[RFC PATCH 1/2] meta: add isar-cfg-rootpw recipe for setting root password

[claudius.heine.ext@siemens.com]

From: Claudius Heine <ch@denx.de>

The isar-cfg-rootpw recipe is a central point to set the root password
for images. It provides the `CFG_ROOT_LOCKED` and `CFG_ROOT_PW` variables,
that can be set from any `.conf` file or via `isar-cfg-rootpw.bbappend`.

The `CFG_ROOT_LOCKED` variable that can be set to "1" in order to lock
the root account, other values leave the account unlocked.

The `CFG_ROOT_RW` variable contains either a root password, or is empty,
in which case login without password is possible.

Signed-off-by: Claudius Heine <ch@denx.de>
---
 meta-isar/conf/local.conf.sample              |  3 ++-
 .../recipes-app/example-raw/files/postinst    |  4 ----
 .../isar-cfg-rootpw/files/postinst.tmpl       | 11 +++++++++++
 .../isar-cfg-rootpw/isar-cfg-rootpw.bb        | 19 +++++++++++++++++++
 4 files changed, 32 insertions(+), 5 deletions(-)
 create mode 100644 meta/recipes-support/isar-cfg-rootpw/files/postinst.tmpl
 create mode 100644 meta/recipes-support/isar-cfg-rootpw/isar-cfg-rootpw.bb

diff --git a/meta-isar/conf/local.conf.sample b/meta-isar/conf/local.conf.sample
index a671b20..a2bdd7e 100644
--- a/meta-isar/conf/local.conf.sample
+++ b/meta-isar/conf/local.conf.sample
@@ -161,7 +161,8 @@ CONF_VERSION = "1"
 
 #
 # The default list of extra packages to be installed.
-IMAGE_INSTALL = "hello-isar example-raw example-module-${KERNEL_NAME} enable-fsck"
+IMAGE_INSTALL = "hello-isar example-raw example-module-${KERNEL_NAME} enable-fsck \
+                 isar-cfg-rootpw"
 
 #
 # Enable cross-compilation support
diff --git a/meta-isar/recipes-app/example-raw/files/postinst b/meta-isar/recipes-app/example-raw/files/postinst
index f60be8c..f48d993 100644
--- a/meta-isar/recipes-app/example-raw/files/postinst
+++ b/meta-isar/recipes-app/example-raw/files/postinst
@@ -15,8 +15,4 @@ fi
 
 chown -R isar:isar /var/lib/isar
 
-# this wins over meta-isar/recipes-core/images/files/*configscript.sh
-# but we take the same password for this example
-echo "root:root" | chpasswd
-
 echo "isar" > /etc/hostname
diff --git a/meta/recipes-support/isar-cfg-rootpw/files/postinst.tmpl b/meta/recipes-support/isar-cfg-rootpw/files/postinst.tmpl
new file mode 100644
index 0000000..51e901e
--- /dev/null
+++ b/meta/recipes-support/isar-cfg-rootpw/files/postinst.tmpl
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+if [ "${CFG_ROOT_LOCKED}" == "1" ]; then
+    passwd -l root
+else
+    if [ -n "${CFG_ROOT_PW}" ]; then
+        echo "root:${CFG_ROOT_PW}" | chpasswd
+    else
+        passwd -d root
+    fi
+fi
diff --git a/meta/recipes-support/isar-cfg-rootpw/isar-cfg-rootpw.bb b/meta/recipes-support/isar-cfg-rootpw/isar-cfg-rootpw.bb
new file mode 100644
index 0000000..adee3b5
--- /dev/null
+++ b/meta/recipes-support/isar-cfg-rootpw/isar-cfg-rootpw.bb
@@ -0,0 +1,19 @@
+# This software is a part of ISAR.
+
+DESCRIPTION = "Isar configuration package for root password"
+MAINTAINER = "isar-users <isar-users@googlegroups.com>"
+DEBIAN_DEPENDS = "passwd"
+
+SRC_URI = "file://postinst.tmpl"
+
+TEMPLATE_FILES = "postinst.tmpl"
+TEMPLATE_VARS = "CFG_ROOT_PW CFG_ROOT_LOCKED"
+
+CFG_ROOT_PW ??= ""
+CFG_ROOT_LOCKED ??= "0"
+
+inherit dpkg-raw
+
+do_install() {
+    echo "intentionally left blank"
+}
-- 
2.20.1