Make read-only rootfs work with live images

index cf02f88..15fe51a 100644
@@ -259,10 +259,6 @@ read_only_rootfs_hook () {
 	if ${@base_contains("DISTRO_FEATURES", "sysvinit", "true", "false", d)}; then
 	        # Tweak the mount option and fs_passno for rootfs in fstab
 		sed -i -e '/^[#[:space:]]*rootfs/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${IMAGE_ROOTFS}/etc/fstab
-	        # Change the value of ROOTFS_READ_ONLY in /etc/default/rcS to yes
-		if [ -e ${IMAGE_ROOTFS}/etc/default/rcS ]; then
-			sed -i 's/ROOTFS_READ_ONLY=no/ROOTFS_READ_ONLY=yes/' ${IMAGE_ROOTFS}/etc/default/rcS
-		fi
 	        # Run populate-volatile.sh at rootfs time to set up basic files
 	        # and directories to support read-only rootfs.
 		if [ -x ${IMAGE_ROOTFS}/etc/init.d/populate-volatile.sh ]; then

index 8e15762..ca477b7 100644
@@ -58,3 +58,17 @@ status() {
     fi
     return 3
 }
+
+# Determine whether rootfs is read-only or not according to /proc/mounts or /etc/fstab.
+is_rootfs_readonly () {
+    local DIRNAME=`dirname $0`
+    local ROOT_DIR=`echo $DIRNAME | sed -ne 's:/etc/.*::p'`
+    local criteria_file
+    [ -n "$ROOT_DIR" ] && criteria_file="$ROOT_DIR/etc/fstab" || criteria_file="/proc/mounts"
+    local flag
+    for flag in `awk '{ if ($2 == "/") { split($4,FLAGS,",") } }; END { for (f in FLAGS) print FLAGS[f] }' < $criteria_file`; do
+	[ "$flag" = "ro" ] && { echo "yes"; return 0; }
+    done
+    echo "no"
+    return 0
+}
\ No newline at end of file

index 91c70efb..a760081 100755
@@ -13,8 +13,12 @@ DIRNAME=`dirname $0`
 ROOT_DIR=`echo $DIRNAME | sed -ne 's:/etc/.*::p'`
 
 [ -e ${ROOT_DIR}/etc/default/rcS ] && . ${ROOT_DIR}/etc/default/rcS
+FUNCTIONS_FILE="${ROOT_DIR}`readlink -f ${ROOT_DIR}/etc/init.d/functions`"
+. $FUNCTIONS_FILE
 # When running populate-volatile.sh at rootfs time, disable cache.
 [ -n "$ROOT_DIR" ] && VOLATILE_ENABLE_CACHE=no
+# Determine whether the rootfs is read-only
+ROOTFS_READ_ONLY=`is_rootfs_readonly`
 # If rootfs is read-only, disable cache.
 [ "$ROOTFS_READ_ONLY" = "yes" ] && VOLATILE_ENABLE_CACHE=no
 

index 9cf0921..d523924 100644
@@ -1,6 +1,8 @@
 #!/bin/sh
 
-. /etc/default/rcS
+. /etc/init.d/functions
+
+ROOTFS_READ_ONLY=`is_rootfs_readonly`
 
 [ "$ROOTFS_READ_ONLY" = "no" ] && exit 0
 

index 709cdf6..3c9dea9 100644
@@ -23,7 +23,3 @@ FSCKFIX=yes
 #TICKADJ=10000
 # Enable caching in populate-volatile.sh
 VOLATILE_ENABLE_CACHE=yes
-# Indicate whether the rootfs is intended to be read-only or not.
-# Setting ROOTFS_READ_ONLY to yes and rebooting will give you a read-only rootfs.
-# Normally you should not change this value.
-ROOTFS_READ_ONLY=no

index d90d446..4e5094a 100644
@@ -79,6 +79,11 @@ case "$1" in
 			    echo "$NEWDATA" > /dev/shm/udev.cache
                     fi
 	    else
+		    # Determine whether the rootfs is read-only or not
+		    ROOTFS_READ_ONLY="no"
+		    for flag in `awk '{ if ($2 == "/") { split($4,FLAGS,",") } }; END { for (f in FLAGS) print FLAGS[f] }' < /proc/mounts`; do
+			    [ "$flag" = "ro" ] && ROOTFS_READ_ONLY="yes"
+		    done
 		    if [ "$ROOTFS_READ_ONLY" != "yes" ]; then
 			    # If rootfs is not read-only, it's possible that a new udev cache would be generated;
 			    # otherwise, we do not bother to read files.

index db5a513..862e0e6 100644
@@ -18,6 +18,11 @@ export TZ=/etc/localtime
 [ -f /etc/default/rcS ] && . /etc/default/rcS
 [ -f /etc/default/udev-cache ] && . /etc/default/udev-cache
 
+ROOTFS_READ_ONLY="no"
+for flag in `awk '{ if ($2 == "/") { split($4,FLAGS,",") } }; END { for (f in FLAGS) print FLAGS[f] }' < /proc/mounts`; do
+    [ "$flag" = "ro" ] && ROOTFS_READ_ONLY="yes"
+done
+
 if [ "$ROOTFS_READ_ONLY" = "yes" ]; then
     [ "$VERBOSE" != "no" ] && echo "udev-cache: read-only rootfs, skip generating udev-cache"
     exit 0

new file mode 100644
index 0000000..f076b0d
@@ -0,0 +1,37 @@
+From b8e8e7f93aca54561cc1d7945ef3ec7aca5f6f43 Mon Sep 17 00:00:00 2001
+From: Chen Qi <[email protected]>
+Date: Tue, 23 Jul 2013 10:48:32 +0800
+Subject: [PATCH V4 V3] add is_rootfs_readonly to functions
+
+---
+ rc.d/init.d/functions |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/rc.d/init.d/functions b/rc.d/init.d/functions
+index a5b2b9e..0663c7f 100644
+--- a/rc.d/init.d/functions
++++ b/rc.d/init.d/functions
+@@ -577,6 +577,20 @@ apply_sysctl() {
+     fi
+ }
+ 
++# Determine whether rootfs is read-only or not according to /proc/mounts or /etc/fstab.
++is_rootfs_readonly () {
++    local DIRNAME=`dirname $0`
++    local ROOT_DIR=`echo $DIRNAME | sed -ne 's:/etc/.*::p'`
++    local criteria_file
++    [ -n "$ROOT_DIR" ] && criteria_file="$ROOT_DIR/etc/fstab" || criteria_file="/proc/mounts"
++    local flag
++    for flag in `awk '{ if ($2 == "/") { split($4,FLAGS,",") } }; END { for (f in FLAGS) print FLAGS[f] }' < $criteria_file`; do
++	[ "$flag" = "ro" ] && { echo "yes"; return 0; }
++    done
++    echo "no"
++    return 0
++}
++
+ # A sed expression to filter out the files that is_ignored_file recognizes
+ __sed_discard_ignored_files='/\(~\|\.bak\|\.orig\|\.rpmnew\|\.rpmorig\|\.rpmsave\)$/d'
+ 
+-- 
+1.7.9.5
+

index 3011f98..927c9db 100644
@@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=ebf4e8b49780ab187d51bd26aaa022c6"
 S="${WORKDIR}/initscripts-${PV}"
 SRC_URI = "http://pkgs.fedoraproject.org/repo/pkgs/initscripts/initscripts-9.48.tar.bz2/7dfab81a5a8d3f0dea5ba55e391c26f3/initscripts-9.48.tar.bz2 \
            file://functions.patch \
+           file://0001-add-is_rootfs_readonly-to-functions.patch \
           " 
 
 SRC_URI[md5sum] = "7dfab81a5a8d3f0dea5ba55e391c26f3"

index 890c562..861d874 100644
@@ -184,6 +184,8 @@ mount_and_boot() {
 	"")
 	    if ! mount -o rw,loop,noatime,nodiratime /media/$i/$ISOLINUX/$ROOT_IMAGE $ROOT_MOUNT ; then
 		fatal "Could not mount rootfs image"
+	    else
+		mount -t tmpfs -o rw,noatime,mode=755 tmpfs $ROOT_MOUNT/media
 	    fi
 	    ;;
     esac

index 4e5094a..52c7925 100644
@@ -9,8 +9,6 @@
 # Short-Description: Start udevd, populate /dev and load drivers.
 ### END INIT INFO
 
-. /etc/init.d/functions
-
 export TZ=/etc/localtime
 
 [ -d /sys/class ] || exit 1

@@ -31,6 +29,11 @@ readfiles () {
    done
 }
 
+kill_udevd () {
+    pid=`pidof -x udevd`
+    [ -n "$pid" ] && kill $pid
+}
+
 case "$1" in
   start)
     export ACTION=add

@@ -94,7 +97,7 @@ case "$1" in
     fi
 
     # make_extra_nodes
-    killproc udevd > "/dev/null" 2>&1
+    kill_udevd > "/dev/null" 2>&1
 
     # trigger the sorted events
     echo -e '\000\000\000\000' > /proc/sys/kernel/hotplug

@@ -119,7 +122,12 @@ case "$1" in
     $0 start
     ;;
   status)
-    status udevd
+    pid=`pidof -x udevd`
+    if [ -n "$pid" ]; then
+	echo "udevd (pid $pid) is running ..."
+    else
+	echo "udevd is stopped"
+    fi
     ;;
   *)
     echo "Usage: $0 {start|stop|status|restart}"

index a760081..d8ae14e 100755
@@ -23,7 +23,7 @@ ROOTFS_READ_ONLY=`is_rootfs_readonly`
 [ "$ROOTFS_READ_ONLY" = "yes" ] && VOLATILE_ENABLE_CACHE=no
 
 CFGDIR="${ROOT_DIR}/etc/default/volatiles"
-TMPROOT="${ROOT_DIR}/var/tmp"
+TMPROOT="${ROOT_DIR}/var/volatile/tmp"
 COREDEF="00_core"
 
 [ "${VERBOSE}" != "no" ] && echo "Populating volatile Filesystems."

index d8ae14e..827fd7d 100755
@@ -46,7 +46,7 @@ create_file() {
 			# but these failures should not be logged to make sure the do_rootfs
 			# process doesn't fail. This does no harm, as this script will
 			# run on target to set up the correct files and directories.
-			eval $EXEC > /dev/null 2>&1 &
+			eval $EXEC > /dev/null 2>&1
 		fi
 	}
 }

@@ -91,7 +91,7 @@ link_file() {
 	else
 		# For the same reason with create_file(), failures should
 		# not be logged.
-		eval $EXEC > /dev/null 2>&1 &
+		eval $EXEC > /dev/null 2>&1
 	fi
 }
 

@@ -160,7 +160,7 @@ apply_cfgfile() {
 		[ "${TTYPE}" = "l" ] && {
 			TSOURCE="$TLTARGET"
 			[ "${VERBOSE}" != "no" ] && echo "Creating link -${TNAME}- pointing to -${TSOURCE}-."
-			link_file "${TSOURCE}" "${TNAME}" &
+			link_file "${TSOURCE}" "${TNAME}"
 			continue
 		}
 

index 9619bec..8a6e551 100755
@@ -526,7 +526,7 @@ if [ "x$RAMFS" = "xtrue" ]; then
 fi
 
 if [ "x$ISOFS" = "xtrue" ]; then
-    QEMUOPTIONS="-cdrom $ROOTFS"
+    QEMUOPTIONS="$QEMU_NETWORK_CMD -cdrom $ROOTFS $QEMU_UI_OPTIONS"
 fi
 
 if [ "x$QEMUOPTIONS" = "x" ]; then

index d523924..eb89e18 100644
@@ -1,15 +1,51 @@
 #!/bin/sh
 
 . /etc/init.d/functions
+READONLY_CFGDIR="/etc/default/readonly"
 
 ROOTFS_READ_ONLY=`is_rootfs_readonly`
 
 [ "$ROOTFS_READ_ONLY" = "no" ] && exit 0
 
+is_on_read_only_partition () {
+    DIRECTORY=$1
+    dir=`readlink -f $DIRECTORY`
+    while true; do
+	if [ ! -d "$dir" ]; then
+	    echo "ERROR: $dir is not a directory"
+	    exit 1
+	else
+	    for flag in `awk -v dir=$dir '{ if ($2 == dir) { print "FOUND"; split($4,FLAGS,",") } }; END { for (f in FLAGS) print FLAGS[f] }' < /proc/mounts`; do
+		[ "$flag" = "FOUND" ] && partition="read-write"
+		[ "$flag" = "ro" ] && { partition="read-only"; break; }
+	    done
+	fi
+	if [ "$dir" = "/" -o -n "$partition" ]; then
+	    break
+	else
+	    dir=`dirname $dir`
+	fi
+    done
+    [ "$partition" = "read-only" ] && echo "yes" || echo "no"
+}
+
+apply_conf () {
+    cfgfile=$1
+    cat $cfgfile | while read line; do
+	eval `echo "$line" | sed -n "s/\(.*\)\ \(.*\)/DIR_READONLY=\1; DIR_VOLATILE=\2;/p"`
+	if [ `is_on_read_only_partition $DIR_READONLY` = "yes" ]; then
+	    mkdir -p $DIR_VOLATILE
+	    cp -a $DIR_READONLY/* $DIR_VOLATILE 2>/dev/null
+	    cp -a $DIR_READONLY/.[!.]* $DIR_VOLATILE 2>/dev/null
+	    mount --bind $DIR_VOLATILE $DIR_READONLY
+	fi
+    done
+}
+
 if [ "$1" = "start" ] ; then
-	grep -q "tmpfs /var/volatile" /proc/mounts || mount /var/volatile
-	mkdir -p /var/volatile/lib
-	cp -a /var/lib/* /var/volatile/lib
-	mount --bind /var/volatile/lib /var/lib
+    grep -q "tmpfs /var/volatile" /proc/mounts || mount /var/volatile
+    for file in `ls -1 "$READONLY_CFGDIR"`; do
+	apply_conf "$READONLY_CFGDIR/$file"
+    done
 fi
 

index 52e1c9c..46c4c99 100644
@@ -105,6 +105,11 @@ do_install () {
 	install -m 0755 ${WORKDIR}/umountfs	${D}${sysconfdir}/init.d/umountfs
 	install -m 0755		${WORKDIR}/device_table.txt		${D}${sysconfdir}/device_table
 #
+# Create config files for read-only rootfs
+#
+	install -d ${D}${sysconfdir}/default/readonly
+	echo "/var/lib /var/volatile/lib" > ${D}${sysconfdir}/default/readonly/initscripts
+#
 # Create runlevel links
 #
 	update-rc.d -r ${D} rmnologin.sh start 99 2 3 4 5 .

index 827fd7d..b1c0245 100755
@@ -76,7 +76,8 @@ link_file() {
 	if [ -L \"$2\" ]; then
 		[ \"\$(readlink -f \"$2\")\" != \"\$(readlink -f \"$1\")\" ] && { rm -f \"$2\"; ln -sf \"$1\" \"$2\"; };
 	elif [ -d \"$2\" ]; then
-		for f in $2/* $2/.[^.]*; do [ -e \$f ] && cp -rf \$f $1; done;
+		cp -a $2/* $1
+		cp -a $2/.[!.]* $1
 		rm -rf \"$2\";
 		ln -sf \"$1\" \"$2\";
 	else

index 63750f1..14efb94 100755
@@ -13,7 +13,6 @@ module_id() {
 }
 
 if [ ! -f /etc/sysconfig/irda ]; then
-
     case `module_id` in
 	"HP iPAQ H2200" | "HP iPAQ HX4700" | "HTC Universal")
 	    IRDA=yes

@@ -28,18 +27,10 @@ if [ ! -f /etc/sysconfig/irda ]; then
 	    DISCOVERY=
 	    ;;
     esac
-
-    mkdir -p /etc/sysconfig
-    echo "IRDA=$IRDA" > /etc/sysconfig/irda
-    if [ $IRDA = "yes" ]; then
-	echo "DEVICE=$DEVICE" >> /etc/sysconfig/irda
-	echo "DONGLE=$DONGLE" >> /etc/sysconfig/irda
-	echo "DISCOVERY=$DISCOVERY" >> /etc/sysconfig/irda
-    fi
+else
+    . /etc/sysconfig/irda
 fi
 
-. /etc/sysconfig/irda
-
 # Check that irda is up.
 [ ${IRDA} = "no" ] && exit 0
 

index 15fe51a..769cf81 100644
@@ -264,6 +264,18 @@ read_only_rootfs_hook () {
 		if [ -x ${IMAGE_ROOTFS}/etc/init.d/populate-volatile.sh ]; then
 			${IMAGE_ROOTFS}/etc/init.d/populate-volatile.sh
 		fi
+		# If we're using openssh and the /etc/ssh directory has no pre-generated keys,
+		# we should configure openssh to use the configuration file /etc/ssh/sshd_config_readonly
+		# and the keys under /var/run/ssh.
+		if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
+			if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
+				echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
+				echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
+			else
+				echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
+				echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
+			fi
+		fi
 	fi
 }
 

index 6beec84..12fb79b 100644
@@ -6,14 +6,22 @@ set -e
 test -x /usr/sbin/sshd || exit 0
 ( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0
 
+# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS
 if test -f /etc/default/ssh; then
     . /etc/default/ssh
 fi
 
+[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
+mkdir -p $SYSCONFDIR
+
+HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
+HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
+HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
+
 check_for_no_start() {
     # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
-    if [ -e /etc/ssh/sshd_not_to_be_run ]; then 
-	echo "OpenBSD Secure Shell server not in use (/etc/ssh/sshd_not_to_be_run)"
+    if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then
+	echo "OpenBSD Secure Shell server not in use ($SYSCONFDIR/sshd_not_to_be_run)"
 	exit 0
     fi
 }

@@ -32,17 +40,17 @@ check_config() {
 
 check_keys() {
 	# create keys if necessary
-	if [ ! -f /etc/ssh/ssh_host_rsa_key ]; then
+	if [ ! -f $HOST_KEY_RSA ]; then
 		echo "  generating ssh RSA key..."
-		ssh-keygen -q -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
+		ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
 	fi
-	if [ ! -f /etc/ssh/ssh_host_ecdsa_key ]; then
+	if [ ! -f $HOST_KEY_ECDSA ]; then
 		echo "  generating ssh ECDSA key..."
-		ssh-keygen -q -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa
+		ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
 	fi
 	if [ ! -f /etc/ssh/ssh_host_dsa_key ]; then
 		echo "  generating ssh DSA key..."
-		ssh-keygen -q -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa
+		ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
 	fi
 }
 

index ab2eefb..c76f9ac 100644
@@ -86,6 +86,13 @@ do_install_append () {
 	install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/sshd
 	rm -f ${D}${bindir}/slogin ${D}${datadir}/Ssh.bin
 	rmdir ${D}${localstatedir}/run/sshd ${D}${localstatedir}/run ${D}${localstatedir}
+        # Create config files for read-only rootfs
+	install -d ${D}${sysconfdir}/ssh
+	install -m 644 ${WORKDIR}/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
+	sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly
+	echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
+	echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
+	echo "HostKey /var/run/ssh/ssh_host_ecdsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly
 }
 
 ALLOW_EMPTY_${PN} = "1"

@@ -94,7 +101,7 @@ PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc $
 FILES_${PN}-scp = "${bindir}/scp.${BPN}"
 FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
 FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd"
-FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config"
+FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly"
 FILES_${PN}-sftp = "${bindir}/sftp"
 FILES_${PN}-sftp-server = "${libexecdir}/sftp-server"
 FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"