[PATCH v2] sshd-regen-keys: Fix sshd deadlock on boot

[Harald Seiler <hws@denx.de>]

Currently, when sshd-regen-keys runs dpkg-reconfigure, this
will lead to a call to `systemctl restart ssh`.  This call blocks
forever because of course the sshd-regen-keys unit, which is a
dependency of sshd, hasn't finished at this point and can't do so
because it is waiting as well.

To circumvent this deadlock, this commit changes sshd-regen-keys'
behavior so sshd is first disabled and only reenabled after the
job is done.

Signed-off-by: Harald Seiler <hws@denx.de>
---
> That is what i guessed. But can we not drop that? The unit has to
> finish before sshd anyways, so there will be a "start sshd" somewhere
> after that point.

I am not certain, however I tested it and it looks like you are right.

Changes for v2:
  - Remove `systemctl start --no-block ssh` call as it looks like
    this is not needed.

 .../sshd-regen-keys/files/sshd-regen-keys.service      |  2 +-
 .../sshd-regen-keys/files/sshd-regen-keys.sh           | 18 ++++++++++++++++++
 .../sshd-regen-keys/sshd-regen-keys_0.1.bb             |  7 +++++--
 3 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh

diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
index 3b8231f..a05e1a9 100644
--- a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.service
@@ -10,7 +10,7 @@ ConditionPathIsReadWrite=/etc
 Type=oneshot
 RemainAfterExit=yes
 Environment=DEBIAN_FRONTEND=noninteractive
-ExecStart=/bin/sh -c "rm -v /etc/ssh/ssh_host_*_key*; dpkg-reconfigure openssh-server"
+ExecStart=/usr/sbin/sshd-regen-keys.sh
 ExecStartPost=-/bin/systemctl disable sshd-regen-keys.service
 StandardOutput=syslog
 StandardError=syslog
diff --git a/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
new file mode 100644
index 0000000..11fca3b
--- /dev/null
+++ b/meta/recipes-support/sshd-regen-keys/files/sshd-regen-keys.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env sh
+
+echo -n "SSH server is "
+if systemctl is-enabled ssh; then
+    SSHD_ENABLED="true"
+    systemctl disable --no-reload ssh
+fi
+
+echo "Removing keys ..."
+rm -v /etc/ssh/ssh_host_*_key*
+
+echo "Regenerating keys ..."
+dpkg-reconfigure openssh-server
+
+if test -n $SSHD_ENABLED; then
+    echo "Reenabling ssh server ..."
+    systemctl enable --no-reload ssh
+fi
diff --git a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
index 02e9e25..6f12414 100644
--- a/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
+++ b/meta/recipes-support/sshd-regen-keys/sshd-regen-keys_0.1.bb
@@ -6,9 +6,12 @@ MAINTAINER = "isar-users <isar-users@googlegroups.com>"
 DEBIAN_DEPENDS = "openssh-server, systemd"
 
 SRC_URI = "file://postinst \
-           file://sshd-regen-keys.service"
+           file://sshd-regen-keys.service \
+           file://sshd-regen-keys.sh"
 
+do_install[cleandirs] = "${D}/lib/systemd/system \
+                         ${D}/usr/sbin"
 do_install() {
-    install -v -d -m 755 "${D}/lib/systemd/system"
     install -v -m 644 "${WORKDIR}/sshd-regen-keys.service" "${D}/lib/systemd/system/sshd-regen-keys.service"
+    install -v -m 755 "${WORKDIR}/sshd-regen-keys.sh" "${D}/usr/sbin/sshd-regen-keys.sh"
 }

-- 
Harald

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-62  Fax: +49-8142-66989-80   Email: hws@denx.de