# Filesystem, Users, and Network

## OS Identity

- `/etc/issue`: `Stern Pinball Spike 3`
- `/etc/os-release` is a symlink to `/usr/lib/os-release`.
- `/bin/busybox`: BusyBox `v1.36.1`, build string `2025-10-22 11:34:32 EDT`.
- `/usr/lib/os-release`:
  - `NAME=Buildroot`
  - `VERSION=2024.08.1`
  - `ID=buildroot`
  - `VERSION_ID=2024.08.1`
  - `PRETTY_NAME="Buildroot 2024.08.1"`

## Mounts

`/etc/fstab` mounts only runtime filesystems by default, plus an explicit noauto boot partition:

| Device/source | Mount point | Type | Options |
| --- | --- | --- | --- |
| `devpts` | `/dev/pts` | `devpts` | `defaults,gid=5,mode=620,ptmxmode=0666` |
| `tmpfs` | `/dev/shm` | `tmpfs` | `mode=0777` |
| `tmpfs` | `/tmp` | `tmpfs` | `mode=1777` |
| `tmpfs` | `/run` | `tmpfs` | `mode=0755,nosuid,nodev` |
| `/dev/mmcblk0p1` | `/boot` | `vfat` | `defaults,ro,noauto` |

Notable extracted top-level directories:

- `/games`: active game and SPIKE payloads.
- `/connectivity`: persistent connectivity/cache/update/dump storage. Only `lost+found` is present in this extraction.
- `/data`: persistent data area. Only `lost+found` is present in this extraction.
- `/usr/local/spike`: fallback SPIKE display utilities and logos.
- `/boot`: empty in this extraction, but expected as separate VFAT partition.

## Persistent Symlinks

Runtime state is intentionally shifted out of rootfs into persistent or tmpfs paths:

- `/etc/resolv.conf -> ../tmp/resolv.conf`
- `/etc/mtab -> ../proc/self/mounts`
- `/etc/os-release -> ../usr/lib/os-release`
- `/var/lib/misc -> ../../tmp`
- `/var/lib/dbus -> /tmp/dbus`
- `/var/lib/alsa -> /connectivity/alsa`
- `/var/lib/bluetooth -> /connectivity/bluetooth`
- `/var/lib/bluealsa -> /connectivity/bluealsa`

`S95game` recreates the ALSA/Bluetooth symlinks if needed by temporarily remounting `/` read-write.

## Users

`/etc/passwd` contains:

- `root:*:0:0:root:/root:/bin/sh`
- standard service users including `daemon`, `bin`, `sys`, `mail`, `www-data`, `operator`, `nobody`, `dbus`, and `sshd`.

No `/etc/shadow` file was found during triage. The `root:*` passwd field indicates password login for root is disabled through the passwd file, and gettys are commented out in `/etc/inittab`.

## Groups

Notable groups:

- `wheel:x:10:root`
- `audio:x:29:`
- `video:x:28:`
- `plugdev:x:46:`
- `netdev:x:82:`
- `input:x:103:`
- `kvm:x:104:`
- `dbus:x:101:dbus`

## Network

`/etc/network/interfaces`:

- Loopback is automatic.
- `eth0` is automatic DHCP.
- `wlan0` is DHCP-capable but not marked `auto`; it uses WEXT and `/etc/wpa_supplicant.conf`.
- `pre-up /etc/network/nfs_check`, `wait-delay 15`, and dynamic hostname commands are present but commented out.

`/etc/wpa_supplicant.conf`:

- `ctrl_interface=/var/run/wpa_supplicant`
- `ap_scan=1`
- Includes an open network block with `key_mgmt=NONE`.

No static SSH startup script was identified in `/etc/init.d`, despite the presence of an `sshd` privilege-separation user and OpenSSH client/server-related binaries.

## Kernel Modules

`/etc/modules` asks the system to load:

- `vc4`
- `v3d`
- `bcm2835-codec`
- `i2c-dev`

`S55spike3` also explicitly loads:

- `i2c-dev`
- `exfat`
- `fuse`

The kernel module tree is `/lib/modules/6.6.28-v8`.