wt/finit
1
0
Fork 0
mirror of https://github.com/troglobit/finit.git synced 2026-10-02 05:52:48 +07:00
Code Issues Packages Projects Releases Wiki Activity
Files
9875e764197319ee632466344a7c2f93e088ccef
finit/doc/build.md
T
Joachim Wiberg 63aabaa6df libink/dbus: identify the caller behind a broker 
On the local bus SO_PEERCRED says who is calling and the kernel is the
one saying it.  Behind a broker one connection carries every caller,
so that credential describes dbus-daemon and nothing else, and every
privileged method was refused there, root included.

Ask the bus driver instead.  libink parks the call and hands us the
sender; we ask GetConnectionUnixUser and answer when the reply lands,
through the same event loop as everything else.  Nothing blocks:
blocking in PID 1 is why libuEv exists.  That needs calls libink can
make on a connection it already has, so it gained those too.

Answers are cached, since a bus never reuses a unique name while it
runs.  Not across a restart though: a new dbus-daemon numbers from
scratch and :1.7 becomes somebody else, so the cache goes when the
broker does.  A sender name too long to key on is refused rather than
truncated, two callers sharing a truncated key would share an
identity.

Privilege is no longer uid 0 alone.  The socket is already owned by
the --with-group group, so refusing its members every method that
changes anything left a wheel user able to open the bus and unable to
reboot.  Both gates now say the same thing.

Group membership needs NSS, which the C library loads with dlopen(),
so the lookup is compiled out where Finit is built to link statically.
That leaves such a build root-only, which is worth saying out loud
rather than leaving to be discovered.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2026-08-13 10:15:06 +02:00

6.9 KiB
Raw Blame History

Building Finit

Finit comes with a traditional configure script to control features and optional plugins to enable. It depends on three external libraries:

Important

Most free/open source software packages that use configure default to install to /usr/local. However, some Linux distributions do no longer search that path for installed software, e.g. Fedora and Alpine Linux. To get finit's configure script to find its dependencies you have to help the pkg-config tool a bit if you do not change the default prefix path:

PKG_CONFIG_LIBDIR=/usr/local/lib/pkgconfig ./configure

The configure script checks for all dependencies, including the correct version of the above mentioned libraries. Currently required versions:

  • libite v2.2.0, or later
  • libuEv v2.2.0, or later
  • libConfuse v3.3, or later

Configure

Below are a few of the main switches to configure:

  • --prefix=..: Usually you want to set this to /usr, default is the GNU default: /usr/local

  • --exec-prefix=..: This you want to set to the empty string, or /, to ensure the programs finit and initctl are installed to the proper locations. Linux expects an "init" in /sbin, default: --prefix

  • --sysconfdir=..: follows --prefix, you likely want it to be /etc

  • --localstatedir=..: follows --prefix, you likely want /var

  • --enable-static: Build Finit statically. The plugins will be built-ins (.o files) and all external libraries, except the C library will be linked statically. Privileged D-Bus methods then accept only root, see Authorization

  • --enable-kernel-cmdline: Enable Finit pre-4.1 parsing of init args from /proc/cmdline, this is not recommended since Finit may be running as the init for container apps that can see the host's /proc filesystem

  • --disable-dbus: Opt out of Finit's built-in D-Bus support, enabled by default. See D-Bus Integration for what it provides. Not to be confused with --enable-dbus-plugin below, which only starts an external dbus-daemon

  • --enable-alsa-utils-plugin: Enable the optional alsa-utils.so sound plugin.

  • --enable-dbus-plugin: Enable the optional D-Bus dbus.so plugin, which launches dbus-daemon at boot. Unrelated to the built-in bus, see --disable-dbus above.

  • --enable-resolvconf-plugin: Enable the resolvconf.so optional plugin.

  • --enable-x11-common-plugin: Enable the optional X Window x11-common.so plugin.

  • --with-sulogin: Enable bundled sulogin program. Default is to use the system sulogin(8). The sulogin shipped with Finit allows password-less login if the root user is disabled or has no password at all.

For more configure flags, see ./configure --help

Note

The configure script is not available in the GIT sources. It is however included in (officially supported) released tarballs. The idea is that you should not need GNU autotools to build, only the above mentioned dependencies, a POSIX shell, a C compiler and make. Any contributing to Finit can generate it from configure.ac using the autogen.sh script.

Example

First, unpack the archive:

$ tar xf finit-4.3.tar.gz
$ cd finit-4.3/

Then configure, build and install:

$ ./configure --prefix=/usr                 --exec-prefix=         \
              --sysconfdir=/etc             --localstatedir=/var   \
              --with-keventd                --with-watchdog
$ make
.
.
.
$ DESTDIR=/tmp/finit make install

In this example the finit-4.3.tar.gz archive is unpacked to the user's home directory, configured, built and installed to a temporary staging directory. The environment variable DESTDIR controls the destination directory when installing, very useful for building binary standalone packages.

Finit 4.1 and later can detect if it runs on an embedded system, or a system that use BusyBox tools instead of udev & C:o. On such systems mdev instead of udev is used. However, remember to also change the Linux config to:

CONFIG_UEVENT_HELPER_PATH="/sbin/mdev"

Tip

If you run into problems starting Finit, take a look at finit.c. One of the most common problems is a custom Linux kernel build that lack CONFIG_DEVTMPFS. Another is too much cruft in the system /etc/fstab.

Running

Having successfully built Finit it is now be time to take it for a test drive. The make install attempts to set up finit as the system system init, /sbin/init, but this is usually a symlink pointing to the current init.

So either change the symlink, or change your boot loader (GRUB, LOADLIN, LILO, U-Boot/Barebox or RedBoot) configuration to append the following to the kernel command line:

append="init=/sbin/finit"

Remember to also set up an initial /etc/finit.conf before rebooting!

Recovery

To rescue a system with Finit, append the following to the kernel command line:

append="init=/sbin/finit rescue"

This tells Finit to start in a very limited recovery mode, no services are loaded, no filesystems are mounted or checked, and no networking is enabled. The default Finit rescue mode configuration is installed into /lib/finit/rescue.conf, which can be safely removed or changed.

By default the a root shell, without login, is started.

Important

In rescue mode initctl will not work, the same goes for reboot, shutdown, and poweroff commands, provided they are the Finit versions of these commands. Use the -f flag to force the action.

Debugging

Edit, or append to, the kernel command line: remove quiet to enable kernel messages and add finit.debug to enable Finit debug messages.

append="init=/sbin/finit -- finit.debug"

Notice the -- separator.

To debug startup issues, in particular issues with getty/login, add the following to your Finit .conf file:

tty board {
    runlevel = "12345789"
    notty    = true
    noclear  = true
}

The notty option ensures reusing the stdin/stdout set up by the kernel. Remember, this is only for debugging and would leave your production system potentially wide open.

There is also a rescue shell available, in case Finit crashes and the kernel usually reboots: configure --enable-emergency-shell. However, the behavior of Finit is severely limited when this is enabled, so use it only for debugging start up issues when Finit crashes.

Caution

None of these options should be enabled on production systems since they can potentially give a user root access.

Reference in New Issue View Git Blame Copy Permalink