Disable failsafe mode

openwrt-disable-failsafe-mode.patch

diff --git a/.config b/.config
index cc8d14f..26c0f5f 100644
--- a/.config
+++ b/.config
@@ -385,9 +385,10 @@ CONFIG_TARGET_SUFFIX="uclibc"
 # CONFIG_IB is not set
 # CONFIG_SDK is not set
 # CONFIG_MAKE_TOOLCHAIN is not set
-# CONFIG_IMAGEOPT is not set
-# CONFIG_PREINITOPT is not set
+CONFIG_IMAGEOPT=y
+CONFIG_PREINITOPT=y
 CONFIG_TARGET_PREINIT_SUPPRESS_STDERR=y
+CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE=y
 CONFIG_TARGET_PREINIT_TIMEOUT=2
 # CONFIG_TARGET_PREINIT_SHOW_NETMSG is not set
 # CONFIG_TARGET_PREINIT_SUPPRESS_FAILSAFE_NETMSG is not set
diff --git a/include/image.mk b/include/image.mk
index b15363e..e584246 100755
--- a/include/image.mk
+++ b/include/image.mk
@@ -250,6 +250,8 @@ define Image/mkfs/prepare/default
 	- $(FIND) $(TARGET_DIR) -type d -print0 | $(XARGS) -0 chmod u+rwx,g+rx,o+rx
 	$(INSTALL_DIR) $(TARGET_DIR)/tmp $(TARGET_DIR)/overlay
 	chmod 1777 $(TARGET_DIR)/tmp
+	mkdir -p $(TARGET_DIR)/lib/preinit
+	$(if $(NOFAILSAFE),echo 'pi_preinit_no_failsafe=y' >>$(TARGET_DIR)/lib/preinit/00_preinit.conf)
 endef
 
 define Image/mkfs/prepare
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index e0bf915..106eff1 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -71,6 +71,7 @@ define ImageConfigOptions
 	echo 'pi_broadcast=$(if $(CONFIG_TARGET_PREINIT_BROADCAST),$(CONFIG_TARGET_PREINIT_BROADCAST),"192.168.1.255")' >>$(1)/lib/preinit/00_preinit.conf
 	echo 'pi_preinit_net_messages="$(CONFIG_TARGET_PREINIT_SHOW_NETMSG)"' >>$(1)/lib/preinit/00_preinit.conf
 	echo 'pi_preinit_no_failsafe_netmsg="$(CONFIG_TARGET_PREINIT_SUPPRESS_FAILSAFE_NETMSG)"' >>$(1)/lib/preinit/00_preinit.conf
+	echo 'pi_preinit_no_failsafe="$(CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE)"' >>$(1)/lib/preinit/00_preinit.conf
 endef
 endif
 
diff --git a/package/base-files/files/lib/preinit/10_indicate_failsafe b/package/base-files/files/lib/preinit/10_indicate_failsafe
index 6afae41..da8ef18 100644
--- a/package/base-files/files/lib/preinit/10_indicate_failsafe
+++ b/package/base-files/files/lib/preinit/10_indicate_failsafe
@@ -9,6 +9,9 @@ indicate_failsafe_led () {
 }
 
 indicate_failsafe() {
+	if [ "$pi_preinit_no_failsafe" = "y" ]; then
+		return
+	fi
 	echo "- failsafe -"
 	preinit_net_echo "Entering Failsafe!\n"
 	indicate_failsafe_led
diff --git a/package/base-files/files/lib/preinit/30_failsafe_wait b/package/base-files/files/lib/preinit/30_failsafe_wait
index 3d69baf..514bab4 100644
--- a/package/base-files/files/lib/preinit/30_failsafe_wait
+++ b/package/base-files/files/lib/preinit/30_failsafe_wait
@@ -39,7 +39,9 @@ fs_wait_for_key () {
 		rm -f $keypress_wait
 	} &
 
-	echo "Press the [$1] key and hit [enter] $2"
+	if [ "$pi_preinit_no_failsafe" != "y" ]; then
+		echo "Press the [$1] key and hit [enter] $2"
+	fi
 	echo "Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level"
 	# if we're on the console we wait for input
 	{
@@ -82,14 +84,20 @@ fs_wait_for_key () {
 
 failsafe_wait() {
 	FAILSAFE=
-	grep -q 'failsafe=' /proc/cmdline && FAILSAFE=true && export FAILSAFE
+	if [ "$pi_preinit_no_failsafe" != "y" ]; then
+		grep -q 'failsafe=' /proc/cmdline && FAILSAFE=true && export FAILSAFE
+	fi
 	if [ "$FAILSAFE" != "true" ]; then
-		pi_failsafe_net_message=true
-		preinit_net_echo "Please press button now to enter failsafe"
-		pi_failsafe_net_message=false
-		fs_wait_for_key f 'to enter failsafe mode' $fs_failsafe_wait_timeout && FAILSAFE=true
-		[ -f "/tmp/failsafe_button" ] && FAILSAFE=true && echo "- failsafe button "`cat /tmp/failsafe_button`" was pressed -"
-		[ "$FAILSAFE" = "true" ] && export FAILSAFE && touch /tmp/failsafe
+		if [ "$pi_preinit_no_failsafe" != "y" ]; then
+			pi_failsafe_net_message=true
+			preinit_net_echo "Please press button now to enter failsafe"
+			pi_failsafe_net_message=false
+			fs_wait_for_key f 'to enter failsafe mode' $fs_failsafe_wait_timeout && FAILSAFE=true
+			[ -f "/tmp/failsafe_button" ] && FAILSAFE=true && echo "- failsafe button "`cat /tmp/failsafe_button`" was pressed -"
+			[ "$FAILSAFE" = "true" ] && export FAILSAFE && touch /tmp/failsafe
+		else
+			fs_wait_for_key "" "" $fs_failsafe_wait_timeout
+		fi
 	fi
 }
 
diff --git a/package/base-files/files/lib/preinit/40_run_failsafe_hook b/package/base-files/files/lib/preinit/40_run_failsafe_hook
index cb43ad3..2b2cf5b 100644
--- a/package/base-files/files/lib/preinit/40_run_failsafe_hook
+++ b/package/base-files/files/lib/preinit/40_run_failsafe_hook
@@ -3,6 +3,9 @@
 # Copyright (C) 2010 Vertical Communications
 
 run_failsafe_hook() {
+    if [ "$pi_preinit_no_failsafe" = "y" ]; then
+		return
+	fi
     if [ "$FAILSAFE" = "true" ]; then
 	boot_run_hook failsafe
 	lock -w /tmp/.failsafe
diff --git a/package/base-files/image-config.in b/package/base-files/image-config.in
index fd0ead6..8369fa2 100644
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@@ -24,13 +24,24 @@ config TARGET_PREINIT_SUPPRESS_STDERR
 		the ash shell launched by inittab will display stderr).  That's
 		the same behaviour as seen in previous version of OpenWrt.
 
+config TARGET_PREINIT_DISABLE_FAILSAFE
+	bool
+	prompt "Disable failsafe" if PREINITOPT
+	default n
+	help
+		Disable failsafe mode.  While it is very handy while
+		experimenting or developing it really ought to be
+		disabled in production environments as it is a major
+		security loophole.
+
 config TARGET_PREINIT_TIMEOUT
 	int
-	prompt "Failsafe wait timeout" if PREINITOPT
+	prompt "Failsafe/Debug wait timeout" if PREINITOPT
 	default 2
 	help
-		How long to wait for failsafe mode to be entered before
-		continuing with a regular boot if failsafe not selected.
+		How long to wait for failsafe mode to be entered or for
+		a debug option to be pressed before continuing with a
+		regular boot.
 
 config TARGET_PREINIT_SHOW_NETMSG
 	bool
@@ -45,7 +56,7 @@ config TARGET_PREINIT_SHOW_NETMSG
 
 config TARGET_PREINIT_SUPPRESS_FAILSAFE_NETMSG
 	bool
-	prompt "Suppress network message indicating failsafe" if PREINITOPT
+	prompt "Suppress network message indicating failsafe" if ( PREINITOPT && !TARGET_PREINIT_SHOW_NETMSG && !TARGET_PREINIT_DISABLE_FAILSAFE )
 	default n
 	help
 		If "Show all preinit network messages" above is not set, then
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index f3bfec1..b8ad635 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -43,6 +43,7 @@ Building images:
 	make image PACKAGES="<pkg1> [<pkg2> [<pkg3> ...]]" # include extra packages
 	make image FILES="<path>" # include extra files from <path>
 	make image BIN_DIR="<path>" # alternative output directory for the images
+	make image NOFAILSAFE=1 # Disable failsafe mode
 
 endef
 $(eval $(call shexport,Helptext))
@@ -157,7 +158,7 @@ package_postinst: FORCE
 build_image: FORCE
 	@echo
 	@echo Building images...
-	$(NO_TRACE_MAKE) -C target/linux/$(BOARD)/image install TARGET_BUILD=1 IB=1 \
+	$(NO_TRACE_MAKE) -C target/linux/$(BOARD)/image install TARGET_BUILD=1 IB=1 NOFAILSAFE="$(NOFAILSAFE)" \
 		$(if $(USER_PROFILE),PROFILE="$(USER_PROFILE)")
 
 clean: