Skip to content

RDKEMW-9437 : Secure Unlock of Debug services(overrides) in LabSigned Build type #433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
KTirumalaSrihari wants to merge 11 commits into
base: develop
Choose a base branch
from
Draft

RDKEMW-9437 : Secure Unlock of Debug services(overrides) in LabSigned Build type #433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
a294dcb
RDKEMW-8748: Bring RDKTV-38567 changes to develop and release/8.3.4.0
naveenkumarhanasi Sep 26, 2025
159602e
3.0.5v1 hotfix release
naveenkumarhanasi Sep 26, 2025
27d2237
Merge branch 'hotfix/3.0.5v1' into support/3.0.5
naveenkumarhanasi Sep 26, 2025
d2fd24b
RDKEMW-8677:Clean up the mitigation done for dnsmasq restart
AravindanNC Sep 30, 2025
fb28b1e
Merge pull request #327 from rdkcentral/topic/RDKEMW-8677_8.3
nhanasi Oct 1, 2025
7ed0d66
3.0.5v2 hotfix release
naveenkumarhanasi Oct 1, 2025
2b2ac60
Merge branch 'hotfix/3.0.5v2' into support/3.0.5
naveenkumarhanasi Oct 1, 2025
fd6ea4c
Add LABSIGNED_ENABLED property to device configuration
KTirumalaSrihari Oct 16, 2025
2d8cec9
Update device.properties - replace LABSIGNED_ENABLED with DBGSERVICES…
KTirumalaSrihari Oct 22, 2025
04563ee
Update device.properties
KTirumalaSrihari Oct 22, 2025
e1f46fc
Update device.properties - rename DBGBUILD_PRODHW to LABSIGNED_ENABLED
KTirumalaSrihari Oct 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,30 @@ All notable changes to this project will be documented in this file. Dates are d

Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).

#### [3.0.5v2](https://github.com/rdkcentral/sysint/compare/3.0.6...3.0.5v2)
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The version comparison shows "3.0.5v2" comparing to "3.0.6", which is unusual. Typically, a v2 hotfix would be based on the same version (e.g., 3.0.5 to 3.0.5v2), not comparing to a later version. This suggests the changelog structure may be incorrect or these changes are being backported from version 3.0.6 to create a 3.0.5v2 hotfix. Please verify this is the intended version comparison.

Suggested change
#### [3.0.5v2](https://github.com/rdkcentral/sysint/compare/3.0.6...3.0.5v2)
#### [3.0.5v2](https://github.com/rdkcentral/sysint/compare/3.0.5...3.0.5v2)

Copilot uses AI. Check for mistakes.

- RDKEMW-8677:Clean up the mitigation done for dnsmasq restart [`#327`](https://github.com/rdkcentral/sysint/pull/327)
- RDKEMW-8748: Bring RDKTV-38567 changes to develop and release/8.3.4.0 [`a294dcb`](https://github.com/rdkcentral/sysint/commit/a294dcb6b228d0d181ce67ec91f4628fe27e1dc1)
- 3.0.5v1 hotfix release [`159602e`](https://github.com/rdkcentral/sysint/commit/159602effeeaf80f45f8bfa03a92e2e7628c1f38)
Comment on lines +7 to +11
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR title and description claim this is for "RDKEMW-9437: Secure Unlock of Debug services(overrides) in LabSigned Build type", but the actual changes documented in the CHANGELOG are for completely different issues (RDKEMW-8677, RDKEMW-8748/RDKTV-38567, and RDKEMW-8560). This is a critical discrepancy. Either the PR description is incorrect, or the wrong changes have been included in this PR.

Copilot uses AI. Check for mistakes.

#### [3.0.6](https://github.com/rdkcentral/sysint/compare/3.0.5...3.0.6)

> 29 September 2025

- Deploy fossid_integration_stateless_diffscan_target_repo action [`#323`](https://github.com/rdkcentral/sysint/pull/323)
- RDKTV-38567: PAT_EntOS_A4K-Soft Reboot failed from settings; Stuck on Black screen [`#311`](https://github.com/rdkcentral/sysint/pull/311)
- Deploy cla action [`#203`](https://github.com/rdkcentral/sysint/pull/203)
- Update CODEOWNERS [`#308`](https://github.com/rdkcentral/sysint/pull/308)
- Delete lib/rdk/rebootSTB.sh [`6e2026e`](https://github.com/rdkcentral/sysint/commit/6e2026e6d73031dadb29879510c48d99bca3d697)
- Delete systemd_units/scheduled-reboot.service [`f3f5062`](https://github.com/rdkcentral/sysint/commit/f3f50625007a8d5ca9f0e3eebd8fefd441c11d73)
- RDKEMW-8560 Remove schedule reboot and move reboot to background execution [`38206e1`](https://github.com/rdkcentral/sysint/commit/38206e19435885f6f74d7edb6365615f6ef8071d)

#### [3.0.5](https://github.com/rdkcentral/sysint/compare/3.0.4...3.0.5)

> 19 September 2025

- RDKEMW-8359: Removed nmcli connect with WIFI in the bootstrap [`#299`](https://github.com/rdkcentral/sysint/pull/299)
- 3.0.5 release changelog updates [`1a8da04`](https://github.com/rdkcentral/sysint/commit/1a8da04a1abee277584910fce197bf4c4a6d963b)
- Merge tag '3.0.4' into develop [`0f001ba`](https://github.com/rdkcentral/sysint/commit/0f001ba7961a088bd1b568dcc4d226f63125be54)

#### [3.0.4](https://github.com/rdkcentral/sysint/compare/3.0.3...3.0.4)
Expand Down
1 change: 1 addition & 0 deletions etc/device.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,4 @@ UDHCP_INTERFACE=eth0
WAN_INTERFACE=eth0
WIFI_INTERFACE=wlan0
WIFI_SUPPORT=true
LABSIGNED_ENABLED=false
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The LABSIGNED_ENABLED property is added but appears to be unused in the codebase. This property should either be utilized in the code to implement the stated feature (secure unlock of debug services based on build variant and device type), or it should be removed if it's not part of this PR's actual purpose.

Suggested change
LABSIGNED_ENABLED=false

Copilot uses AI. Check for mistakes.
12 changes: 0 additions & 12 deletions lib/rdk/NM_Dispatcher.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,18 +144,6 @@ if [ "x$interfaceName" != "x" ] && [ "$interfaceName" != "lo" ]; then
checkDefaultRoute_Add $imode $interfaceName $ipaddr $gwip $interfaceName "metric" "add"
NMdispatcherLog "checkDefaultRoute_Add"
fi
# Restart dnsmasq if it's running under NetworkManager
DNSMASQ_PID_FILE="/var/run/NetworkManager/dnsmasq.pid"

if [ -f "$DNSMASQ_PID_FILE" ]; then
DNSMASQ_PID=$(cat "$DNSMASQ_PID_FILE")
if [ -n "$DNSMASQ_PID" ]; then
echo "$DT_TIME Killing dnsmasq PID $DNSMASQ_PID" >> /opt/logs/NMMonitor.log
kill -TERM "$DNSMASQ_PID"
else
echo "$DT_TIME dnsmasq PID not running or invalid" >> /opt/logs/NMMonitor.log
fi
fi
if [ "$interfaceName" == "wlan0" ]; then
touch /tmp/wifi-on
fi
Expand Down
21 changes: 9 additions & 12 deletions lib/rdk/rebootNow.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,21 +472,18 @@ rebootLog "End of the sync"

rebootLog "Creating $REBOOTNOW_FLAG as the reboot was triggred by RDK software"
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The word 'triggred' is misspelled and should be 'triggered'.

Suggested change
rebootLog "Creating $REBOOTNOW_FLAG as the reboot was triggred by RDK software"
rebootLog "Creating $REBOOTNOW_FLAG as the reboot was triggered by RDK software"

Copilot uses AI. Check for mistakes.
touch $REBOOTNOW_FLAG
rebootLog "Rebooting the Device Now"
rm -rf $pid_file
reboot

sleep 15
rebootLog "Rebooting the Device Now"
reboot &
REBOOT_PID=$!

rebootLog "System still running after reboot command, Reboot Failed..."
rebootLog "Invoking Systemctl Reboot After First Reboot Attempt Failure"
sleep 90
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sleep duration has been increased from 15 seconds to 90 seconds before declaring the reboot as failed. While this may be intentional to allow more time for graceful shutdown, it significantly delays the fallback reboot mechanism. If the first reboot command genuinely fails, the system will wait 90 seconds before attempting recovery. Consider whether this extended delay is appropriate for all failure scenarios, or if a shorter timeout with better detection logic would be more effective.

Copilot uses AI. Check for mistakes.
rebootLog "System still running after reboot command, Reboot Failed for $REBOOT_PID..."
systemctl reboot
if [ $? -eq 1 ]; then
rebootLog "Reboot failed due to systemctl hang or connection timeout, trying force reboot..."
if [ -f /tmp/systemd_freeze_reboot_on ]; then
rebootLog "Force Reboot due to systemd freeze detection"
else
rebootLog "Force Reboot after systemd reboot failure"
fi
reboot -f
rebootLog "Reboot failed due to systemctl hang or connection timeout"
fi
kill $REBOOT_PID 2>/dev/null
rebootLog "Triggering force Reboot after standard soft reboot failure"
reboot -f
Comment on lines +478 to +489
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reboot command is now executed in the background with '&', but the script continues immediately to sleep for 90 seconds. If the reboot succeeds quickly (within 90 seconds), the subsequent commands (systemctl reboot, kill, reboot -f) will attempt to execute on a system that is already shutting down. This could lead to race conditions and unpredictable behavior. Consider checking if the system is still responsive before proceeding with fallback reboot attempts.

Copilot uses AI. Check for mistakes.
Comment on lines 483 to +489
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The force reboot (reboot -f) is now always executed unconditionally after systemctl reboot, regardless of whether systemctl reboot succeeded or not. The previous logic only attempted force reboot when systemctl returned an error code of 1. This change means that even if systemctl reboot succeeds, the script will still try to kill the background reboot process and execute a force reboot, which could interrupt a successful graceful reboot in progress.

Copilot uses AI. Check for mistakes.
130 changes: 0 additions & 130 deletions lib/rdk/rebootSTB.sh
View file
Open in desktop

This file was deleted.

30 changes: 0 additions & 30 deletions systemd_units/scheduled-reboot.service
View file
Open in desktop

This file was deleted.

Loading