You can take some steps that are specific to the OpenEmbedded build system to make your images more secure:
Ensure "debug-tweaks" is not listed with
IMAGE_FEATURES
.
The default is to enable "debug-tweaks" by adding it
to
EXTRA_IMAGE_FEATURES
in local.conf
.
However, you should comment out the variable or be
sure that it does not have "debug-tweaks" before
producing your final image.
Among other things, leaving this in place sets the
root password as blank, which makes logging in for
debugging or inspection easy during
development but also means anyone can easily log in
during production.
It is possible to set a root password for the image and also to set passwords for any extra users you might add (e.g. administrative or service type users). When you set up passwords for multiple images or users, you should not duplicate passwords.
To set up passwords, use the
extrausers
class, which is the
preferred method.
For an example on how to set up both root and user
passwords, see the
"extrausers.bbclass
"
section.
Consider enabling a Mandatory Access Control (MAC) framework (such as SMACK or SELinux) and tuning it appropriately for your device's usage.