Device doesn't reboot after update about iot-hub-device-update HOT 8 CLOSED

After comparing the bitbake files to the postinst script found in the .deb package, I discovered that the permissions are not set correctly in Yocto. If you have the time, feel free to post me an update ... Here are the commands I had to run:

mkdir -p /home/adu /home/do
chown adu:adu /home/adu
chown do:do /home/do
chmod u=rwx,g=rx /home/adu
chmod u=rwx,g=rx/home/do
chmod u=rwx,g=rx /home/do

chown "root:adu" /usr/lib/adu/adu-shell
chmod u=rxs /usr/lib/adu/adu-shell
setfacl -m "group::---" /usr/lib/adu/adu-shell
setfacl -m "user::r--" /usr/lib/adu/adu-shell
setfacl -m "user:adu:r-x" /usr/lib/adu/adu-shell

from iot-hub-device-update.

Hi @SimonSimCity,

Thank you for raising this issue. We will investigate and add a fix in our code.

from iot-hub-device-update.

I tried to pack those lines mentioned into my recipe, but that complained about not finding setfacl. As I've tried, it doesn't work if I just set the permission to something different.

I noticed that the script didn't set the group of the file to adu, but left it as root. Therefore, I replaced all ${PN}-adu parameters by ${PN} - removing the -adu and removed the EXTRA_USERS_PARAMS setting from the file meta-azure-device-update/conf/layer.conf - otherwise the user and group adu and do were created too late for the script to use it on install. Before I had a ton of problems because the permissions weren't applied.

Now that the permissions are set correctly, all makes sense again; let me explained:

The update service is running as adu, so this user should be able to flash the device; but flashing is only permitted by root. This can be achieved by setting the s flag for the file. As pointed out at the comment on the question https://unix.stackexchange.com/questions/118853/what-does-the-s-attribute-in-file-permissions-mean#comment186210_118854:

If setuid bit is set, it executes with ITS owner's permissions (usually root's), no matter who calls it.

This also means, that there wasn't a need for changing the permissions - the problem really was, that the users and groups were created too late in the process, so the install script gave the file a group-relation of root instead of adu.

from iot-hub-device-update.

I've created a repository to document my changes of the yocto layer. Here's the commit to fix this problem: munit-solutions/meta-azure-device-update@58a74e3

from iot-hub-device-update.

I've created a repository to document my changes of the yocto layer. Here's the commit to fix this problem: SimonSimCity/meta-azure-device-update@58a74e3

@SimonSimCity Hi, thank you for the investigation and contribution! But I cannot access this link (maybe I don't have permission to your fork) - do you mind creating a Pull Request to our repo so I can read/merge it?

from iot-hub-device-update.

I've created a repository to document my changes of the yocto layer. Here's the commit to fix this problem: SimonSimCity/meta-azure-device-update@58a74e3

@SimonSimCity Hi, thank you for the investigation and contribution! But I cannot access this link (maybe I don't have permission to your fork) - do you mind creating a Pull Request to our repo so I can read/merge it?

Okie I found the link from another open issue. munit-solutions/meta-azure-device-update@53a54e7
This is actually out of scope of this iot-hub-device-update repo, so I understand that no PR will be created.
Is your problem resolved with your changes?

from iot-hub-device-update.

@shiyi-peng Sorry for the late answer on this ticket. I've moved the repo to a different organization lately, so that's where the error comes from. Here's the correct link of the referred change: munit-solutions/meta-azure-device-update@58a74e3

If you apply this patch the users should be created by Yocto as expected.

As said, those changes are only related to yocto-scripts, which are not yet in a repository but only provided as an artefact. I've created a repository for the yocto meta-layer, so the community can work on improving the layer for everyone.

from iot-hub-device-update.

Closing this issue as there has been no activity on this thread. Please feel free to open an issue if needed.
Our Yocto layers published in this repo and will be maintained for our releases: https://github.com/Azure/iot-hub-device-update-yocto

from iot-hub-device-update.