0001-base-files-do-not-automatically-activate-services-an.patch

From a3cc1cd4904113cdf5005e66649597ac35f8281b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <karel.koci@nic.cz>
Date: Tue, 29 May 2018 16:13:18 +0200
Subject: [PATCH] base-files: do not automatically activate services and
 restart activated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For security reasons only selected services are automatically activated.
Those are listed in /etc/services_wanted.
We also restart services when updated instead of just starting them.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
Signed-off-by: Josef Schlehofer <josef.schlehofer@nic.cz>
---
 package/base-files/Makefile                  | 11 ++++
 package/base-files/files/etc/services_wanted | 58 ++++++++++++++++++++
 package/base-files/files/lib/functions.sh    | 16 +++---
 3 files changed, 78 insertions(+), 7 deletions(-)
 create mode 100644 package/base-files/files/etc/services_wanted

diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 19ae198..9c5664e 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -212,6 +212,17 @@ define Package/base-files/install
 		rm -f $(1)/sbin/pkg_check)
 endef

+define Package/base-files/postinst
+[ -n "$$IPKG_INSTROOT" ] || {
+	# Enable wanted services
+	while read L; do
+		if [ -f "/etc/init.d/$$L" ]; then
+			"/etc/init.d/$$L" enable
+		fi
+	done < /etc/services_wanted
+}
+endef
+
 ifneq ($(DUMP),1)
   -include $(PLATFORM_DIR)/base-files.mk
   -include $(PLATFORM_SUBDIR)/base-files.mk
diff --git a/package/base-files/files/etc/services_wanted b/package/base-files/files/etc/services_wanted
new file mode 100644
index 0000000..ba3fcbc
--- /dev/null
+++ b/package/base-files/files/etc/services_wanted
@@ -0,0 +1,57 @@
+asm1062-fix
+atd
+atlas
+boot
+cron
+cups
+dev-detect
+dnsmasq
+done
+firewall
+foris-controller
+foris-ws
+fosquitto
+fstab
+gpio_switch
+haas-proxy
+haveged
+hd-idle
+led
+lighttpd
+lm-sensors
+lvm2
+lxc-auto
+mountd
+mox_autosetup
+netdata
+nethist
+network
+odhcpd
+openvpn
+rainbow
+relayd
+resolver
+rpcd
+sentinel-dynfw-client
+sentinel-minipot
+sentinel-proxy
+setup_led
+smartd
+sqm
+srv
+sshd
+start-indicator
+sysctl
+sysfixtime
+sysfsutils
+syslog-ng
+sysntpd
+system
+ucitrack
+umdns
+umount
+update_mac
+updater-journal-recover
+urandom_seed
+usbmode
+zram
diff --git a/package/base-files/files/lib/functions.sh b/package/base-files/files/lib/functions.sh
index 323e057..8e12825 100755
--- a/package/base-files/files/lib/functions.sh
+++ b/package/base-files/files/lib/functions.sh
@@ -266,13 +266,15 @@ default_postinst() {
 
 	local shell="$(command -v bash)"
 	for i in $(grep -s "^/etc/init.d/" "$root$filelist"); do
-		if [ -n "$root" ]; then
-			${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" enable
-		else
-			if [ "$PKG_UPGRADE" != "1" ]; then
-				"$i" enable
+		if grep -q "^$(basename "$i")$" "$root/etc/services_wanted"; then
+			if [ -n "$root" ]; then
+				${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" enable
+			else
+				[ "$PKG_UPGRADE" = "1" ] || "$i" enable
 			fi
-			"$i" start
+		fi
+		if [ -z "$root" ] && "$i" enabled; then
+			"$i" restart
 		fi
 	done
 
--
2.26.0