
rather than using a SHA and date to describe non-tag commits.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
And include a pxe-parser test which uses a port in the path prefix to
exercise this. This could cause PXE discovery failures if parameters
such as pathprefix included a port in the URL.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover/devmapper: Retry dm-device remove if busy
Buildroot's libdm is not built with --enable-udev_sync, so device-mapper
actions are not able to sync or wait for udev events.
(see 185676316, "discover/devmapper: Disable libdm udev sync support")
This can cause an issue when tearing down a snapshot in
devmapper_destroy_snapshot() which performs a DM_DEVICE_REMOVE task
against the snapshot, origin, and base devices one after the other. In
some cases if the interval between these actions is too short the action
can fail as the preceding device hasn't disappeared yet and the device
being removed is still busy.
Since we don't yet have a way to tell exactly when the device is ready,
pause for a short time and retry the action, letting
devmapper_destroy_snapshot() continue and, for example, letting
mount_device() fall back to the physical device.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
If there is an IPMI boot mailbox configuration present display a message
in the System Configuration screen and provide the option to clear the
mailbox.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover/platform-powerpc: read bootdev config from IPMI boot mailbox
The IPMI Get System Boot Options commands includes parameter 7, the
"boot initiator mailbox". This can be used to hold arbitrary data to
influence the boot order.
Use this to provide an alternate bootdev configuration to Petitboot that
will override the one saved to NVRAM. This provides more fine grained
override options than the existing device-type based overrides.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Keep track of the default boot option, and prefix its display name with
a '(*)' to point it out to the user.
This avoids having to authenticate with pb-discover even if only booting
the default option.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
ui/ncurses: Add nc-auth and authenticate when required.
When the user tries to perform actions that require authentication a new
subscreen 'nc-auth' is launched which accepts a password and will send
an authentication request before performing the action.
This also adds a button in nc-config which launches an nc-auth screen
allowing the user to set or change the system password.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Instead of calling sh twice to echo the 'exiting' message just call sh
by itself and leave any welcome message to the shell's interactive
config.
Also drop the explicit nc_scr_unpost() in cui_run_cmd() since clear()
will blank out the screen anyway.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover/platform-powerpc: Read and write password hash from NVRAM
If petitboot,password exists set it as the root password. This will be
the password used to authenticate clients.
This is the *hash* of a password as it would appear in /etc/shadow, not
the password itself.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover/discover-server: Restrict clients based on uid
If crypt support is enabled restrict what actions clients can perform by
default. Initial authorisation is set at connection time; clients
running as root are unrestricted, anything else runs as restricted until
it makes an authentication to pb-discover.
Unprivileged clients may only perform the following actions:
- Boot the default boot option.
- Cancel the autoboot timeout.
- Make an authentication request.
If a group named "petitgroup" exists then the socket permissions are
also modified so that only clients running as root or in that group may
connect to the socket.
The user-event socket is only usable by root since the two main
usecases are by utilities called by pb-discover or by a user in the
shell who will need to su to root anyway.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Add a new "authenticate" action. Depending on the 'op' field this is
either a) an authentication request, b) a response indicating the
result, or c) a request to change the password.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
lib/crypt: Add helpers for operating on /etc/shadow
Provides helper functions for reading, writing, and checking against
/etc/shadow. The main use case if for authenticating clients against the
"system" password, which is set as the root password.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
utils/pb-console: Support agetty's autologin option
If the getty arguments include '-a' do not set the '-l' option. This
implies the environment has been configured with users and will launch
the subsequent pb-console instance itself.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover/boot: Fix talloc parent for resource URLs
The pb_urls for the boot resources use 'opt' as the talloc parent but
this may be NULL, for example if this is a user-created boot option.
Move the boot_task initialisation so it can be used as the talloc parent
instead.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
A few places where we print out the response buffer from an IPMI command
weren't updated when log timestamps were added, resulting in very hard
to read output. Add a little helper to format buffers and use it to
print these with only one timestamp.
The ncurses UI sets a few console options at startup that are needed for
ncurses to work properly. These aren't reset however and can lead to
quirks like the cursor being invisible after kexecing to the next
kernel.
The UI process doesn't have time to reset these when it is killed by
kexec, so instead add a 'boot_active' field to status updates. This is
set by boot.c's update handler so the UI can assume it is about to boot
if it receives a status update with this field, and resets the console
options. If the boot is cancelled for any reason the status update will
reflect that and the console options are restored.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
discover: Reimplement native-parser as a Bison parser
Occasionally you look at some code and realise that a) this never gets
built, and b) even if it did it would never compile. Today's example is
native-parser.c which we must have just assumed worked for quite a
while.
The native parser has bitrotted entirely and needs to be brought up to
date. While we're here, lets take the chance to implement a proper
grammar for it. This helps us reason more effectively about the parser,
lets us extend it easily in the future, and.. I wanted to write a Bison
parser too.
This implements most of the old functionality, but drops off some
smaller details like settings icons which needs some separate attention
to bring up to date.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
In more recent firmware images built by op-build the VERSION partition
is signed, and includes a 'secure header'. Check for this and skip it if
found so we parse the version strings properly.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
To avoid sending all the files in the top most project
directory tree down to the docker daemon, change into
the docker directory when running 'docker build'.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
docker: Allow CC and make command to be customised
Allow CC to be passed through to change the default compiler, and also
allow the invocation of 'make' to be customised. An example use case of
this is to set CC=/usr/bin/clang and use
--make-command 'scan-build make' to build Petitboot with the clang
static analyzer.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
The kboot parser doesn't set a default option. Change it so that if we
see the 'default' parameter we match against this value when deciding if
an option should be set as default.
discover/device-handler: Restore autoboot setting on requery
When a device requery is triggered we cancel any default boot option on
the device. This also disables autoboot which we don't want; any boot
options found after the requery will not be able to autoboot.
To avoid this restore the existing autoboot setting after checking for
default options.
This prevents a particular corner case where a default boot option has
been selected for boot but one of its boot files has stalled or is
taking more time to download than the requery timeout and the requery
accidentally cancels autoboot preventing Petitboot from trying to boot
again.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Brett Grandbois [Sun, 26 Aug 2018 22:17:20 +0000 (08:17 +1000)]
ui/ncurses: in lockdown ensure system reboot in ncurses menu exit
In a lockdown situation in the ncurses menu there is a switch to replace
the 'Exit to shell' option with 'Reboot', so the intent seems to be to
not allow the user the option to exit to shell in a lockdown situation.
However the associated foreced reboot logic is in the process atexit so
is only triggered when completely exiting the menu system. The default
menu item logic to exit to shell is still in place though so the menu
exit never occurs and shell access is still available.
Add a switch to a different menu exit callback to force a menu abort
using the same mechanism as a signal in lockdown situations so the shell
can never be entered. This also affects the 'x' or esc shortcut keys.
Signed-off-by: Brett Grandbois <brett.grandbois@opengear.com> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
If a 'name' parameter is used for a boot user event, search existing
boot options for one that matches that name on the given device.
This allows a pb-event user to boot based on name rather than having to
specify the exact boot arguments.
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Fri, 17 Aug 2018 17:59:33 +0000 (10:59 -0700)]
travis: Update to job matrix
o Set language to bash (same as generic), so just the
scrip steps run.
o Move build-builder to 'before_script'.
o Switch to a job matrix of 'os' entries with names.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Fri, 10 Aug 2018 17:29:14 +0000 (17:29 +0000)]
lib/efi: Add new struct efi_mount
To make it easier to manage EFI variables add a new struct efi_mount
that holds the path to the EFI file system mount and the EFI variable
name GUID. Update the lib/efi routines to use struct efi_mount. Add
a new routine efi_check_mount based on the checks done in
platform-arm64.
This change to using struct efi_mount removes the static variable
efivarfs_path making the lib/efi routines stateless.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Wed, 8 Aug 2018 20:24:50 +0000 (13:24 -0700)]
lib/talloc: Fix TALLOC_ABORT
The current TALLOC_ABORT macro had a number of problems.
Failures were not going to the pb log, but only to stderr.
If the object passed in was not a talloc object the printing
of an object name would be printing random data.
The use of a macro obscured the code.
To clean this up, remove all reference to TALLOC_ABORT and
put the logging and abort calls directly into talloc_chunk_from_ptr.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Ge Song [Thu, 2 Aug 2018 17:29:41 +0000 (17:29 +0000)]
discover: Add platform-arm64
Signed-off-by: Ge Song <ge.song@hxt-semitech.com>
[Split from a larger patch and cleaned up] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Thu, 2 Aug 2018 17:29:40 +0000 (17:29 +0000)]
discover: Add platform-dummy
With the new configure enable-platform parameters it is possible
configure no platform support. Add a new minimal 'dummy' platform
so that the __start_platforms and __stop_platforms variables needed
by platform_init are created.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Ge Song [Thu, 2 Aug 2018 17:29:39 +0000 (17:29 +0000)]
discover: Move generic params routines to platform
Move the generic params routines from platform-powerpc to platform.
Also, for clarity, add a params prefix to the names.
Signed-off-by: Ge Song <ge.song@hxt-semitech.com>
[Split from a larger patch and cleaned up] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Ge Song [Thu, 2 Aug 2018 17:29:39 +0000 (17:29 +0000)]
discover: Move generic config routines to platform
Move the generic config routines from platform-powerpc to platform.
Also, for clarity, add a config_ prefix to the names.
Signed-off-by: Ge Song <ge.song@hxt-semitech.com>
[Split from a larger patch and cleaned up] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Ge Song [Thu, 2 Aug 2018 17:29:38 +0000 (17:29 +0000)]
discover/powerpc: Rearange save_config
Rearange update_config and save_config so that update_config
only operates on the platform params list.
Signed-off-by: Ge Song <ge.song@hxt-semitech.com>
[Split from a larger patch and cleaned up] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Ge Song [Thu, 2 Aug 2018 17:29:37 +0000 (17:29 +0000)]
discover: Move generic ipmi routines to ipmi
Signed-off-by: Ge Song <ge.song@hxt-semitech.com>
[Split from a larger patch] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Thu, 2 Aug 2018 17:29:36 +0000 (17:29 +0000)]
lib/efi: Cleanup read/write routines
Make a new stucture struct efi_data to hold the info that describes
an efi variable. Make a common routine efi_open that opens the efi
variable file. Switch the efi get/set/del routines over to use
efi_open.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Ge Song [Thu, 2 Aug 2018 17:29:36 +0000 (17:29 +0000)]
lib/efi: Add new routines to access efi variables
Provide methods to load/store petitboot's configuration on efi-based
platforms. A test case is also provided.
Signed-off-by: Ge Song <ge.song@hxt-semitech.com>
[Cleanup file comments, make efivarfs_path static.] Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Thu, 2 Aug 2018 17:29:35 +0000 (17:29 +0000)]
lib/process: Add process_get_stdout
Add a new structure 'struct process_stdout' and optional parameter
'stdout' to the process_run_simple functions to allow the caller
to get a buffer filled with the stdout from the child process.
Rename the process_run_simple functions to process_get_stdout
and add wrappers for the old process_run_simple function names.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Thu, 2 Aug 2018 17:29:35 +0000 (17:29 +0000)]
lib/process: Cleanup stdout callback
General cleanup of async stdout processing.
The process_stdout_cb and process_stdout_custom routines were doing the
same thing, so rename process_stdout_custom to process_process_stdout
and make process_stdout_cb a wrapper that calls process_process_stdout.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Thu, 2 Aug 2018 17:29:34 +0000 (17:29 +0000)]
discover: Add --debug to kexec
If verbose logging is enabled then add '--debug' to the kexec command line.
Adds a new routine pb_log_get_debug() that can be used to query the log
debug state.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Geoff Levand [Thu, 2 Aug 2018 17:29:33 +0000 (17:29 +0000)]
lib/log: Add verbose logging routines
Add three new logging routines pb_log_fn and pb_debug_fn, which
print the calling function's name to the log, and pb_debug_fl
which prints the calling function's name and the file line
number to the log.
Signed-off-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
projects / petitboot / log