From patchwork Thu Aug 18 09:46:14 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Timothy Pearson X-Patchwork-Id: 660381 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3sFLp46SfYz9sxN for ; Thu, 18 Aug 2016 19:46:20 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=raptorengineering.com header.i=@raptorengineering.com header.b=utCq9TL/; dkim-atps=neutral Received: from ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 3sFLp45cprzDr5j for ; Thu, 18 Aug 2016 19:46:20 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=raptorengineering.com header.i=@raptorengineering.com header.b=utCq9TL/; dkim-atps=neutral X-Original-To: petitboot@lists.ozlabs.org Delivered-To: petitboot@lists.ozlabs.org Received: from mail.rptsys.com (mail.rptsys.com [192.119.205.245]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3sFLp11HZ1zDr5M for ; Thu, 18 Aug 2016 19:46:17 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=raptorengineering.com header.i=@raptorengineering.com header.b=utCq9TL/; dkim-atps=neutral Received: from localhost (localhost [127.0.0.1]) by mail.rptsys.com (Postfix) with ESMTP id E3FA4640BC6 for ; Thu, 18 Aug 2016 04:46:14 -0500 (CDT) Received: from mail.rptsys.com ([127.0.0.1]) by localhost (vali.starlink.edu [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id 5RrIaO3xnQxh for ; Thu, 18 Aug 2016 04:46:14 -0500 (CDT) Received: from localhost (localhost [127.0.0.1]) by mail.rptsys.com (Postfix) with ESMTP id 655CA640FE2 for ; Thu, 18 Aug 2016 04:46:14 -0500 (CDT) DKIM-Filter: OpenDKIM Filter v2.9.2 mail.rptsys.com 655CA640FE2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raptorengineering.com; s=B8E824E6-0BE2-11E6-931D-288C65937AAD; t=1471513574; bh=eRKmyEXHEs34uAjNkCprgSO33cLWrYC3cXtZ0vxGBCU=; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding; b=utCq9TL/WrixNgZMDgcmBBER4VZpdZX79xlawYVILmFtsKkjm5l9Tgght4wdToVyr O9epjfqlC75olBaerZC+5aLEv0h/hU0vofdOaCZ2/rHz6k06KrD0gHKpX07XWCAq7v oj80ojaO+cF76DLWKs3e6CveiLgsRTy8PAfwSbDk= X-Virus-Scanned: amavisd-new at rptsys.com Received: from mail.rptsys.com ([127.0.0.1]) by localhost (vali.starlink.edu [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id NG8y5kMMQYK0 for ; Thu, 18 Aug 2016 04:46:14 -0500 (CDT) Received: from vali.starlink.edu (vali.starlink.edu [192.168.3.21]) by mail.rptsys.com (Postfix) with ESMTP id 3BF40640BC6 for ; Thu, 18 Aug 2016 04:46:14 -0500 (CDT) Date: Thu, 18 Aug 2016 04:46:14 -0500 (CDT) From: Timothy Pearson To: petitboot Message-ID: <1156959418.80728.1471513574151.JavaMail.zimbra@raptorengineeringinc.com> Subject: [PATCH 2/3] [V7] Disable shell access when lockdown is active MIME-Version: 1.0 X-Mailer: Zimbra 8.5.0_GA_3042 (ZimbraWebClient - FF3.6 (Linux)/8.5.0_GA_3042) Thread-Topic: Disable shell access when lockdown is active Thread-Index: 1Gf1j2+srY8tfrU6K91WyAg5DgmG0w== X-BeenThere: petitboot@lists.ozlabs.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Petitboot bootloader development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: petitboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Petitboot" This patch disables direct command line access when the /etc/pb-lockdown file is present. Signed-off-by: Timothy Pearson --- ui/ncurses/nc-cui.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/ui/ncurses/nc-cui.c b/ui/ncurses/nc-cui.c index 09b63b0..c2f1c83 100644 --- a/ui/ncurses/nc-cui.c +++ b/ui/ncurses/nc-cui.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "log/log.h" #include "pb-protocol/pb-protocol.h" @@ -47,6 +48,14 @@ extern const struct help_text main_menu_help_text; static struct pmenu *main_menu_init(struct cui *cui); +static bool lockdown_active(void) +{ + bool lockdown = false; + if (access(LOCKDOWN_FILE, F_OK) != -1) + lockdown = true; + return lockdown; +} + static void cui_start(void) { initscr(); /* Initialize ncurses. */ @@ -94,6 +103,13 @@ static void cui_atexit(void) clear(); refresh(); endwin(); + + bool lockdown = lockdown_active(); + + while (lockdown) { + sync(); + reboot(RB_AUTOBOOT); + } } /** @@ -826,6 +842,7 @@ static struct pmenu *main_menu_init(struct cui *cui) struct pmenu_item *i; struct pmenu *m; int result; + bool lockdown = lockdown_active(); m = pmenu_init(cui, 7, cui_on_exit); if (!m) { @@ -869,7 +886,10 @@ static struct pmenu *main_menu_init(struct cui *cui) i->on_execute = menu_add_url_execute; pmenu_item_insert(m, i, 5); - i = pmenu_item_create(m, _("Exit to shell")); + if (lockdown) + i = pmenu_item_create(m, _("Reboot")); + else + i = pmenu_item_create(m, _("Exit to shell")); i->on_execute = pmenu_exit_cb; pmenu_item_insert(m, i, 6);