pfSense

Why is this the fault of pfSense?

It's a regression. In previous versions with the embedded kernel you could not stop the serial console from working since the kernel was built that way.

Now it's possible to completely break the console very easily. We should not allow the user to brick their device if we can help it.

Do you agree with this diff?

diff --git a/usr/local/www/diag_backup.php b/usr/local/www/diag_backup.php
index d71a3b2..5192c4a 100644
--- a/usr/local/www/diag_backup.php
+++ b/usr/local/www/diag_backup.php
@@ -411,6 +411,13 @@ if ($_POST) {
                                                                if(file_exists("{$g['tmp_path']}/config.cache"))
                                                                        unlink("{$g['tmp_path']}/config.cache");
                                                                $config = parse_config(true);
+                                                               if (file_exists("/boot/loader.conf")) {
+                                                                       $loaderconf = file_get_contents("/boot/loader.conf");
+                                                                       if (strpos($loaderconf, "comconsole")) {
+                                                                               $config['system']['enableserial'] = true;
+                                                                               write_config("Restore serial console enabling in configuration.");
+                                                                       }
+                                                               }
                                                                /* extract out rrd items, unset from $config when done */
                                                                if($config['rrddata']) {
                                                                        restore_rrddata();

Yeah that seems fine if it works, haven't tested it. Maybe JimP can think of a scenario where that doesn't work, but it seems reasonable.

Seems like that would still be possible to bypass in a few ways (like ACB). Relying on config.xml for what should be a property of the installed OS seems wrong. It should persist independent of the contents of config.xml

I committed that part by accident.
Though i think returning a embedded kernel only for this is redundant no?

No need for an embedded kernel, maybe a flag file in /conf/ that is set/checked to signal that the serial console should always be enabled, similar to the enableserial_force that is there but file based not just in $g

Worked fine on my tests, will leave it open to hear a 2nd opinion

yeah looks good