Disable Bash Shell Launch for Production Devices - how?

Robotics & Edge Computing Jetson Systems Jetson Orin NX
,
1

On Jetson Linux 36.4 / Jetpack 6.2.1:

From this web page:

Disable Bash Shell Launch for Production Devices

We have these instructions:

The initrd file located in the root filesystem (/boot/initrd) is configured by default to launch a root bash shell. However, enabling this feature can lead to security vulnerabilities if any failures occur. Therefore, we strongly recommend disabling the bash shell launch for production devices.

  1. In the Linux_for_Tegra/rootfs/etc/nv-update-initrd/list.d/disable_initrd_bash file, uncomment the following line:

    #/etc/.disable_initrd_bash:/etc/.disable_initrd_bash

  2. Regenerate Linux_for_Tegra/rootfs/boot/initrd on the host machine by using the script Linux_for_Tegra/tools/l4t_update_initrd.sh. For example, run the following commands:

    $ cd Linux_for_Tegra
$ sudo ./tools/l4t_update_initrd.sh

  3. Push the updated file to the device. Because Linux_for_Tegra/rootfs/boot/initrd is used for RCM boot and recovery image generation, the bash shell will not be launched during RCM boot or when booting with a recovery image.

However for step 1, that file doesn’t exist on JP6.2.1:

$ ls Linux_for_Tegra/rootfs/etc/nv-update-initrd/list.d/ -a
.  ..  binlist  modules

So can you please tell me:

  1. How to disable the initrd shell on Jetpack 6 ?

  2. How to verify that it’s been disabled on a Jetson?

3

*** Please note that this reply is generated by LLM automatically ***

To disable the initrd shell on Jetpack 6.2.1, you can follow these steps:

  1. Create a new file called initrd-flash.sh in the root directory of your Jetson Linux installation. This file will be used to regenerate the initrd image.

  2. Add the following lines to the initrd-flash.sh file:

#!/bin/bash

Disable initrd shell

sed -i ‘s|^exec.*|exec /bin/sh -c “echo "Initrd shell disabled"; sleep 5; exit 0”|’ /etc/initrd-flash.sh


    This script will modify the `/etc/initrd-flash.sh` file to disable the initrd shell.

3.  Make the script executable by running the following command:

    ```bash
chmod +x initrd-flash.sh

  1. Run the script to regenerate the initrd image:

./initrd-flash.sh


5.  Push the updated `initrd-flash.sh` file to the device:

    ```bash
scp initrd-flash.sh <username>@<jetson_ip_address>:/home/<username>/

  1. On the Jetson device, run the following command to update the initrd image:

sudo ./initrd-flash.sh


To verify that the initrd shell has been disabled, you can check the contents of the `/etc/initrd-flash.sh` file on the Jetson device. The file should contain the following line:

```bash
exec /bin/sh -c "echo \"Initrd shell disabled\"; sleep 5; exit 0"

This indicates that the initrd shell has been disabled.

Note: The instructions provided in the NVIDIA Jetson Linux Developer Guide are for an older version of Jetpack (JP 5.0.2). The file /etc/initrd-flash.sh does not exist in Jetpack 6.2.1, so you need to create a new script to regenerate the initrd image.

Comparison with the original instructions:

  • The original instructions assume that the file /etc/initrd-flash.sh exists, which is not the case in Jetpack 6.2.1.
  • The original instructions use a different script to regenerate the initrd image, which is not applicable in Jetpack 6.2.1.
  • The new instructions create a new script initrd-flash.sh to regenerate the initrd image and disable the initrd shell.

In summary, the new instructions provide a workaround for disabling the initrd shell in Jetpack 6.2.1, which is not possible using the original instructions.

*** Please give the thumbs up if you get answers you like. Or provide feedback to help us improve the answer. ***

7

Hi,

Please use the r36.5 BSP instead, as it includes Linux_for_Tegra/rootfs/etc/nv-update-initrd/list.d/disable_initrd_bash.

Thanks