mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-11-23 11:31:08 +01:00
2d4ff62f00
r273823-r273826, r273833, r273836, r273944, r274069-r274071,
r274134, r274211, r274280-r274285, r274287-r274288, r274292,
r274296-r274297, r274356, r274533, r274725, r274726, r274729,
r274734, r274771, r274945-r274946, r277180, r277183-r277184,
r277186-r277187, r277250-r277253, r277263-r277264, r277383-r277384,
r277393-r277395, r277438-r277439, r277447, r277455:
r273823:
Move virtual machine / cloud provider targets and
options from release/Makefile to their own Makefile.
r273824:
Add glue to allow enabling building cloud provider VM images
by default.
When WITH_CLOUDWARE is not empty, add CLOUDTARGETS to the
release/Makefile 'release' target.
r273825:
Avoid hard-coding the Azure image file format. While here,
avoid using OSRELEASE for the output file name.
r273826:
Remove a few vestiges of passing an exit code to panic().
r273833:
Initial commit providing a mechanism to create openstack images
as part of the release build.
r273836:
Fix output file name for openstack images. No further conversion
is necessary for this VM file target, so there is no need to append
the '.raw' suffix here.
r273944:
Uncomment the cloudinit rc.conf(5) line.
r274069:
Add line continuation so OPENSTACKCONF is actually included in the env(1).
r274070:
Add a 'vm-cloudware' target, used to drive all targets in CLOUDTARGETS.
r274071:
Add examples for WITH_CLOUDWARE to release.conf.sample.
Add WITH_CLOUDWARE evaluation to RELEASE_RMAKEFLAGS.
r274134:
Initial rewrite to consolidate VM image build scripts into one.
r274211:
Add write_partition_layout() used to populate the final image.
Fix duplicated mkimg(1) call in vm_create_disk().
Add primitive (untested) PowerPC/PowerPC64 VM image support.
Note: As it is currently written, the /boot/pmbr and
/boot/{gptboot,boot1.hfs} use the build host and not the target
build. Fixing this is likely going to be a hack in itself.
r274280:
Return if vm_create_disk() is unsuccessful.
r274281:
Add CLEANFILES entry for VM targets
r274282:
Add vm_extra_pre_umount() prototype to vmimage.subr.
r274283:
Fix DESTDIR for installworld, and make sure it is created before use.
r274284:
Move usage() from vmimage.subr to mk-vmimage.sh, in case vmimage.subr
has not been sourced.
r274285:
Spell 'OPTARG' correctly. Actually call vm_create_base().
r274287:
Fix line continuation in write_partition_layout().
Remove variable test that is no longer needed.
r274288:
Fix scheme flag to mkimg(1).
r274292:
mount(8) and umount(8) devfs(5) as needed.
r274296:
Change path for mk-vmimage.sh from ${TARGET}/ to scripts/ now that
it is consolidated into one file.
Fix paths for the base image and output disk image files.
r274297:
Call cleanup() after everything is done.
r274356:
Remove a stray directory from CLEANFILES.
r274533:
Set the boot partition type to 'apple-boot' for powerpc.
r274725:
In vm_install_base(), copy the host resolv.conf into
the build chroot before attempting to do anything that
requires working DNS (i.e., pkg bootstrap).
In vm_extra_pre_umount(), remove the resolv.conf before
the disk image is unmounted from the backing md(4).
r274726 (cperciva):
Silence errors when umounting the chroot's /dev, since it
probably doesn't exist when we're running this.
Unmount filesystems before attempting to destroy the md which
holds them.
r274729 (cperciva):
Unmount filesystem and destroy md before we read the vnode from
disk and package it into a disk image. Otherwise we end up
packaging an unclean filesystem.
r274734 (cperciva):
Merge duplicative vm-CLOUDTYPE targets before additional duplication
gets added by the impending arrival of ec2 and gcloud.
r274771 (cperciva):
Add NOSWAP option which can be set by a vmimage.conf file to specify
that no swap space should be created in the image. This will be used
by EC2 builds, since FreeBSD/EC2 allocates swap space on "ephemeral"
disks which are physically attached to the Xen host node.
r274945:
In vm_extra_install_packages(), only bootstrap pkg(8) if
VM_EXTRA_PACKAGES is empty.
In vm_extra_pre_umount(), cleanup downloaded packages if pkg(8) was
bootstrapped earlier.
r274946:
Fix indentation nit.
r277180:
In vm_extra_install_base(), do not install waagent in the openstack
image, because it is not used. This appears to be a copy mistake.
Remove vm_extra_install_base() from the openstack.conf entirely,
since it does not need to be overridden.
r277183:
Enable the textmode console by default for VM images, since there is
no way to tell if the environment will be able to use the
graphics-mode console.
r277184:
Enable password-less sudo for openstack images.
r277186:
Update the VM_EXTRA_PACKAGES list for the openstack images.
The documentation suggests doing a "just fetch this and run it"-style
bootstrap, from which the list of dependencies was obtained (in
github, at: pellaeon/bsd-cloudinit-installer)
There is one Python dependency unmet, oslo.config, which is not in
the Ports Collection.
r277187:
Add a comment to note that setting hw.vga.textmode=1 is temporary.
r277250:
Remove vm_extra_install_base() for the Azure image, now that the
waagent exists in the ports tree.
Add sysutils/azure-agent to the VM_EXTRA_PACKAGES list.
In vm_extra_pre_umount(), remove the explicit pkg(8) install
list, as dependencies are resolved by sysutils/azure-agent.
r277251:
Add a 'list-cloudware' target to print the list of supported CLOUDWARE
values and a description.
Add the AZURE_DESC and OPENSTACK_DESC descriptions.
r277252:
Update release(7)
r277253:
Add 'list-vmtargets' target, which produces a list of all supported
VM and cloud provider images.
Add VHD_DESC, VMDK_DESC, QCOW2_DESC, RAW_DESC image descriptions.
Format the output to make a bit more readable.
Update release(7) to document the list-vmtargets target.
r277263:
Add initial support for the GCE (Google Compute Engine) cloud hosting
provider image.
r277264:
Style and line length cleanup.
r277383:
Remove the console setting from rc.conf(5), which is not used there.
While here, set console to include vidconsole in the loader.conf(5).
r277384:
Fix an indentation nit.
No functional changes.
r277393:
Remove the pkg-clean(8) call from vm_extra_pre_umount() since the
function is often overridden.
Add vm_extra_pkg_rmcache() to call pkg-clean(8) to avoid duplicated
code.
r277394:
Move resolv.conf(5) removal back to vm_extra_pre_umount() where it
belongs.
The GCE image needs resolv.conf(5) to exist (created as part of the
image setup), so it cannot be removed.
r277395:
Comment the line that configures ttys(5) to 'off', which makes it
impossible to test that the image boots.
Add a note explaining why the line is commented, and not (yet) removed
entirely.
r277438:
Move the 'install' bits that are specific to virtual machine images
from the Makefile to Makefile.vm.
Rename the 'install' target to 'release-install', and add a new
'vm-install' target.
Add a new 'install' target that invokes the new targets.
r277439:
Add WITH_CLOUDWARE to the list of make(1) variables for the release
build.
r277447:
Remove hw.vga.textmode=1 from the VM image loader.conf, which was
included during test builds and not intended to be included when
merging this project branch back to head.
r277455:
Remove mk-azure.sh, which is no longer needed.
MFC after: 1 month
X-MFC-To: stable/10 (requires mkimg(1))
Help from: cperciva, swills
Relnotes: yes
Sponsored by: The FreeBSD Foundation
101 lines
2.6 KiB
Bash
101 lines
2.6 KiB
Bash
#!/bin/sh
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
|
|
# Set to a list of packages to install.
|
|
export VM_EXTRA_PACKAGES="firstboot-freebsd-update firstboot-pkgs \
|
|
google-cloud-sdk google-daemon panicmail sudo firstboot-growfs \
|
|
google-startup-scripts"
|
|
|
|
# Set to a list of third-party software to enable in rc.conf(5).
|
|
export VM_RC_LIST="google_accounts_manager ntpd"
|
|
|
|
vm_extra_install_base() {
|
|
echo 'search google.internal' > ${DESTDIR}/etc/resolv.conf
|
|
echo 'nameserver 169.254.169.254' >> ${DESTDIR}/etc/resolv.conf
|
|
echo 'nameserver 8.8.8.8' >> ${DESTDIR}/etc/resolv.conf
|
|
}
|
|
|
|
vm_extra_pre_umount() {
|
|
cat << EOF >> ${DESTDIR}/etc/rc.conf
|
|
dumpdev="AUTO"
|
|
ifconfig_vtnet0="SYNCDHCP mtu 1460"
|
|
ntpd_sync_on_start="YES"
|
|
ntpd_enable="YES"
|
|
sshd_enable="YES"
|
|
google_accounts_manager_enable="YES"
|
|
#disabled until I can figure out why the reboot for updates is hanging
|
|
#firstboot_freebsd_update_enable="YES"
|
|
#firstboot_pkgs_enable="YES"
|
|
# need to fill in something here
|
|
#firstboot_pkgs_list=""
|
|
panicmail_autosubmit="YES"
|
|
firstboot_growfs_enable="YES"
|
|
google_startup_enable="YES"
|
|
EOF
|
|
|
|
cat << EOF >> ${DESTDIR}/boot/loader.conf
|
|
autoboot_delay="-1"
|
|
beastie_disable="YES"
|
|
loader_logo="none"
|
|
hw.memtest.tests="0"
|
|
console="comconsole,vidconsole"
|
|
hw.vtnet.mq_disable=1
|
|
kern.timecounter.hardware=ACPI-safe
|
|
aesni_load="YES"
|
|
nvme_load="YES"
|
|
EOF
|
|
|
|
echo '169.254.169.254 metadata.google.internal metadata' > \
|
|
${DESTDIR}/etc/hosts
|
|
|
|
# overwrite ntp.conf
|
|
cat << EOF > ${DESTDIR}/etc/ntp.conf
|
|
server metadata.google.internal iburst
|
|
|
|
restrict default kod nomodify notrap nopeer noquery
|
|
restrict -6 default kod nomodify notrap nopeer noquery
|
|
|
|
restrict 127.0.0.1
|
|
restrict -6 ::1
|
|
restrict 127.127.1.0
|
|
EOF
|
|
|
|
cat << EOF >> ${DESTDIR}/etc/syslog.conf
|
|
*.err;kern.warning;auth.notice;mail.crit /dev/console
|
|
EOF
|
|
|
|
cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config
|
|
ChallengeResponseAuthentication no
|
|
X11Forwarding no
|
|
AcceptEnv LANG
|
|
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
|
|
AllowAgentForwarding no
|
|
ClientAliveInterval 420
|
|
EOF
|
|
|
|
cat << EOF >> ${DESTDIR}/etc/crontab
|
|
0 3 * * * root /usr/sbin/freebsd-update cron
|
|
EOF
|
|
|
|
cat << EOF >> ${DESTDIR}/etc/sysctl.conf
|
|
net.inet.icmp.drop_redirect=1
|
|
net.inet.ip.redirect=0
|
|
net.inet.tcp.blackhole=2
|
|
net.inet.udp.blackhole=1
|
|
kern.ipc.somaxconn=1024
|
|
debug.trace_on_panic=1
|
|
debug.debugger_on_panic=0
|
|
EOF
|
|
|
|
## XXX: Verify this is needed. I do not see this requirement
|
|
## in the docs, and it impairs the ability to boot-test a copy
|
|
## of the image prior to packaging for upload to GCE.
|
|
#sed -E -i '' 's/^([^#].*[[:space:]])on/\1off/' ${DESTDIR}/etc/ttys
|
|
|
|
touch ${DESTDIR}/firstboot
|
|
|
|
return 0
|
|
}
|