RDKEMW-22087: Support configurable Dropbear host key files and command-line arguments

[leenaS-d]

No description provided.

[Copilot]

Pull request overview

Adds configurability around Dropbear host key location and runtime arguments by shifting more of the Dropbear invocation to environment-driven configuration and updating the start-up script/unit wiring.

Changes:

• Updates start_ssh.sh to source /etc/default/dropbear (community builds) and use a configurable RSA host key directory.
• Removes DROPBEAR_EXTRA_ARGS from the Dropbear systemd unit invocation, relying on other variables instead.
• Cleans up environment handling in start_ssh.sh by removing DROPBEAR_EXTRA_ARGS export calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
systemd_units/dropbear.service	Adjusts Dropbear ExecStart argument expansion.
lib/rdk/start_ssh.sh	Adds config sourcing + configurable host key dir handling for community builds; removes exporting extra args.

Comments suppressed due to low confidence (1)

lib/rdk/start_ssh.sh:104

• Hard-failing when DROPBEAR_RSAKEY_DIR is unset makes community builds dependent on external configuration (and EnvironmentFile=-/etc/default/dropbear is optional). Also, this block calls systemctl without an absolute path, while the rest of the script uses /bin/systemctl.

To preserve the previous default behavior and avoid PATH issues, default DROPBEAR_RSAKEY_DIR to /opt/dropbear and invoke /bin/systemctl explicitly.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

lib/rdk/start_ssh.sh:100

• start_ssh.sh sources /etc/default/dropbear (. /etc/default/dropbear), which executes that file as shell code. Since the systemd unit already loads /etc/default/dropbear via EnvironmentFile=, this extra source is redundant and expands the attack surface (any unexpected shell content in the file will be executed). Prefer relying on the environment variables provided by systemd rather than executing the file.

    # Source Dropbear configuration    
    [ -f /etc/default/dropbear ] && . /etc/default/dropbear

lib/rdk/start_ssh.sh:110

• In community builds, the script exits with status 1 when DROPBEAR_RSAKEY_DIR is unset. Because /etc/default/dropbear is optional in the unit (EnvironmentFile=-...), this can prevent SSH from starting on systems that don't provide that file/variable. Consider defaulting to the prior directory (/opt/dropbear) instead of hard-failing.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service
    fi

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

lib/rdk/start_ssh.sh:173

• Same as above in startDropbear(): for non-community builds, the systemd-path DROPBEAR_PARAMS value does not include any configured extra CLI flags (e.g., from /etc/default/dropbear). Given dropbear.service no longer passes ${DROPBEAR_EXTRA_ARGS}, those flags will be dropped unless appended here.

          if [ "$COMMUNITY_BUILDS" = "true" ]; then
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
          else
                /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
          fi

lib/rdk/start_ssh.sh:108

• For community builds, start_ssh.sh exits with status 1 when DROPBEAR_RSAKEY_DIR is unset. Since the systemd unit declares EnvironmentFile=-/etc/default/dropbear as optional, a missing/empty config can cause Dropbear startup to fail unexpectedly. Consider either (a) making the environment file mandatory in the unit, or (b) falling back to a default key directory instead of exiting.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then

lib/rdk/start_ssh.sh:153

• In the /etc/os-release (systemd) path for non-community builds, DROPBEAR_PARAMS is set to only -r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2. With ${DROPBEAR_EXTRA_ARGS} removed from dropbear.service, any extra Dropbear CLI flags configured via /etc/default/dropbear will be ignored for this path (while other paths in this script still hardcode flags like -a). If configurable CLI args are intended, they should be appended here as well.

This issue also appears on line 169 of the same file.

                if [ "$COMMUNITY_BUILDS" = "true" ]; then
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS"
                else
                      /bin/systemctl set-environment DROPBEAR_PARAMS="-r $DROPBEAR_PARAMS_1 -r $DROPBEAR_PARAMS_2"
                fi