Skip to content

Commit 328458a

Browse files
jiriajiria
authored
Additional cleanup for the OSGuard image definition (#14441)
Enables stable interface names Works around missing credentials directory Stops reinstalling initramfs Reenables selinux-policy-ci Reorders AKS packages for cleanliness Removes custom eth0 configuration Disables SSHD (though it gets reenabled in runtime anyway)
1 parent 74befd6 commit 328458a

File tree

9 files changed

+77
-37
lines changed

9 files changed

+77
-37
lines changed

‎toolkit/imageconfigs/files/common/99-dhcp-eth0.network

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎toolkit/imageconfigs/files/osguard/repart.d/14-root-a.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[Partition]
22
Type=root
33
Label=root-a
4-
SizeMinBytes=10G
4+
SizeMinBytes=12G
55
Weight=1000
66
GrowFileSystem=true

‎toolkit/imageconfigs/files/osguard/repart.d/18-root-b.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[Partition]
22
Type=root
33
Label=root-b
4-
SizeMinBytes=10G
4+
SizeMinBytes=12G
55
Weight=1000
66
GrowFileSystem=true

‎toolkit/imageconfigs/linuxguard-amd64.yaml

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,14 @@ storage:
6666
mountPoint:
6767
idType: part-label
6868
path: /boot/efi
69-
options: umask=0077,noexec,nodev
69+
options: nodev,noexec,umask=0077
7070

7171
- deviceId: boot-a
7272
type: ext4
7373
mountPoint:
7474
idType: uuid
7575
path: /boot
76-
options: noexec,nodev
76+
options: nodev,noexec,nosuid
7777

7878
- deviceId: root-a
7979
type: ext4
@@ -85,21 +85,21 @@ storage:
8585
type: ext4
8686
mountPoint:
8787
path: /usr
88-
options: ro,nodev
88+
options: nodev,ro
8989

9090
- deviceId: trident
9191
type: ext4
9292
mountPoint:
9393
idType: part-label
9494
path: /var/lib/trident
95-
options: noexec,nodev
95+
options: nodev,noexec,nosuid
9696

9797
- deviceId: home
9898
type: ext4
9999
mountPoint:
100100
idType: part-label
101101
path: /home
102-
options: noexec,nodev
102+
options: nodev,noexec,nosuid
103103

104104
os:
105105
bootloader:
@@ -119,6 +119,7 @@ os:
119119
- rd.luks=0
120120
- rd.hostonly=0
121121
- ipe.enforce=0
122+
- net.ifnames=1
122123

123124
packages:
124125
remove:
@@ -177,15 +178,24 @@ os:
177178

178179
scripts:
179180
postCustomization:
181+
# Various performance tuning steps
180182
- path: scripts/common/performance-tuning.sh
181-
# Config AzureLinuxagent
183+
# Config AzureLinuxAgent
182184
- path: scripts/common/azlinuxagentconfig.sh
183185
# Disable unused SELinux policy modules and configure SELinux policy for CI
184186
- path: scripts/common/selinux-ci-config.py
185187
interpreter: /usr/bin/python3
188+
# Ensure the /etc/machine-id is cleared before the first boot
186189
- path: scripts/common/cleanup-machineid.sh
190+
# Move CNI binaries from /opt to /usr for IPE
187191
- path: scripts/common/prepare_trusted_cni_plugins.sh
192+
# Move iptables scripts from /etc to /usr for IPE
193+
- path: scripts/common/move-iptables-scripts-to-usr.sh
194+
# Disable exec and suid on /tmp
188195
- path: scripts/common/tmp-no-exec.sh
196+
# Remove ImportCredential from getty services to avoid boot log warnings
197+
- path: scripts/common/remove-getty-import-credential.sh
198+
# Set OS release variant entries
189199
- path: scripts/set_os_release_variant_entries.sh
190200
arguments:
191201
- --variant-id

‎toolkit/imageconfigs/osguard-amd64.yaml

Lines changed: 28 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ storage:
33

44
disks:
55
- partitionTableType: gpt
6-
maxSize: 24G
6+
maxSize: 40G
77
partitions:
88
- id: esp
99
type: esp
@@ -26,7 +26,7 @@ storage:
2626
- id: root-a
2727
type: root
2828
label: root-a
29-
size: 4G
29+
size: 12G
3030

3131
verity:
3232
- id: usrverity
@@ -42,26 +42,26 @@ storage:
4242
mountPoint:
4343
idType: part-label
4444
path: /boot/efi
45-
options: umask=0077,noexec,nodev
45+
options: nodev,noexec,umask=0077
4646

4747
- deviceId: boot-a
4848
type: ext4
4949
mountPoint:
5050
idType: uuid
5151
path: /boot
52-
options: noexec,nodev,nosuid
52+
options: nodev,noexec,nosuid
5353

5454
- deviceId: usrverity
5555
type: ext4
5656
mountPoint:
5757
path: /usr
58-
options: ro,nodev
58+
options: nodev,ro
5959

6060
- deviceId: root-a
6161
type: ext4
6262
mountPoint:
6363
path: /
64-
options: nodev,nosuid,x-initrd.mount,x-systemd.growfs
64+
options: nodev,nosuid,x-systemd.growfs,x-initrd.mount
6565

6666
os:
6767
bootloader:
@@ -83,14 +83,13 @@ os:
8383
- rd.hostonly=0
8484
- ipe.enforce=0
8585
- fips=1
86+
- net.ifnames=1
8687

8788
packages:
8889
remove:
89-
- initramfs
9090
- dracut-hostonly # Not used for UKI images
9191
- grub2-efi-binary # Replaced by systemd-boot
9292
- kernel # Replaced by kernel-ipe
93-
9493
install:
9594
- syslog
9695
- WALinuxAgent
@@ -121,10 +120,9 @@ os:
121120
- policycoreutils-python-utils
122121
- secilc
123122
- selinux-policy
124-
# - selinux-policy-ci
123+
- selinux-policy-ci
125124
- selinux-policy-modules
126125
- setools-console
127-
- chrony
128126

129127
# === System packages ===
130128
- systemd-ukify
@@ -139,7 +137,9 @@ os:
139137
- bind-utils
140138
- tar
141139
# =====AKS=====
140+
- blobfuse2
142141
- ca-certificates
142+
- chrony
143143
- cifs-utils
144144
- cloud-init-azure-kvp
145145
- conntrack-tools
@@ -152,11 +152,15 @@ os:
152152
- iproute
153153
- ipset
154154
- iptables
155+
- iscsi-initiator-utils
155156
- jq
156157
- logrotate
157158
- lsof
159+
- netplan
160+
- nftables
158161
- nmap-ncat
159162
- nfs-utils
163+
- oras
160164
- pam
161165
- psmisc
162166
- rsyslog
@@ -166,12 +170,6 @@ os:
166170
- util-linux
167171
- xz
168172
- zip
169-
- blobfuse2
170-
- nftables
171-
- iscsi-initiator-utils
172-
- netplan
173-
- oras
174-
- initramfs
175173

176174
additionalDirs:
177175
- source: files/osguard/repart.d
@@ -182,8 +180,6 @@ os:
182180
# SELinux customizations
183181
- source: files/linuxguard/selinux-ci-uki.semanage
184182
destination: /etc/selinux/targeted/selinux-ci.semanage
185-
- source: files/common/99-dhcp-eth0.network
186-
destination: /etc/systemd/network/99-dhcp-eth0.network
187183
# Cloud-init configuration
188184
- source: files/osguard/cloud.cfg
189185
destination: /etc/cloud/cloud.cfg
@@ -202,8 +198,9 @@ os:
202198
permissions: "600"
203199

204200
services:
205-
enable:
201+
disable:
206202
- sshd
203+
enable:
207204
- systemd-networkd
208205
- systemd-resolved
209206

@@ -214,14 +211,24 @@ os:
214211

215212
scripts:
216213
postCustomization:
214+
# Various performance tuning steps
217215
- path: scripts/common/performance-tuning.sh
218-
# Config AzureLinuxagent
216+
# Config AzureLinuxAgent
219217
- path: scripts/common/azlinuxagentconfig.sh
220218
# Disable unused SELinux policy modules and configure SELinux policy for CI
221-
#- path: scripts/linuxguard/selinux-ci-config.sh
219+
- path: scripts/common/selinux-ci-config.py
220+
interpreter: /usr/bin/python3
221+
# Ensure the /etc/machine-id is cleared before the first boot
222222
- path: scripts/common/cleanup-machineid.sh
223+
# Move CNI binaries from /opt to /usr for IPE
223224
- path: scripts/common/prepare_trusted_cni_plugins.sh
225+
# Move iptables scripts from /etc to /usr for IPE
226+
- path: scripts/common/move-iptables-scripts-to-usr.sh
227+
# Disable exec and suid on /tmp
224228
- path: scripts/common/tmp-no-exec.sh
229+
# Remove ImportCredential from getty services to avoid boot log warnings
230+
- path: scripts/common/remove-getty-import-credential.sh
231+
# Set OS release variant entries
225232
- path: scripts/set_os_release_variant_entries.sh
226233
arguments:
227234
- --variant-id

‎toolkit/imageconfigs/scripts/common/move-iptables-scripts-to-usr.sh

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
set -euxo pipefail
4+
5+
# Move iptables scripts to /usr/libexec/iptables, as /etc will be locked down by
6+
# IPE and also is mounted with noexec.
7+
8+
START_SOURCE="/etc/systemd/scripts/iptables"
9+
STOP_SOURCE="/etc/systemd/scripts/iptables.stop"
10+
11+
START_TARGET="/usr/libexec/iptables/iptables"
12+
STOP_TARGET="/usr/libexec/iptables/iptables.stop"
13+
14+
mkdir -p /usr/libexec/iptables
15+
16+
mv "$START_SOURCE" "$START_TARGET"
17+
mv "$STOP_SOURCE" "$STOP_TARGET"
18+
19+
# Create symlinks for compatibility
20+
ln -s "$START_TARGET" "$START_SOURCE"
21+
ln -s "$STOP_TARGET" "$STOP_SOURCE"

‎toolkit/imageconfigs/scripts/common/remove-getty-import-credential.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
3+
set -euxo pipefail
4+
5+
# Reported upstream as https://github.com/util-linux/util-linux/issues/2896,
6+
# requires systemd updated to v256. The workaround is to remove the ImportCredential lines.
7+
sed -i /ImportCredential=/d /usr/lib/systemd/system/[email protected]
8+
sed -i /ImportCredential=/d /usr/lib/systemd/system/[email protected]

‎toolkit/imageconfigs/scripts/common/tmp-no-exec.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@
55

66
set -euxo pipefail
77

8-
sed -i 's/^Options=/Options=noexec,/' /usr/lib/systemd/system/tmp.mount
8+
sed -i 's/^Options=/Options=noexec,nosuid,/' /usr/lib/systemd/system/tmp.mount

‎toolkit/scripts/generate-repartd.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ emit_partition() {
3131
[Partition]
3232
Type=$type_out
3333
Label=$label
34-
SizeMinBytes=10G
34+
SizeMinBytes=12G
3535
Weight=1000
3636
GrowFileSystem=true
3737
EOF

0 commit comments

Comments
 (0)