add remote access switch for edgeview

add an option to eve command and edgeview to set the remote
access config switch to On/Off. When On, edgeview is inaccsiable.

Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>

docs/CONFIG.md

@@ -13,6 +13,7 @@ In general, EVE is trying to make sure that its controller always has the last w
 * `wpa_supplicant.conf` - a legacy way of configuring EVE's WiFi
 * `authorized_keys` - initial authorized SSH keys for accessing EVE's debug console; DO NOT use options, we only accept 'keytype, base64-encoded key, comment' format
 * `bootstrap-config.pb`- initial device configuration used only until device is onboarded (see below for details)
+* `remote_access_disabled`- a file indicating remote access status, if it exist remote access (currently edge-view) is disabled. Please check [config document](SECURITY.md#disabling-remote-access) for more information.
 
 The initial content of these configuration files is stored in the EVE's source tree under [config](../config) folder. From there, these configuration files are baked into the EVE installer images. For the read-write bootable disk installer image these files can further be tweaked by mounting the "EVE" partition and editing those files directly on the installer image. This gives you an ability to take the default installer image and tweak it for your needs without re-building EVE from scratch (obviously this is not an option for a read-only ISO installer image). A typical workflow is to take an installer image from the official EVE build, flash it onto a USB flash drive, insert that USB flash drive into your desktop and edit file on the partition called EVE.
 

docs/SECURITY.md

@@ -158,6 +158,9 @@ Two ECOs communicating using the overlay will get an secure channel since LISP w
 
 In addition, the LISP map server can provide ability to limit access to the mappings for certain EIDs based on the EID which is trying to look them up.
 
+## Disabling Remote Access
+EVE provides a mechanism to build an image with remote access disabled, this can be done by configuring EVE when building an installer. Enabling remote access back, requires access to the cloud controller to enable debugging access on the edge node, plus physical access to the edge node to issue `eve remote-access` command on the edge node. In addition changing remote access status from its initial value to anything else will result in change of PCR-14 value and subsequent failure in unsealing the vault key that needs to be handled using the cloud controller. Check [config document](CONFIG.md#eve-configuration) for more information.
+
 ## Details on keys and certificates
 
 These details are specified in [KEYS-AND-CERTS](KEYS-AND-CERTS.md).

pkg/dom0-ztools/rootfs/bin/eve

@@ -19,6 +19,7 @@ Welcome to EVE!
             persist attach <disk>
             config mount <mountpoint>
             config unmount
+            remote-access on|off
             http-debug
             dump-stacks
             dump-memory
@@ -199,6 +200,32 @@ __EOT__
                  ;;
           esac
           ;;
+ remote-access)
+          if CONFIG=$(findfs PARTLABEL=CONFIG) && [ -n "$CONFIG" ]; then
+              CONFIGDIR_RW=/tmp/config_rw
+              mkdir $CONFIGDIR_RW
+              if mount -t vfat -o rw,iocharset=iso8859-1 "$CONFIG" $CONFIGDIR_RW; then
+                  case "$2" in
+                    on) rm -f $CONFIGDIR_RW/remote_access_disabled
+                        umount $CONFIGDIR_RW
+                        rm -rf $CONFIGDIR_RW
+                        ;;
+                    off) touch $CONFIGDIR_RW/remote_access_disabled
+                         umount $CONFIGDIR_RW
+                         rm -rf $CONFIGDIR_RW
+                        ;;
+                    *) umount $CONFIGDIR_RW
+                       rm -rf $CONFIGDIR_RW
+                       help
+                    ;;
+                  esac
+              else
+                  echo "Failed to set the remote access configuration!"
+              fi
+          else
+              echo "Failed to set the remote access configuration!"
+          fi
+          ;;
  version)
           v=$(cat /run/eve-release)
           echo "$v"

pkg/pillar/cmd/zedagent/parseedgeview.go

@@ -22,6 +22,11 @@ import (
 // edge-view specific parser/utility routines
 
 func parseEvConfig(ctx *getconfigContext, config *zconfig.EdgeDevConfig) {
+	if !remoteEvAccess() {
+		log.Noticef("Remote access to edgeview is disabled")
+		removeEvFiles()
+		return
+	}
 
 	log.Tracef("Started parsing edge-view config")
 	zcfgEv := config.GetEdgeview()
@@ -285,3 +290,11 @@ func removeEvFiles() {
 		os.Remove(types.EdgeviewCfgFile)
 	}
 }
+
+func remoteEvAccess() bool {
+	if _, err := os.Stat(types.RemoteAccessFlagFileName); err == nil {
+		return false // file exists, remote access is disabled
+	} else {
+		return true
+	}
+}

pkg/pillar/types/locationconsts.go

@@ -64,6 +64,8 @@ const (
 	APIV1FileName = IdentityDirname + "/Force-API-V1"
 	// BootstrapConfFileName - file to store initial device configuration for bootstrapping
 	BootstrapConfFileName = IdentityDirname + "/bootstrap-config.pb"
+	// RemoteAccessFlagFileName -- file to check for remote access configuration
+	RemoteAccessFlagFileName = IdentityDirname + "/remote_access_disabled"
 	// BootstrapShaFileName - file to store SHA hash of an already ingested bootstrap config
 	BootstrapShaFileName = IngestedDirname + "/bootstrap-config.sha"