hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-12-04 23:22:22 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'freebsd/current/main' into hardened/current/master

Browse Source
This commit is contained in:
HardenedBSD Sync Services 2024-09-04 00:01:57 -06:00
commit 4d251c16e1
No known key found for this signature in database
6 changed files with 84 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
release/Makefile.vm
View File

@ -39,9 +39,10 @@ BASIC-CLOUDINIT_FSLIST?= ufs zfs
BASIC-CLOUDINIT_DESC?= Images for VM with cloudinit disk config support
EC2_FORMAT= raw
EC2_FSLIST?= ufs zfs
EC2_FLAVOURS?= BASE CLOUD-INIT
EC2_FLAVOURS?= BASE CLOUD-INIT SMALL
EC2-BASE_DESC= Amazon EC2 image
EC2-CLOUD-INIT_DESC= Amazon EC2 Cloud-Init image
EC2-SMALL_DESC= Amazon EC2 small image
GCE_FORMAT= raw
GCE_FSLIST?= ufs zfs
GCE_DESC= Google Compute Engine image

30
release/tools/ec2-base.conf
View File

@ -4,11 +4,13 @@
# Packages to install into the image we're creating. In addition to packages
# present on all EC2 AMIs, we install:
# * amazon-ssm-agent (not enabled by default, but some users need to use
# it on systems not connected to the internet),
# * ec2-scripts, which provides a range of EC2ification startup scripts,
# * firstboot-freebsd-update, to install security updates at first boot,
# * firstboot-pkgs, to install packages at first boot, and
# * isc-dhcp44-client, used for IPv6 network setup.
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ec2-scripts \
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} amazon-ssm-agent ec2-scripts \
firstboot-freebsd-update firstboot-pkgs isc-dhcp44-client"
# Services to enable in rc.conf(5).
@ -22,29 +24,6 @@ vm_extra_pre_umount() {
# via EC2 user-data.
echo 'firstboot_pkgs_list="devel/py-awscli"' >> ${DESTDIR}/etc/rc.conf
# EC2 instances use DHCP to get their network configuration. IPv6
# requires accept_rtadv.
echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf
# The EC2 DHCP server can be trusted to know whether an IP address is
# assigned to us; we don't need to ARP to check if anyone else is using
# the address before we start using it.
echo 'dhclient_arpwait="NO"' >> ${DESTDIR}/etc/rc.conf
# Enable IPv6 on all interfaces, and spawn DHCPv6 via rtsold
echo 'ipv6_activate_all_interfaces="YES"' >> ${DESTDIR}/etc/rc.conf
echo 'rtsold_enable="YES"' >> ${DESTDIR}/etc/rc.conf
echo 'rtsold_flags="-M /usr/local/libexec/rtsold-M -a"' >> ${DESTDIR}/etc/rc.conf
# Provide a script which rtsold can use to launch DHCPv6
mkdir -p ${DESTDIR}/usr/local/libexec
cat > ${DESTDIR}/usr/local/libexec/rtsold-M <<'EOF'
#!/bin/sh
/usr/local/sbin/dhclient -6 -nw -N -cf /dev/null $1
EOF
chmod 755 ${DESTDIR}/usr/local/libexec/rtsold-M
# Any EC2 ephemeral disks seen when the system first boots will
# be "new" disks; there is no "previous boot" when they might have
# been seen and used already.
@ -53,5 +32,8 @@ EOF
# Configuration common to all EC2 AMIs
ec2_common
# Standard FreeBSD network configuration
ec2_base_networking
return 0
}

4
release/tools/ec2-cloud-init.conf
View File

@ -3,8 +3,8 @@
. ${WORLDDIR}/release/tools/ec2.conf
# Packages to install into the image we're creating. In addition to packages
# present on all EC2 AMIs, we install cloud-init.
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} net/cloud-init"
# present on all EC2 AMIs, we install amazon-ssm-agent and cloud-init.
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} amazon-ssm-agent net/cloud-init"
# Services to enable in rc.conf(5).
export VM_RC_LIST="${VM_RC_LIST} cloudinit sshd"

44
release/tools/ec2-small.conf Normal file
View File

@ -0,0 +1,44 @@
#!/bin/sh
. ${WORLDDIR}/release/tools/ec2.conf
# Build with a 4.9 GB partition; the growfs rc.d script will expand
# the partition to fill the root disk after the EC2 instance is launched.
# Note that if this is set to <N>G, we will end up with an <N+1> GB disk
# image since VMSIZE is the size of the filesystem partition, not the disk
# which it resides within. (This overrides the default in ec2.conf.)
export VMSIZE=5000m
# Flags to installworld/kernel: We don't want debug symbols (kernel or
# userland), 32-bit libraries, tests, or the debugger.
export INSTALLOPTS="WITHOUT_DEBUG_FILES=YES WITHOUT_KERNEL_SYMBOLS=YES \
WITHOUT_LIB32=YES WITHOUT_TESTS=YES WITHOUT_LLDB=YES"
# Packages to install into the image we're creating. In addition to packages
# present on all EC2 AMIs, we install:
# * ec2-scripts, which provides a range of EC2ification startup scripts,
# * firstboot-freebsd-update, to install security updates at first boot,
# * firstboot-pkgs, to install packages at first boot, and
# * isc-dhcp44-client, used for IPv6 network setup.
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ec2-scripts \
firstboot-freebsd-update firstboot-pkgs isc-dhcp44-client"
# Services to enable in rc.conf(5).
export VM_RC_LIST="${VM_RC_LIST} ec2_configinit ec2_ephemeral_swap \
ec2_fetchkey ec2_loghostkey firstboot_freebsd_update firstboot_pkgs \
growfs sshd"
vm_extra_pre_umount() {
# Any EC2 ephemeral disks seen when the system first boots will
# be "new" disks; there is no "previous boot" when they might have
# been seen and used already.
touch ${DESTDIR}/var/db/ec2_ephemeral_diskseen
# Configuration common to all EC2 AMIs
ec2_common
# Standard FreeBSD network configuration
ec2_base_networking
return 0
}

33
release/tools/ec2.conf
View File

@ -1,11 +1,9 @@
#!/bin/sh
# Packages which should be installed onto all EC2 AMIs:
# Package which should be installed onto all EC2 AMIs:
# * ebsnvme-id, which is very minimal and provides important EBS-specific
# functionality,
# * amazon-ssm-agent (not enabled by default, but some users need to use
# it on systems not connected to the internet).
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ebsnvme-id amazon-ssm-agent"
export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ebsnvme-id"
# Services which should be enabled by default in rc.conf(5).
export VM_RC_LIST="dev_aws_disk ntpd"
@ -104,3 +102,30 @@ EOF
return 0
}
ec2_base_networking () {
# EC2 instances use DHCP to get their network configuration. IPv6
# requires accept_rtadv.
echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf
# The EC2 DHCP server can be trusted to know whether an IP address is
# assigned to us; we don't need to ARP to check if anyone else is using
# the address before we start using it.
echo 'dhclient_arpwait="NO"' >> ${DESTDIR}/etc/rc.conf
# Enable IPv6 on all interfaces, and spawn DHCPv6 via rtsold
echo 'ipv6_activate_all_interfaces="YES"' >> ${DESTDIR}/etc/rc.conf
echo 'rtsold_enable="YES"' >> ${DESTDIR}/etc/rc.conf
echo 'rtsold_flags="-M /usr/local/libexec/rtsold-M -a"' >> ${DESTDIR}/etc/rc.conf
# Provide a script which rtsold can use to launch DHCPv6
mkdir -p ${DESTDIR}/usr/local/libexec
cat > ${DESTDIR}/usr/local/libexec/rtsold-M <<'EOF'
#!/bin/sh
/usr/local/sbin/dhclient -6 -nw -N -cf /dev/null $1
EOF
chmod 755 ${DESTDIR}/usr/local/libexec/rtsold-M
return 0
}

2
release/tools/vmimage.subr
View File

@ -52,7 +52,7 @@ vm_install_base() {
# Installs the FreeBSD userland/kernel to the virtual machine disk.
cd ${WORLDDIR} && \
make DESTDIR=${DESTDIR} \
make DESTDIR=${DESTDIR} ${INSTALLOPTS} \
installworld installkernel distribution || \
err "\n\nCannot install the base system to ${DESTDIR}."