You can take some steps that are specific to the OpenEmbedded build system to make your images more secure:
Ensure "debug-tweaks" is not one of your selected
IMAGE_FEATURES
.
When creating a new project, the default is to provide you
with an initial local.conf
file that
enables this feature using the
EXTRA_IMAGE_FEATURES
variable with the line:
EXTRA_IMAGE_FEATURES = "debug-tweaks"
To disable that feature, simply comment out that line in your
local.conf
file, or
make sure IMAGE_FEATURES
does not contain
"debug-tweaks" before producing your final image.
Among other things, leaving this in place sets the
root password as blank, which makes logging in for
debugging or inspection easy during
development but also means anyone can easily log in
during production.
It is possible to set a root password for the image and also to set passwords for any extra users you might add (e.g. administrative or service type users). When you set up passwords for multiple images or users, you should not duplicate passwords.
To set up passwords, use the
extrausers
class, which is the preferred method.
For an example on how to set up both root and user
passwords, see the
"extrausers.bbclass
"
section.
Consider enabling a Mandatory Access Control (MAC)
framework such as SMACK or SELinux and tuning it
appropriately for your device's usage.
You can find more information in the
meta-selinux
layer.