factory: Fail to unmount encstateful for wiping. |
|||||||||||
Issue descriptionChrome Version: ToT OS: Chrome What steps will reproduce the problem? (1) Install factory toolkit on test images. (2) gooftool wipe_in_place What is the expected result? Successfully entering wiping screen What happens instead? Fail due to unable to unmount encstateful It was found that killing openssh-server service would solve it, but openssh-server was an important tool for us to debug wiping process. Another solution is to use encrypted-mount. Need Kees' comment for if that's ok.
,
Jan 11 2017
,
Jan 11 2017
Ok there may be multiple problems. Seems like if 422588 is merged, 'factory.conf' cannot control goofy anymore, and there may be a "tail" process not terminated, and also few programs running behind The other thing is openssh-server, which we've realized it's caused by sshl. sshl runs in minijail, which locks /var. However, since Arc++ was introduced, we can't run openssh-server without sshl (openssh is now bound to port 22). One solution is to add sshl into inhibited list, and run an explicit "sshd -oPort=22", although that will stop adb support.
,
Jan 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/3b12b2c535bf2c695049baea88556cae26523bf7 commit 3b12b2c535bf2c695049baea88556cae26523bf7 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed Jan 11 07:46:39 2017 init: Prevent running processes in minijail0. For factory testing, we may need to stop all services for unmounting stateful partition (including encrypted block), especially for wiping in place. ChromeOS images recently enabled "sslh", which runs inside minijail0 and tries to multiplex ssh/adb services, for openssh-server. This caused factory programs to fail doing wipe-in-place if we want to keep SSH connections alive for debugging. It was found that minijail0 will keep a reference to /var that blocks our umount request, even if the process inside jail does not really use /var. Also, lsof can't find such references. Since the factory testing environment has no security concern, we decide to mock all minijail0 calls and run the programs directly in same name space. BUG= chromium:679676 TEST=Start factory and run "gooftool wipe_in_place". Change-Id: I3fe1f1670525ad5ea887fb87e7ee009a02daca97 Reviewed-on: https://chromium-review.googlesource.com/426306 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> [add] https://crrev.com/3b12b2c535bf2c695049baea88556cae26523bf7/init/goofy.d/device/jailbreak/minijail0 [add] https://crrev.com/3b12b2c535bf2c695049baea88556cae26523bf7/init/goofy.d/device/jailbreak.sh
,
Jan 11 2017
,
Jan 12 2017
After applying the CL in #4, sshd in port 22 cannot start. Still debugging.
,
Jan 12 2017
openssh-server also failed to start on Gru
,
Jan 12 2017
Besides, with jailbreak, goofy cannot start properly on Gru (okay on Reef).
,
Jan 12 2017
,
Jan 16 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/1e4ef960eaa00036009bcd70e6b5e77784ce0df2 commit 1e4ef960eaa00036009bcd70e6b5e77784ce0df2 Author: Ting Shen <phoenixshen@google.com> Date: Fri Jan 13 09:00:04 2017 init: revise minijail0 Rewrite the script using python, parse options correctly. BUG= chromium:679676 TEST=Start factory, ssh to DUT, and run "gooftool wipe_in_place". Change-Id: Idfefccf191b65f91d3e8f90096b0fdd3aa7d82b0 Reviewed-on: https://chromium-review.googlesource.com/427443 Commit-Ready: Ting Shen <phoenixshen@chromium.org> Tested-by: Youcheng Syu <youcheng@google.com> Tested-by: Ting Shen <phoenixshen@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Youcheng Syu <youcheng@google.com> [modify] https://crrev.com/1e4ef960eaa00036009bcd70e6b5e77784ce0df2/init/goofy.d/device/jailbreak/minijail0
,
Jan 16 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/c28996a6f62249e54e6a176e149515d81f647d99 commit c28996a6f62249e54e6a176e149515d81f647d99 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed Jan 11 07:46:39 2017 init: Prevent running processes in minijail0. For factory testing, we may need to stop all services for unmounting stateful partition (including encrypted block), especially for wiping in place. ChromeOS images recently enabled "sslh", which runs inside minijail0 and tries to multiplex ssh/adb services, for openssh-server. This caused factory programs to fail doing wipe-in-place if we want to keep SSH connections alive for debugging. It was found that minijail0 will keep a reference to /var that blocks our umount request, even if the process inside jail does not really use /var. Also, lsof can't find such references. Since the factory testing environment has no security concern, we decide to mock all minijail0 calls and run the programs directly in same name space. BUG= chromium:679676 TEST=Start factory and run "gooftool wipe_in_place". Change-Id: I3fe1f1670525ad5ea887fb87e7ee009a02daca97 Reviewed-on: https://chromium-review.googlesource.com/426306 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> (cherry picked from commit 3b12b2c535bf2c695049baea88556cae26523bf7) Reviewed-on: https://chromium-review.googlesource.com/428472 Reviewed-by: Youcheng Syu <youcheng@google.com> Commit-Queue: Youcheng Syu <youcheng@google.com> Tested-by: Youcheng Syu <youcheng@google.com> [add] https://crrev.com/c28996a6f62249e54e6a176e149515d81f647d99/init/goofy.d/device/jailbreak/minijail0 [add] https://crrev.com/c28996a6f62249e54e6a176e149515d81f647d99/init/goofy.d/device/jailbreak.sh
,
Jan 16 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/6e629b94b737faa846565b42a9eb0ff692e8257d commit 6e629b94b737faa846565b42a9eb0ff692e8257d Author: Ting Shen <phoenixshen@google.com> Date: Fri Jan 13 09:00:04 2017 init: revise minijail0 Rewrite the script using python, parse options correctly. BUG= chromium:679676 TEST=Start factory, ssh to DUT, and run "gooftool wipe_in_place". Change-Id: Idfefccf191b65f91d3e8f90096b0fdd3aa7d82b0 Reviewed-on: https://chromium-review.googlesource.com/427443 Commit-Ready: Ting Shen <phoenixshen@chromium.org> Tested-by: Youcheng Syu <youcheng@google.com> Tested-by: Ting Shen <phoenixshen@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Youcheng Syu <youcheng@google.com> (cherry picked from commit 1e4ef960eaa00036009bcd70e6b5e77784ce0df2) Reviewed-on: https://chromium-review.googlesource.com/428473 Commit-Queue: Youcheng Syu <youcheng@google.com> [modify] https://crrev.com/6e629b94b737faa846565b42a9eb0ff692e8257d/init/goofy.d/device/jailbreak/minijail0
,
Jan 20 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/09226ef08b45e7b68f2097eda1c4a39aed0d2c58 commit 09226ef08b45e7b68f2097eda1c4a39aed0d2c58 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed Jan 11 10:00:19 2017 gooftool: Improve wiping process. - Check and error if minijail processes were not terminated. - Do not unlink /var/run and /var/lock, which would cause problems if we change test image to run in unencrypted mode. - Change umount commands to run with same params (-nR -> "-n -R"), to prevent unexpected errors when umount comes from different versions, for example busybox or toybox. - Fixed logging.* calls (should use param instead of %). BUG= chromium:679676 TEST=gooftool wipe_in_place Change-Id: I09cb5bad161dca1bd37dbe5a47d9958800813081 Reviewed-on: https://chromium-review.googlesource.com/426419 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> [modify] https://crrev.com/09226ef08b45e7b68f2097eda1c4a39aed0d2c58/py/gooftool/wipe.py
,
Jan 20 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/da405b5fdad9c2862df38ba4b1b9157a93638496 commit da405b5fdad9c2862df38ba4b1b9157a93638496 Author: Hung-Te Lin <hungte@chromium.org> Date: Mon Jan 16 16:31:32 2017 init: Change main.d to support running in background or foreground. In CL:422588 goofy.sh was modified to run in background, but it seems like we can't wait for "background process executed by a child process which as also run in background". i.e., the 'wait' in startup:factory_main does not work. To solve that, we are changing main.d to always run in background, and a special folder "pre-start" that rules inside will be executed in foreground before anything in main.d was started. By the change we can allow non-parallel rules (for example, setting static IP) and parallel main programs to live in both main.d. BUG= chromium:679676 TEST=status factory # see started/running. Change-Id: I7f4068954a8834c9888558cd418c16f6f2dd7058 Reviewed-on: https://chromium-review.googlesource.com/428616 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Chih-Yu Huang <akahuang@chromium.org> [add] https://crrev.com/da405b5fdad9c2862df38ba4b1b9157a93638496/init/main.d/pre-start/dummy.sh [modify] https://crrev.com/da405b5fdad9c2862df38ba4b1b9157a93638496/init/main.d/whale_servo.sh [modify] https://crrev.com/da405b5fdad9c2862df38ba4b1b9157a93638496/init/startup [modify] https://crrev.com/da405b5fdad9c2862df38ba4b1b9157a93638496/init/main.d/goofy.sh [modify] https://crrev.com/da405b5fdad9c2862df38ba4b1b9157a93638496/init/main.d/README.md
,
Jan 21 2017
,
Jan 23 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/dca0f05b61fb1fe179c0c252a515b9aa84b880e4 commit dca0f05b61fb1fe179c0c252a515b9aa84b880e4 Author: Hung-Te Lin <hungte@chromium.org> Date: Mon Jan 23 09:19:45 2017 init: Fix "system-services stall in starting state" due to jailbreak. Some upstart jobs using minijail will specify "-u" or "-g" to run as different user, and they may even have security policy files checking if the permission was set correctly (for example mtpd, powerd). When these services are set to respawn, upstart will keep retrying and make system-services not able to enter "start/running" stage, also blocked other jobs to run. This changes jailbreak/minijail0 to accept and process -u/-g correctly. One special daemon that still can't run (will see ABRT) is permission_broker that will cause firewalld to keep restarting, so we have to inhibit its execution. Note if we use setuid/setgid instead of seteuid/setegid, shill will fail because some daemons like wpasuplicant won't be able to access /var/run/*. BUG= chromium:679676 TEST=make toolkit; manually deployed and tested. Change-Id: I1eb6936a5d472aaecdbbbb4ce51de172f7b06003 Reviewed-on: https://chromium-review.googlesource.com/430582 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Wei-Han Chen <stimim@chromium.org> [add] https://crrev.com/dca0f05b61fb1fe179c0c252a515b9aa84b880e4/init/common.d/inhibit_jobs/permission_broker [modify] https://crrev.com/dca0f05b61fb1fe179c0c252a515b9aa84b880e4/init/goofy.d/device/jailbreak/minijail0
,
Jan 23 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/482359fa2cb999ea468f711bc7294537fcd826fb commit 482359fa2cb999ea468f711bc7294537fcd826fb Author: Hung-Te Lin <hungte@chromium.org> Date: Mon Jan 23 09:26:19 2017 init: Inhibit arc-camera, arc-system-mount and mtp. The factory environment should not run Arc++. Disable arc-* and mtp services until we really need them. BUG= chromium:679676 TEST=make toolkit; manually started factory UI. Change-Id: I7003eb62eac5b612717ee7f5850b14354b8055a9 Reviewed-on: https://chromium-review.googlesource.com/430583 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Wei-Han Chen <stimim@chromium.org> [add] https://crrev.com/482359fa2cb999ea468f711bc7294537fcd826fb/init/common.d/inhibit_jobs/arc-system-mount [add] https://crrev.com/482359fa2cb999ea468f711bc7294537fcd826fb/init/common.d/inhibit_jobs/mtpd [add] https://crrev.com/482359fa2cb999ea468f711bc7294537fcd826fb/init/common.d/inhibit_jobs/arc-camera
,
Jan 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/68260fbd1c07a08baa7bdd84c6db5d60fd12ef82 commit 68260fbd1c07a08baa7bdd84c6db5d60fd12ef82 Author: Hung-Te Lin <hungte@chromium.org> Date: Mon Jan 23 09:26:19 2017 init: Inhibit arc-camera, arc-system-mount and mtp. The factory environment should not run Arc++. Disable arc-* and mtp services until we really need them. BUG= chromium:679676 TEST=make toolkit; manually started factory UI. Change-Id: I7003eb62eac5b612717ee7f5850b14354b8055a9 Reviewed-on: https://chromium-review.googlesource.com/430583 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Wei-Han Chen <stimim@chromium.org> (cherry picked from commit 482359fa2cb999ea468f711bc7294537fcd826fb) Reviewed-on: https://chromium-review.googlesource.com/432141 Reviewed-by: Youcheng Syu <youcheng@google.com> Commit-Queue: Youcheng Syu <youcheng@google.com> Tested-by: Youcheng Syu <youcheng@google.com> [add] https://crrev.com/68260fbd1c07a08baa7bdd84c6db5d60fd12ef82/init/common.d/inhibit_jobs/arc-system-mount [add] https://crrev.com/68260fbd1c07a08baa7bdd84c6db5d60fd12ef82/init/common.d/inhibit_jobs/mtpd [add] https://crrev.com/68260fbd1c07a08baa7bdd84c6db5d60fd12ef82/init/common.d/inhibit_jobs/arc-camera
,
Jan 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/97cc5d2b895d24a007225d03df14bf60c12d92d2 commit 97cc5d2b895d24a007225d03df14bf60c12d92d2 Author: Hung-Te Lin <hungte@chromium.org> Date: Mon Jan 23 09:19:45 2017 init: Fix "system-services stall in starting state" due to jailbreak. Some upstart jobs using minijail will specify "-u" or "-g" to run as different user, and they may even have security policy files checking if the permission was set correctly (for example mtpd, powerd). When these services are set to respawn, upstart will keep retrying and make system-services not able to enter "start/running" stage, also blocked other jobs to run. This changes jailbreak/minijail0 to accept and process -u/-g correctly. One special daemon that still can't run (will see ABRT) is permission_broker that will cause firewalld to keep restarting, so we have to inhibit its execution. Note if we use setuid/setgid instead of seteuid/setegid, shill will fail because some daemons like wpasuplicant won't be able to access /var/run/*. BUG= chromium:679676 TEST=make toolkit; manually deployed and tested. Change-Id: I1eb6936a5d472aaecdbbbb4ce51de172f7b06003 Reviewed-on: https://chromium-review.googlesource.com/430582 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Wei-Han Chen <stimim@chromium.org> (cherry picked from commit dca0f05b61fb1fe179c0c252a515b9aa84b880e4) Reviewed-on: https://chromium-review.googlesource.com/432144 Reviewed-by: Youcheng Syu <youcheng@google.com> Commit-Queue: Youcheng Syu <youcheng@google.com> Tested-by: Youcheng Syu <youcheng@google.com> [add] https://crrev.com/97cc5d2b895d24a007225d03df14bf60c12d92d2/init/common.d/inhibit_jobs/permission_broker [modify] https://crrev.com/97cc5d2b895d24a007225d03df14bf60c12d92d2/init/goofy.d/device/jailbreak/minijail0
,
Jan 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/f546de94baa1eb55f5ea06816107013f186d8cf6 commit f546de94baa1eb55f5ea06816107013f186d8cf6 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed Jan 11 10:00:19 2017 gooftool: Improve wiping process. - Check and error if minijail processes were not terminated. - Do not unlink /var/run and /var/lock, which would cause problems if we change test image to run in unencrypted mode. - Change umount commands to run with same params (-nR -> "-n -R"), to prevent unexpected errors when umount comes from different versions, for example busybox or toybox. - Fixed logging.* calls (should use param instead of %). BUG= chromium:679676 TEST=gooftool wipe_in_place Change-Id: I09cb5bad161dca1bd37dbe5a47d9958800813081 Reviewed-on: https://chromium-review.googlesource.com/426419 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> (cherry picked from commit 09226ef08b45e7b68f2097eda1c4a39aed0d2c58) Reviewed-on: https://chromium-review.googlesource.com/432145 Reviewed-by: Youcheng Syu <youcheng@google.com> Commit-Queue: Youcheng Syu <youcheng@google.com> Tested-by: Youcheng Syu <youcheng@google.com> [modify] https://crrev.com/f546de94baa1eb55f5ea06816107013f186d8cf6/py/gooftool/wipe.py
,
Jan 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/f546de94baa1eb55f5ea06816107013f186d8cf6 commit f546de94baa1eb55f5ea06816107013f186d8cf6 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed Jan 11 10:00:19 2017 gooftool: Improve wiping process. - Check and error if minijail processes were not terminated. - Do not unlink /var/run and /var/lock, which would cause problems if we change test image to run in unencrypted mode. - Change umount commands to run with same params (-nR -> "-n -R"), to prevent unexpected errors when umount comes from different versions, for example busybox or toybox. - Fixed logging.* calls (should use param instead of %). BUG= chromium:679676 TEST=gooftool wipe_in_place Change-Id: I09cb5bad161dca1bd37dbe5a47d9958800813081 Reviewed-on: https://chromium-review.googlesource.com/426419 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> (cherry picked from commit 09226ef08b45e7b68f2097eda1c4a39aed0d2c58) Reviewed-on: https://chromium-review.googlesource.com/432145 Reviewed-by: Youcheng Syu <youcheng@google.com> Commit-Queue: Youcheng Syu <youcheng@google.com> Tested-by: Youcheng Syu <youcheng@google.com> [modify] https://crrev.com/f546de94baa1eb55f5ea06816107013f186d8cf6/py/gooftool/wipe.py
,
Apr 17 2017
,
Apr 27 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/98b6f53b1141e3fab9a61a3ab8c120f0451818dd commit 98b6f53b1141e3fab9a61a3ab8c120f0451818dd Author: Hung-Te Lin <hungte@chromium.org> Date: Thu Apr 27 09:08:14 2017 init: Prevent running processes in minijail0. For factory testing, we may need to stop all services for unmounting stateful partition (including encrypted block), especially for wiping in place. ChromeOS images recently enabled "sslh", which runs inside minijail0 and tries to multiplex ssh/adb services, for openssh-server. This caused factory programs to fail doing wipe-in-place if we want to keep SSH connections alive for debugging. It was found that minijail0 will keep a reference to /var that blocks our umount request, even if the process inside jail does not really use /var. Also, lsof can't find such references. Since the factory testing environment has no security concern, we decide to mock all minijail0 calls and run the programs directly in same name space. BUG= chromium:679676 TEST=Start factory and run "gooftool wipe_in_place". Change-Id: I3fe1f1670525ad5ea887fb87e7ee009a02daca97 Reviewed-on: https://chromium-review.googlesource.com/426306 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> (cherry picked from commit 3b12b2c535bf2c695049baea88556cae26523bf7) Reviewed-on: https://chromium-review.googlesource.com/487849 Reviewed-by: Ting Shen <phoenixshen@chromium.org> Commit-Queue: Ting Shen <phoenixshen@chromium.org> Tested-by: Ting Shen <phoenixshen@chromium.org> [add] https://crrev.com/98b6f53b1141e3fab9a61a3ab8c120f0451818dd/init/goofy.d/device/jailbreak/minijail0 [add] https://crrev.com/98b6f53b1141e3fab9a61a3ab8c120f0451818dd/init/goofy.d/device/jailbreak.sh
,
Apr 27 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/06eab3b5de8bfa9b7b2a63cc83623530db6eaa51 commit 06eab3b5de8bfa9b7b2a63cc83623530db6eaa51 Author: Ting Shen <phoenixshen@google.com> Date: Thu Apr 27 09:12:04 2017 init: revise minijail0 Rewrite the script using python, parse options correctly. BUG= chromium:679676 TEST=Start factory, ssh to DUT, and run "gooftool wipe_in_place". Change-Id: Idfefccf191b65f91d3e8f90096b0fdd3aa7d82b0 Reviewed-on: https://chromium-review.googlesource.com/427443 Commit-Ready: Ting Shen <phoenixshen@chromium.org> Tested-by: Youcheng Syu <youcheng@google.com> Tested-by: Ting Shen <phoenixshen@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Youcheng Syu <youcheng@google.com> (cherry picked from commit 1e4ef960eaa00036009bcd70e6b5e77784ce0df2) Reviewed-on: https://chromium-review.googlesource.com/487850 Reviewed-by: Ting Shen <phoenixshen@chromium.org> Commit-Queue: Ting Shen <phoenixshen@chromium.org> [modify] https://crrev.com/06eab3b5de8bfa9b7b2a63cc83623530db6eaa51/init/goofy.d/device/jailbreak/minijail0
,
Apr 27 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/bd3170009affeffb365d6853e56bbfef9208fb77 commit bd3170009affeffb365d6853e56bbfef9208fb77 Author: Hung-Te Lin <hungte@chromium.org> Date: Thu Apr 27 09:13:17 2017 init: Fix "system-services stall in starting state" due to jailbreak. Some upstart jobs using minijail will specify "-u" or "-g" to run as different user, and they may even have security policy files checking if the permission was set correctly (for example mtpd, powerd). When these services are set to respawn, upstart will keep retrying and make system-services not able to enter "start/running" stage, also blocked other jobs to run. This changes jailbreak/minijail0 to accept and process -u/-g correctly. One special daemon that still can't run (will see ABRT) is permission_broker that will cause firewalld to keep restarting, so we have to inhibit its execution. Note if we use setuid/setgid instead of seteuid/setegid, shill will fail because some daemons like wpasuplicant won't be able to access /var/run/*. BUG= chromium:679676 TEST=make toolkit; manually deployed and tested. Change-Id: I1eb6936a5d472aaecdbbbb4ce51de172f7b06003 Reviewed-on: https://chromium-review.googlesource.com/430582 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Wei-Han Chen <stimim@chromium.org> (cherry picked from commit dca0f05b61fb1fe179c0c252a515b9aa84b880e4) Reviewed-on: https://chromium-review.googlesource.com/487851 Reviewed-by: Ting Shen <phoenixshen@chromium.org> Commit-Queue: Ting Shen <phoenixshen@chromium.org> Tested-by: Ting Shen <phoenixshen@chromium.org> [add] https://crrev.com/bd3170009affeffb365d6853e56bbfef9208fb77/init/common.d/inhibit_jobs/permission_broker [modify] https://crrev.com/bd3170009affeffb365d6853e56bbfef9208fb77/init/goofy.d/device/jailbreak/minijail0
,
May 2 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/e0bbca4a94b8bdeb4abc4f88709e2e8331088510 commit e0bbca4a94b8bdeb4abc4f88709e2e8331088510 Author: Hung-Te Lin <hungte@chromium.org> Date: Tue May 02 14:31:32 2017 init: Create unencrypted factory data only when encstateful is enabled. When the test image is configured to use unencrypted factory data, we don't need to re-map /var/factory to var_overlay/factory. BUG= chromium:679676 TEST=Boots factory UI. Change-Id: I506d27ef00f3f93d737bee1f52c64c7edbfd3791 Reviewed-on: https://chromium-review.googlesource.com/492711 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Ting Shen <phoenixshen@chromium.org> [modify] https://crrev.com/e0bbca4a94b8bdeb4abc4f88709e2e8331088510/init/common.d/unencrypted_factory_data.sh
,
May 3 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform/factory/+/aca7d7d4ad027f65b822437f34578f7d42937874 commit aca7d7d4ad027f65b822437f34578f7d42937874 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed May 03 03:20:53 2017 init: Create unencrypted factory data only when encstateful is enabled. When the test image is configured to use unencrypted factory data, we don't need to re-map /var/factory to var_overlay/factory. BUG= chromium:679676 TEST=Boots factory UI. Change-Id: I506d27ef00f3f93d737bee1f52c64c7edbfd3791 Reviewed-on: https://chromium-review.googlesource.com/492711 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Ting Shen <phoenixshen@chromium.org> (cherry picked from commit e0bbca4a94b8bdeb4abc4f88709e2e8331088510) Reviewed-on: https://chromium-review.googlesource.com/494406 Reviewed-by: Hung-Te Lin <hungte@chromium.org> Commit-Queue: Hung-Te Lin <hungte@chromium.org> Trybot-Ready: Hung-Te Lin <hungte@chromium.org> [modify] https://crrev.com/aca7d7d4ad027f65b822437f34578f7d42937874/init/common.d/unencrypted_factory_data.sh
,
May 5 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/8ac9b186b90ddde03571ed0f6d3aff4a81067f07 commit 8ac9b186b90ddde03571ed0f6d3aff4a81067f07 Author: Hung-Te Lin <hungte@chromium.org> Date: Fri May 05 07:34:31 2017 init: Change encrypted_stateful to skip encryption on factory mode. The factory software has to unmount stateful partition and rootfs during wiping process of finalization. The encstateful has created extra complexity and hard to solve service dependency for stopping (to prevent stateful/encstateful being busy). Also made it more difficult to debug devices when kernel is corrupted. Since "factory" mode for mount-encrypted was executed with fixed key, it should be fine to just skip encryption so the factory wiping process and fault analysis can be done more easily. Cherry-picked and modified from CL:426560 BUG= chromium:679676 TEST=./build_image test; install factory toolkit; run "gooftool wipe_in_place" and finished wiping process. Change-Id: Ic5e6bf5b106b4011e1f22b185a544aac2c48336f Reviewed-on: https://chromium-review.googlesource.com/494526 Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Commit-Queue: Hung-Te Lin <hungte@chromium.org> Trybot-Ready: Hung-Te Lin <hungte@chromium.org> [modify] https://crrev.com/8ac9b186b90ddde03571ed0f6d3aff4a81067f07/init/encrypted_stateful/startup_utils.sh
,
May 30 2017
,
May 31 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/203d7c0b15d95f9503545df8503941d5b095fc32 commit 203d7c0b15d95f9503545df8503941d5b095fc32 Author: Hung-Te Lin <hungte@chromium.org> Date: Wed May 31 09:15:31 2017 init: factory_utils.sh: Allow mounting var and home in unencrypted mode. The factory software has to unmount stateful partition and rootfs during wiping process of finalization. The encstateful has created extra complexity and hard to solve service dependency for stopping (to prevent stateful/encstateful being busy). Also made it more difficult to debug devices when kernel is corrupted. Since "factory" mode for mount-encrypted was executed with fixed key, it should be fine to just skip encryption so the factory wiping process and fault analysis can be done more easily. We now support a new mount_option file /usr/local/factory/init/encstateful_mount_option with following modes: "factory": The "factory" mode using fixed key. "unencrypted": Do not use encstateful. And if encstateful_mount_option is not defined, default to unencrypted. BUG= chromium:725086 , chromium:679676 TEST=./build_image test; install factory toolkit; run "gooftool wipe_in_place" and finished wiping process. Change-Id: I9130ebb4620bc9b1ac62ceeea71de2f5a10d8358 Reviewed-on: https://chromium-review.googlesource.com/487922 Commit-Ready: Hung-Te Lin <hungte@chromium.org> Tested-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> [modify] https://crrev.com/203d7c0b15d95f9503545df8503941d5b095fc32/init/upstart/test-init/factory_utils.sh
,
Aug 1 2017
,
Oct 14 2017
|
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by hungte@chromium.org
, Jan 11 2017