Skip to content

Commit 0214816

Browse files
author
Abhishek Mishra
committed
sched: Remove hard-coded default password and add build-time generation
Fixes #16822
1 parent 3722664 commit 0214816

12 files changed

Lines changed: 323 additions & 39 deletions

File tree

‎Documentation/platforms/renesas/rx65n/boards/rx65n-grrose/index.rst‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -491,21 +491,22 @@ mounted at /etc and will look like this at run-time:
491491
nsh>
492492
493493
``/etc/init.d/rc.sysinit`` is system init script; ``/etc/init.d/rcS`` is the
494-
start-up script; ``/etc/passwd`` is a the password file. It supports a single
495-
user:
494+
start-up script; ``/etc/passwd`` is the password file.
496495

497-
.. code:: text
496+
The ``/etc/passwd`` file is auto-generated at build time when
497+
``CONFIG_ETC_ROMFS_GENPASSWD`` is enabled. To configure the admin user and
498+
password, run ``make menuconfig`` and set:
498499

499-
USERNAME: admin
500-
PASSWORD: Administrator
500+
* ``CONFIG_ETC_ROMFS_GENPASSWD=y``
501+
* ``CONFIG_ETC_ROMFS_PASSWD_USER`` (default: ``admin``)
502+
* ``CONFIG_ETC_ROMFS_PASSWD_PASSWORD`` (required, build fails if empty)
501503

502-
nsh> cat /etc/passwd
503-
admin:8Tv+Hbmr3pLVb5HHZgd26D:0:0:/
504+
The password is hashed with TEA at build time using
505+
``tools/mkpasswd.py``; the plaintext is **not** stored in the firmware.
504506

505-
The encrypted passwords in the provided passwd file are only valid if the TEA
506-
key is set to: 012345678 9abcdef0 012345678 9abcdef0. Changes to either the key
507-
or the password word will require regeneration of the ``nsh_romfimg.h`` header
508-
file.
507+
The encrypted passwords are only valid if the TEA key matches the one
508+
configured in ``CONFIG_FSUTILS_PASSWD_KEY1..4`` (default:
509+
``012345678 9abcdef0 012345678 9abcdef0``).
509510

510511
The format of the password file is:
511512

‎Documentation/platforms/risc-v/esp32c3-legacy/boards/esp32c3-legacy-devkit/ROMFS.txt‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,22 @@ README
2323
nsh>
2424

2525
/etc/init.d/rc.sysinit is system init script; /etc/init.d/rcS is the start-up
26-
script; /etc/passwd is a the password file. It supports a single user:
26+
script; /etc/passwd is the password file.
2727

28-
USERNAME: admin
29-
PASSWORD: Administrator
28+
The /etc/passwd file is auto-generated at build time when
29+
CONFIG_ETC_ROMFS_GENPASSWD is enabled. To configure the admin user and
30+
password, run 'make menuconfig' and set:
3031

31-
nsh> cat /etc/passwd
32-
admin:8Tv+Hbmr3pLVb5HHZgd26D:0:0:/
32+
CONFIG_ETC_ROMFS_GENPASSWD=y
33+
CONFIG_ETC_ROMFS_PASSWD_USER (default: admin)
34+
CONFIG_ETC_ROMFS_PASSWD_PASSWORD (required, build fails if empty)
3335

34-
The encrypted passwords in the provided passwd file are only valid if the
35-
TEA key is set to: 012345678 9abcdef0 012345678 9abcdef0. Changes to either
36-
the key or the password word will require regeneration of the nsh_romfimg.h
37-
header file.
36+
The password is hashed with TEA at build time using tools/mkpasswd.py;
37+
the plaintext is NOT stored in the firmware image.
38+
39+
The encrypted passwords are only valid if the TEA key matches the one
40+
configured in CONFIG_FSUTILS_PASSWD_KEY1..4 (default:
41+
012345678 9abcdef0 012345678 9abcdef0).
3842

3943
The format of the password file is:
4044

‎Documentation/platforms/sim/sim/boards/sim/index.rst‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2008,24 +2008,22 @@ mounted at ``/etc`` and will look like this at run-time:
20082008
nsh>
20092009
20102010
``/etc/init.d/rc.sysinit`` is system init script; ``/etc/init.d/rcS`` is the
2011-
start-up script; ``/etc/passwd`` is a the password file. It supports a single
2012-
user:
2011+
start-up script; ``/etc/passwd`` is the password file.
20132012

2014-
.. code:: text
2015-
2016-
USERNAME: admin
2017-
PASSWORD: Administrator
2018-
2019-
.. code:: console
2013+
The ``/etc/passwd`` file is auto-generated at build time when
2014+
``CONFIG_ETC_ROMFS_GENPASSWD`` is enabled. To configure the admin user and
2015+
password, run ``make menuconfig`` and set:
20202016

2021-
nsh> cat /etc/passwd
2022-
admin:8Tv+Hbmr3pLVb5HHZgd26D:0:0:/
2017+
* ``CONFIG_ETC_ROMFS_GENPASSWD=y``
2018+
* ``CONFIG_ETC_ROMFS_PASSWD_USER`` (default: ``admin``)
2019+
* ``CONFIG_ETC_ROMFS_PASSWD_PASSWORD`` (required, build fails if empty)
20232020

2024-
The encrypted passwords in the provided passwd file are only valid if the
2025-
TEA key is set to: 012345678 9abcdef0 012345678 9abcdef0.
2021+
The password is hashed with TEA at build time using
2022+
``tools/mkpasswd.py``; the plaintext is **not** stored in the firmware.
20262023

2027-
Changes to either the key or the password word will require regeneration of the
2028-
``nsh_romfimg.h`` header file.
2024+
The encrypted passwords are only valid if the TEA key matches the one
2025+
configured in ``CONFIG_FSUTILS_PASSWD_KEY1..4`` (default:
2026+
``012345678 9abcdef0 012345678 9abcdef0``).
20292027

20302028
The format of the password file is:
20312029

‎boards/Board.mk‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,19 @@ $(ETCSRC): $(foreach raw,$(RCRAWS), $(if $(wildcard $(BOARD_DIR)$(DELIM)src$(DEL
3535
$(shell rm -rf $(ETCDIR)$(DELIM)$(raw)) \
3636
$(shell mkdir -p $(dir $(ETCDIR)$(DELIM)$(raw))) \
3737
$(shell cp -rfp $(if $(wildcard $(BOARD_DIR)$(DELIM)src$(DELIM)$(raw)), $(BOARD_DIR)$(DELIM)src$(DELIM)$(raw), $(if $(wildcard $(BOARD_COMMON_DIR)$(DELIM)$(raw)), $(BOARD_COMMON_DIR)$(DELIM)$(raw), $(BOARD_DIR)$(DELIM)src$(DELIM)$(raw))) $(ETCDIR)$(DELIM)$(raw)))
38+
ifeq ($(CONFIG_ETC_ROMFS_GENPASSWD),y)
39+
ifeq ($(CONFIG_ETC_ROMFS_PASSWD_PASSWORD),)
40+
$(error CONFIG_ETC_ROMFS_PASSWD_PASSWORD must be set when ETC_ROMFS_GENPASSWD is enabled. Run 'make menuconfig' to set a password.)
41+
endif
42+
$(Q) mkdir -p $(ETCDIR)$(DELIM)$(CONFIG_ETC_ROMFSMOUNTPT)
43+
$(Q) python3 $(TOPDIR)$(DELIM)tools$(DELIM)mkpasswd.py \
44+
--user $(CONFIG_ETC_ROMFS_PASSWD_USER) \
45+
--password $(CONFIG_ETC_ROMFS_PASSWD_PASSWORD) \
46+
--uid $(CONFIG_ETC_ROMFS_PASSWD_UID) \
47+
--gid $(CONFIG_ETC_ROMFS_PASSWD_GID) \
48+
--home $(CONFIG_ETC_ROMFS_PASSWD_HOME) \
49+
-o $(ETCDIR)$(DELIM)$(CONFIG_ETC_ROMFSMOUNTPT)$(DELIM)passwd
50+
endif
3851
$(Q) genromfs -f romfs.img -d $(ETCDIR)$(DELIM)$(CONFIG_ETC_ROMFSMOUNTPT) -V "NSHInitVol"
3952
$(Q) echo "#include <nuttx/compiler.h>" > $@
4053
$(Q) xxd -i romfs.img | sed -e "s/^unsigned char/const unsigned char aligned_data(4)/g" >> $@

‎boards/risc-v/esp32c3-legacy/esp32c3-legacy-devkit/src/Make.defs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ endif
4646

4747
ifeq ($(CONFIG_ETC_ROMFS),y)
4848
RCSRCS = etc/init.d/rc.sysinit etc/init.d/rcS
49-
RCRAWS = etc/group etc/passwd
49+
RCRAWS = etc/group
5050
endif
5151

5252
DEPPATH += --dep-path board

‎boards/risc-v/esp32c3-legacy/esp32c3-legacy-devkit/src/etc/passwd‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎boards/sim/sim/sim/src/CMakeLists.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@ if(CONFIG_ETC_ROMFS)
7777
etc/init.d/rc.sysinit
7878
RCRAWS
7979
etc/group
80-
etc/passwd
8180
PATH
8281
${CMAKE_CURRENT_BINARY_DIR}/etc)
8382

‎boards/sim/sim/sim/src/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ endif
5656

5757
ifeq ($(CONFIG_ETC_ROMFS),y)
5858
RCSRCS = etc/init.d/rc.sysinit etc/init.d/rcS
59-
RCRAWS = etc/group etc/passwd
59+
RCRAWS = etc/group
6060
endif
6161

6262
ifeq ($(CONFIG_ARCH_BUTTONS),y)

‎boards/sim/sim/sim/src/etc/passwd‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎cmake/nuttx_add_romfs.cmake‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,33 @@ function(process_all_directory_romfs)
282282
list(PREPEND RCSRCS ${board_rcsrcs} ${dyn_rcsrcs})
283283
list(PREPEND RCRAWS ${board_rcraws} ${dyn_rcraws})
284284
285+
# Auto-generate /etc/passwd at build time if configured
286+
if(CONFIG_ETC_ROMFS_GENPASSWD)
287+
if("${CONFIG_ETC_ROMFS_PASSWD_PASSWORD}" STREQUAL "")
288+
message(
289+
FATAL_ERROR
290+
"CONFIG_ETC_ROMFS_PASSWD_PASSWORD must be set when"
291+
" ETC_ROMFS_GENPASSWD is enabled."
292+
" Run 'make menuconfig' to set a password.")
293+
endif()
294+
295+
set(GENPASSWD_OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/etc/passwd)
296+
add_custom_command(
297+
OUTPUT ${GENPASSWD_OUTPUT}
298+
COMMAND
299+
${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/etc
300+
COMMAND
301+
${Python3_EXECUTABLE} ${NUTTX_DIR}/tools/mkpasswd.py --user
302+
"${CONFIG_ETC_ROMFS_PASSWD_USER}" --password
303+
"${CONFIG_ETC_ROMFS_PASSWD_PASSWORD}" --uid
304+
${CONFIG_ETC_ROMFS_PASSWD_UID} --gid ${CONFIG_ETC_ROMFS_PASSWD_GID}
305+
--home "${CONFIG_ETC_ROMFS_PASSWD_HOME}" -o ${GENPASSWD_OUTPUT}
306+
COMMENT "Generating /etc/passwd from Kconfig values")
307+
add_custom_target(generate_passwd DEPENDS ${GENPASSWD_OUTPUT})
308+
list(APPEND RCRAWS ${GENPASSWD_OUTPUT})
309+
list(APPEND dyn_deps generate_passwd)
310+
endif()
311+
285312
# init dynamic dependencies
286313
287314
get_property(

0 commit comments

Comments
 (0)