Skip to content

Commit 8c0db83

Browse files
authored
Update linuxguard config (microsoft#14355)
Add noexec mount option Remove vim, wget, tardev-snapshotter, erofs-utils Remove verity-signature files Add cloud.cfg file Make scripts executable
1 parent 4568ace commit 8c0db83

14 files changed

+153
-187
lines changed
Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# The top level settings are used as module
2+
# and base configuration.
3+
4+
# A set of users which may be applied and/or used by various modules
5+
# when a 'default' entry is found it will reference the 'default_user'
6+
# from the distro configuration specified below
7+
users:
8+
- default
9+
10+
# If this is set, 'root' will not be able to ssh in and they
11+
# will get a message to login instead as the default $user
12+
# disable_root: false
13+
14+
# This will cause the set+update hostname module to not operate (if true)
15+
# preserve_hostname: false
16+
17+
# If you use datasource_list array, keep array items in a single line.
18+
# If you use multi line array, ds-identify script won't read array items.
19+
# Example datasource config
20+
# datasource:
21+
# Ec2:
22+
# metadata_urls: [ 'blah.com' ]
23+
# timeout: 5 # (defaults to 50 seconds)
24+
# max_wait: 10 # (defaults to 120 seconds)
25+
26+
# The modules that run in the 'init' stage
27+
cloud_init_modules:
28+
# - seed_random
29+
# - bootcmd
30+
# - write_files
31+
# - growpart
32+
# - resizefs
33+
# - disk_setup
34+
# - mounts
35+
- set_hostname
36+
# - update_hostname
37+
# - update_etc_hosts
38+
# - ca_certs
39+
# - rsyslog
40+
- users_groups
41+
- ssh
42+
# - set_passwords
43+
44+
# The modules that run in the 'config' stage
45+
# cloud_config_modules:
46+
# - ssh_import_id
47+
# - keyboard
48+
# - locale
49+
# - spacewalk
50+
# - yum_add_repo
51+
# - ntp
52+
# - timezone
53+
# - disable_ec2_metadata
54+
# - runcmd
55+
56+
# The modules that run in the 'final' stage
57+
# cloud_final_modules:
58+
# - package_update_upgrade_install
59+
# - write_files_deferred
60+
# - puppet
61+
# - chef
62+
# - ansible
63+
# - mcollective
64+
# - salt_minion
65+
# - reset_rmc
66+
# - scripts_vendor
67+
# - scripts_per_once
68+
# - scripts_per_boot
69+
# - scripts_per_instance
70+
# - scripts_user
71+
# - ssh_authkey_fingerprints
72+
# - keys_to_console
73+
# - install_hotplug
74+
# - phone_home
75+
# - final_message
76+
# - power_state_change
77+
78+
# System and/or distro specific settings
79+
# (not accessible to handlers/transforms)
80+
system_info:
81+
# This will affect which distro class gets used
82+
distro: azurelinux
83+
# Default user name + that default users groups (if added/used)
84+
default_user:
85+
name: azurelinux
86+
lock_passwd: True
87+
gecos: Azure Linux
88+
groups: [wheel]
89+
sudo: ["ALL=(ALL) NOPASSWD:ALL"]
90+
shell: /bin/bash
91+
# network:
92+
# renderers: ['networkd']
93+
# # Other config here will be given to the distro class and/or path classes
94+
# paths:
95+
# cloud_dir: /var/lib/cloud/
96+
# templates_dir: /etc/cloud/templates/
97+
ssh_svcname: sshd

toolkit/imageconfigs/files/linuxguard/selinux-ci-uki.semanage

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ fcontext -a -f f -t fsadm_exec_t -r 's0' '/usr/bin/lsblk'
2121
fcontext -a -f f -t dockerd_exec_t -r 's0' '/usr/bin/tardev-snapshotter'
2222
fcontext -a -f f -t bin_t -r 's0' '/usr/share/netplan/netplan\.script'
2323
fcontext -a -e / /rw
24+
fcontext -a -e /etc/selinux /usr/etc/selinux

toolkit/imageconfigs/files/linuxguard/verity-signature/10-mountbootpartition.conf

Lines changed: 0 additions & 1 deletion
This file was deleted.

toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/module-setup.sh

Lines changed: 0 additions & 31 deletions
This file was deleted.

toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/mountbootpartition-generator.sh

Lines changed: 0 additions & 79 deletions
This file was deleted.

toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/mountbootpartition-genrules.sh

Lines changed: 0 additions & 6 deletions
This file was deleted.

toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/mountbootpartition.sh

Lines changed: 0 additions & 14 deletions
This file was deleted.

0 commit comments

Comments
 (0)