From: Chen Qi <Qi.Chen@windriver.com>
Date: Wed, 17 Dec 2025 05:22:40 +0000 (+0000)
Subject: rootfs-postcommands.bbclass: fix adding 'no password' banner
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b650bd2c94f9aefd4dec82b27285ed1d439778bc;p=thirdparty%2Fopenembedded%2Fopenembedded-core.git

rootfs-postcommands.bbclass: fix adding 'no password' banner

It's possible that users use EXTRA_USERS_PARAMS to set password
for root or explicitly expire root password. So we need to check
these two cases to ensure the 'no password' banner is not misleading.

As an example, below are configurations to make an image requiring
setting a root password on first boot, but without having to first enter
a static initial password:

  In conf/toolcfg.cfg:
  OE_FRAGMENTS += "distro/poky core/yocto/root-login-with-empty-password
  In local.conf:
  INHERIT += "extrausers"
  EXTRA_USERS_PARAMS += " passwd-expire root;"

Adding such banner is only meaningful when base-passwd and baes-files are
installed. In case of container image, they might not be installed (e.g.,
container-test-image). So add extra checking for it. With the above logic,
we avoid breaking the following oe-selftest test case:
containerimage.ContainerImageTests.test_expected_files

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---

diff --git a/meta/classes-recipe/rootfs-postcommands.bbclass b/meta/classes-recipe/rootfs-postcommands.bbclass
index f4fbc4c57e..2a36840f29 100644
--- a/meta/classes-recipe/rootfs-postcommands.bbclass
+++ b/meta/classes-recipe/rootfs-postcommands.bbclass
@@ -5,7 +5,7 @@
 #
 
 # Zap the root password if empty-root-password feature is not enabled
-ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES", "empty-root-password", "add_empty_root_password_note", "zap_empty_root_password ",d)}'
+ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES", "empty-root-password", "", "zap_empty_root_password ",d)}'
 
 # Allow dropbear/openssh to accept logins from accounts with an empty password string if allow-empty-password is enabled
 ROOTFS_POSTPROCESS_COMMAND += '${@bb.utils.contains("IMAGE_FEATURES", "allow-empty-password", "ssh_allow_empty_password ", "",d)}'
@@ -58,6 +58,9 @@ inherit image-artifact-names
 SORT_PASSWD_POSTPROCESS_COMMAND ??= "tidy_shadowutils_files"
 ROOTFS_POSTPROCESS_COMMAND += '${SORT_PASSWD_POSTPROCESS_COMMAND}'
 
+# Check and add 'no root password' banner.
+ROOTFS_POSTPROCESS_COMMAND += "add_empty_root_password_note"
+
 #
 # Note that useradd-staticids.bbclass has to be used to ensure that
 # the numeric IDs of dynamically created entries remain stable.
@@ -259,8 +262,14 @@ zap_empty_root_password () {
 # This function adds a note to the login banner that the system is configured for root logins without password
 #
 add_empty_root_password_note () {
-	echo "Type 'root' to login with superuser privileges (no password will be asked)." >> ${IMAGE_ROOTFS}/etc/issue
-	echo "" >> ${IMAGE_ROOTFS}/etc/issue
+	if [ -e ${IMAGE_ROOTFS}/etc/shadow -a -e ${IMAGE_ROOTFS}/etc/issue ]; then
+		rootpw="`grep '^root:' ${IMAGE_ROOTFS}/etc/shadow | cut -d':' -f2`"
+		rootpw_lastchanged="`grep "^root:" ${IMAGE_ROOTFS}/etc/shadow | cut -d: -f3`"
+		if [ -z "$rootpw" -a "$rootpw_lastchanged" != "0" ]; then
+			echo "Type 'root' to login with superuser privileges (no password will be asked)." >> ${IMAGE_ROOTFS}/etc/issue
+			echo "" >> ${IMAGE_ROOTFS}/etc/issue
+		fi
+	fi
 }
 
 #