Hi Alex,

Allowing 'empty-root-password' image feature + setting/expiring root password 
has been working for the past 10+ years. We should still allow it. In fact, we 
do.

Below is an example:
In conf/toolcfg.cfg:
OE_FRAGMENTS += "distro/poky core/yocto/root-login-with-empty-password
In local.conf:
INHERIT += "extrausers"
EXTRA_USERS_PARAMS += " passwd-expire root;"

The problem is that the banner is misleading when root has a password or is set 
to expire.

The solution of 'refusing to set a password for root' will send up as special 
cases in useradd_base.bbclass. I don't think this is an appropriate solution. 
And with doing this, we're breaking compatibility when unnecessary. 

The functions needs to run *after* set_user_group because this is where the 
root password is set or set to expire. The check is valid only after that.

I'll separate the '\n' change and send out V2.

Regards,
Qi


-----Original Message-----
From: Alexander Kanavin <[email protected]> 
Sent: Friday, November 28, 2025 10:11 PM
To: Chen, Qi <[email protected]>
Cc: [email protected]; [email protected]
Subject: Re: [OE-core][PATCH] rootfs-postcommands.bbclass: fix adding 'no 
password' banner

On Fri, 28 Nov 2025 at 10:16, Chen Qi via lists.openembedded.org 
<[email protected]> wrote:
> It's possible that users use EXTRA_USERS_PARAMS to set password for 
> root or explicitly expire root password. So we need to check these two 
> cases to ensure the 'no password' banner is not misleading.

Wait. The check is for the 'empty-root-password' IMAGE_FEATURE, so is your 
setup having that feature enabled, and then setting a root password somewhere 
else anyway?

I'd say the correct thing to do is to refuse to set a password if the feature 
is enabled. Can you show where and how it is done?

> We need to ensure that the function runs after set_user_group function 
> from extrausers.bbclass. So change to use :append.

Why? What does the function do, and why this needs to run after?

> Besides the above check, the '\n' at the end of the banner is also 
> removed. The '\n' in /etc/issue means hostname instead of new line.

Please do not bundle the unrelated changes, they should be all separate commits.

Alex
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#226923): 
https://lists.openembedded.org/g/openembedded-core/message/226923
Mute This Topic: https://lists.openembedded.org/mt/116511225/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to