add stuff
This commit is contained in:
angryzero committed
commit
26cd15d899
65 files changed
+4820
No files matched your search
@@ -0,0 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLzgdRrwTGWMSHIurddPrQBY/2zOk+BlsU4jJWtPh/B vidaa-root
|
||||
Executable
+97
@@ -0,0 +1,97 @@
|
||||
#!/bin/sh
|
||||
# deploy_sshd.sh — run as root on the TV (e.g. via the root loop).
|
||||
#
|
||||
# Expects in /3rd_rw/appdata:
|
||||
# dropbear dropbearkey authorized_keys start_sshd.sh root_loop.sh
|
||||
# hamservice-wrapper.sh
|
||||
# Upload these with root/scripts/host/upload_to_appdata.js (or File.download).
|
||||
#
|
||||
# Installs:
|
||||
# /3rd_rw/sshd/{dropbear,dropbearkey,host_key,etc_passwd,start_sshd.sh,home/.ssh/authorized_keys}
|
||||
# /3rd_rw/hamservice/HamService (wrapper; replaces the symlink)
|
||||
# bind /etc/passwd -> /3rd_rw/sshd/etc_passwd
|
||||
# devpts /dev/shm/pts -> bind /dev/pts (PTY workaround)
|
||||
# Dropbear on 0.0.0.0:22, key-only root login
|
||||
#
|
||||
# Reversible with rollback.sh or the ROOT-GUIDE.
|
||||
set -e
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
APP=/3rd_rw/appdata
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== deploy_sshd: start ==="
|
||||
for f in dropbear dropbearkey authorized_keys start_sshd.sh root_loop.sh hamservice-wrapper.sh; do
|
||||
[ -f "$APP/$f" ] || { echo "missing: $APP/$f"; exit 1; }
|
||||
done
|
||||
|
||||
mkdir -p "$D/home/.ssh" /3rd_rw/hamservice
|
||||
|
||||
# --- binaries + host key -------------------------------------------------
|
||||
cp -f "$APP/dropbear" "$D/dropbear"
|
||||
if [ -f "$APP/dropbear-sftp" ]; then
|
||||
cp -f "$APP/dropbear-sftp" "$D/dropbear"
|
||||
echo "using SFTP-capable dropbear"
|
||||
fi
|
||||
chmod 755 "$D/dropbear"
|
||||
cp -f "$APP/dropbearkey" "$D/dropbearkey"; chmod 755 "$D/dropbearkey"
|
||||
if [ -f "$APP/sftp-server" ]; then
|
||||
cp -f "$APP/sftp-server" "$D/sftp-server"
|
||||
chmod 755 "$D/sftp-server"
|
||||
echo "sftp-server installed"
|
||||
fi
|
||||
if [ ! -f "$D/host_key" ]; then
|
||||
"$D/dropbearkey" -t ed25519 -f "$D/host_key"
|
||||
fi
|
||||
|
||||
# --- root home via bind-mounted passwd -----------------------------------
|
||||
cp -f /etc/passwd "$D/etc_passwd"
|
||||
sed -i 's|^root:x:0:0:root:.*|root:x:0:0:root:/3rd_rw/sshd/home:/bin/sh|' "$D/etc_passwd"
|
||||
if ! grep -q '^root:x:0:0:root:/3rd_rw/sshd/home:' /etc/passwd 2>/dev/null; then
|
||||
mount --bind "$D/etc_passwd" /etc/passwd 2>>"$D/mount.log" \
|
||||
|| mount -o bind "$D/etc_passwd" /etc/passwd 2>>"$D/mount.log"
|
||||
fi
|
||||
|
||||
# --- PTY: devpts on tmpfs, bind over /dev/pts -----------------------------
|
||||
mkdir -p /dev/shm/pts
|
||||
if ! grep -q ' /dev/shm/pts ' /proc/mounts; then
|
||||
mount -t devpts -o mode=620,ptmxmode=666,gid=5 devpts /dev/shm/pts 2>>"$D/mount.log" \
|
||||
|| mount -t devpts devpts /dev/shm/pts 2>>"$D/mount.log"
|
||||
fi
|
||||
if ! grep -q ' /dev/pts ' /proc/mounts; then
|
||||
mount --bind /dev/shm/pts /dev/pts 2>>"$D/mount.log"
|
||||
fi
|
||||
|
||||
# --- authorized key / permissions ----------------------------------------
|
||||
cp -f "$APP/authorized_keys" "$D/home/.ssh/authorized_keys"
|
||||
chmod 700 "$D/home" "$D/home/.ssh"
|
||||
chmod 600 "$D/home/.ssh/authorized_keys"
|
||||
chown -R 0:0 "$D"
|
||||
|
||||
# --- start script + root loop + boot wrapper -----------------------------
|
||||
cp -f "$APP/start_sshd.sh" "$D/start_sshd.sh"; chmod 755 "$D/start_sshd.sh"
|
||||
chmod 644 "$APP/root_loop.sh"
|
||||
rm -f /3rd_rw/hamservice/HamService
|
||||
cp -f "$APP/hamservice-wrapper.sh" /3rd_rw/hamservice/HamService
|
||||
chmod 755 /3rd_rw/hamservice/HamService
|
||||
|
||||
# --- start now (idempotent) ----------------------------------------------
|
||||
/bin/sh "$D/start_sshd.sh"
|
||||
sleep 2
|
||||
|
||||
echo "--- passwd root entry ---"
|
||||
grep '^root:' /etc/passwd
|
||||
echo "--- mounts ---"
|
||||
grep -E ' /etc/passwd | /dev/pts | /dev/shm/pts ' /proc/mounts
|
||||
echo "--- processes ---"
|
||||
ps | grep -E 'dropbear|root_loop' | grep -v grep || true
|
||||
echo "--- tcp 22 ---"
|
||||
cat /proc/net/tcp | grep -i ':0016' || true
|
||||
echo "--- dropbear log ---"
|
||||
/bin/busybox tail -n 8 "$D/dropbear.log" 2>&1 || true
|
||||
echo "--- host key ---"
|
||||
"$D/dropbearkey" -y -f "$D/host_key" 2>&1 | /bin/busybox tail -n 3 || true
|
||||
echo "--- files ---"
|
||||
ls -la "$D" "$D/home/.ssh" /3rd_rw/hamservice
|
||||
echo "=== deploy_sshd: done ==="
|
||||
Executable
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
Executable
BIN
Binary file not shown.
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
# /3rd_rw/hamservice/HamService (wrapper; install via deploy_sshd.sh)
|
||||
# Early-ish boot hook (startHam.sh, after ~15 s): starts the root loop and
|
||||
# Dropbear, then executes the real HamService. Reversible:
|
||||
# rm /3rd_rw/hamservice/HamService
|
||||
# ln -s /3rd/hamservice/HamService /3rd_rw/hamservice/HamService
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
/bin/sh /3rd_rw/appdata/root_loop.sh >/dev/null 2>&1 &
|
||||
[ -x /3rd_rw/sshd/start_sshd.sh ] && /bin/sh /3rd_rw/sshd/start_sshd.sh >/dev/null 2>&1 &
|
||||
|
||||
exec /3rd/hamservice/HamService "$@"
|
||||
Binary file not shown.
Executable
+29
@@ -0,0 +1,29 @@
|
||||
#!/bin/sh
|
||||
# rollback.sh — remove the root/SSH persistence layers (run as root).
|
||||
# The rootfs is untouched; this only removes /3rd_rw changes + runtime mounts.
|
||||
# Reboot afterwards for a clean state.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== rollback: stopping loop/dropbear ==="
|
||||
[ -f /3rd_rw/appdata/root_loop.pid ] && kill "$(cat /3rd_rw/appdata/root_loop.pid)" 2>/dev/null || true
|
||||
[ -f "$D/dropbear.pid" ] && kill "$(cat "$D/dropbear.pid")" 2>/dev/null || true
|
||||
|
||||
echo "=== restore HamService symlink ==="
|
||||
rm -f /3rd_rw/hamservice/HamService
|
||||
ln -s /3rd/hamservice/HamService /3rd_rw/hamservice/HamService
|
||||
|
||||
echo "=== unmount runtime bind mounts ==="
|
||||
umount /etc/passwd 2>/dev/null || true
|
||||
umount /dev/pts 2>/dev/null || true
|
||||
umount /dev/shm/pts 2>/dev/null || true
|
||||
|
||||
echo "=== remove sshd dir + shadows ==="
|
||||
rm -rf "$D"
|
||||
rm -f /3rd_rw/loglevel/lib/libtvsysinfo.so
|
||||
rm -f /3rd_rw/ms-screen/lib/liblogLevel.so
|
||||
rm -f /3rd_rw/appdata/liblogLevel.so
|
||||
sync
|
||||
|
||||
echo "=== rollback done; reboot recommended ==="
|
||||
Executable
+25
@@ -0,0 +1,25 @@
|
||||
#!/bin/sh
|
||||
# /3rd_rw/appdata/root_loop.sh
|
||||
# Root command loop. One instance per boot (boot_id lock).
|
||||
# Write /3rd_rw/appdata/root_cmd.sh; read /3rd_rw/appdata/root_out.txt.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
|
||||
BID=""
|
||||
[ -r /proc/sys/kernel/random/boot_id ] && BID=$(cat /proc/sys/kernel/random/boot_id 2>/dev/null)
|
||||
[ -z "$BID" ] && BID=0
|
||||
LOCK="/3rd_rw/appdata/root_loop.lock.$BID"
|
||||
mkdir "$LOCK" 2>/dev/null || exit 0
|
||||
|
||||
echo "$$" > /3rd_rw/appdata/root_loop.pid
|
||||
echo "loop started $$ $BID" > /3rd_rw/appdata/root_loop.log
|
||||
|
||||
while true; do
|
||||
if [ -f /3rd_rw/appdata/root_cmd.sh ]; then
|
||||
mv /3rd_rw/appdata/root_cmd.sh /3rd_rw/appdata/root_cmd.run
|
||||
/bin/sh /3rd_rw/appdata/root_cmd.run > /3rd_rw/appdata/root_out.txt 2>&1
|
||||
echo "rc=$?" >> /3rd_rw/appdata/root_out.txt
|
||||
mv /3rd_rw/appdata/root_cmd.run /3rd_rw/appdata/root_cmd.done
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
Executable
BIN
Binary file not shown.
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/bin/sh
|
||||
# /3rd_rw/sshd/start_sshd.sh
|
||||
# Starts Dropbear with key-only auth. Also re-creates the runtime bind mounts:
|
||||
# /etc/passwd -> /3rd_rw/sshd/etc_passwd (root home -> /3rd_rw/sshd/home)
|
||||
# /dev/pts -> devpts on /dev/shm/pts (PTY workaround; /dev is static ro)
|
||||
# Must run as root. Idempotent.
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
mkdir -p /3rd_rw/sshd
|
||||
|
||||
# 1) passwd bind mount (root home must be writable for ~/.ssh/authorized_keys)
|
||||
if ! grep -q '^root:x:0:0:root:/3rd_rw/sshd/home:' /etc/passwd 2>/dev/null; then
|
||||
mount --bind /3rd_rw/sshd/etc_passwd /etc/passwd 2>>/3rd_rw/sshd/mount.log \
|
||||
|| mount -o bind /3rd_rw/sshd/etc_passwd /etc/passwd 2>>/3rd_rw/sshd/mount.log
|
||||
fi
|
||||
|
||||
# 2) PTY: /dev is a static ro squashfs, no devtmpfs. Mount devpts on tmpfs
|
||||
# and bind it over /dev/pts. /dev/ptmx (5,2) remains the static node.
|
||||
mkdir -p /dev/shm/pts
|
||||
if ! grep -q ' /dev/shm/pts ' /proc/mounts; then
|
||||
mount -t devpts -o mode=620,ptmxmode=666,gid=5 devpts /dev/shm/pts 2>>/3rd_rw/sshd/mount.log \
|
||||
|| mount -t devpts devpts /dev/shm/pts 2>>/3rd_rw/sshd/mount.log
|
||||
fi
|
||||
if ! grep -q ' /dev/pts ' /proc/mounts; then
|
||||
mount --bind /dev/shm/pts /dev/pts 2>>/3rd_rw/sshd/mount.log
|
||||
fi
|
||||
|
||||
# 3) already running?
|
||||
if [ -f /3rd_rw/sshd/dropbear.pid ]; then
|
||||
PID=$(cat /3rd_rw/sshd/dropbear.pid)
|
||||
if kill -0 "$PID" 2>/dev/null && grep -q dropbear "/proc/$PID/cmdline" 2>/dev/null; then
|
||||
exit 0
|
||||
fi
|
||||
rm -f /3rd_rw/sshd/dropbear.pid
|
||||
fi
|
||||
|
||||
# 4) start key-only Dropbear (password auth is disabled at build time)
|
||||
/3rd_rw/sshd/dropbear -r /3rd_rw/sshd/host_key -p 22 \
|
||||
-P /3rd_rw/sshd/dropbear.pid -E >> /3rd_rw/sshd/dropbear.log 2>&1 &
|
||||
Executable
+47
@@ -0,0 +1,47 @@
|
||||
#!/bin/sh
|
||||
# verify.sh — quick health check for the rooted TV (run as root).
|
||||
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin
|
||||
export PATH
|
||||
D=/3rd_rw/sshd
|
||||
|
||||
echo "=== proof ==="
|
||||
cat /3rd_rw/root_proof.txt 2>&1
|
||||
|
||||
echo "=== root loop ==="
|
||||
cat /3rd_rw/appdata/root_loop.pid 2>&1
|
||||
ps | grep root_loop | grep -v grep || true
|
||||
|
||||
echo "=== dropbear ==="
|
||||
ps | grep dropbear | grep -v grep || true
|
||||
cat /proc/net/tcp | grep -i ':0016' || true
|
||||
/bin/busybox tail -n 10 "$D/dropbear.log" 2>&1 || true
|
||||
|
||||
echo "=== sftp (optional) ==="
|
||||
if [ -f /3rd_rw/sshd/sftp-server ]; then
|
||||
echo "sftp-server present"
|
||||
else
|
||||
echo "sftp-server missing (optional)"
|
||||
fi
|
||||
if grep -q '/3rd_rw/sshd/sftp-server' /3rd_rw/sshd/dropbear 2>/dev/null; then
|
||||
echo "dropbear SFTP path OK"
|
||||
else
|
||||
echo "dropbear unpatched (optional; install_sftp.sh)"
|
||||
fi
|
||||
|
||||
echo "=== passwd / root home ==="
|
||||
grep '^root:' /etc/passwd
|
||||
|
||||
echo "=== authorized key ==="
|
||||
ls -l "$D/home/.ssh/authorized_keys" 2>&1
|
||||
/bin/busybox head -c 120 "$D/home/.ssh/authorized_keys" 2>&1; echo
|
||||
|
||||
echo "=== mounts ==="
|
||||
grep -E ' /etc/passwd | /dev/pts | /dev/shm/pts ' /proc/mounts
|
||||
|
||||
echo "=== current uid/gid (this shell) ==="
|
||||
grep -E '^(Uid|Gid|CapEff):' /proc/self/status
|
||||
|
||||
echo "=== host key ==="
|
||||
"$D/dropbearkey" -y -f "$D/host_key" 2>&1 | /bin/busybox tail -n 3 || true
|
||||
|
||||
echo "=== verify done ==="
|
||||
Reference in new issue
Block a user