mirror of
https://github.com/apache/nuttx.git
synced 2026-08-01 20:28:58 +00:00
boards: add CI ROMFS passwd credentials and refresh docs
Support NUTTX_ROMFS_PASSWD_PASSWORD via update_romfs_password.sh for configs that enable ROMFS passwd without a defconfig password (sim/login CI). Enable RANDOMIZE_KEYS in sim/login defconfig. Update mkpasswd.c header, platform docs, and the mkpasswd_autogen guide. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
This commit is contained in:
Abhishek Mishra
Xiang Xiao
parent
ffa6ba222f
commit
e9c9cba51d
12 changed files with 307 additions and 119 deletions
|
|
@ -356,6 +356,9 @@ echo "CONFIG_BASE_DEFCONFIG=\"$posboardconfig\"" >> "${dest_config}"
|
|||
|
||||
${TOPDIR}/tools/sethost.sh $host $*
|
||||
|
||||
# Supply ROMFS admin password from NUTTX_ROMFS_PASSWD_PASSWORD when absent
|
||||
"${TOPDIR}/tools/update_romfs_password.sh" "${dest_config}"
|
||||
|
||||
# Save the original configuration file without CONFIG_BASE_DEFCONFIG
|
||||
# for later comparison
|
||||
|
||||
|
|
|
|||
|
|
@ -85,5 +85,8 @@ else
|
|||
}
|
||||
fi
|
||||
|
||||
printf 'TEA keys generated and written to %s.\nSearch %s for CONFIG_FSUTILS_PASSWD_KEY to view if needed.\n' \
|
||||
"${CONFIG}" "${CONFIG}"
|
||||
# User-visible notice (stderr): key values are never printed.
|
||||
printf 'WARNING: [passwd] TEA keys auto-generated in %s\n' "${CONFIG}" >&2
|
||||
printf 'WARNING: [passwd] View: search .config for CONFIG_FSUTILS_PASSWD_KEY\n' >&2
|
||||
printf 'WARNING: [passwd] Change: make menuconfig -> Application Configuration\n' >&2
|
||||
printf 'WARNING: [passwd] -> File System Utilities -> Password file support\n' >&2
|
||||
|
|
|
|||
|
|
@ -22,31 +22,45 @@
|
|||
|
||||
/****************************************************************************
|
||||
* Description:
|
||||
* Host build tool that generates a NuttX /etc/passwd entry with a
|
||||
* TEA-encrypted password hash. This is a pure C replacement for the
|
||||
* former tools/mkpasswd.py, removing the Python dependency from the build.
|
||||
* Host tool that writes one NuttX /etc/passwd line with a TEA-encrypted
|
||||
* password hash. The plaintext password is never stored in the output.
|
||||
*
|
||||
* The encryption algorithm and base64 encoding are identical to those
|
||||
* used at runtime by:
|
||||
* libs/libc/misc/lib_tea_encrypt.c
|
||||
* apps/fsutils/passwd/passwd_encrypt.c
|
||||
* Build integration:
|
||||
* When ``CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y``, ``boards/Board.mk``
|
||||
* invokes this program during the ROMFS etc/ image build. The password
|
||||
* and TEA keys are taken from ``.config`` (see ``tools/passwd_keys.mk``,
|
||||
* ``tools/update_romfs_password.sh``, and
|
||||
* Documentation/components/tools/index.rst).
|
||||
*
|
||||
* Usage:
|
||||
* mkpasswd --user <name> --password <pass> [options] [-o <output>]
|
||||
* Runtime compatibility:
|
||||
* The encryption algorithm and base64 encoding match:
|
||||
* libs/libc/misc/lib_tea_encrypt.c
|
||||
* apps/fsutils/passwd/passwd_encrypt.c
|
||||
*
|
||||
* Security (enforced before writing output):
|
||||
* - Password must be non-empty and at least 8 characters.
|
||||
* - Password ``Administrator`` is rejected (legacy insecure default).
|
||||
* - The published default TEA key set (0x12345678 / 0x9abcdef0)
|
||||
* is rejected. Use Kconfig keys or explicit --key options.
|
||||
*
|
||||
* Standalone usage (advanced / debugging only):
|
||||
* mkpasswd --user <name> --password <pass> \\
|
||||
* --key1 <hex> --key2 <hex> --key3 <hex> --key4 <hex> \\
|
||||
* [-o <output>]
|
||||
*
|
||||
* Options:
|
||||
* --user <str> Username (required)
|
||||
* --password <str> Plaintext password (required, not stored in output)
|
||||
* --password <str> Plaintext password (required, min 8 characters)
|
||||
* --uid <int> User ID (default: 0)
|
||||
* --gid <int> Group ID (default: 0)
|
||||
* --home <str> Home directory (default: /)
|
||||
* --key1 <hex> TEA key word 1 (default: 0x12345678)
|
||||
* --key2 <hex> TEA key word 2 (default: 0x9abcdef0)
|
||||
* --key3 <hex> TEA key word 3 (default: 0x12345678)
|
||||
* --key4 <hex> TEA key word 4 (default: 0x9abcdef0)
|
||||
* --key1 <hex> TEA key word 1 (required for standalone use)
|
||||
* --key2 <hex> TEA key word 2 (required for standalone use)
|
||||
* --key3 <hex> TEA key word 3 (required for standalone use)
|
||||
* --key4 <hex> TEA key word 4 (required for standalone use)
|
||||
* -o <path> Output file (default: stdout)
|
||||
*
|
||||
* Output format (matches NuttX passwd file format):
|
||||
* Output format:
|
||||
* username:encrypted_hash:uid:gid:home
|
||||
*
|
||||
****************************************************************************/
|
||||
|
|
@ -89,9 +103,9 @@
|
|||
#define MAX_PASSWORD (3 * MAX_ENCRYPTED / 4) /* Max plaintext length */
|
||||
#define MIN_PASSWORD 8 /* Minimum plaintext length for security */
|
||||
|
||||
/* Default TEA key values - must match CONFIG_FSUTILS_PASSWD_KEY1-4 defaults
|
||||
* in apps/fsutils/passwd/Kconfig so that the generated hash verifies
|
||||
* correctly at runtime when the user has not changed the key config.
|
||||
/* Known-insecure TEA key values from legacy NuttX releases. Used only to
|
||||
* detect and reject the published default set in main(); normal builds pass
|
||||
* keys from CONFIG_FSUTILS_PASSWD_KEY1..4 via boards/Board.mk.
|
||||
*/
|
||||
|
||||
#define DEFAULT_KEY1 0x12345678u
|
||||
|
|
@ -391,23 +405,28 @@ static int mkdir_p(const char *path)
|
|||
static void show_usage(const char *progname)
|
||||
{
|
||||
fprintf(stderr,
|
||||
"Usage: %s --user <name> --password <pass> [options] [-o <file>]\n"
|
||||
"Usage: %s --user <name> --password <pass>\n"
|
||||
" --key1 <hex> --key2 <hex> --key3 <hex> --key4 <hex>\n"
|
||||
" [options] [-o <file>]\n"
|
||||
"\n"
|
||||
"Options:\n"
|
||||
" --user <str> Username (required)\n"
|
||||
" --password <str> Plaintext password (required)\n"
|
||||
" --password <str> Plaintext password (required, min %d chars)\n"
|
||||
" --uid <int> User ID (default: 0)\n"
|
||||
" --gid <int> Group ID (default: 0)\n"
|
||||
" --home <str> Home directory (default: /)\n"
|
||||
" --key1 <hex> TEA key word 1 (default: 0x%08x)\n"
|
||||
" --key2 <hex> TEA key word 2 (default: 0x%08x)\n"
|
||||
" --key3 <hex> TEA key word 3 (default: 0x%08x)\n"
|
||||
" --key4 <hex> TEA key word 4 (default: 0x%08x)\n"
|
||||
" --key1 <hex> TEA key word 1\n"
|
||||
" --key2 <hex> TEA key word 2 (all four required;\n"
|
||||
" --key3 <hex> TEA key word 3 legacy defaults rejected)\n"
|
||||
" --key4 <hex> TEA key word 4\n"
|
||||
" -o <path> Output file (default: stdout)\n"
|
||||
"\n"
|
||||
"Rejected: empty password, \"Administrator\", default TEA keys.\n"
|
||||
"See Documentation/components/tools/index.rst for normal builds.\n"
|
||||
"\n"
|
||||
"Output format: username:encrypted_hash:uid:gid:home\n",
|
||||
progname,
|
||||
DEFAULT_KEY1, DEFAULT_KEY2, DEFAULT_KEY3, DEFAULT_KEY4);
|
||||
MIN_PASSWORD);
|
||||
}
|
||||
|
||||
/****************************************************************************
|
||||
|
|
|
|||
|
|
@ -31,6 +31,10 @@ endif
|
|||
ifeq ($(CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE),y)
|
||||
ifeq ($(_PASSWD_ENFORCE),y)
|
||||
|
||||
# Apply NUTTX_ROMFS_PASSWD_PASSWORD when defconfig omitted the secret.
|
||||
$(shell $(TOPDIR)/tools/update_romfs_password.sh $(TOPDIR)/.config >/dev/null 2>&1)
|
||||
include $(TOPDIR)/.config
|
||||
|
||||
# --- password check ---
|
||||
ifeq ($(strip $(patsubst "%",%,$(CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD))),)
|
||||
$(info )
|
||||
|
|
@ -55,7 +59,6 @@ _PASSWD_KEYS_NEED_SETUP := $(shell \
|
|||
ifneq ($(_PASSWD_KEYS_NEED_SETUP),no)
|
||||
ifeq ($(CONFIG_BOARD_ETC_ROMFS_PASSWD_RANDOMIZE_KEYS),y)
|
||||
$(shell $(TOPDIR)/tools/gen_passwd_keys.sh $(TOPDIR)/.config >/dev/null)
|
||||
$(info [passwd] TEA keys written to .config (search for CONFIG_FSUTILS_PASSWD_KEY to view))
|
||||
include $(TOPDIR)/.config
|
||||
else
|
||||
$(info )
|
||||
|
|
|
|||
75
tools/update_romfs_password.sh
Executable file
75
tools/update_romfs_password.sh
Executable file
|
|
@ -0,0 +1,75 @@
|
|||
#!/usr/bin/env sh
|
||||
# tools/update_romfs_password.sh
|
||||
#
|
||||
# Licensed to the Apache Software Foundation (ASF) under one or more
|
||||
# contributor license agreements. See the NOTICE file distributed with
|
||||
# this work for additional information regarding copyright ownership. The
|
||||
# ASF licenses this file to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance with the
|
||||
# License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
# Usage:
|
||||
# update_romfs_password.sh <path-to-.config>
|
||||
#
|
||||
# When CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y and the admin password is not
|
||||
# set in .config, copy NUTTX_ROMFS_PASSWD_PASSWORD into .config. This is the
|
||||
# supported way to supply build-time credentials that must not live in defconfig
|
||||
# (CI, automation, local scripts). No-op when the password is already set or
|
||||
# ROMFS passwd generation is disabled.
|
||||
|
||||
set -e
|
||||
|
||||
CONFIG="${1}"
|
||||
PASSWD_ENV="${NUTTX_ROMFS_PASSWD_PASSWORD:-}"
|
||||
|
||||
if [ -z "${CONFIG}" ]; then
|
||||
printf 'Usage: update_romfs_password.sh <path-to-.config>\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "${CONFIG}" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if ! grep -q '^CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y' "${CONFIG}"; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# True when CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD is unset or empty in .config
|
||||
get_password() {
|
||||
grep -E '^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=' "${CONFIG}" 2>/dev/null \
|
||||
| tail -n 1 \
|
||||
| sed 's/^[^=]*=//' \
|
||||
| tr -d '"'
|
||||
}
|
||||
|
||||
cur=$(get_password)
|
||||
if [ -n "${cur}" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -z "${PASSWD_ENV}" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ "${#PASSWD_ENV}" -lt 8 ]; then
|
||||
printf 'update_romfs_password: NUTTX_ROMFS_PASSWD_PASSWORD must be at least 8 characters\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if command -v kconfig-tweak >/dev/null 2>&1; then
|
||||
kconfig-tweak --file "${CONFIG}" \
|
||||
--set-str CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD "${PASSWD_ENV}"
|
||||
else
|
||||
sed -i.bak -e '/^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=/d' "${CONFIG}"
|
||||
rm -f "${CONFIG}.bak"
|
||||
printf 'CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD="%s"\n' "${PASSWD_ENV}" >> "${CONFIG}"
|
||||
fi
|
||||
Loading…
Add table
Add a link
Reference in a new issue