RDKEMW-22087: Support configurable Dropbear host key files and command-line arguments

[leenaS-d]

No description provided.

[Copilot]

Pull request overview

Adds configurability around Dropbear host key location and runtime arguments by shifting more of the Dropbear invocation to environment-driven configuration and updating the start-up script/unit wiring.

Changes:

• Updates start_ssh.sh to source /etc/default/dropbear (community builds) and use a configurable RSA host key directory.
• Removes DROPBEAR_EXTRA_ARGS from the Dropbear systemd unit invocation, relying on other variables instead.
• Cleans up environment handling in start_ssh.sh by removing DROPBEAR_EXTRA_ARGS export calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
systemd_units/dropbear.service	Adjusts Dropbear ExecStart argument expansion.
lib/rdk/start_ssh.sh	Adds config sourcing + configurable host key dir handling for community builds; removes exporting extra args.

Comments suppressed due to low confidence (1)

lib/rdk/start_ssh.sh:104

• Hard-failing when DROPBEAR_RSAKEY_DIR is unset makes community builds dependent on external configuration (and EnvironmentFile=-/etc/default/dropbear is optional). Also, this block calls systemctl without an absolute path, while the rest of the script uses /bin/systemctl.

To preserve the previous default behavior and avoid PATH issues, default DROPBEAR_RSAKEY_DIR to /opt/dropbear and invoke /bin/systemctl explicitly.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

lib/rdk/start_ssh.sh:100

• start_ssh.sh sources /etc/default/dropbear (. /etc/default/dropbear), which executes that file as shell code. Since the systemd unit already loads /etc/default/dropbear via EnvironmentFile=, this extra source is redundant and expands the attack surface (any unexpected shell content in the file will be executed). Prefer relying on the environment variables provided by systemd rather than executing the file.

    # Source Dropbear configuration    
    [ -f /etc/default/dropbear ] && . /etc/default/dropbear

lib/rdk/start_ssh.sh:110

• In community builds, the script exits with status 1 when DROPBEAR_RSAKEY_DIR is unset. Because /etc/default/dropbear is optional in the unit (EnvironmentFile=-...), this can prevent SSH from starting on systems that don't provide that file/variable. Consider defaulting to the prior directory (/opt/dropbear) instead of hard-failing.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service
    fi

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

lib/rdk/start_ssh.sh:173

• Same as above in startDropbear(): for non-community builds, the systemd-path DROPBEAR_PARAMS value does not include any configured extra CLI flags (e.g., from /etc/default/dropbear). Given dropbear.service no longer passes ${DROPBEAR_EXTRA_ARGS}, those flags will be dropped unless appended here.

          if [ "$COMMUNITY_BUILDS" = "true" ]; then
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
          else
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
          fi

lib/rdk/start_ssh.sh:108

• For community builds, start_ssh.sh exits with status 1 when DROPBEAR_RSAKEY_DIR is unset. Since the systemd unit declares EnvironmentFile=-/etc/default/dropbear as optional, a missing/empty config can cause Dropbear startup to fail unexpectedly. Consider either (a) making the environment file mandatory in the unit, or (b) falling back to a default key directory instead of exiting.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then

lib/rdk/start_ssh.sh:153

• In the /etc/os-release (systemd) path for non-community builds, DROPBEAR_PARAMS is set to only -r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2. With ${DROPBEAR_EXTRA_ARGS} removed from dropbear.service, any extra Dropbear CLI flags configured via /etc/default/dropbear will be ignored for this path (while other paths in this script still hardcode flags like -a). If configurable CLI args are intended, they should be appended here as well.

This issue also appears on line 169 of the same file.

                if [ "$COMMUNITY_BUILDS" = "true" ]; then
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
                else
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
                fi

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

lib/rdk/start_ssh.sh:109

• The unit treats /etc/default/dropbear as optional (EnvironmentFile=-...), but for community builds the script exits with failure when DROPBEAR_RSAKEY_DIR is unset. This makes the Dropbear service fail to start on systems where the defaults file is absent or missing the variable. Consider falling back to the previous default key directory instead of exiting.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service

lib/rdk/start_ssh.sh:173

• Same issue as above in startDropbear(): for non-community builds the systemd path sets DROPBEAR_PARAMS without appending DROPBEAR_EXTRA_ARGS, so any configured extra Dropbear flags will be ignored.

          if [ "$COMMUNITY_BUILDS" = "true" ]; then
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
          else
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
          fi

lib/rdk/start_ssh.sh:155

• For non-community builds on systemd-based systems (/etc/os-release path), DROPBEAR_EXTRA_ARGS is no longer included anywhere in the final Dropbear command line. Previously it was passed via ${DROPBEAR_EXTRA_ARGS} from the unit; now it’s dropped, so configured extra flags in /etc/default/dropbear (and prior defaults) won’t take effect for this branch.

                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
                else
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
                fi
                /bin/systemctl set-environment IP_ADDRESS_PARAM="$IP_ADDRESS_PARAM"

lib/rdk/start_ssh.sh:100

• start_ssh.sh sources /etc/default/dropbear as a shell script, which executes any non-assignment content in that file and can behave differently than systemd’s EnvironmentFile parsing. Since the unit already loads /etc/default/dropbear via EnvironmentFile=-/etc/default/dropbear, this sourcing is redundant and adds avoidable security/operational risk.

This issue also appears on line 105 of the same file.

    # Source Dropbear configuration    
    [ -f /etc/default/dropbear ] && . /etc/default/dropbear

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (3)

lib/rdk/start_ssh.sh:169

• Same as the mediaclient branch: when exporting DROPBEAR_PARAMS for systemd, extra configurable flags from /etc/default/dropbear (e.g. ${DROPBEAR_EXTRA_ARGS}) are dropped, so the systemd-started Dropbear may behave differently than the direct dropbear ... fallback path that still includes additional flags.

          if [ "$COMMUNITY_BUILDS" = "true" ]; then
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
          else
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
          fi

lib/rdk/start_ssh.sh:105

• In COMMUNITY_BUILDS, /etc/default/dropbear is sourced only if present, but the script then hard-fails if DROPBEAR_RSAKEY_DIR is unset. This makes service startup depend on an optional file in a non-obvious way. If the config is required, fail explicitly when the file is missing and use a consistent systemctl path.

    # Source Dropbear configuration    
    [ -f /etc/default/dropbear ] && . /etc/default/dropbear

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service

lib/rdk/start_ssh.sh:151

• DROPBEAR_PARAMS is overwritten to contain only host-key (-r) flags for the systemd path. With ${DROPBEAR_EXTRA_ARGS} no longer exported, there’s currently no way for /etc/default/dropbear to add extra Dropbear flags when started by systemd. Consider appending ${DROPBEAR_EXTRA_ARGS} here so the unit can remain simple and configurable.

This issue also appears on line 165 of the same file.

                if [ "$COMMUNITY_BUILDS" = "true" ]; then
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
                else
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
                fi
                /bin/systemctl set-environment IP_ADDRESS_PARAM="$IP_ADDRESS_PARAM"

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.