From 355767935c2d2cfa68332bed993da8482a3e0c82 Mon Sep 17 00:00:00 2001 From: CyberMind Date: Fri, 15 May 2026 13:26:32 +0200 Subject: [PATCH] Round image: drop dead ifupdown config, give secubox sudo, fix misleading OTG comment (closes #139) (#143) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(round): remove dead ifupdown config + secubox sudo + clarify gadget IP comment (closes #139) Three small cleanups against the round image, all triggered by the follow-up to PR #137's OTG bench: 1. Drop `remote-ui/round/files/etc/network/interfaces.d/usb0` — the stanza configured `usb0` via `ifupdown`, but `ifupdown` is not in the apt list, `networking.service` is inactive, and the actual IP binding happens in `secubox-otg-gadget.sh` (which configures `usb1` programmatically with `ip addr add`). Keeping the file on disk misleads diagnostics — it cost a round trip during the 2026-05-15 bench when I assumed `usb0`/10.55.0.2 must be where the IP would land. Deleting it. 2. Add `sudo` to the `secubox` user's group list in `build-eye-remote-image.sh`. Without it, ACM serial console recovery is impossible — the user can log in but can't fix anything. The round previously needed `pi/raspberry` (which the build script does not provision) as a fallback; now `secubox` can recover networking from the only path that survives a broken IP link. 3. Rewrite the misleading comment block in `secubox-otg-gadget.sh` about which kernel interface name belongs to which gadget function. The legacy comment claimed `usb1 = ECM` and tied the binding choice to "Linux uses cdc_ether"; in reality both RNDIS and ECM share the same host_addr so the host can reach 10.55.0.2 via either function (verified on Pop!_OS 22.04 host: ping succeeded with 10.55.0.1 bound on the host's RNDIS leg). Comment now states the actual contract: bind on `usb1` (the second-registered network function), independent of which transport carries the packets. Test plan --------- - [ ] Rebuild the round image and flash to Pi Zero W 1st gen. - [ ] Verify boot still reaches OFFLINE-mode radar on the HyperPixel. - [ ] `id secubox` on the booted device shows `sudo` in groups. - [ ] `ls /etc/network/interfaces.d/usb0` returns "no such file". - [ ] `systemctl is-active secubox-otg-gadget` returns `active`. - [ ] Host ping 10.55.0.2 succeeds (regression check — the comment rewrite is documentation-only, must not change behaviour). Co-Authored-By: Claude Opus 4.7 (1M context) * fix(round): also drop inline heredoc that recreates dead ifupdown stanza (ref #139) The previous commit deleted remote-ui/round/files/etc/network/interfaces.d/usb0 but missed that build-eye-remote-image.sh writes the same file inline at build time via heredoc. Without removing that block too, the dead config keeps shipping to the rootfs. Verified on the just-rebuilt image: file still present after first attempt at the fix. With both source-tree deletion AND the heredoc gone, the config never lands. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: CyberMind-FR Co-authored-by: Claude Opus 4.7 (1M context) --- remote-ui/common/shell/secubox-otg-gadget.sh | 15 +++++++++----- remote-ui/round/build-eye-remote-image.sh | 20 +++++++++---------- .../round/files/etc/network/interfaces.d/usb0 | 5 ----- 3 files changed, 19 insertions(+), 21 deletions(-) delete mode 100644 remote-ui/round/files/etc/network/interfaces.d/usb0 diff --git a/remote-ui/common/shell/secubox-otg-gadget.sh b/remote-ui/common/shell/secubox-otg-gadget.sh index 96139d43..bea67365 100755 --- a/remote-ui/common/shell/secubox-otg-gadget.sh +++ b/remote-ui/common/shell/secubox-otg-gadget.sh @@ -284,9 +284,14 @@ gadget_start() { log "Activation sur UDC: ${udc}" echo "$udc" > UDC - # Attendre que l'interface usb1 (ECM) apparaisse - # Note: Le gadget composite crée usb0 (RNDIS/Windows) et usb1 (ECM/Linux-Mac) - # On configure usb1 car les hôtes Linux utilisent le driver cdc_ether (ECM) + # Attendre que la deuxième interface réseau du gadget composé + # apparaisse côté kernel. Le composé crée rndis.usb0 puis ecm.usb0 + # (dans cet ordre, cf. liens configfs ci-dessus) — le kernel les + # enregistre comme /sys/class/net/usb0 et /sys/class/net/usb1. + # Côté hôte, RNDIS et ECM partagent le même host_addr donc l'ARP + # remonte sur n'importe laquelle des deux interfaces UP du host; + # binder /usb1 ici suffit pour rendre 10.55.0.2 joignable depuis + # 10.55.0.1, peu importe le canal physique sélectionné par l'hôte. local retry=0 while [[ ! -d /sys/class/net/usb1 ]] && [[ $retry -lt 10 ]]; do sleep 0.5 @@ -294,9 +299,9 @@ gadget_start() { done if [[ -d /sys/class/net/usb1 ]]; then - log "Interface usb1 (ECM) créée" + log "Interface usb1 (deuxième fonction réseau du gadget) créée" - # Configurer l'IP sur usb1 uniquement (évite le routage asymétrique) + # Configurer l'IP sur usb1 uniquement (évite le routage asymétrique). ip addr flush dev usb1 2>/dev/null || true ip addr add "${OTG_NETWORK_DEV}/30" dev usb1 ip link set usb1 up diff --git a/remote-ui/round/build-eye-remote-image.sh b/remote-ui/round/build-eye-remote-image.sh index 8f883cd6..cf46ec94 100755 --- a/remote-ui/round/build-eye-remote-image.sh +++ b/remote-ui/round/build-eye-remote-image.sh @@ -704,15 +704,12 @@ ln -sf /etc/systemd/system/secubox-serial-console.service \ # NOTE: fb-dashboard is DEPRECATED - use fallback-display instead # The old dashboard is kept for reference but NOT enabled by default -# Network config for usb0 -mkdir -p "$ROOT_MNT/etc/network/interfaces.d" -cat > "$ROOT_MNT/etc/network/interfaces.d/usb0" << 'EOF' -allow-hotplug usb0 -iface usb0 inet static - address 10.55.0.2 - netmask 255.255.255.252 - gateway 10.55.0.1 -EOF +# IP binding for the gadget's usb1 interface is handled by +# /usr/local/sbin/secubox-otg-gadget.sh (the same script that composes +# the configfs gadget). The legacy /etc/network/interfaces.d/usb0 +# stanza was removed (closes #139) — it required `ifupdown` which the +# image never installed, so it never did anything except confuse +# diagnostics. # USB network script (handles both usb0 and usb1 - ECM may create either) mkdir -p "$ROOT_MNT/usr/local/bin" @@ -787,8 +784,9 @@ if ! id secubox &>/dev/null; then echo "secubox:secubox2026" | chpasswd fi -# Add to groups -usermod -aG video,input,gpio,i2c,spi,audio secubox 2>/dev/null || true +# Add to groups. `sudo` lets the kiosk user manually recover networking +# from the ACM serial console (e.g. when /dev/ttyACM0 is the only path in). +usermod -aG sudo,video,input,gpio,i2c,spi,audio secubox 2>/dev/null || true # Enable lightdm and nginx systemctl enable lightdm 2>/dev/null || true diff --git a/remote-ui/round/files/etc/network/interfaces.d/usb0 b/remote-ui/round/files/etc/network/interfaces.d/usb0 deleted file mode 100644 index 55b3832e..00000000 --- a/remote-ui/round/files/etc/network/interfaces.d/usb0 +++ /dev/null @@ -1,5 +0,0 @@ -allow-hotplug usb0 -iface usb0 inet static - address 10.55.0.2 - netmask 255.255.255.252 - gateway 10.55.0.1