build: add MAINTENANCEMENU option

The new maintenance menu needs to be tested in real builds but should
not yet be enabled in production builds.

By adding this feature, but disabled by default, it can be go into
a more extensive security review.

This commit:
* adds the option BASE_MAINTENANCEMENU, default: 'false'
* `startup-maintenance.service` is only enabled if set to true

armbian/base/build.conf

@@ -60,3 +60,7 @@
 # Make root filesystem read-only and overlay it with a temporary filesystem.
 # All changes are lost on reboot, guaranteeing a safe state.
 #BASE_OVERLAYROOT="true"
+
+# Start Maintenance Menu if authorized maintenance token
+# is found on USB flasdrive on boot
+#BASE_MAINTENANCEMENU="false"

armbian/base/customize-armbian-rockpro64.sh

@@ -81,6 +81,7 @@ CONFIGURATION:
     AUTOSETUP SSD:      ${BASE_AUTOSETUP_SSD}
     BITCOIN SERVICES ENABLED:
                         ${BASE_ENABLE_BITCOIN_SERVICES}
+    MAINTENANCE MENU:   ${BASE_MAINTENANCEMENU}
 
 ================================================================================
 BUILD OPTIONS:
@@ -179,6 +180,7 @@ BASE_DASHBOARD_HDMI_ENABLED="false"
 BASE_HDMI_BUILD="false"
 BASE_MINIMAL="true"
 BASE_OVERLAYROOT="true"
+BASE_MAINTENANCEMENU="false"        # TODO(Stadicus): set "true" by default after further review
 
 # Overwrite defaults if BASE_PRODUCTION_IMAGE set to "false"
 if [[ ${BASE_PRODUCTION_IMAGE} == "false" ]]; then
@@ -471,7 +473,10 @@ systemctl enable update-checks.service
 
 ## maintenance menu
 importFile /etc/systemd/system/startup-maintenance.service
-systemctl enable startup-maintenance.service
+
+if [[ "${BASE_MAINTENANCEMENU}" == "true" ]]; then
+  systemctl enable startup-maintenance.service
+fi
 
 ## disable ssh login messages
 echo "MOTD_DISABLE='header tips updates armbian-config'" >> /etc/default/armbian-motd

armbian/base/scripts/bbb-cmd.sh

@@ -16,7 +16,7 @@ possible commands:
   flashdrive    <check|mount|umount>
   backup        <sysconfig|hsm_secret>
   restore       <sysconfig|hsm_secret>
-  reset         <auth|config|image|ssd>
+  reset         <auth|config>
   mender-update <install|commit>
   presync       <create|restore>