Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

petitboot: openpower rules for usb devices #2790

Closed
wants to merge 1 commit into from
Closed

petitboot: openpower rules for usb devices #2790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions openpower/package/petitboot/Config.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,3 +32,11 @@ config BR2_PACKAGE_PETITBOOT_MTD
Adds Petitboot support for MTD devices

comment "Add support for accessing MTD devices"

config BR2_PACKAGE_PETITBOOT_RESTRICT_USB
bool "petitboot-restrict-usb"
depends on BR2_PACKAGE_PETITBOOT
help
Adds Petitboot UDEV rule disabling USB devices

comment "Disables Petitboot USB devices"
6 changes: 6 additions & 0 deletions openpower/package/petitboot/openpower.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Rule to disable USB devices from being authorized
# we want to leverage ancestry so use ATTRS first
# query to see if the petitboot,usb-override=1 exists (grep -c == 1)
# RESULT holds the shell command output, not the shell exit code
ACTION=="add", SUBSYSTEM=="usb", ATTRS{authorized_default}=="*", PROGRAM="/bin/sh -c '/usr/sbin/nvram --print-config | /bin/grep -c petitboot,usb-override=1 || true'", RESULT=="0", ATTR{authorized_default}="0"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer a script in the filesystem that is called by the udev rule, instead of implementing it inline.

/usr/sbin/usb-authorisation

#!/bin/sh

VALUE=$(/usr/sbin/nvram --print-config=petitboot,usb-override)

if [ "$VALUE" = 1 ]; then
   exit 1
fi

exit 0

Copy link
Author

@debmc debmc May 6, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

prefer

If I understand the limitations correctly, I'm not sure that udev rules allow the suggestion you make, my understanding is that the exit code from the script/program executed from the udev rule must run to success (exit code=0). The script/program can do any short running procedures and set output on standard out, but that is the extent. Let me know if you have a different understanding or how-to (and how to get the exit code returned via udev interface).

Just a sample to show what I think udev would allow, but I don't think this buys anything useful in functionality.


VALUE=$(/usr/sbin/nvram --print-config=petitboot,usb-override)

# udev rule openpower    
if [ "$VALUE" = 1 ]; then
   echo "1"
else          
   echo "0"
fi
                                                                   
# exit code must be zero for udev handling to account as successful
exit 0

~
3 changes: 3 additions & 0 deletions openpower/package/petitboot/petitboot.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,9 @@ define PETITBOOT_POST_INSTALL
$(TARGET_DIR)/usr/sbin/
$(INSTALL) -D -m 0755 $(BR2_EXTERNAL_OP_BUILD_PATH)/package/petitboot/petitboot-console-ui.rules \
$(TARGET_DIR)/etc/udev/rules.d/
$(if $(BR2_PACKAGE_PETITBOOT_RESTRICT_USB), \
$(INSTALL) -D -m 0755 $(BR2_EXTERNAL_OP_BUILD_PATH)/package/petitboot/openpower.rules \
$(TARGET_DIR)/etc/udev/rules.d/)
$(INSTALL) -D -m 0755 $(BR2_EXTERNAL_OP_BUILD_PATH)/package/petitboot/removable-event-poll.rules \
$(TARGET_DIR)/etc/udev/rules.d/
$(INSTALL) -D -m 0755 $(BR2_EXTERNAL_OP_BUILD_PATH)/package/petitboot/63-md-raid-arrays.rules \
Expand Down