RDKEMW-22087: Support configurable Dropbear host key files and command-line arguments

[leenaS-d]

No description provided.

[Copilot]

Pull request overview

Adds configurability around Dropbear host key location and runtime arguments by shifting more of the Dropbear invocation to environment-driven configuration and updating the start-up script/unit wiring.

Changes:

• Updates start_ssh.sh to source /etc/default/dropbear (community builds) and use a configurable RSA host key directory.
• Removes DROPBEAR_EXTRA_ARGS from the Dropbear systemd unit invocation, relying on other variables instead.
• Cleans up environment handling in start_ssh.sh by removing DROPBEAR_EXTRA_ARGS export calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
systemd_units/dropbear.service	Adjusts Dropbear ExecStart argument expansion.
lib/rdk/start_ssh.sh	Adds config sourcing + configurable host key dir handling for community builds; removes exporting extra args.

Comments suppressed due to low confidence (1)

lib/rdk/start_ssh.sh:104

• Hard-failing when DROPBEAR_RSAKEY_DIR is unset makes community builds dependent on external configuration (and EnvironmentFile=-/etc/default/dropbear is optional). Also, this block calls systemctl without an absolute path, while the rest of the script uses /bin/systemctl.

To preserve the previous default behavior and avoid PATH issues, default DROPBEAR_RSAKEY_DIR to /opt/dropbear and invoke /bin/systemctl explicitly.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

lib/rdk/start_ssh.sh:100

• start_ssh.sh sources /etc/default/dropbear (. /etc/default/dropbear), which executes that file as shell code. Since the systemd unit already loads /etc/default/dropbear via EnvironmentFile=, this extra source is redundant and expands the attack surface (any unexpected shell content in the file will be executed). Prefer relying on the environment variables provided by systemd rather than executing the file.

    # Source Dropbear configuration    
    [ -f /etc/default/dropbear ] && . /etc/default/dropbear

lib/rdk/start_ssh.sh:110

• In community builds, the script exits with status 1 when DROPBEAR_RSAKEY_DIR is unset. Because /etc/default/dropbear is optional in the unit (EnvironmentFile=-...), this can prevent SSH from starting on systems that don't provide that file/variable. Consider defaulting to the prior directory (/opt/dropbear) instead of hard-failing.

    if [ -z "${DROPBEAR_RSAKEY_DIR}" ]; then
        echo "DROPBEAR_RSAKEY_DIR is not set"
        exit 1
    elif [ ! -f "${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" ]; then
        systemctl start dropbearkey.service
    fi