From mboxrd@z Thu Jan 1 00:00:00 1970 X-GM-THRID: 6696415711607128064 X-Received: by 2002:ac2:494f:: with SMTP id o15mr4281106lfi.22.1559133792252; Wed, 29 May 2019 05:43:12 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com Received: by 2002:a2e:8710:: with SMTP id m16ls261916lji.11.gmail; Wed, 29 May 2019 05:43:11 -0700 (PDT) X-Google-Smtp-Source: APXvYqxaEO3C2hMGGrrSxVN4/1HeTZ7cmaclfzS69emprf/aYiY78t/9jH3oSl4wslE1Z87XJOqV X-Received: by 2002:a2e:8716:: with SMTP id m22mr16324337lji.128.1559133791776; Wed, 29 May 2019 05:43:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1559133791; cv=none; d=google.com; s=arc-20160816; b=JUuKtdR5MnQa1JCT+z0+BLJ6KUZqkSyTVZD35FTzXRsirkzD4vbNwMxCXk7xuyZwar qW9Onlt8yCXx52TO+mLdB/70FVuN4sA/8W1YopRNwn9qZ1dDY4DRGHII9N8FzJPOFDoc DCBSuJQHggkUdR0QyI4l6DT3LRCg+lLh4Z8jPL01nmMT5X6pAtKLcc6zwo3TnXrn4vks 4EN60ljNPAnFEG7uw3ZJxd+cQRy7D99OWRLKBrviN+qnVA2v1o8TeLuFztuFahf5Xd8e AaCRPcrKF6nR0V6QbIdDjgUpxTSAJDmGJFmgIeYdF9kwLDxOqFFrSIU+pBJr/ul+iyeE Uw0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:to:subject; bh=5tIhaScXzCzmX1vg1d2PVCk13Ldd1SyMSNi0rH2GUOA=; b=K5wN66qf8d9IROIqJARGIASl6PhsTrqbfxEldLgwOYv4+c/FVtfFAZxfMAqxzkVwc6 EauCTpyRUnDqBfysCmtDMV9OydaLpKr8MWXxt4UriE2EEzIbGprSm3FoAu6rFf5g+rIi cxS0lUpWZUWQI1ypWjrXCDtDmzE8j3QDy5zWFfyTZtceHBv+1If9ggfI3T1P74VQm347 VxaSMMfidjcYhAR2zCN09GxmJnbXIZz+hSl9PFgKB8EmaMiqaFsKhRjUKFGdfu8UCmm3 7PvsEoMef9IVH3WTH6bJ37ZtMTLul8u40sSJgjclLMl1gzh5vAbG9FoxJbAinwsWtzb3 BqMA== ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of claudius.heine.ext@siemens.com designates 194.138.37.39 as permitted sender) smtp.mailfrom=claudius.heine.ext@siemens.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=siemens.com Return-Path: Received: from lizzard.sbs.de (lizzard.sbs.de. [194.138.37.39]) by gmr-mx.google.com with ESMTPS id o20si901014lji.2.2019.05.29.05.43.11 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 May 2019 05:43:11 -0700 (PDT) Received-SPF: pass (google.com: domain of claudius.heine.ext@siemens.com designates 194.138.37.39 as permitted sender) client-ip=194.138.37.39; Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of claudius.heine.ext@siemens.com designates 194.138.37.39 as permitted sender) smtp.mailfrom=claudius.heine.ext@siemens.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=siemens.com Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by lizzard.sbs.de (8.15.2/8.15.2) with ESMTPS id x4TChBB9025254 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 29 May 2019 14:43:11 +0200 Received: from [139.25.69.232] (linux-ses-ext02.ppmd.siemens.net [139.25.69.232]) by mail2.sbs.de (8.15.2/8.15.2) with ESMTP id x4TChAv7006293; Wed, 29 May 2019 14:43:11 +0200 Subject: Re: [PATCH 1/2] meta/classes/image: Introduce sshd host key assertion To: "[ext] Henning Schild" , isar-users@googlegroups.com References: <20190529115257.28898-1-henning.schild@siemens.com> From: Claudius Heine Message-ID: <1436968b-b542-dc76-f971-e8bc9e3a626b@siemens.com> Date: Wed, 29 May 2019 14:43:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <20190529115257.28898-1-henning.schild@siemens.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-TUID: t+hNrG+9MXTy Hi Henning, On 29/05/2019 13.52, [ext] Henning Schild wrote: > From: Henning Schild > > Images containing ssh host keys without some way of dealing with the > fact that those have to be generate at run-time not install-time are > invalid! > > Introduce a check that our own package "sshd-regen-keys" is installed > when such keys are present (when an ssh daemon is installed). > > Suggest to install that package or find some other way of dealing with > the problem. But fail by default, since such an image is most likely > broken. > > Signed-off-by: Henning Schild > --- > meta/classes/image-postproc-extension.bbclass | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/meta/classes/image-postproc-extension.bbclass b/meta/classes/image-postproc-extension.bbclass > index 625ba7d..5467bbc 100644 > --- a/meta/classes/image-postproc-extension.bbclass > +++ b/meta/classes/image-postproc-extension.bbclass > @@ -44,3 +44,17 @@ image_postprocess_mark() { > update_etc_os_release \ > --build-id "${BUILD_ID}" --variant "${DESCRIPTION}" > } > + > +ROOTFS_POSTPROCESS_COMMAND =+ "image_postprocess_sshd_key_regen" > + > +image_postprocess_sshd_key_regen() { > + if ls ${WORKDIR}/rootfs/etc/ssh/ssh_host_*key* > /dev/null; then ${WORKDIR}/rootfs -> ${IMAGE_ROOTFS} If that file is not found, ls will complain on stderr: ls: cannot access '...': No such file or directory so a '2>&1' would be needed. (I would also rather use `stat -t` than ls.) Merging those two ifs into one would also be nice. Otherwise looks good. Claudius > + if [ ! -d ${WORKDIR}/rootfs/usr/share/doc/sshd-regen-keys ]; then > + bbwarn "Looks like you have ssh host keys in the image but did "\ > + "not install \"sshd-regen-keys\". This image should not be "\ > + "deployed more than once." > + bberror "Install the package or forcefully remove this check!" > + exit 1 > + fi > + fi > +} > -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-54 Fax: (+49)-8142-66989-80 Email: ch@denx.de