| Summary: | Add default non-root user (e.g. "admin") | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Tim Orling <tim.orling> | ||||
| Component: | core | Assignee: | Unassigned <unassigned> | ||||
| Status: | NEW --- | QA Contact: | |||||
| Severity: | enhancement | ||||||
| Priority: | Medium+ | CC: | ccasciato, meta.mr.watcher, meta.watcher, randy.macleod, ross.burton | ||||
| Version: | 5.3 | ||||||
| Target Milestone: | 6.1 M2 | ||||||
| Hardware: | x86 | ||||||
| OS: | Multiple | ||||||
| Whiteboard: | |||||||
| OS type for building Yocto: | --- | Type of Regression: | --- | ||||
| Verified: | Documentation change: | Yes (doc changes required) | |||||
| Attachments: |
|
||||||
Currently tied to systemd and has some other minor issues. We may also want to run the ptest as the admin user so there's more work to do. Generally, sudo with no password is also considered a security flaw, so ptest would need to use a default password. The systemd-journal group allows you to see dmesg and journald without using sudo, but needs to be gated on whether 'systemd' is in DISTRO_FEATURES. In practice, we are also using user-staticids, but I am not sure that should be added to a base image (you provide /etc/passwd and /etc/group to ensure all uid and gid are static/known). sudo with no password, but limited access to commands could be an option for ptest. We could have a dedicated ptest user. Concept (/etc/sudoers.d/ptest): # Add commands that the 'ptest' user is allowed to run without a sudo password Cmnd_Alias PTEST_CMDS=/some/restricted/command /some/other/resistricted/command %ptest ALL=(ALL:ALL) NOPASSWORD: PTEST_CMDS The ptest-runner recipe already has a user for ptests, we "just" need to use it in oeqa. Bulk move of unassigned 6.0-M* bugs to 6.1-M2. |
Created attachment 5107 [details] admin-user_1.0.bb: an example "admin" user with "sudo" privileges For a more secure baseline, we should really not be logging in as root at all. Instead, we should use a non-root user with 'sudo' privileges. I have attached a stripped down version of recipe that I use.