0001-base-files-do-not-automatically-activate-services-an.patch

From 7541f97446fc67b5eb83ca42f452eabcf1290e7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <karel.koci@nic.cz>
Date: Tue, 29 May 2018 16:13:18 +0200
Subject: [PATCH] base-files: do not automatically activate services and
 restart activated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For security reasons only selected services are automatically activated.
Those are listed in /etc/services_wanted.
We also restart services when updated instead of just starting them.

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
Signed-off-by: Josef Schlehofer <josef.schlehofer@nic.cz>
---
 package/base-files/Makefile                  | 11 ++++
 package/base-files/files/etc/services_wanted | 64 ++++++++++++++++++++
 package/base-files/files/lib/functions.sh    | 14 +++--
 3 files changed, 83 insertions(+), 6 deletions(-)
 create mode 100644 package/base-files/files/etc/services_wanted

diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 8a1ddf96f5..3b3a22c4da 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -207,6 +207,17 @@ define Package/base-files/install
 		rm -f $(1)/etc/banner.failsafe,)
 endef
 
+define Package/base-files/postinst
+[ -n "$$IPKG_INSTROOT" ] || {
+	# Enable wanted services
+	while read L; do
+		if [ -f "/etc/init.d/$$L" ]; then
+			"/etc/init.d/$$L" enable
+		fi
+	done < /etc/services_wanted
+}
+endef
+
 ifneq ($(DUMP),1)
   -include $(PLATFORM_DIR)/base-files.mk
   -include $(PLATFORM_SUBDIR)/base-files.mk
diff --git a/package/base-files/files/etc/services_wanted b/package/base-files/files/etc/services_wanted
new file mode 100644
index 0000000000..29d2d21b93
--- /dev/null
+++ b/package/base-files/files/etc/services_wanted
@@ -0,0 +1,65 @@
+asm1062-fix
+atd
+atlas
+atsha204-feed-entropy
+boot
+cron
+dev-detect
+dnsmasq
+done
+firewall
+foris-controller
+foris-ws
+fosquitto
+fstab
+gpio_switch
+haas-proxy
+haveged
+hd-idle
+led
+lighttpd
+lm-sensors
+lvm2
+lxc-auto
+morce
+mox_autosetup
+mysqld
+netdata
+nethist
+network
+odhcpd
+openvpn
+php8-fpm
+rainbow
+rainbow-button-sync
+relayd
+resolver
+rpcd
+sentinel-dynfw-client
+sentinel-fwlogs
+sentinel-minipot
+sentinel-proxy
+setup_led
+smartd
+sqm
+srv
+sshd
+start-indicator
+syncthing
+sysctl
+sysfixtime
+sysfsutils
+syslog-ng
+sysntpd
+system
+transmission
+ucitrack
+umdns
+umount
+update_mac
+updater-journal-recover
+urandom_seed
+usbmode
+watchdog_adjust
+wpad
+zram
diff --git a/package/base-files/files/lib/functions.sh b/package/base-files/files/lib/functions.sh
index 2bad45324f..2680951cc4 100644
--- a/package/base-files/files/lib/functions.sh
+++ b/package/base-files/files/lib/functions.sh
@@ -277,13 +277,15 @@ default_postinst() {
 
 	local shell="$(command -v bash)"
 	for i in $(grep -s "^/etc/init.d/" "$root$filelist"); do
-		if [ -n "$root" ]; then
-			${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" enable
-		else
-			if [ "$PKG_UPGRADE" != "1" ]; then
-				"$i" enable
+		if grep -q "^$(basename "$i")$" "$root/etc/services_wanted"; then
+			if [ -n "$root" ]; then
+				${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" enable
+			else
+				[ "$PKG_UPGRADE" = "1" ] || "$i" enable
 			fi
-			"$i" start
+		fi
+		if [ -z "$root" ] && "$i" enabled; then
+			"$i" restart
 		fi
 	done
 
-- 
2.39.1