Skip to content

Commit a4141a6

Browse files
vinceaperridallasd1
vinceaperri
and
dallasd1
authored
Add Image Customizer configuration for linuxguard, baremetal, hyperv-guest, qemu-guest, marketplace-gen1, and marketplace-gen2 images (#13251)
Co-authored-by: Dallas Delaney <dadelan@microsoft.com>
1 parent 3b81565 commit a4141a6

37 files changed

Lines changed: 1371 additions & 0 deletions

‎toolkit/imageconfigs/baremetal-amd64.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
storage:
2+
bootType: efi
3+
4+
disks:
5+
- partitionTableType: gpt
6+
maxSize: 1024M
7+
partitions:
8+
- id: esp
9+
type: esp
10+
size: 8M
11+
12+
- id: rootfs
13+
type: root
14+
size: grow
15+
16+
filesystems:
17+
- deviceId: esp
18+
type: fat32
19+
mountPoint:
20+
path: /boot/efi
21+
options: umask=0077
22+
23+
- deviceId: rootfs
24+
type: ext4
25+
mountPoint:
26+
path: /
27+
28+
os:
29+
bootloader:
30+
resetType: hard-reset
31+
32+
hostname: azure-linux
33+
34+
kernelCommandLine:
35+
extraCommandLine:
36+
- console=tty0
37+
- console=ttyS0
38+
- rd.info
39+
- log_buf_len=1M
40+
41+
selinux:
42+
mode: enforcing
43+
44+
packages:
45+
remove:
46+
- dracut-hostonly
47+
48+
installLists:
49+
- packagelists/baremetal-packages.yaml
50+
- packagelists/base-image-packages.yaml
51+
- packagelists/cloud-init-packages.yaml
52+
- packagelists/selinux.yaml
53+
54+
scripts:
55+
finalizeCustomization:
56+
- path: scripts/cleanup.sh
57+
- path: scripts/set_os_release_variant_entries.sh
58+
arguments:
59+
- --variant-id
60+
- baremetal
61+
- --variant
62+
- Bare Metal Image
63+
64+
output:
65+
image:
66+
format: vhdx

‎toolkit/imageconfigs/baremetal-arm64.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
storage:
2+
bootType: efi
3+
4+
disks:
5+
- partitionTableType: gpt
6+
maxSize: 1024M
7+
partitions:
8+
- id: esp
9+
type: esp
10+
size: 8M
11+
12+
- id: rootfs
13+
type: root
14+
size: grow
15+
16+
filesystems:
17+
- deviceId: esp
18+
type: fat32
19+
mountPoint:
20+
path: /boot/efi
21+
options: umask=0077
22+
23+
- deviceId: rootfs
24+
type: ext4
25+
mountPoint:
26+
path: /
27+
28+
os:
29+
bootloader:
30+
resetType: hard-reset
31+
32+
hostname: azure-linux
33+
34+
kernelCommandLine:
35+
extraCommandLine:
36+
- console=tty0
37+
- console=ttyS0
38+
- rd.info
39+
- log_buf_len=1M
40+
41+
selinux:
42+
mode: enforcing
43+
44+
packages:
45+
remove:
46+
- dracut-hostonly
47+
48+
installLists:
49+
- packagelists/baremetal-packages.yaml
50+
- packagelists/base-image-packages.yaml
51+
- packagelists/cloud-init-packages.yaml
52+
- packagelists/selinux.yaml
53+
54+
scripts:
55+
finalizeCustomization:
56+
- path: scripts/cleanup.sh
57+
- path: scripts/set_os_release_variant_entries.sh
58+
arguments:
59+
- --variant-id
60+
- baremetal
61+
- --variant
62+
- Bare Metal Image
63+
64+
output:
65+
image:
66+
format: vhdx

‎toolkit/imageconfigs/files/linuxguard/99-dhcp-eth0.network‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[Match]
2+
Name=eth0
3+
4+
[Network]
5+
DHCP=yes
6+
IPv6AcceptRA=no

‎toolkit/imageconfigs/files/linuxguard/no-password-prompt-on-sudo‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Do not prompt for password on sudo
2+
azuresu ALL=(ALL) NOPASSWD:ALL

‎toolkit/imageconfigs/files/linuxguard/selinux-ci-uki.semanage‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
boolean -D
2+
login -D
3+
interface -D
4+
user -D
5+
port -D
6+
node -D
7+
fcontext -D
8+
module -D
9+
ibendport -D
10+
ibpkey -D
11+
permissive -D
12+
boolean -m -1 cloudinit_manage_non_security
13+
boolean -m -1 container_mounton_non_security
14+
boolean -m -1 init_mounton_non_security
15+
login -m -s ci_unconfined_u -r 's0' root
16+
login -m -s ci_unconfined_u -r 's0' __default__
17+
fcontext -a -f f -t bin_t -r 's0' '/etc/grub\.d/.*'
18+
fcontext -a -f d -t root_t -r 's0' '/overlays'
19+
fcontext -a -f d -t lost_found_t -r 's0' '/overlays/lost\+found'
20+
fcontext -a -f f -t fsadm_exec_t -r 's0' '/usr/bin/lsblk'
21+
fcontext -a -f f -t dockerd_exec_t -r 's0' '/usr/bin/tardev-snapshotter'
22+
fcontext -a -f f -t bin_t -r 's0' '/usr/share/netplan/netplan\.script'
23+
fcontext -a -e / /rw

‎toolkit/imageconfigs/files/linuxguard/sshd-keygen.service‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=Generate sshd host keys
3+
ConditionPathExists=|!/rw/etc/ssh/ssh_host_rsa_key
4+
ConditionPathExists=|!/rw/etc/ssh/ssh_host_ecdsa_key
5+
ConditionPathExists=|!/rw/etc/ssh/ssh_host_ed25519_key
6+
Before=sshd.service
7+
8+
[Service]
9+
Type=oneshot
10+
RemainAfterExit=yes
11+
ExecStart=/usr/bin/ssh-keygen -A -f /rw
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎toolkit/imageconfigs/files/linuxguard/verity-signature/10-mountbootpartition.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
add_dracutmodules+=" mountbootpartition "

‎toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/module-setup.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
3+
# called by dracut
4+
check() {
5+
return 255
6+
}
7+
8+
# called by dracut
9+
depends() {
10+
return 0
11+
}
12+
13+
# called by dracut
14+
installkernel() {
15+
return 0
16+
}
17+
18+
# called by dracut
19+
install() {
20+
# install utilities
21+
inst_multiple lsblk umount
22+
# generate udev rule - i.e. schedule things post udev settlement
23+
inst_hook pre-udev 30 "$moddir/mountbootpartition-genrules.sh"
24+
# script to run post udev to mout
25+
inst_script "$moddir/mountbootpartition.sh" "/sbin/mountbootpartition"
26+
# script runs early on when systemd is initialized...
27+
if dracut_module_included "systemd-initrd"; then
28+
inst_script "$moddir/mountbootpartition-generator.sh" "$systemdutildir"/system-generators/dracut-mountbootpartition-generator
29+
fi
30+
dracut_need_initqueue
31+
}

‎toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/mountbootpartition-generator.sh‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
#!/bin/sh
2+
3+
set -x
4+
set -e
5+
6+
echo "Running mountbootpartition-generator.sh" > /dev/kmsg
7+
8+
# type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
9+
10+
function updateVeritySetupUnit () {
11+
systemdDropInDir=/etc/systemd/system
12+
verityDropInDir=$systemdDropInDir/systemd-veritysetup@root.service.d
13+
14+
mkdir -p $verityDropInDir
15+
verityConfiguration=$verityDropInDir/verity-azl-extension.conf
16+
17+
cat <<EOF > $verityConfiguration
18+
[Unit]
19+
After=bootmountmonitor.service
20+
Requires=bootmountmonitor.service
21+
EOF
22+
23+
chmod 644 $verityConfiguration
24+
chown root:root $verityConfiguration
25+
}
26+
27+
# -----------------------------------------------------------------------------
28+
function createBootPartitionMonitorScript () {
29+
local bootPartitionMonitorCmd=$1
30+
local semaphorefile=$2
31+
32+
cat <<EOF > $bootPartitionMonitorCmd
33+
#!/bin/sh
34+
while [ ! -e "$semaphorefile" ]; do
35+
echo "Waiting for $semaphorefile to exist..."
36+
sleep 1
37+
done
38+
EOF
39+
chmod +x $bootPartitionMonitorCmd
40+
}
41+
42+
# -----------------------------------------------------------------------------
43+
function createBootPartitionMonitorUnit() {
44+
local bootPartitionMonitorCmd=$1
45+
46+
bootMountMonitorName="bootmountmonitor.service"
47+
systemdDropInDir=/etc/systemd/system
48+
bootMountMonitorDir=$systemdDropInDir
49+
bootMountMonitorUnitFile=$bootMountMonitorDir/$bootMountMonitorName
50+
51+
cat <<EOF > $bootMountMonitorUnitFile
52+
[Unit]
53+
Description=bootpartitionmounter
54+
DefaultDependencies=no
55+
56+
[Service]
57+
Type=oneshot
58+
ExecStart=$bootPartitionMonitorCmd
59+
RemainAfterExit=yes
60+
61+
[Install]
62+
WantedBy=multi-user.target
63+
EOF
64+
}
65+
66+
# -----------------------------------------------------------------------------
67+
68+
updateVeritySetupUnit
69+
70+
systemdScriptsDir=/usr/local/bin
71+
bootPartitionMonitorCmd=$systemdScriptsDir/boot-partition-monitor.sh
72+
semaphorefile=/run/boot-parition-mount-complete.sem
73+
74+
mkdir -p $systemdScriptsDir
75+
76+
createBootPartitionMonitorScript $bootPartitionMonitorCmd $semaphorefile
77+
createBootPartitionMonitorUnit $bootPartitionMonitorCmd
78+
79+
echo "mountbootpartition-generator.sh completed successfully." > /dev/kmsg

‎toolkit/imageconfigs/files/linuxguard/verity-signature/90mountbootpartition/mountbootpartition-genrules.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/sh
2+
3+
echo "Running mountbootpartition-genrules.sh" > /dev/kmsg
4+
5+
# this gets called after all devices have settled.
6+
/sbin/initqueue --finished --onetime --unique /sbin/mountbootpartition > /dev/kmsg

0 commit comments

Comments
 (0)