mirror of
https://github.com/apache/nuttx.git
synced 2026-08-31 14:13:04 +00:00
ab6b1fd6f9
Introduce mkpasswd, a pure-C host tool for generating encrypted password
files at build time using TEA encryption. This enables secure,
credential-free firmware images while allowing build-time password
configuration.
Changes:
* Add mkpasswd.c host tool for TEA-based password hashing and encryption
* Integrate mkpasswd into Make build system (tools/Makefile.host)
* Add CMake support for mkpasswd compilation and ROMFS passwd generation
* Add CONFIG_BOARD_ETC_ROMFS_PASSWD_* configuration options to Kconfig
* Implement credential exclusion from defconfig to prevent password leaking
* Update savedefconfig.cmake to strip sensitive credentials
* Fix mkdir() portability for Windows Native builds (CONFIG_WINDOWS_NATIVE)
* Change default username from "admin" to "root" (POSIX convention)
* Improve build-failure error message with full menuconfig navigation path
BREAKING CHANGE: Boards enabling CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE
must set CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD to a non-empty string
of at least 8 characters. The build now fails with an explicit error if
this config is left empty. To fix: run 'make menuconfig' and navigate to:
Board Selection --->
Auto-generate /etc/passwd at build time --->
Admin password
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
96 lines
3.5 KiB
CMake
96 lines
3.5 KiB
CMake
# ##############################################################################
|
|
# cmake/savedefconfig.cmake
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Licensed to the Apache Software Foundation (ASF) under one or more contributor
|
|
# license agreements. See the NOTICE file distributed with this work for
|
|
# additional information regarding copyright ownership. The ASF licenses this
|
|
# file to you under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy of
|
|
# the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations under
|
|
# the License.
|
|
#
|
|
# ##############################################################################
|
|
|
|
include(cmake/nuttx_kconfig.cmake)
|
|
|
|
set(SOURCE_FILE ${CMAKE_ARGV3})
|
|
set(TARGET_FILE ${CMAKE_ARGV4})
|
|
|
|
file(STRINGS ${SOURCE_FILE} ConfigContents)
|
|
encode_brackets(ConfigContents)
|
|
set(PASSWD_AUTOGEN_ENABLED FALSE)
|
|
|
|
foreach(NameAndValue ${ConfigContents})
|
|
decode_brackets(NameAndValue)
|
|
encode_semicolon(NameAndValue)
|
|
if("${NameAndValue}" MATCHES "^CONFIG_BOARD_ETC_ROMFS_PASSWD_ENABLE=y$")
|
|
set(PASSWD_AUTOGEN_ENABLED TRUE)
|
|
endif()
|
|
if("${NameAndValue}" MATCHES "CONFIG_ARCH="
|
|
OR "${NameAndValue}" MATCHES "^CONFIG_ARCH_CHIP_"
|
|
OR "${NameAndValue}" MATCHES "CONFIG_ARCH_CHIP="
|
|
OR "${NameAndValue}" MATCHES "CONFIG_ARCH_BOARD="
|
|
OR "${NameAndValue}" MATCHES "CONFIG_ARCH_BOARD_COMMON="
|
|
OR "${NameAndValue}" MATCHES "^CONFIG_ARCH_CUSTOM"
|
|
OR "${NameAndValue}" MATCHES "^CONFIG_ARCH_BOARD_CUSTOM")
|
|
decode_semicolon(Value)
|
|
file(APPEND ${TARGET_FILE} "${NameAndValue}\n")
|
|
endif()
|
|
endforeach()
|
|
|
|
get_filename_component(BINARY_DIR "${TARGET_FILE}" DIRECTORY)
|
|
|
|
if(CMAKE_ARGV5)
|
|
set(OUTPUT_FILE ${CMAKE_ARGV5})
|
|
else()
|
|
set(OUTPUT_FILE ${BINARY_DIR}/defconfig)
|
|
endif()
|
|
# cmake-format: off
|
|
file(WRITE ${OUTPUT_FILE} "")
|
|
file(APPEND ${OUTPUT_FILE} "\#\n")
|
|
file(APPEND ${OUTPUT_FILE} "\# This file is autogenerated: PLEASE DO NOT EDIT IT.\n")
|
|
file(APPEND ${OUTPUT_FILE} "\#\n")
|
|
file(APPEND ${OUTPUT_FILE} "\# You can use \"make menuconfig\" to make any modifications to the installed .config file.\n")
|
|
file(APPEND ${OUTPUT_FILE} "\# You can then do \"make savedefconfig\" to generate a new defconfig file that includes your\n")
|
|
file(APPEND ${OUTPUT_FILE} "\# modifications.\n")
|
|
file(APPEND ${OUTPUT_FILE} "\#\n")
|
|
file(READ ${TARGET_FILE} CONTENTS)
|
|
# cmake-format: on
|
|
encode_brackets(CONTENTS)
|
|
encode_semicolon(CONTENTS)
|
|
|
|
string(REGEX MATCHALL "[^\n]+" LINES ${CONTENTS})
|
|
|
|
list(REMOVE_DUPLICATES LINES)
|
|
list(SORT LINES)
|
|
|
|
foreach(LINE IN LISTS LINES)
|
|
decode_brackets(LINE)
|
|
decode_semicolon(LINE)
|
|
if(NOT "${LINE}" MATCHES "^CONFIG_FSUTILS_PASSWD_KEY[0-9]"
|
|
AND NOT "${LINE}" MATCHES "^CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD=")
|
|
file(APPEND ${OUTPUT_FILE} "${LINE}\n")
|
|
endif()
|
|
endforeach()
|
|
|
|
if(PASSWD_AUTOGEN_ENABLED)
|
|
message(
|
|
WARNING
|
|
"CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD and CONFIG_FSUTILS_PASSWD_KEY1-4 "
|
|
"were intentionally excluded from defconfig by savedefconfig. Add them "
|
|
"manually in local defconfig if needed.")
|
|
endif()
|
|
|
|
# Converts the newline style for the output file.
|
|
configure_file(${OUTPUT_FILE} ${OUTPUT_FILE} @ONLY NEWLINE_STYLE LF)
|
|
|
|
execute_process(COMMAND ${CMAKE_COMMAND} -E remove ${TARGET_FILE})
|