diff --git a/meta-openeuler/recipes-core/os-base/os-base/fstab b/meta-openeuler/recipes-core/os-base/os-base/fstab index 26247ff28ea4f01d8d9cc69d2069ec6a15f2bad4..a1ddb366b705f62efd195451f716624a056d9797 100644 --- a/meta-openeuler/recipes-core/os-base/os-base/fstab +++ b/meta-openeuler/recipes-core/os-base/os-base/fstab @@ -1,9 +1,9 @@ -proc /proc proc defaults,nofail 0 0 -sysfs /sys sysfs defaults,nofail 0 0 +proc /proc proc defaults 0 0 +sysfs /sys sysfs defaults 0 0 none /var tmpfs nodev,nosuid,mode=755,noexec 0 0 -none /var/log/audit tmpfs nodev,nosuid,mode=755,nofail 0 0 -devtmpfs /dev devtmpfs defaults,nofail 0 0 +none /var/log/audit tmpfs nodev,nosuid,mode=755 0 0 +devtmpfs /dev devtmpfs defaults 0 0 tmpfs /dev/shm tmpfs nodev,nosuid,mode=1777,noexec 0 0 -devpts /dev/pts devpts mode=620,nofail 0 0 +devpts /dev/pts devpts mode=620 0 0 tmpfs /tmp tmpfs nodev,nosuid,noexec 0 0 -tmpfs /opt tmpfs defaults,mode=0750,nofail 0 0 +tmpfs /opt tmpfs defaults,mode=0750 0 0 diff --git a/meta-openeuler/recipes-core/os-base/os-base_1.0.bb b/meta-openeuler/recipes-core/os-base/os-base_1.0.bb index fc2ecd64b1edbb561d6a3f02b3fb508b534597ad..942954a8f159e0dcac0a58c46f72b2e0d6574c13 100644 --- a/meta-openeuler/recipes-core/os-base/os-base_1.0.bb +++ b/meta-openeuler/recipes-core/os-base/os-base_1.0.bb @@ -21,7 +21,9 @@ SRC_URI = "file://bashrc \ file://profile \ file://securetty \ file://shadow \ - file://sysctl.conf" + file://sysctl.conf \ + file://rc.functions \ + file://rc.sysinit" do_install() { install -d ${D}/etc @@ -38,6 +40,9 @@ do_install() { cp ${WORKDIR}/securetty ${D}/etc/ cp ${WORKDIR}/shadow ${D}/etc/ cp ${WORKDIR}/sysctl.conf ${D}/etc/ + install -d ${D}/etc/rc.d + cp ${WORKDIR}/rc.functions ${D}/etc/rc.d + cp ${WORKDIR}/rc.sysinit ${D}/etc/rc.d } diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account index d00fde09120cb5b50d6400d3e274a18e1757fa91..0a9d30a5d315b2d983a4e469f21e9a412077bce1 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-account @@ -1,4 +1,4 @@ -account required pam_faillock.so -account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so -account requisite pam_deny.so -account required pam_permit.so +account required pam_faillock.so +account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so +account requisite pam_deny.so +account required pam_permit.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth index 4306fd74a71edf4c549d26f64cdb911609693957..d77adbe5af2e398d86a37db5f82a16165b9b06e0 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-auth @@ -1,7 +1,7 @@ -auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=300 -auth sufficient pam_unix.so nullok try_first_pass -auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=300 -auth requisite pam_listfile.so item=user onerr=succeed sense=deny file=/etc/login.user.deny -auth [success=1 default=ignore] pam_unix.so -auth required pam_deny.so -auth required pam_permit.so +auth required pam_faillock.so preauth audit deny=3 even_deny_root unlock_time=300 +auth sufficient pam_unix.so nullok try_first_pass +auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root unlock_time=300 +auth requisite pam_listfile.so item=user onerr=succeed sense=deny file=/etc/login.user.deny +auth [success=1 default=ignore] pam_unix.so +auth required pam_deny.so +auth required pam_permit.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password index 155775e57e7d30bb73fc871158a396be980a6886..06335bf722ef8b71cd88ca6d1821a5e7a5345d1a 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-password @@ -1,5 +1,5 @@ -password requisite pam_pwquality.so try_first_pass minclass=3 minlen=8 lcredit=0 ucredit=0 dcredit=0 ocredit=0 reject_username gecoscheck retry=3 enforce_for_root -password required pam_pwhistory.so remember=5 use_authtok enforce_for_root -password [success=1 default=ignore] pam_unix.so use_authtok nullok sha512 -password requisite pam_deny.so -password required pam_permit.so +password requisite pam_pwquality.so try_first_pass minclass=3 minlen=8 lcredit=0 ucredit=0 dcredit=0 ocredit=0 reject_username gecoscheck retry=3 enforce_for_root +password required pam_pwhistory.so remember=5 use_authtok enforce_for_root +password [success=1 default=ignore] pam_unix.so use_authtok nullok sha512 +password requisite pam_deny.so +password required pam_permit.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session index 7a1e3a527076b77c161eee6a333ffe792c867c28..94765c85d4d6be0ef9bd083f59cff79fd980b752 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session @@ -1,19 +1,19 @@ -# -# /etc/pam.d/common-session - session-related modules common to all services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define tasks to be performed -# at the start and end of sessions of *any* kind (both interactive and -# non-interactive). -# - -# here are the per-package modules (the "Primary" block) -session [default=1] pam_permit.so -# here's the fallback if no module succeeds -session requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -session required pam_permit.so -# and here are more per-package modules (the "Additional" block) -session required pam_unix.so +# +# /etc/pam.d/common-session - session-related modules common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of sessions of *any* kind (both interactive and +# non-interactive). +# + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# and here are more per-package modules (the "Additional" block) +session required pam_unix.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive index 79518d1de1c52e4a8c3320b44210ca9ae5c7cbfd..a9c830d4c9b131f5142477f3d24552d76000d3cc 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/common-session-noninteractive @@ -1,19 +1,19 @@ -# -# /etc/pam.d/common-session-noninteractive - session-related modules -# common to all non-interactive services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define tasks to be performed -# at the start and end of all non-interactive sessions. -# - -# here are the per-package modules (the "Primary" block) -session [default=1] pam_permit.so -# here's the fallback if no module succeeds -session requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -session required pam_permit.so -# and here are more per-package modules (the "Additional" block) -session required pam_unix.so +# +# /etc/pam.d/common-session-noninteractive - session-related modules +# common to all non-interactive services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of all non-interactive sessions. +# + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# and here are more per-package modules (the "Additional" block) +session required pam_unix.so diff --git a/meta-openeuler/recipes-core/pam/libpam/pam.d/other b/meta-openeuler/recipes-core/pam/libpam/pam.d/other index 696f789eb97afd440e038622230f5d0cfd8f24ef..010d5d11d82279fcfb2112dd45bd25a705ecf87d 100644 --- a/meta-openeuler/recipes-core/pam/libpam/pam.d/other +++ b/meta-openeuler/recipes-core/pam/libpam/pam.d/other @@ -1,24 +1,24 @@ -# -# /etc/pam.d/other - specify the PAM fallback behaviour -# -# Note that this file is used for any unspecified service; for example -#if /etc/pam.d/cron specifies no session modules but cron calls -#pam_open_session, the session module out of /etc/pam.d/other is -#used. - -# We use pam_warn.so to generate syslog notes that the 'other' -#fallback rules are being used (as a hint to suggest you should setup -#specific PAM rules for the service and aid to debugging). Then to be -#secure, deny access to all services by default. - -auth required pam_warn.so -auth required pam_deny.so - -account required pam_warn.so -account required pam_deny.so - -password required pam_warn.so -password required pam_deny.so - -session required pam_warn.so -session required pam_deny.so +# +# /etc/pam.d/other - specify the PAM fallback behaviour +# +# Note that this file is used for any unspecified service; for example +#if /etc/pam.d/cron specifies no session modules but cron calls +#pam_open_session, the session module out of /etc/pam.d/other is +#used. + +# We use pam_warn.so to generate syslog notes that the 'other' +#fallback rules are being used (as a hint to suggest you should setup +#specific PAM rules for the service and aid to debugging). Then to be +#secure, deny access to all services by default. + +auth required pam_warn.so +auth required pam_deny.so + +account required pam_warn.so +account required pam_deny.so + +password required pam_warn.so +password required pam_deny.so + +session required pam_warn.so +session required pam_deny.so