From patchwork Tue Aug 16 22:39:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Timothy Pearson X-Patchwork-Id: 659855 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [103.22.144.68]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3sDS3Z6bwBz9sdg for ; Wed, 17 Aug 2016 08:39:54 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=raptorengineering.com header.i=@raptorengineering.com header.b=SDRuUHZ4; dkim-atps=neutral Received: from ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 3sDS3Z55pvzDr4l for ; Wed, 17 Aug 2016 08:39:54 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=raptorengineering.com header.i=@raptorengineering.com header.b=SDRuUHZ4; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Received: from mail.rptsys.com (mail.rptsys.com [192.119.205.245]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3sDS3X28pdzDr4c for ; Wed, 17 Aug 2016 08:39:52 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=raptorengineering.com header.i=@raptorengineering.com header.b=SDRuUHZ4; dkim-atps=neutral Received: from localhost (localhost [127.0.0.1]) by mail.rptsys.com (Postfix) with ESMTP id F0215640FB0 for ; Tue, 16 Aug 2016 17:39:49 -0500 (CDT) Received: from mail.rptsys.com ([127.0.0.1]) by localhost (vali.starlink.edu [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id uHkePi6Ttq_G for ; Tue, 16 Aug 2016 17:39:49 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by mail.rptsys.com (Postfix) with ESMTP id 609686410B6 for ; Tue, 16 Aug 2016 17:39:49 -0500 (CDT) DKIM-Filter: OpenDKIM Filter v2.9.2 mail.rptsys.com 609686410B6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raptorengineering.com; s=B8E824E6-0BE2-11E6-931D-288C65937AAD; t=1471387189; bh=eRKmyEXHEs34uAjNkCprgSO33cLWrYC3cXtZ0vxGBCU=; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding; b=SDRuUHZ4qQwy/5G55GbbbarVoO11FO0mK62aDNfuPQFbd9pIPqmtGiCmo+4aEnDrI m2iDKXiZkaYN9VMwk4ssh2kFlnb/NixiVpkP1PS8aQUEgQtR0oYjBpAa8R6TN3OAZh 8PnDRfa/au1zpDmNG6MgmsUGR1epJ18jjbed71vM= X-Virus-Scanned: amavisd-new at rptsys.com Received: from mail.rptsys.com ([127.0.0.1]) by localhost (vali.starlink.edu [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id q0kVKP6xcX8p for ; Tue, 16 Aug 2016 17:39:49 -0500 (CDT) Received: from vali.starlink.edu (localhost [127.0.0.1]) by mail.rptsys.com (Postfix) with ESMTP id 0068E640FB0 for ; Tue, 16 Aug 2016 17:39:48 -0500 (CDT) Date: Tue, 16 Aug 2016 17:39:48 -0500 (CDT) From: Timothy Pearson To: petitboot Message-ID: <1429662311.78270.1471387188671.JavaMail.zimbra@raptorengineeringinc.com> Subject: [PATCH 2/3] [V6 revision 2] Disable shell access when lockdown is active MIME-Version: 1.0 X-Mailer: Zimbra 8.5.0_GA_3042 (ZimbraWebClient - FF3.6 (Linux)/8.5.0_GA_3042) Thread-Topic: Disable shell access when lockdown is active Thread-Index: 11nVjhoLwynD326BGd41nH+qpRfYCQ== X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" This patch disables direct command line access when the /etc/pb-lockdown file is present. Signed-off-by: Timothy Pearson --- ui/ncurses/nc-cui.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/ui/ncurses/nc-cui.c b/ui/ncurses/nc-cui.c index 09b63b0..c2f1c83 100644 --- a/ui/ncurses/nc-cui.c +++ b/ui/ncurses/nc-cui.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "log/log.h" #include "pb-protocol/pb-protocol.h" @@ -47,6 +48,14 @@ extern const struct help_text main_menu_help_text; static struct pmenu *main_menu_init(struct cui *cui); +static bool lockdown_active(void) +{ + bool lockdown = false; + if (access(LOCKDOWN_FILE, F_OK) != -1) + lockdown = true; + return lockdown; +} + static void cui_start(void) { initscr(); /* Initialize ncurses. */ @@ -94,6 +103,13 @@ static void cui_atexit(void) clear(); refresh(); endwin(); + + bool lockdown = lockdown_active(); + + while (lockdown) { + sync(); + reboot(RB_AUTOBOOT); + } } /** @@ -826,6 +842,7 @@ static struct pmenu *main_menu_init(struct cui *cui) struct pmenu_item *i; struct pmenu *m; int result; + bool lockdown = lockdown_active(); m = pmenu_init(cui, 7, cui_on_exit); if (!m) { @@ -869,7 +886,10 @@ static struct pmenu *main_menu_init(struct cui *cui) i->on_execute = menu_add_url_execute; pmenu_item_insert(m, i, 5); - i = pmenu_item_create(m, _("Exit to shell")); + if (lockdown) + i = pmenu_item_create(m, _("Reboot")); + else + i = pmenu_item_create(m, _("Exit to shell")); i->on_execute = pmenu_exit_cb; pmenu_item_insert(m, i, 6);