aboutsummaryrefslogtreecommitdiffstats
path: root/package/base-files/Makefile
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "build: separate signing logic"John Crispin2019-10-211-9/+8
| | | | | | | | This reverts commit 4a45e69d190f72ed94878487b271ed7651dd9efa. This broke the buildbots Signed-off-by: John Crispin <john@phrozen.org>
* build: separate signing logicPaul Spooren2019-10-211-8/+9
| | | | | | | | | | | | | | | | This separates the options for signature creation and verification * SIGNED_PACKAGES create Packages.sig * SIGNED_IMAGES add ucert signature to created images * CHECK_SIGNATURE add verification capabilities to images * INSTALL_LOCAL_KEY add local key-build to /etc/opkg/keys Right now the buildbot.git contains some hacks to create images that have signature verification capabilities while not storing private keys on buildbot slaves. This commit allows to disable these steps for the buildbots and only perform signing on the master. Signed-off-by: Paul Spooren <mail@aparcar.org>
* build: add buildinfo files for reproducibilityPaul Spooren2019-08-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | generate feeds.buildinfo and version.buildinfo in build dir after containing the feed revisions (via ./scripts/feeds list -sf) as well as the current revision of buildroot (via ./scripts/getver.sh). With this information it should be possible to reproduce any build, especially the release builds. Usage would be to move feeds.buildinfo to feeds.conf and git checkout the revision hash of version.buildinfo. Content of feeds.buildinfo would look similar to this: src-git routing https://git.openwrt.org/feed/routing.git^bf475d6 src-git telephony https://git.openwrt.org/feed/telephony.git^470eb8e ... Content of version.buildinfo would look similar to this: r10203+1-c12bd3a21b Without the exact feed revision it is not possible to determine installed package versions. Also rename config.seed to config.buildinfo to follow the recommended style of https://reproducible-builds.org/docs/recording/ Signed-off-by: Paul Spooren <mail@aparcar.org>
* base-files: drop support for the platform_nand_pre_upgrade()Rafał Miłecki2019-07-221-1/+1
| | | | | | | No target uses it anymore. All code from that callback was moved into the platform_do_upgrade(). Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* base-files: don't set ARGV and ARGCRafał Miłecki2019-07-171-1/+1
| | | | | | Those are not used by any image check function anymore. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* base-files: drop support for NAND upgrade in platform_pre_upgrade()Rafał Miłecki2019-07-081-1/+1
| | | | | | | With bcm53xx switched to the new procedure there is no more need for keeping that backward compatibility code. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* base-files: drop unused jffs2_copy_config()Rafał Miłecki2019-07-081-1/+1
| | | | | | | | Its last usage was dropped back in 2013 in the commit b95bdc8ab56e ("kernel/base-files: clean up old code related to refreshing mtd partitions, it is no longer used anywhere"). Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* base-files: add network_get_uptime() to /lib/functions/network.shFlorian Eckert2019-06-291-1/+1
| | | | | | Add missing ubus api call for uptime value. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* base-files: change boot & umount STOP indexesJoseph Tingiris2019-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch is in a series to allow additional STOP indexes after umount, so that other block devices may stop cleanly. boot is now STOP=90 umount is now STOP=90 After this patch series, the resulting STOP indexes in the 80s & 90s will be: STOP=85 odhcpd.init STOP=89 conntrackd.init STOP=89 log.init STOP=89 rssileds.init STOP=90 boot STOP=90 kdump.init STOP=90 network STOP=90 sysfixtime STOP=90 umount STOP=98 mdadm.init (note: will be addressed in a separate patch) Signed-off-by: Joseph Tingiris <joseph.tingiris@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [PKG_RELEASE is now 200]
* base-files: apply new sysctl.conf at postinstYousong Zhou2019-06-211-1/+1
| | | | | | | | | | | | | | | | This is mainly for kmod-br-netfilter. To turn off bridge-netfilter-call-xxx immediately after installation While at it - Define filelist="/usr/lib/opkg/info/${pkgname}.list" - Reuse "[ -z "$root" ]" - Grep with "-m1" Fixes FS#2300 Reported-by: Marco Sartorius <tidbits@ormoorgmen.info> Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* base-files: move urandom seed bits into separate packagePetr Štetiar2019-06-111-1/+10
| | | | | | | So it's possible to install or remove it as needed. Tested-by: Lucian Cristian <lucian.cristian@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* base-files: config_get: prevent filename globbingGünther Kelleter2019-01-301-1/+1
| | | | | | | | | When config_get is called as "config_get section option" the option is unexpectedly globbed by the shell which differs from the way options are read to a variable with "config_get variable section option". Add another layer of double quotes to fix it. Signed-off-by: Günther Kelleter <guenther.kelleter@devolo.de>
* build: Optionally provide file checksums in package metadataMichal Hrusecky2019-01-221-0/+2
| | | | | | | This may be useful if you don't entirely trust your flash and want to be able to check for corruptions. Signed-off-by: Michal Hrusecky <Michal@Hrusecky.net>
* base-files: add network_get_metric() to /lib/functions/network.shFlorian Eckert2018-09-251-1/+1
| | | | | Signed-off-by: Florian Eckert <fe@dev.tdt.de> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* base-files: create /etc/ethers by defaultLuiz Angelo Daros de Luca2018-08-211-0/+1
| | | | | | | | | | | /etc/ethers is missing on /rom but always created when dnsmasq runs. It is better to have it in place and avoid an extra change in flash after firstboot. It will generate an extra /etc/ethers-opkg when it has changed. Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* base-files: introduce sysupgrade signature chain verificationDaniel Golle2018-08-081-2/+5
| | | | | | | | | Verify ucert signature chains in sysupgrade images in case ucert is installed and $CHECK_IMAGE_SIGNARURE = 1. Also make sure ucert host binary is present and generate a self-signed ucert in case $TOPDIR/key-build.ucert is missing. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* base-files: sysupgrade: abort if config backup failsAndreas Ziegler2018-08-061-1/+1
| | | | | | | Sysupgrade shouldn't proceed, if the backup of the configuration fails because tar (or gzip) exit with a non-zero code. Signed-off-by: Andreas Ziegler <dev@andreas-ziegler.de>
* base-files: fix wrong sysctl parameter orderLuiz Angelo Daros de Luca2018-07-181-1/+1
| | | | | | | | | | | Restarting service sysctl echos multiple errors like: sysctl: -e: No such file or directory After the first filename, all remaining arguments are treated as files. Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
* base-files: network.sh: gracefully handle missing network.interface ubus nsJo-Philipp Wich2018-07-171-1/+1
| | | | | | | | | | | | | | | | | | | | | When attempting to use any of the functions in network.sh while netifd is not started yet, the ubus interface dump query will fail with "Not found", yielding an empty response. Subsequently, jsonfilter is invoked with an empty string instead of a valid JSON document, causing it to emit a second "unexpected end of data" error. This caused the dnsmasq init script to log the following errors during early boot on some systems: procd: /etc/rc.d/S19dnsmasq: Command failed: Not found. procd: /etc/rc.d/S19dnsmasq: Failed to parse json data: unexpected end of data. Fix the issue by allowing the ubus query to fail with "Not found" but still logging other failures, and by passing an empty JSON object to jsonfilter if the interface status cache is empty. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* include/feeds.mk: rework generation of opkg distfeeds.confMatthias Schiffer2018-07-121-2/+0
| | | | | | | Allow enabling/commenting/disabling each feed individually by using a tristate config symbol. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: fix feed list in PKG_CONFIG_DEPENDSMatthias Schiffer2018-07-121-1/+1
| | | | | | | FEEDS_ENABLED and FEEDS_DISABLED are derived from FEEDS_AVAILABLE, not FEEDS_INSTALLED. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: fix UCI config parsing and callback handlingTony Ambardar2018-06-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are several long-standing issues present in the UCI shell API as documented in https://wiki.openwrt.org/doc/devel/config-scripting. They relate both to high-level, user-defined callback functions used to process UCI config files, and also to low-level functions used within scripts generally. The related problems have been encountered now and in the past, e.g. https://forum.openwrt.org/viewtopic.php?id=54295, and include: a) UCI parsing option() function and user-defined option_cb() callbacks being erroneously called during processing of "list" config file entries; b) normal usage of the low-level config_set() unexpectedy calling any defined option_cb() if present; and c) handling of the list_cb() not respecting the NO_CALLBACK variable. Root causes include a function stack "inversion", where the low-level config_set() function incorrectly calls the high-level option() function, intended only for processing the "option" keyword of UCI config files. This change addresses the inversion and other issues, making the option handling code more consistent and smaller, and simplifying developers' usage of UCI callbacks. Signed-off-by: Tony Ambardar <itugrok@yahoo.com> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* base-files: depend on openwrt-keyringJo-Philipp Wich2018-05-201-1/+1
| | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* kernel: disable accept_ra by defaultMatthias Schiffer2018-04-171-1/+1
| | | | | | | | | | | Our commands setting accept_ra to 0 on all interfaces got lost in the transition to procd. This remained unnoticed for a long time, as we also enable forwarding on all interfaces, which prevents RA handling by default. Restore the commands, while also fixing a possible race condition in the old version. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: /lib/functions.sh: remove unused insert_modulesMatthias Schiffer2018-04-171-1/+1
| | | | | | insert_modules has been unused since r5279. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: remove /etc/sysctl.d/ from conffilesMatthias Schiffer2018-04-131-3/+1
| | | | | | | | Let's use /etc/sysctl.d for package-provided snippets and leave /etc/sysctl.conf to the admin. Don't backup /etc/sysctl.d on upgrades, so old defaults get replaced properly. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: move netfilter sysctl defaults to specific kmod packagesMatthias Schiffer2018-04-131-1/+1
| | | | | | | Avoid warnings when applying settings for uninstalled kmods. See also FS#1073. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: change /var link from /tmp to tmpAlexander Couzens2018-04-051-1/+1
| | | | | | | | Some packages are already using $(1)/var on package install. On multiuser systems this breaks the build when multiple users build OpenWrt. Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
* base-files: tune fragment queue thresholds for available system memoryMatthias Schiffer2018-03-071-1/+1
| | | | | | | | | The default fragment low/high thresholds are 3 and 4 MB. On devices with only 32MB RAM, these settings may lead to OOM when many fragments that cannot be reassembled are received. Decrease fragment low/high thresholds to 384 and 512 kB on devices with less than 64 MB RAM. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: sysupgrade: do not rely on opkg to list changed conffilesMatthias Schiffer2018-03-071-1/+1
| | | | | | | Many packages use the opkg conffiles field to list configuration files that are to be retained on upgrades. Make this work on systems without opkg. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* treewide: combine VERSION_SED and VERSION_SED_SCRIPTPhilip Prindeville2018-02-021-2/+2
| | | | | | | | | We don't need two versions of this. The escaping quotes is so that the sed commands aren't misinterpreted by shell; it has nothing to do with the contents of the file, thus one version is adequate. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* base-files: gpio switch: check if direction can be setMathias Kresin2018-01-181-1/+1
| | | | | | | | | | | | Obviously not all GPIO controller allow to change the direction. The issue is around since the beginning of the script but only due to the recent changes error messages are more visible. Add a check if a change of the direction is supported by the GPIO controller and fallback to setting only the value if not. Fixes: FS#1271 Signed-off-by: Mathias Kresin <dev@kresin.me>
* base-files: sysupgrade: correct command help textKevin Darbyshire-Bryant2018-01-121-1/+1
| | | | | | | | | | Commit 30f61a34b4cfd2c676fea4a919e089d6a77254e9 claimed to drop -d & -p options. In reality only -d was dropped. Update command help text to reflect that -d is no longer a supported option. Fixes FS#1187 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
* base-files: gpio switch: set output value with directionMathias Kresin2018-01-091-1/+1
| | | | | | | | | | | | Use the "low" and "high" values to configure the GPIO as an output with that initial value. It ensures that the gpio doesn't have a unwanted value during the time the direction is set to ouput and the actual value is applied. We don't need to take care of the GPIO polarity for now, since our exported GPIOs are always active low. Signed-off-by: Mathias Kresin <dev@kresin.me>
* base-files: fix logic when to show failsafe bannerMatthias Schiffer2017-12-291-1/+1
| | | | | | Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> Fixes: 8170f280c4 ("base-files: set FAILSAFE in /etc/profile when /tmp/.failsafe exists")
* base-files: set FAILSAFE in /etc/profile when /tmp/.failsafe existsMatthias Schiffer2017-12-291-1/+1
| | | | | | | Since dropbear clears the environment, FAILSAFE was not set as intended in failsafe mode. This also broke sysupgrade from failsafe mode over SSH. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* base-files: make including distfeeds.conf optionalJonas Gorski2017-12-131-3/+5
| | | | | | | | | | | To not clutter the system when building an opkg free image, generate the distfeeds.conf only if CLEAN_IPKG is unset. Since opkg is now a shared package, we can't rely on PACKAGE_opkg, but since opkg is not reasonably usable without the status information, we can tie the distfeeds.conf to it. Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
* base-files: create /etc/opkg before generating distfeeds.confJonas Gorski2017-12-131-0/+1
| | | | | | | | Ensure /etc/opkg exists before trying to write there. This fixes a build failure if SIGNED_PACKAGES is disabled. Reported-by: Matthias Schiffer <mschiffer@universe-factory.net> Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
* package: move distfeeds.conf from opkg to base-filesJonas Gorski2017-12-131-2/+10
| | | | | | | | | | | All the relevant options used for distfeeds.conf are part of base-files, so it makes more sense to move the file there as well. This has the added benefit that the we can share the opkg package again, reducing the amount of target specific packages. Acked-by: Jo-Philipp Wich <jo@mein.io> Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
* merge: base: update base-files and basic configZoltan HERPAI2017-12-081-1/+1
| | | | Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
* base-files: fix getting gid from group_add_nextYousong Zhou2017-11-091-1/+1
| | | | | | | | | | | | Shell function return code only has range [0, 255]. Other values will be truncated, e.g. return 65536 will have the same effect as return 0 While at it, drop other "return $rc" where rc will almost always take value 0 and whose value current callers actually do not check Fixes FS#988 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* base-files: add interval option to netdev LED trigger configurationEdmunt Pienkowsky2017-11-031-1/+1
| | | | | | Add an uci option to set the interval parameter of the netdev trigger. Signed-off-by: Edmunt Pienkowsky <roed@onet.eu>
* base-files: create /etc/config/ directoryHauke Mehrtens2017-09-301-0/+1
| | | | | | | | | | | | | | | The /bin/config_generate script and some other scripts are assuming the /etc/config directory exists in the image. This is true in case for example the package firewall, dropbear or dnsmasq are included, which are adding the files under /etc/config/. Without any of these package the system will not boot up fully because the /etc/config/ directory is missing and some init scripts just fail. Make sure all images with the base-files contain a /etc/config/ directory. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Acked-by: John Crispin <john@phrozen.org>
* base-files: fix wan6 interface config generation for pppoeHans Dedecker2017-09-181-1/+1
| | | | | | | | | | | | | | | | Setting ipv6 to auto in case of a pppoe interface will trigger the creation of a dynamic wan_6 interface meaning two IPv6 interfaces (wan6 and wan_6) will be active on top of the pppoe interface. This leads to unpredictable behavior in the network; therefore set ipv6 to 1 which will prevent the dynamic creation of the wan_6 interface. Further alias the wan6 interface on top of the wan interface for pppoe as the wan6 interface can only be started when the link local address is ready. In case of pppoe the link local address is negotiated during the Internet Protocol Control Protocol when the PPP link is setup meaning all the IP address info is only available when the wan interface is up. Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
* basefiles: allow suid coredumpsKevin Darbyshire-Bryant2017-09-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set sysctl fs.suid_dumpable = 2 This allows suid processes to dump core according to kernel.core_pattern setting. LEDE typically uses suid to drop root priviledge rather than gain it but without this setting any suid process would be unable to produce coredumps (e.g. dnsmasq) Processes still need to set a non zero core file process limit ('ulimit -c unlimited' or if procd used 'procd_set_param limits core="unlimited"') in order to produce a core. This setting removes an obscure stumbling block along the way. >From https://www.kernel.org/doc/Documentation/sysctl/fs.txt suid_dumpable: This value can be used to query and set the core dump mode for setuid or otherwise protected/tainted binaries. The modes are 0 - (default) - traditional behaviour. Any process which has changed privilege levels or is execute only will not be dumped. 1 - (debug) - all processes dump core when possible. The core dump is owned by the current user and no security is applied. This is intended for system debugging situations only. Ptrace is unchecked. This is insecure as it allows regular users to examine the memory contents of privileged processes. 2 - (suidsafe) - any binary which normally would not be dumped is dumped anyway, but only if the "core_pattern" kernel sysctl is set to either a pipe handler or a fully qualified path. (For more details on this limitation, see CVE-2006-2451.) This mode is appropriate when administrators are attempting to debug problems in a normal environment, and either have a core dump pipe handler that knows to treat privileged core dumps with care, or specific directory defined for catching core dumps. If a core dump happens without a pipe handler or fully qualifid path, a message will be emitted to syslog warning about the lack of a correct setting. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk> Signed-off-by: Hans Dedecker <dedeckeh@gmail.com> [PKG_RELEASE increase]
* base-files: add /etc/profile.d to conffilesStijn Tintel2017-09-031-0/+1
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* base-files: order conffiles alphabeticallyStijn Tintel2017-09-031-10/+10
| | | | Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* base-files: fix PKG_CONFIG_DEPENDS to include version.mk entriesRafał Miłecki2017-06-221-1/+2
| | | | | | | | Including version.mk sets PKG_CONFIG_DEPENDS to config entries used for VERSION_SED command. We should keep these configs to make sure package gets refreshed when needed. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* base-files: allocate uid/gid starting from 65536Yousong Zhou2017-06-181-1/+1
| | | | | | | | | | | There already exist static assignment of uid/gid 65533 in packages feed and we have nobody/nogroup taking 65534 as their ids. Let's change the pid of dynamic assignment to start from 65536 so that the two assignment scheme will not collide with each other While at it, fix the scan command checking existence of uid/gid Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* base-files: network.sh: properly report local IPv6 addressesJo-Philipp Wich2017-06-081-1/+1
| | | | | | | | | | Rework the network_get_ipaddr6() and network_get_ipaddrs6() functions to fetch the effective local IPv6 address of delegated prefix from the "local-address" field instead of naively hardcoding ":1" as static suffix. Fixes FS#829. Signed-off-by: Jo-Philipp Wich <jo@mein.io>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 22:56:22 +0000