Subject: [alpine-devel] [PATCH 0/8] Refinements and fixes for syslinux

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:13 -0400

I wrote to the list about these patches a few months ago ("some patches for
syslinux/update-extlinux", 13 March), but it got lost in the noise. No worries.

Enclosed are some bugfixes and (mostly) some extensions/refinements for our
update-extlinux scripts.

I've been using these patches in practice on my laptop for many months and have
had no difficulties with them. There's nothing fancy here; one just has to be
on top of the syslinux docs (for example, at
http://www.syslinux.org/wiki/index.php/SYSLINUX and at
http://www.syslinux.org/wiki/index.php/Comboot/menu.c32).

Dubiousjim (8):
  main/syslinux: fix/refactor initramfs
  main/syslinux: use more specific COM32 (instead of KERNEL) for
    mboot.c32
  main/syslinux: use more specific LINUX (instead of KERNEL) for kernels
  main/syslinux: reorganize menu layout
  main/syslinux: add reboot entry
  main/syslinux: add Hardware Detection Tool entry
  main/syslinux: don't create backup when no changes
  main/syslinux: hooks for bootloader password

 main/syslinux/APKBUILD             |  1 +
 main/syslinux/update-extlinux      | 76 ++++++++++++++++++++++++++++----------
 main/syslinux/update-extlinux.conf |  9 +++++
 3 files changed, 66 insertions(+), 20 deletions(-)

-- 
1.8.3.1

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:19 -0400

HDT provides a curses-like interface to display lots of hardware info
about your machine at bootloader time.

We don't install /boot/hdt.c32, but if it's present (it can be copied from
/usr/share/syslinux/hdt.c32), we add a menu entry for it---in preference to,
rather than in addition to, memtest, since HDT has a menu entry which invokes
memtest.

Using HDT to its full capacity requires finding or generating modules.pcimap
and pci.ids files for your machine, and installing them in /boot. We might want
to document this, which I don't here (but the online docs for HDT do). These
aren't required to use other functionality of HDT; and it's pretty useful
already without those.
---
 main/syslinux/update-extlinux      | 12 +++++++++++-
 main/syslinux/update-extlinux.conf |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index 1c5fc5c..66bc0ed 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -143,7 +143,17 @@ done
 echo "MENU SEPARATOR" >> $conf.new
 echo "" >> $conf.new
 
-if [ -f "/boot/memtest" ]; then
+if [ -f "/boot/hdt.c32" ]; then
+	everbose "Found Hardware Detection Tool: /boot/hdt.c32"
+	echo "LABEL hdt" >> $conf.new
+	echo "  MENU LABEL Hardware info" >> $conf.new
+	echo "  COM32 hdt.c32" >> $conf.new
+	if [ -f "/boot/memtest" ]; then
+		everbose "Found memtest86+: /boot/memtest"
+		echo "  APPEND memtest=memtest" >> $conf.new
+	fi
+	echo "" >> $conf.new
+elif [ -f "/boot/memtest" ]; then
 	everbose "Found memtest86+: /boot/memtest"
 	echo "LABEL memtest" >> $conf.new
 	echo "  MENU LABEL Memtest86+" >> $conf.new
diff --git a/main/syslinux/update-extlinux.conf b/main/syslinux/update-extlinux.conf
index 7be434b..b548d7e 100644
--- a/main/syslinux/update-extlinux.conf
+++ b/main/syslinux/update-extlinux.conf
@@ -43,5 +43,5 @@ default=grsec
 #    dom0_mem=256M (give domain-0 environment 256M ram)
 xen_opts=dom0_mem=256M
 
-# neither of /boot/memtest or /boot/reboot.c32 are installed by default
+# none of /boot/memtest, /boot/hdt.c32, or /boot/reboot.c32 are installed by default
 # but entries for them will be auto-generated if they're present
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:42:11 +0200

On Thu, 27 Jun 2013 03:32:19 -0400

>  # but entries for them will be auto-generated if they're present

ACK

---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:18 -0400

We don't install /boot/reboot.c32, but if it's present (it can be copied from
/usr/share/syslinux/reboot.c32), we add a menu entry for it---just like
with memtest.

Add a comment to /etc/update-extlinux.conf stating this.

It'd already be possible to get a reboot entry using the
/etc/update-extlinux.d/ folder, but this patch provides a more intelligent
framework with nicer layout.

The syslinux sourceball also provides a shutdown module, but I couldn't get this to
work and looking at the sources reveals it to be for machines with APM enabled.
Not sure how many machines that applies to anymore.
---
 main/syslinux/update-extlinux      | 7 +++++++
 main/syslinux/update-extlinux.conf | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index 0dc3601..1c5fc5c 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -151,6 +151,13 @@ if [ -f "/boot/memtest" ]; then
 	echo "" >> $conf.new
 fi
 
+if [ -f "/boot/reboot.c32" ]; then
+	everbose "Found reboot"
+	echo "LABEL reboot" >> $conf.new
+	echo "  MENU LABEL Reboot" >> $conf.new
+        echo "  COM32 reboot.c32" >> $conf.new
+	echo "" >> $conf.new
+fi

 if [ "$overwrite" != "1" ]; then
diff --git a/main/syslinux/update-extlinux.conf b/main/syslinux/update-extlinux.conf
index 59f9e60..7be434b 100644
--- a/main/syslinux/update-extlinux.conf
+++ b/main/syslinux/update-extlinux.conf
@@ -42,3 +42,6 @@ default=grsec
 # options to hand to xen hypervisor, useful ones are:
 #    dom0_mem=256M (give domain-0 environment 256M ram)
 xen_opts=dom0_mem=256M
+
+# neither of /boot/memtest or /boot/reboot.c32 are installed by default
+# but entries for them will be auto-generated if they're present
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:41:38 +0200

On Thu, 27 Jun 2013 03:32:18 -0400

ACK

-nc

---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:15 -0400

---
 main/syslinux/update-extlinux | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index 2b980a9..e46eadf 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -105,7 +105,7 @@ if [ -f "/boot/xen.gz" ]; then
 			echo "  MENU DEFAULT" >> $conf.new
 		fi
 		echo "  MENU LABEL Xen + Linux $tag" >> $conf.new
-		echo "  KERNEL mboot.c32" >> $conf.new
+		echo "  COM32 mboot.c32" >> $conf.new
 		echo "  APPEND xen.gz $xen_opts --- $(basename $kernel) root=$root modules=${modules}${TYPE:+,$TYPE} $default_kernel_opts --- $initramfs" >> $conf.new
 		echo "" >> $conf.new
 		lst=$(($lst + 1))
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:40:26 +0200

On Thu, 27 Jun 2013 03:32:15 -0400

>  		echo "  APPEND xen.gz $xen_opts --- $(basename $kernel) root=$root modules=${modules}${TYPE:+,$TYPE} $default_kernel_opts --- $initramfs" >> $conf.new

looks good to me. I'll apply unless someone NACK it.

-nc

---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:16 -0400

---

diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index e46eadf..014df1b 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -124,7 +124,7 @@ for kernel in $(find /boot -name "vmlinuz-*" -type f); do
 		echo "  MENU DEFAULT" >> $conf.new
 	fi
 	echo "  MENU LABEL Linux $tag" >> $conf.new
-	echo "  KERNEL $(basename $kernel)" >> $conf.new
+	echo "  LINUX $(basename $kernel)" >> $conf.new
 	if [ -f "/boot/initramfs-$tag" ]; then
 		everbose "Found initramfs: /boot/initramfs-$tag"
 		echo "  INITRD initramfs-$tag" >> $conf.new
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:40:57 +0200

On Thu, 27 Jun 2013 03:32:16 -0400

ACK

-nc

---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:21 -0400

We allow a password to be set in /etc/update-extlinux.conf. This can be
generated using a script we install that has a runtime dependency on perl and
perl-digest-sha1.  These only need to be in place when the password is first
generated.

If one sets a password, one will presumably want to make
/etc/update-extlinux.conf world-unreadable. We don't do that for you; however
we do make sure when a password is present to make the /boot/extlinux.conf
files we generate be world-unreadable.

Of the auto-generated entries, only HDT (if this is generated) is now
configured to respect the password; however, you can include "MENU PASSWD" in
any entries you put in /etc/update-extlinux.d/.

For example, I configure my BIOS to only boot from the internal drive, but I
have an entry in /etc/update-extlinux.d that permits chain-booting from a USB
key, and I have this entry configured to also require the password. (The BIOS
is also passworded, so that these settings can't be changed willy-nilly.)
---
 main/syslinux/APKBUILD             |  1 +
 main/syslinux/update-extlinux      | 10 ++++++++++
 main/syslinux/update-extlinux.conf |  6 ++++++
 3 files changed, 17 insertions(+)

diff --git a/main/syslinux/APKBUILD b/main/syslinux/APKBUILD
index 79d7e6c..a6c0f54 100644
--- a/main/syslinux/APKBUILD
+++ b/main/syslinux/APKBUILD
@@ -39,6 +39,7 @@ build() {
 package() {
 	cd "$_builddir"
 	make INSTALLROOT="$pkgdir" MANDIR=/usr/share/man local-install
+	install -D -m755 utils/sha1pass "$pkgdir"/usr/sbin/sha1pass || return 1
 
 	mkdir -p "$pkgdir"/etc/update-extlinux.d
 	cp "$srcdir"/update-extlinux.conf "$pkgdir"/etc/
diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index a8b0474..1bc7b3f 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -134,6 +134,13 @@ for kernel in $(find /boot -name "vmlinuz-*" -type f); do
 	lst=$(($lst + 1))
 done
 
+if [ -n "$password" ]; then
+	echo "NOESCAPE 1" >> $conf.new
+	echo "MENU MASTER PASSWD $password" >> $conf.new
+	echo "" >> $conf.new
+	chmod o-r $conf.new
+fi
+
 everbose "$lst entries found."
 
 for entry in /etc/update-extlinux.d/*; do
@@ -147,6 +154,9 @@ if [ -f "/boot/hdt.c32" ]; then
 	everbose "Found Hardware Detection Tool: /boot/hdt.c32"
 	echo "LABEL hdt" >> $conf.new
 	echo "  MENU LABEL Hardware info" >> $conf.new
+	if [ -n "$password" ]; then
+		echo "  MENU PASSWD" >> $conf.new
+	fi
 	echo "  COM32 hdt.c32" >> $conf.new
 	if [ -f "/boot/memtest" ]; then
 		everbose "Found memtest86+: /boot/memtest"
diff --git a/main/syslinux/update-extlinux.conf b/main/syslinux/update-extlinux.conf
index b548d7e..6cabc61 100644
--- a/main/syslinux/update-extlinux.conf
+++ b/main/syslinux/update-extlinux.conf
@@ -45,3 +45,9 @@ xen_opts=dom0_mem=256M
 
 # none of /boot/memtest, /boot/hdt.c32, or /boot/reboot.c32 are installed by default
 # but entries for them will be auto-generated if they're present
+
+# optional password
+# generate using /usr/sbin/sha1pass, which has a runtime dependency on perl and perl-digest-sha1
+# of the auto-generated entries, only hdt (if present) is password-protected
+# but you can include "MENU PASSWD" in any entries in /etc/update-extlinux.d/
+password=''
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:54:53 +0200

On Thu, 27 Jun 2013 03:32:21 -0400

> +	install -D -m755 utils/sha1pass "$pkgdir"/usr/sbin/sha1pass || return 1

I had a look at this script but i don't like it.
1) IMHO its useless use of perl. A tiny C app using crypt(3) would do
the same job with less lines and without perl.
2) it requires that password is specified on command line. I think it
should at least optionally be able to read it from stdin.

Looks like it supports sha256/sha512 passwords. Maybe we could use
cryptpw instead?

Could you please test if the cryptpw generated passwd works? If so,
then we don't install sha1pass which does things bad.

---

---

From: Dubiousjim <[email-masked]>
Date: Fri, 28 Jun 2013 12:40:00 -0400

> then we don't install sha1pass which does things bad.

Ok, I'll queue that up. I was just taking that script from the syslinux
source folder.

-- 
Dubiousjim
[email-masked]

---

---

From: Dubiousjim <[email-masked]>
Date: Sat, 29 Jun 2013 16:51:50 -0400

> ...

In the instructions I wrote for generating a SHA1 password by hand
(though not the MD5 password), I'm still guilty of complaint #2. The
problem is that openssl can read data from stdin, but you'd have to be
sure the user prefixed the salt manually. Or you'd have to write a shell
script and do `echo -stty; read pass; echo stty` and then echo the salt
and the pass to openssl; or use Bash or C or something else.

I'm not going to do any of that right now.

-- 
Dubiousjim
[email-masked]

---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:17 -0400

Add a blank line between any entries added from /etc/update-extlinux.d/*.

Move the memtest entry (if any) after a separator line, below these.
---
 main/syslinux/update-extlinux | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index 014df1b..0dc3601 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -134,20 +134,24 @@ for kernel in $(find /boot -name "vmlinuz-*" -type f); do
 	lst=$(($lst + 1))
 done
 
+everbose "$lst entries found."
+
+for entry in /etc/update-extlinux.d/*; do
+	[ -f "$entry" ] && { cat $entry; echo ""; } >> $conf.new
+done
+
+echo "MENU SEPARATOR" >> $conf.new
+echo "" >> $conf.new
+
 if [ -f "/boot/memtest" ]; then
 	everbose "Found memtest86+: /boot/memtest"
 	echo "LABEL memtest" >> $conf.new
 	echo "  MENU LABEL Memtest86+" >> $conf.new
         echo "  KERNEL memtest" >> $conf.new
 	echo "" >> $conf.new
-	lst=$(($lst + 1))
 fi
 
-everbose "$lst entries found."
 
-for entry in /etc/update-extlinux.d/*; do
-	[ -f "$entry" ] && cat $entry >> $conf.new
-done
 
 	exit 0
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:41:13 +0200

On Thu, 27 Jun 2013 03:32:17 -0400

ACK

-nc

---

---

From: Dubiousjim <[email-masked]>
Date: Thu, 27 Jun 2013 03:32:20 -0400

---
 main/syslinux/update-extlinux | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/main/syslinux/update-extlinux b/main/syslinux/update-extlinux
index 66bc0ed..a8b0474 100755
--- a/main/syslinux/update-extlinux
+++ b/main/syslinux/update-extlinux
@@ -169,18 +169,22 @@ if [ -f "/boot/reboot.c32" ]; then
 	echo "" >> $conf.new
 fi
 
+if diff -q $conf.new $conf >/dev/null 2>&1; then
+	everbose "Configuration unchanged."
+	rm $conf.new
+fi
 
 if [ "$overwrite" != "1" ]; then
 	exit 0
-fi
+elif [ -f "$conf.new" ]; then
+	# keep a backup just in case
+	if [ -f "$conf" ]; then
+		mv $conf $conf.old
+	fi
 
-# keep a backup just in case
-if [ -f "$conf" ]; then
-	mv $conf $conf.old
+	mv $conf.new $conf
 fi
 
-mv $conf.new $conf
-
 everbose "Installing libutil.c32 libcom32.c32 mboot.c32 menu.c32 vesamenu.c32 to /boot."
 cp /usr/share/syslinux/libutil.c32 \
 	/usr/share/syslinux/libcom32.c32 \
-- 
1.8.3.1

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:43:42 +0200

On Thu, 27 Jun 2013 03:32:20 -0400

> +	everbose "Configuration unchanged."

maybe use 'cmp -s' instead of diff?

>  	/usr/share/syslinux/libcom32.c32 \

otherwise looks good to me.

-nc

---

---

From: Dubiousjim <[email-masked]>
Date: Fri, 28 Jun 2013 11:05:02 -0400

> maybe use 'cmp -s' instead of diff?

Fine by me.

If no one else weighs in... do you just want to apply what I sent and
amend the commit to use "cmp -s"? Or would you rather I send a new one?

-- 
Dubiousjim
[email-masked]

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 28 Jun 2013 16:35:49 +0200

On Thu, 27 Jun 2013 03:32:13 -0400

> syslinux/update-extlinux", 13 March), but it got lost in the noise. No worries.

Sorry about that.
 
>  3 files changed, 66 insertions(+), 20 deletions(-)

Looks good in general. Maybe William (original author) has comments?

If not I think I'll just apply.

btw, I'd like a --root or --basedir option so it could be run on a
separate root. (to be used with isolinux when generating the iso image)

(We'd still want make it easy to enable serial support, maybe just
uncomment a line or so)

-nc

---