General Procedure of stripping down an OpenWrt based Firmware build

[cdutz]

Hi all,

we are using OpenWRT-based devices as Edge gateways in IIoT usecases. So there is a lot of stuff on these boxes we don't need and a lot of stuff we would like to remove (removing attack vectors).

With the build for my Mips based RUT955 device this was pretty simple. However when working on my ARM based RUTX09 device it seems I can't disable much because most options are "locked". Now I stated trying to find out what's requiring something I want to disable, but this is an extremely frustrating operation and some times it's not enough.

For example I wanted to disable luasec as we don't need it and it was causing compile errors (I could possibly update it from 0.6 to 0.7 but I would prefer to disable it). So I can see that:

• luasoap (disabled)
• prosody (disabled)
• luarocks (disabled)
• lua-pop3 (enabled but can't disable)

When searching for what's requiring "lua-pop3", it seems "email_to_sms" is requiring this but this again depends on lua-pop3. So I guess we're stuck in a hen-egg-problem. If I manually disable both in the .config and run make menuconfig it just enables both again.

So is there any tooling to help with disabling stuff or just even to list dependencies requiring something (I mean the functionality must be there otherwise make menuconfig wouldn't know to lock the option)

Chris

[peternikolow]

I have similar issues. Did you make:
make clean
make dirclean
make distclean
between builds?

Difference between them is here:

Build system usage

[cdutz]

All except the "distclean"

[hnyman]

@cdutz

is there any tooling to help with disabling stuff or just even to list dependencies requiring something

You can use "/" key in menuconfig to initiate a search for package details like dependencies.

See example in

Advice on polarssl deprecation

No. Polarssl will not be selected by default. Only if you select one of those few packets that still use it, bmx7 etc. You can actually see pretty easily in menuconfig, which other packages select a package: press "/" (slash) to start search and then just write the string to search for, e.g. polarssl in the dialog box. You will get a scrollable listing of all config options where polarssl is mentioned. The package itself is included in the listing, as well are its dependencies and selectors (…

[peternikolow]

I found that distclean sometime fix weird build problems.

[cdutz]

Ok ... I'll give that a try too ... will report back as soon as I have more infos.

[cdutz]

Well yesterday I gave it a spin and unfortunately the teltonika folks seem to have modeled things in a quite unflexible way ... so I generally don't want LUA or even the entire LUCI thing. In order to disable luasec, i need to disable lua-pop3 in order to do that I need to disable email_to_sms in order to disable that I need to disable mobile support in the teltonika section. But I want mobile support ... I just don't want the other stuff

[hnyman]

@cdutz

unfortunately the teltonika folks seem to have modeled things in a quite unflexible way

So, are you talking about actual OpenWrt, or about some vendor-specific variant by Teltonika?

If the device support is set up normally, you should be able to start with empty config, then just selct the device and add those packages that you want (plus their dependencies automatically).

but if it is some Teltonika's proprietary config, you may be in deep water and on your own.

[reinerotto]

Teltonika has its own SDK, to do custom builds from. In case of issues with this one, ask on their forum. For RUT955, though, "official" openwrt works like a charm, so you might ask here.

[cdutz]

Yeah It's the teltonika SDK ... so as usual ... I jumped in on the side of the ocean where the sharks are ... I'll take my questions over there. But thanks for your support @all