From c63283367ae12a15112dcffb5539fb100d63c9b7 Mon Sep 17 00:00:00 2001 From: zhuyan Date: Sat, 18 Sep 2021 20:42:25 +0800 Subject: [PATCH 1/3] add init scripts to image Signed-off-by: zhuyan --- meta-openeuler/recipes-core/os-base/os-base_1.0.bb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/meta-openeuler/recipes-core/os-base/os-base_1.0.bb b/meta-openeuler/recipes-core/os-base/os-base_1.0.bb index fc2ecd64b1e..942954a8f15 100644 --- a/meta-openeuler/recipes-core/os-base/os-base_1.0.bb +++ b/meta-openeuler/recipes-core/os-base/os-base_1.0.bb @@ -21,7 +21,9 @@ SRC_URI = "file://bashrc \ file://profile \ file://securetty \ file://shadow \ - file://sysctl.conf" + file://sysctl.conf \ + file://rc.functions \ + file://rc.sysinit" do_install() { install -d ${D}/etc @@ -38,6 +40,9 @@ do_install() { cp ${WORKDIR}/securetty ${D}/etc/ cp ${WORKDIR}/shadow ${D}/etc/ cp ${WORKDIR}/sysctl.conf ${D}/etc/ + install -d ${D}/etc/rc.d + cp ${WORKDIR}/rc.functions ${D}/etc/rc.d + cp ${WORKDIR}/rc.sysinit ${D}/etc/rc.d } -- Gitee From 2de316ffd4ef62f5ddd99b67d76d7f4d96cf578b Mon Sep 17 00:00:00 2001 From: zhuyan Date: Sat, 18 Sep 2021 20:42:59 +0800 Subject: [PATCH 2/3] fix fstab errors Signed-off-by: zhuyan --- meta-openeuler/recipes-core/os-base/os-base/fstab | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/meta-openeuler/recipes-core/os-base/os-base/fstab b/meta-openeuler/recipes-core/os-base/os-base/fstab index 26247ff28ea..a1ddb366b70 100644 --- a/meta-openeuler/recipes-core/os-base/os-base/fstab +++ b/meta-openeuler/recipes-core/os-base/os-base/fstab @@ -1,9 +1,9 @@ -proc /proc proc defaults,nofail 0 0 -sysfs /sys sysfs defaults,nofail 0 0 +proc /proc proc defaults 0 0 +sysfs /sys sysfs defaults 0 0 none /var tmpfs nodev,nosuid,mode=755,noexec 0 0 -none /var/log/audit tmpfs nodev,nosuid,mode=755,nofail 0 0 -devtmpfs /dev devtmpfs defaults,nofail 0 0 +none /var/log/audit tmpfs nodev,nosuid,mode=755 0 0 +devtmpfs /dev devtmpfs defaults 0 0 tmpfs /dev/shm tmpfs nodev,nosuid,mode=1777,noexec 0 0 -devpts /dev/pts devpts mode=620,nofail 0 0 +devpts /dev/pts devpts mode=620 0 0 tmpfs /tmp tmpfs nodev,nosuid,noexec 0 0 -tmpfs /opt tmpfs defaults,mode=0750,nofail 0 0 +tmpfs /opt tmpfs defaults,mode=0750 0 0 -- Gitee From 7013905cb798e7fc84a7e0a847aab1b1bbab68b0 Mon Sep 17 00:00:00 2001 From: zhuyan Date: Sat, 18 Sep 2021 20:48:16 +0800 Subject: [PATCH 3/3] fix file format error Signed-off-by: zhuyan --- .../pam/libpam/pam.d/common-account | 8 ++-- .../recipes-core/pam/libpam/pam.d/common-auth | 14 +++--- .../pam/libpam/pam.d/common-password | 10 ++-- .../pam/libpam/pam.d/common-session | 38 +++++++-------- .../pam.d/common-session-noninteractive | 38 +++++++-------- .../recipes-core/pam/libpam/pam.d/other | 48 +++++++++---------- 6 files changed, 78 insertions(+), 78 deletions(-) diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account index d00fde09120..0a9d30a5d31 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account @@ -1,4 +1,4 @@ -account required pam_faillock.so -account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so -account requisite pam_deny.so -account required pam_permit.so +account required pam_faillock.so +account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so +account requisite pam_deny.so +account required pam_permit.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth index 4306fd74a71..d77adbe5af2 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth @@ -1,7 +1,7 @@ -auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=300 -auth sufficient pam_unix.so nullok try_first_pass -auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=300 -auth requisite pam_listfile.so item=user onerr=succeed sense=deny file=/etc/login.user.deny -auth [success=1 default=ignore] pam_unix.so -auth required pam_deny.so -auth required pam_permit.so +auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=300 +auth sufficient pam_unix.so nullok try_first_pass +auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=300 +auth requisite pam_listfile.so item=user onerr=succeed sense=deny file=/etc/login.user.deny +auth [success=1 default=ignore] pam_unix.so +auth required pam_deny.so +auth required pam_permit.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password index 155775e57e7..06335bf722e 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password @@ -1,5 +1,5 @@ -password requisite pam_pwquality.so try_first_pass minclass=3 minlen=8 lcredit=0 ucredit=0 dcredit=0 ocredit=0 reject_username gecoscheck retry=3 enforce_for_root -password required pam_pwhistory.so remember=5 use_authtok enforce_for_root -password [success=1 default=ignore] pam_unix.so use_authtok nullok sha512 -password requisite pam_deny.so -password required pam_permit.so +password requisite pam_pwquality.so try_first_pass minclass=3 minlen=8 lcredit=0 ucredit=0 dcredit=0 ocredit=0 reject_username gecoscheck retry=3 enforce_for_root +password required pam_pwhistory.so remember=5 use_authtok enforce_for_root +password [success=1 default=ignore] pam_unix.so use_authtok nullok sha512 +password requisite pam_deny.so +password required pam_permit.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session index 7a1e3a52707..94765c85d4d 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session @@ -1,19 +1,19 @@ -# -# /etc/pam.d/common-session - session-related modules common to all services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define tasks to be performed -# at the start and end of sessions of *any* kind (both interactive and -# non-interactive). -# - -# here are the per-package modules (the "Primary" block) -session [default=1] pam_permit.so -# here's the fallback if no module succeeds -session requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -session required pam_permit.so -# and here are more per-package modules (the "Additional" block) -session required pam_unix.so +# +# /etc/pam.d/common-session - session-related modules common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of sessions of *any* kind (both interactive and +# non-interactive). +# + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# and here are more per-package modules (the "Additional" block) +session required pam_unix.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive index 79518d1de1c..a9c830d4c9b 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive @@ -1,19 +1,19 @@ -# -# /etc/pam.d/common-session-noninteractive - session-related modules -# common to all non-interactive services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define tasks to be performed -# at the start and end of all non-interactive sessions. -# - -# here are the per-package modules (the "Primary" block) -session [default=1] pam_permit.so -# here's the fallback if no module succeeds -session requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -session required pam_permit.so -# and here are more per-package modules (the "Additional" block) -session required pam_unix.so +# +# /etc/pam.d/common-session-noninteractive - session-related modules +# common to all non-interactive services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of all non-interactive sessions. +# + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# and here are more per-package modules (the "Additional" block) +session required pam_unix.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/other b/meta-openeuler/recipes-core/pam/libpam/pam.d/other index 696f789eb97..010d5d11d82 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/other +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/other @@ -1,24 +1,24 @@ -# -# /etc/pam.d/other - specify the PAM fallback behaviour -# -# Note that this file is used for any unspecified service; for example -#if /etc/pam.d/cron specifies no session modules but cron calls -#pam_open_session, the session module out of /etc/pam.d/other is -#used. - -# We use pam_warn.so to generate syslog notes that the 'other' -#fallback rules are being used (as a hint to suggest you should setup -#specific PAM rules for the service and aid to debugging). Then to be -#secure, deny access to all services by default. - -auth required pam_warn.so -auth required pam_deny.so - -account required pam_warn.so -account required pam_deny.so - -password required pam_warn.so -password required pam_deny.so - -session required pam_warn.so -session required pam_deny.so +# +# /etc/pam.d/other - specify the PAM fallback behaviour +# +# Note that this file is used for any unspecified service; for example +#if /etc/pam.d/cron specifies no session modules but cron calls +#pam_open_session, the session module out of /etc/pam.d/other is +#used. + +# We use pam_warn.so to generate syslog notes that the 'other' +#fallback rules are being used (as a hint to suggest you should setup +#specific PAM rules for the service and aid to debugging). Then to be +#secure, deny access to all services by default. + +auth required pam_warn.so +auth required pam_deny.so + +account required pam_warn.so +account required pam_deny.so + +password required pam_warn.so +password required pam_deny.so + +session required pam_warn.so +session required pam_deny.so -- Gitee