From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH v2] Core Update 170: Harden mount options of /boot on
 existing installations
Date: Thu, 28 Jul 2022 20:41:39 +0100
Message-ID: <0B63CF4A-DCD3-48CC-B3C3-CC447B090DCA@ipfire.org>
In-Reply-To: <54183fd2-bebd-9098-de78-114afc8198cd@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8992102303538156903=="
List-Id: <development.lists.ipfire.org>

--===============8992102303538156903==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Looks good to me. You can merge it with the next sweep.

-Michael

> On 28 Jul 2022, at 14:29, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wr=
ote:
>=20
> Hello *,
>=20
>> Hello Michael,
>>=20
>>> Hello,
>>>=20
>>> Yes, it isn=E2=80=99t great to edit such files with sed, but there are no=
 other options.
>>>=20
>>> I would however prefer to merge it only together with the changes to the =
installer. Otherwise we are shipping a small change over the course of three =
updates.
>>=20
>> yes, absolutely. I will send in a patch for the installer later today.
>=20
> https://patchwork.ipfire.org/project/ipfire/patch/de573afc-f8ed-1cf8-949d-8=
22b8801953f(a)ipfire.org/
> - here it is, apologies for the tardy response.
>=20
> Thanks, and best regards,
> Peter M=C3=BCller
>=20
>>=20
>> Thanks, and best regards,
>> Peter M=C3=BCller
>>=20
>>>=20
>>> -Michael
>>>=20
>>>> On 14 Jul 2022, at 11:15, Peter M=C3=BCller <peter.mueller(a)ipfire.org>=
 wrote:
>>>>=20
>>>> Hello Michael,
>>>>=20
>>>> gee, thank you. :-)
>>>>=20
>>>> Are you otherwise fine with this patch?
>>>>=20
>>>> Thanks, and best regards,
>>>> Peter M=C3=BCller
>>>>=20
>>>>=20
>>>>> Hello,
>>>>>=20
>>>>> The pointer: https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dblob;f=3Dsr=
c/installer/hw.c;h=3D12f8e793de49b65afb4d271f10d6d7717e8a8145;hb=3DHEAD#l1125
>>>>>=20
>>>>> -Michael
>>>>>=20
>>>>>> On 13 Jul 2022, at 20:48, Peter M=C3=BCller <peter.mueller(a)ipfire.or=
g> wrote:
>>>>>>=20
>>>>>> Hello *,
>>>>>>=20
>>>>>> additionally, we need to ensure /boot mount options are already writte=
n with these flags
>>>>>> into /etc/fstab on new installations. For flash-images, this is alread=
y done in C169, but
>>>>>> I have yet to investigate where to change things for the ISO files.
>>>>>>=20
>>>>>> Any hints would be appreciated. :-)
>>>>>>=20
>>>>>> Thanks, and best regards,
>>>>>> Peter M=C3=BCller
>>>>>>=20
>>>>>>=20
>>>>>>> The second version of this patch uses @ instead of / for sed delimite=
rs,
>>>>>>> which makes the command less hard to read. Since Core Update 170 alre=
ady
>>>>>>> requires a reboot at this point, the respective directive is omitted.
>>>>>>>=20
>>>>>>> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
>>>>>>> ---
>>>>>>> config/rootfiles/core/170/update.sh | 3 +++
>>>>>>> 1 file changed, 3 insertions(+)
>>>>>>>=20
>>>>>>> diff --git a/config/rootfiles/core/170/update.sh b/config/rootfiles/c=
ore/170/update.sh
>>>>>>> index 7dde03060..78a4709bc 100644
>>>>>>> --- a/config/rootfiles/core/170/update.sh
>>>>>>> +++ b/config/rootfiles/core/170/update.sh
>>>>>>> @@ -110,6 +110,9 @@ chown nobody:nobody /var/lib/ipblocklist
>>>>>>> # Start services
>>>>>>> /etc/init.d/rc.d/unbound start
>>>>>>>=20
>>>>>>> +# Harden mount options of /boot
>>>>>>> +sed -e -i "s@[[:space:]]*\/boot[[:space:]]*auto[[:space:]]*defaults[=
[:space:]]*@ \/boot    auto defaults,nodev,noexec,nosuid   @g" /etc/fstab
>>>>>>> +
>>>>>>> # This update needs a reboot...
>>>>>>> touch /var/run/need_reboot
>>>>>>>=20
>>>>>=20
>>>=20


--===============8992102303538156903==--