From: ChenQi <Qi.Chen@windriver.com>
To: "Burton, Ross" <ross.burton@intel.com>
Cc: Zhangle.Yang@windriver.com, openembedded-core@lists.openembedded.org
Subject: Re: [PATCH V2 10/10] openssh: make /etc/ssh directory writable in read-only rootfs
Date: Tue, 30 Jul 2013 13:24:03 +0800 [thread overview]
Message-ID: <51F74DF3.9020602@windriver.com> (raw)
In-Reply-To: <CAJTo0LZNX0DXiZVu6cL+7dEbD77g1c6KPj7XXT59VV6Tm4sX4g@mail.gmail.com>
On 07/29/2013 11:59 PM, Burton, Ross wrote:
> On 29 July 2013 03:33, <Qi.Chen@windriver.com> wrote:
>> From: Chen Qi <Qi.Chen@windriver.com>
>>
>> If the rootfs is read-only and the ssh keys are not available at system
>> start-up, the init script will generate ssh keys into /etc/ssh, thus
>> causing a 'read-only file system' error.
>>
>> Make this directory writable in case of a read-only rootfs.
>> Note that if the ssh keys are pregenerated, they will not be lost,
>> as there's a copying process before bind mounting.
> I'm not very keen on the idea of every oe-core system having a tmpfs
> on /etc/openssh just for read-only-root configurations
I agree, especially when the configuration is not likely to change at
runtime.
> where there
> isn't a pre-generated key.
>
> At least one better option would be to handle the read-only / with no
> pre-generated keys situation in the init script, and write keys to
> /run.
For now, I want to use the following logic.
If the rootfs is not read-only, everything remains the same as before.
If the rootfs is read-only and there are pre-generated keys under
/etc/ssh, we use the pre-generated keys. The pre-generated keys are
mainly for debugging or development purpose.
If the rootfs is read-only and there are no pre-generated keys under
/etc/ssh, we use /var/run/ssh as the location for ssh keys. That is, at
system boot-up, the generated ssh keys will be put into /var/run/ssh.
What do you think about it? If it's OK, I'll send out a V3.
Best Regards,
Chen Qi
prev parent reply other threads:[~2013-07-30 5:23 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-29 2:33 [PATCH V2 00/10] Make read-only rootfs work with live images Qi.Chen
2013-07-29 2:33 ` [PATCH V2 01/10] init-live.sh: make $ROOT_MOUNT/media writable when necessary Qi.Chen
2013-07-29 2:33 ` [PATCH V2 02/10] use a uniform way to determine whether rootfs is read-only Qi.Chen
2013-07-29 2:33 ` [PATCH V2 03/10] udev: remove implicit dependency on initscripts Qi.Chen
2013-07-29 2:33 ` [PATCH V2 04/10] populate-volatile.sh: use $ROOT_DIR/var/volatile/tmp as TMPDIR Qi.Chen
2013-07-29 2:33 ` [PATCH V2 05/10] populate-volatile.sh: don't spawn background process at rootfs time Qi.Chen
2013-07-29 2:33 ` [PATCH V2 06/10] runqemu-internal: fix to start X correctly in live images Qi.Chen
2013-07-29 2:33 ` [PATCH V2 07/10] initscripts: use a uniform way to handle directories in read-only rootfs Qi.Chen
2013-07-29 2:33 ` [PATCH V2 08/10] irda-utils: make /etc/sysconfig writable " Qi.Chen
2013-07-29 15:26 ` Phil Blundell
2013-07-30 5:48 ` ChenQi
2013-07-29 2:33 ` [PATCH V2 09/10] lighttpd: make /www diretory " Qi.Chen
2013-07-29 15:56 ` Burton, Ross
2013-07-30 5:33 ` ChenQi
2013-07-29 2:33 ` [PATCH V2 10/10] openssh: make /etc/ssh directory " Qi.Chen
2013-07-29 15:59 ` Burton, Ross
2013-07-30 5:24 ` ChenQi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51F74DF3.9020602@windriver.com \
--to=qi.chen@windriver.com \
--cc=Zhangle.Yang@windriver.com \
--cc=openembedded-core@lists.openembedded.org \
--cc=ross.burton@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox