busybox: improve support for telnetd (branch yem/pw)

Hello All!

This series improves upon the previous iterations to auto-start telnetd on the target.

It now removes handling of securetty altogether, since we've concluded it is not used by util-linux' login utility, and can also be ignored by busybox' login even with our current busybox defconfig.

Changes v3 -> v4:
- drop support for securetty altogether

Regards,
Yann E. MORIN.

The following changes since commit b40509c7d80d6610b3f54e6da0dc1265bf6e9e22:

package/x11r7/xdriver_xf86-video-r128: bump version to 6.10.0 (2015-07-13 10:16:13 +0200)

are available in the git repository at:

git://git.busybox.net/~ymorin/git/buildroot yem/pw

for you to fetch changes up to 7d67670ffb919ed240b7fb157e44c8219375cff0:

busybox: improve support for telnetd (2015-07-13 11:00:30 +0200)

----------------------------------------------------------------
Alexey Brodkin (1):
busybox: improve support for telnetd

Yann E. MORIN (1):
core/skeleton: drop /etc/securetty

 package/busybox/S50telnet     | 36 +++++++++++++++++++++++++++
 package/busybox/busybox.mk    |  9 +++++++
 package/util-linux/login.pam  |  1 -
 system/skeleton/etc/securetty | 57 -------------------------------------------
 system/system.mk              |  8 ------
 5 files changed, 45 insertions(+), 66 deletions(-)
 create mode 100755 package/busybox/S50telnet
 delete mode 100644 system/skeleton/etc/securetty

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

securetty is supposed to restrict the terminals root is allowed to login from. As it happens, login from busybox (w/ securetty support) is actually enforcing use of securetty, while login from util-linux is completely ignoring securetty altogether.

Remove securetty from our skeleton altogether and stop worrying about it.

---
 package/util-linux/login.pam  |  1 -
 system/skeleton/etc/securetty | 57 -------------------------------------------
 system/system.mk              |  8 ------
 3 files changed, 66 deletions(-)
 delete mode 100644 system/skeleton/etc/securetty

index 1d9cd70..01f5632 100644
@@ -1,4 +1,3 @@
-auth		required	pam_securetty.so
 auth		required	pam_unix.so nullok
 
 account		required	pam_unix.so

index 2794667..fd94e03 100644
@@ -8,14 +8,6 @@ TARGET_GENERIC_GETTY_BAUDRATE = $(call qstrip,$(BR2_TARGET_GENERIC_GETTY_BAUDRAT
 TARGET_GENERIC_GETTY_TERM = $(call qstrip,$(BR2_TARGET_GENERIC_GETTY_TERM))
 TARGET_GENERIC_GETTY_OPTIONS = $(call qstrip,$(BR2_TARGET_GENERIC_GETTY_OPTIONS))
 
-ifeq ($(BR2_TARGET_GENERIC_GETTY),y)
-define SYSTEM_SECURETTY
-	grep -q '^$(TARGET_GENERIC_GETTY_PORT)$$' $(TARGET_DIR)/etc/securetty || \
-		echo '$(TARGET_GENERIC_GETTY_PORT)' >> $(TARGET_DIR)/etc/securetty
-endef
-TARGET_FINALIZE_HOOKS += SYSTEM_SECURETTY
-endif
-
 ifneq ($(TARGET_GENERIC_HOSTNAME),)
 define SYSTEM_HOSTNAME
 	mkdir -p $(TARGET_DIR)/etc

1.9.1

Hi Yann,

But CONFIG_FEATURE_SECURETTY=y is still there in current package/busybox/busybox.config. Shouldn't we disable it first?

baruch

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -

Baruch, All,

On 2015-07-13 12:20 +0300, Baruch Siach spake thusly:

Indeed, it is still present, but that does not prevent root login to work when /etc/securetty is missing.

So, I decided to leave it as-is.

Regards,
Yann E. MORIN.

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Hi Yann,

It would still break overlays with /etc/securetty (maybe locally modified). Why not just disable Busybox FEATURE_SECURETTY?

baruch

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -

Baruch, All,

On 2015-07-13 12:44 +0300, Baruch Siach spake thusly:

After discussing this with Thomas, we've decided to keep it, especially to keep the case you mention (custom securetty from overlay) is still working as expected.

The reasoning is that a user which installs a custom /etc/securetty will obviously have it contain the ttys he wants root to log in from, so he'd still be able to log in as root from those ttys.

But if we were to remove FEATURE_SECURETTY, then he'd still be able to log in as root from those ttys, but *also* from *any other* tty, and would probably not notice that change as this is a silent change.

So, we've concluded that we should keep FEATURE_SECURETTY since it works for our new use-case, and works for existing use-cases.

Regards,
Yann E. MORIN.

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Hi Yann,

Makes sense. Thanks for the explanation.

baruch

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -

Thanks for paying attention to these things as well. Even when there's six of
us together here, we are still vulnerable to group think and may miss things that way. So an external pair of eyes is definitely good!

Regards,
Arnout

Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF

From: Alexey Brodkin <[email protected]>

If target has connection to the network it might be pretty useful to have telnet connection to it instead of serial console or even in addition to serial console.

This changes makes the busybox package automatically install an init script, and tune the securetty file to make telnetd work when CONFIG_FEATURE_TELNETD_STANDALONE is enabled in the Busybox configuration.

[Thomas:
- don't create a new Buildroot Config.in option, just test if CONFIG_FEATURE_TELNETD_STANDALONE is enabled or not in the Busybox configuration
- move the securetty tuning in busybox.mk instead of system.mk
- use start-stop-daemon in the init script, in order to properly implement the stop and restart actions
- misc other minor improvements in the init script.]
[yann.morin.1998 at free.fr:
- don't use securetty
- drop stray variable BUSYBOX_SET_STANDALONE_TELNETD]

---
 package/busybox/S50telnet  | 36 ++++++++++++++++++++++++++++++++++++
 package/busybox/busybox.mk |  9 +++++++++
 2 files changed, 45 insertions(+)
 create mode 100755 package/busybox/S50telnet

new file mode 100755
index 0000000..463a772
@@ -0,0 +1,36 @@
+#!/bin/sh
+#
+# Start telnet....
+#
+
+start() {
+      echo -n "Starting telnetd: "
+      start-stop-daemon -S -q -m -b -p /var/run/telnetd.pid \
+			-x /usr/sbin/telnetd -- -F
+      [ $? = 0 ] && echo "OK" || echo "FAIL"
+}
+
+stop() {
+	echo -n "Stopping telnetd: "
+	start-stop-daemon -K -q -p /var/run/telnetd.pid \
+			  -x /usr/sbin/telnetd
+	[ $? = 0 ] && echo "OK" || echo "FAIL"
+}
+
+case "$1" in
+    start)
+	start
+	;;
+    stop)
+	stop
+	;;
+    restart|reload)
+	stop
+	start
+	;;
+  *)
+	echo "Usage: $0 {start|stop|restart}"
+	exit 1
+esac
+
+exit $?

index 92874cd..9289e0a 100644
@@ -168,6 +168,14 @@ endef
 BUSYBOX_DEPENDENCIES += linux-pam
 endif
 
+# Telnet support
+define BUSYBOX_INSTALL_TELNET_SCRIPT
+	if grep -q CONFIG_FEATURE_TELNETD_STANDALONE=y $(@D)/.config; then \
+		$(INSTALL) -m 0755 -D package/busybox/S50telnet \
+			$(TARGET_DIR)/etc/init.d/S50telnet ; \
+	fi
+endef
+
 # Enable "noclobber" in install.sh, to prevent BusyBox from overwriting any
 # full-blown versions of apps installed by other packages with sym/hard links.
 define BUSYBOX_NOCLOBBER_INSTALL

@@ -205,6 +213,7 @@ define BUSYBOX_INSTALL_INIT_SYSV
 	$(BUSYBOX_INSTALL_MDEV_SCRIPT)
 	$(BUSYBOX_INSTALL_LOGGING_SCRIPT)
 	$(BUSYBOX_INSTALL_WATCHDOG_SCRIPT)
+	$(BUSYBOX_INSTALL_TELNET_SCRIPT)
 endef
 
 $(eval $(kconfig-package))

1.9.1

Dear Yann E. MORIN,

Both applied, thanks a lot!

Thomas

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com