15799 2025-03-17 17:39:46 +0000 Add default non-root user (e.g. "admin") 2026-05-28 13:17:57 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 5.3 x86 Multiple NEW Medium+ enhancement 6.1 M2 1 tim.orling unassigned ccasciato meta.mr.watcher meta.watcher randy.macleod ross.burton --- --- Yes (doc changes required) oldest_to_newest 101392 0 5107 tim.orling 2025-03-17 17:39:46 +0000 Created attachment 5107 admin-user_1.0.bb: an example "admin" user with "sudo" privileges For a more secure baseline, we should really not be logging in as root at all. Instead, we should use a non-root user with 'sudo' privileges. I have attached a stripped down version of recipe that I use. 101434 1 randy.macleod 2025-03-20 14:38:04 +0000 Currently tied to systemd and has some other minor issues. We may also want to run the ptest as the admin user so there's more work to do. 101436 2 tim.orling 2025-03-20 14:42:42 +0000 Generally, sudo with no password is also considered a security flaw, so ptest would need to use a default password. The systemd-journal group allows you to see dmesg and journald without using sudo, but needs to be gated on whether 'systemd' is in DISTRO_FEATURES. In practice, we are also using user-staticids, but I am not sure that should be added to a base image (you provide /etc/passwd and /etc/group to ensure all uid and gid are static/known). 101439 3 tim.orling 2025-03-20 14:56:52 +0000 sudo with no password, but limited access to commands could be an option for ptest. We could have a dedicated ptest user. Concept (/etc/sudoers.d/ptest): # Add commands that the 'ptest' user is allowed to run without a sudo password Cmnd_Alias PTEST_CMDS=/some/restricted/command /some/other/resistricted/command %ptest ALL=(ALL:ALL) NOPASSWORD: PTEST_CMDS 101442 4 ross.burton 2025-03-20 15:00:47 +0000 The ptest-runner recipe already has a user for ptests, we "just" need to use it in oeqa. 105633 5 randy.macleod 2026-05-28 13:17:57 +0000 Bulk move of unassigned 6.0-M* bugs to 6.1-M2. 5107 2025-03-17 17:39:46 +0000 2025-03-17 17:39:46 +0000 admin-user_1.0.bb: an example "admin" user with "sudo" privileges admin-user_1.0.bb text/plain 1495 tim.orling U1VNTUFSWSA9ICJBZG1pbmlzdHJhdGl2ZSB1c2VyIgpERVNDUklQVElPTiA9ICJTdGFydCBmcm9t IGEgcG9zaXRpb24gb2YgbGVhc3QgcHJpdmlsZWdlcywgbm8gcm9vdCB1c2VyIFwKYWNjZXNzLiBJ bnN0ZWFkIHVzZSBhZG1pbiB1c2VyIGFuZCBzdWRvLiIKTElDRU5TRSA9ICJNSVQiCkxJQ19GSUxF U19DSEtTVU0gPSAiZmlsZTovLyR7Q09SRUJBU0V9L21ldGEvQ09QWUlORy5NSVQ7bWQ1PTNkYTlj ZmJjYjc4OGM4MGEwMzg0MzYxYjRkZTIwNDIwIgoKCiMgUmVjaXBlcyB0aGF0IGRlZmluZSB0aGUg Z3JvdXAocykgdGhpcyB1c2VyCiMgaXMgbWVtYmVyIG9mIChzdWRvKQpVU0VSQUREX0RFUEVORFMg PSAic3VkbyIKVVNFUkFERF9QQUNLQUdFUyA9ICIke1BOfSIKCmluaGVyaXQgdXNlcmFkZAoKREVQ RU5EUyArPSAib3BlbnNzbC1uYXRpdmUiCgpkb19pbnN0YWxsKCkgewogICAgIyBCZSBjZXJ0YWlu IHRoaXMgbWF0Y2hlcyB3aGF0IHN1ZG8gcmVjaXBlIHNldHMgdG8gYXZvaWQgY29uZmxpY3QKICAg IGluc3RhbGwgLWQgLW0gMDc1MCAke0R9JHtzeXNjb25mZGlyfS9zdWRvZXJzLmQKICAgICMgVGhp cyBpcyBwcm9iYWJseSBlcXVpdmFsZW50IHRvIC1HfC0tZ3JvdXBzIHN1ZG8sIGJ1dCBnaXZlcyB1 cwogICAgIyBhbiBvcHRpb24gdG8gY29uc3RyYWluIHBlcm1pc3Npb25zIGJ5IGNoYW5naW5nIHRo aXMuCiAgICBlY2hvICIlYWRtaW4gQUxMPShBTEw6QUxMKSBBTEwiID4gJHtEfSR7c3lzY29uZmRp cn0vc3Vkb2Vycy5kL2FkbWluCiAgICBjaG1vZCAwNjQ0ICR7RH0ke3N5c2NvbmZkaXJ9L3N1ZG9l cnMuZC9hZG1pbiB8fCB0cnVlCn0KCkdST1VQQUREX1BBUkFNOiR7UE59ID0gIi0tZ2lkIDk5OTkg YWRtaW4gOyIKCiMgVXNlIElNQUdFX0ZFQVRVUkVTIHByb2R1Y3Rpb24gdnMgZGV2ZWxvcG1lbnQg dG8gY2hvb3NlIGJlaGF2aW9yCkFETUlOX1NBTFQgPSAiJHtAYmIudXRpbHMuY29udGFpbnNfYW55 KCdJTUFHRV9GRUFUVVJFUycsICdwcm9kdWN0aW9uIHJlbGVhc2UnLCAnPHJhbmRvbSBzYWx0Pics ICdsaW51eCMxOTkxJywgZCl9IgpBRE1JTl9QQVNTV0QgPSAiJHtAYmIudXRpbHMuY29udGFpbnNf YW55KCdJTUFHRV9GRUFUVVJFUycsICdwcm9kdWN0aW9uIHJlbGVhc2UnLCAnPHJhbmRvbSBwYXNz d29yZD4nLCAnU3VwZXIjU2VjcmV0IzEyMzQnLCBkKX0iCgojIFVzZSAtc2FsdCBmb3IgcmVwcm9k dWNpYmlsaXR5OyBubyBzdXJwcmlzZXMKVVNFUkFERF9QQVJBTToke1BOfSA9ICJcCiAgICAtLXVp ZCA5OTk5IFwKICAgIC0tZ2lkIGFkbWluIFwKICAgIC0tZ3JvdXBzIGFkbSxzdWRvLHN5c3RlbWQt am91cm5hbCx3aGVlbFwKICAgIC0tcGFzc3dvcmQgJyQob3BlbnNzbCBwYXNzd2QgLXNhbHQgJHtA ZC5nZXRWYXIoJ0FETUlOX1NBTFQnKX0gLTYgJHtAZC5nZXRWYXIoJ0FETUlOX1BBU1NXRCcpfSkn IFwKICAgIGFkbWluIDsgXAogICAgIgoKRklMRVM6JHtQTn0gPSAiJHtzeXNjb25mZGlyfS9zdWRv ZXJzLmQvYWRtaW4iCg==