[OLPC-AU] magic update usbkey

[Jerry Vonau]

On Thu, 2011-02-10 at 15:09 +1100, James Cameron wrote:
> On Thu, Feb 10, 2011 at 02:59:18PM +1100, Sridhar Dhanapalan wrote:
> > On 10 February 2011 14:45, James Cameron <quozl at laptop.org> wrote:
> > > On Thu, Feb 10, 2011 at 02:07:00PM +1100, Sridhar Dhanapalan wrote:
> > >> A practical example of how this can be used:
> > >> http://dev.laptop.org.au/issues/346
> > >
> > > netcfg.sh blindly sources xonet.cfg without any filtering. ?Very brave,
> > > very powerful. ?An rm rf / planted by a child in the borrowed drive will
> > > be instructive.
> > 
> > I don't understand how this is a problem. It's just reading
> > environment variables from xonet.cfg to insert into config files. It's
> > not executing anything. Am I missing something?
> 
> Looking at netcfg.sh in reply #14 on http://dev.laptop.org.au/issues/346
> 
> CFG="/media/$USB/xonet.cfg"
> if [ -f $CFG ]; then
>     tr -d '\r' < $CFG > /tmp/xonet.cfg
>     . /tmp/xonet.cfg
> 
> This removes carriage return characters, and executes each line in the
> file.

If a student can figure that out, you have your next XO tech. ;)
Any less secure than having root on tty2 or using sudo? Yea, brute
force, but its useful. Think I'll move to having the trigger look for a
script on the usbkey rather than having the script in the XO image. At
least then someone can edit the script to suit their needs at any point
after image generation.

Jerry