diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/cmd.conf b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/cmd.conf similarity index 99% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/cmd.conf rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/cmd.conf index 6378b8212c0c7c698abef9f0dd8e7b7a447216be..33d83081f8c24215e5ae41d77acfa0af9b518963 100644 --- a/dpuos/image_tailor_cfg/custom/cfg_dpuos/cmd.conf +++ b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/cmd.conf @@ -348,6 +348,7 @@ + @@ -1288,6 +1289,7 @@ + @@ -1328,6 +1330,8 @@ + + @@ -1731,6 +1735,7 @@ + @@ -2440,6 +2445,7 @@ + diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/rpm.conf b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/rpm.conf similarity index 99% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/rpm.conf rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/rpm.conf index bcfb83e8ed0ee3c241e7fa816e465c7af542621e..9c638c1427f05eb17908267fffb65c3122d17f9e 100644 --- a/dpuos/image_tailor_cfg/custom/cfg_dpuos/rpm.conf +++ b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/rpm.conf @@ -21,7 +21,7 @@ - + @@ -1239,6 +1239,8 @@ + + @@ -1850,6 +1852,8 @@ + + diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/security_s.conf b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/security_s.conf similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/security_s.conf rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/security_s.conf diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/sys.conf b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/sys.conf similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/sys.conf rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/sys.conf diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/default/grub b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/default/grub similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/default/grub rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/default/grub diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd diff --git a/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/qtfs/whitelist b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/qtfs/whitelist new file mode 100644 index 0000000000000000000000000000000000000000..ed537a33c74897ef2d88805e456df063ad1d42a8 --- /dev/null +++ b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/qtfs/whitelist @@ -0,0 +1,35 @@ +[Open] +Path=/var/lib/libvirt/qemu + +[Write] +Path=/var/lib/libvirt/qemu + +[Read] +Path=/var/lib/libvirt/qemu + +[Readdir] +Path=/var/lib/libvirt/qemu + +[Mkdir] +Path=/var/lib/libvirt/qemu + +[Rmdir] +Path=/var/lib/libvirt/qemu + +[Create] +Path=/var/lib/libvirt/qemu + +[Unlink] +Path=/var/lib/libvirt/qemu + +[Rename] +Path=/var/lib/libvirt/qemu + +[Setattr] +Path=/var/lib/libvirt/qemu + +[Setxattr] +Path=/var/lib/libvirt/qemu + +[Mount] +Path=/var/lib/libvirt diff --git a/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/rexec/whitelist b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/rexec/whitelist new file mode 100644 index 0000000000000000000000000000000000000000..b7f34b553f680335d5f2a268f457237e0419c70f --- /dev/null +++ b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_file/etc/rexec/whitelist @@ -0,0 +1 @@ +/usr/bin/qemu-kvm diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S03setcap_ping.sh b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S03setcap_ping.sh similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S03setcap_ping.sh rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S03setcap_ping.sh diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S04transuuid_to_byid.sh b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S04transuuid_to_byid.sh similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S04transuuid_to_byid.sh rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S04transuuid_to_byid.sh diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/filelist b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/filelist similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/filelist rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/all/filelist diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/conf/isopackage.sdf b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/conf/isopackage.sdf similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/conf/isopackage.sdf rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/conf/isopackage.sdf diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/conf/menu.lst b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/conf/menu.lst similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/conf/menu.lst rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/conf/menu.lst diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/conf/modules b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/conf/modules similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/conf/modules rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/conf/modules diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/hook/after_setup_os_hook/S00setcap b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/hook/after_setup_os_hook/S00setcap similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/hook/after_setup_os_hook/S00setcap rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/hook/after_setup_os_hook/S00setcap diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/hook/install_succ_hook/S00reboot b/dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/hook/install_succ_hook/S00reboot similarity index 100% rename from dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/hook/install_succ_hook/S00reboot rename to dpuos/image_tailor_cfg/aarch64/custom/cfg_dpuos/usr_install/hook/install_succ_hook/S00reboot diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/cmd.conf b/dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/cmd.conf similarity index 100% rename from dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/cmd.conf rename to dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/cmd.conf diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/rpm.conf b/dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/rpm.conf similarity index 99% rename from dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/rpm.conf rename to dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/rpm.conf index 746f3ff42fca9607c12092f21742d5a9c4b57be1..caa077813346560d8f03293fdb48ee3171e66ef8 100644 --- a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/rpm.conf +++ b/dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/rpm.conf @@ -224,7 +224,7 @@ - + diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/security_s.conf b/dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/security_s.conf similarity index 100% rename from dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/security_s.conf rename to dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/security_s.conf diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/sys.conf b/dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/sys.conf similarity index 100% rename from dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/sys.conf rename to dpuos/image_tailor_cfg/aarch64/kiwi/minios/cfg_dpuos/sys.conf diff --git a/dpuos/image_tailor_cfg/aarch64/rpms/qtfs-client-1.4-2.oe2203sp2.aarch64.rpm b/dpuos/image_tailor_cfg/aarch64/rpms/qtfs-client-1.4-2.oe2203sp2.aarch64.rpm new file mode 100644 index 0000000000000000000000000000000000000000..c6383807bc720fc4c9757213c2a53527f6feb038 Binary files /dev/null and b/dpuos/image_tailor_cfg/aarch64/rpms/qtfs-client-1.4-2.oe2203sp2.aarch64.rpm differ diff --git a/dpuos/image_tailor_cfg/aarch64/rpms/qtfs-server-1.4-2.oe2203sp2.aarch64.rpm b/dpuos/image_tailor_cfg/aarch64/rpms/qtfs-server-1.4-2.oe2203sp2.aarch64.rpm new file mode 100644 index 0000000000000000000000000000000000000000..d9140d697ff117c4d0a0a58d25bf0e954c22090a Binary files /dev/null and b/dpuos/image_tailor_cfg/aarch64/rpms/qtfs-server-1.4-2.oe2203sp2.aarch64.rpm differ diff --git a/dpuos/image_tailor_cfg/dpuos.md b/dpuos/image_tailor_cfg/dpuos.md index 303f33538ea3ca4f362d152c9d0485e8cd6e98c0..747c911e5fb659fa2a56c6a8c0434afc5e84b222 100644 --- a/dpuos/image_tailor_cfg/dpuos.md +++ b/dpuos/image_tailor_cfg/dpuos.md @@ -4,10 +4,11 @@ ## 准备imageTailor和所需的rpm包 参照`https://docs.openeuler.org/zh/docs/22.03_LTS/docs/TailorCustom/imageTailor-%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97.html`安装好`imageTailor`工具并将裁剪所要用到的rpm包准备好。 -镜像`openEuler-22.03-LTS-everything-debug-aarch64-dvd.iso`中的rpm比较全但是此镜像很大，可以用镜像`openEuler-22.03-LTS-aarch64-dvd.iso`中的rpm包外加一个`install-scripts.noarch`（从everything镜像中获取）就可以了。 +镜像`openEuler-22.03-LTS-everything-debug-${ARCH}-dvd.iso`中的rpm比较全但是此镜像很大，可以用镜像`openEuler-22.03-LTS-${ARCH}-dvd.iso`中的rpm包外加一个`install-scripts.noarch`（从everything镜像中获取）就可以了。 +如果需要增加自定义包，请制作或下载对应RPM包并拷贝到指定位置。本仓库$ARCH/rpms/有一些自定义rpm包。也需要拷贝到image-Tailor特定目录。 ## 拷贝dpuos相关的配置文件 -`imageTailor`工具默认安装在`/opt/imageTailor`路径下，执行那个下面的命令将`dpuos`的配置拷贝到对应的路径下 +`imageTailor`工具默认安装在`/opt/imageTailor`路径下，执行那个下面的命令将对应架构目录下`dpuos`的配置拷贝到对应的路径下 ```bash cp -rf custom/cfg_dpuos /opt/imageTailor/custom cp -rf kiwi/minios/cfg_dpuos /opt/imageTailor/kiwi/minios/cfg_dpuos @@ -19,7 +20,7 @@ cp -rf kiwi/minios/cfg_dpuos /opt/imageTailor/kiwi/minios/cfg_dpuos 3. 修改`repos/RepositoryRule.conf`增加名称为`dpuos`的相关配置 ## 设置密码 -进入到`conf/aarch64`子目录下，修改下面3个文件的密码，详见openEuler手册 +进入到`conf/${ARCH}`子目录下，修改下面3个文件的密码，详见openEuler手册 1. `custom/cfg_dpuos/usr_file/etc/default/grub` 2. `custom/cfg_dpuos/rpm.conf` 3. `kiwi/minios/cfg_dpuos/rpm.conf` diff --git a/dpuos/image_tailor_cfg/specs/README.md b/dpuos/image_tailor_cfg/specs/README.md new file mode 100644 index 0000000000000000000000000000000000000000..f4518bf8cedf8ccbd4e55853f904fe18d3699412 --- /dev/null +++ b/dpuos/image_tailor_cfg/specs/README.md @@ -0,0 +1,17 @@ +## 介绍 + +用户可以为DPU-OS自定义软件包及特性，自定义包构建成rpm后放置到DPU-OS特定目录构建ISO。 + +本目录用来存放用于制作rpm包的spec文件。 + +## kernel.spec + +用于制作自定义内核的kernel spec文件。 + +#### 制作步骤： +* 下载对应src包：https://repo.openeuler.org/openEuler-22.03-LTS-SP2/source/Packages/ 。 从链接中下载kernel src rpm包 +* 使用kernel.spec.patch修改rpm包中的kernel.spec文件，使能kernel制定特性。 +* 使用rpmbuild工具构建新的kernel rpm包。并替换至image-Tailor中rpm源。 + +#### 当前特性 +* 开启内核vDPA特性 diff --git a/dpuos/image_tailor_cfg/specs/kernel.spec.patch b/dpuos/image_tailor_cfg/specs/kernel.spec.patch new file mode 100644 index 0000000000000000000000000000000000000000..08d61ffe739d585a538aedf666f12037f4fc8282 --- /dev/null +++ b/dpuos/image_tailor_cfg/specs/kernel.spec.patch @@ -0,0 +1,18 @@ +--- ./kernel.spec.old 2023-08-11 10:30:33.908338152 +0800 ++++ ./kernel.spec 2023-08-11 10:10:20.235273335 +0800 +@@ -13,6 +13,7 @@ + %global devel_release 153 + %global maintenance_release .12.0 + %global pkg_release .92 ++%global extra_release .oe2203sp2 + + %define with_debuginfo 1 + # Do not recompute the build-id of vmlinux in find-debuginfo.sh +@@ -341,6 +342,7 @@ + sed -i arch/arm64/configs/openeuler_defconfig -e 's/^CONFIG_ARM64_VA_BITS=.*/CONFIG_ARM64_VA_BITS=52/' + sed -i arch/arm64/configs/openeuler_defconfig -e 's/^CONFIG_ARM64_VA_BITS_.*/CONFIG_ARM64_VA_BITS_52=y/' + %endif ++sed -i arch/%{Arch}/configs/openeuler_defconfig -e 's/^# CONFIG_VDPA is not set/CONFIG_VDPA=y/' + + make ARCH=%{Arch} openeuler_defconfig + diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/cmd.conf b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/cmd.conf new file mode 100644 index 0000000000000000000000000000000000000000..1b130a53dca9f721ecb1e663e723add07db673c2 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/cmd.conf @@ -0,0 +1,2552 @@ + + + + + + + default items to keep or delete from the kiwi initrd + + + + 2.7.1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/rpm.conf b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/rpm.conf new file mode 100644 index 0000000000000000000000000000000000000000..e421f5c37a457a7b7281f5b91c09a6d61f0dd971 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/rpm.conf @@ -0,0 +1,1856 @@ + + + + + + + boot/initrd image used for LiveDVD media + + + + 2.1.2 + yum + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/security_s.conf b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/security_s.conf new file mode 100644 index 0000000000000000000000000000000000000000..eaec2a2a74fb354b5a205a4a2e575f25c10b73e8 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/security_s.conf @@ -0,0 +1,227 @@ +######################################################################## +# +# HowTo: +# # delete key, and difference caused by blankspace/tab on key is ignored +# id@d@file@key +# +# # modify option: find line started with key, and get the value changed +# id@m@file@key[@value] +# +# # modify sub-option: find line started with key, and then change the value of key2 to value2(prepositive seperator should not be blank characters) in the line +# id@M@file@key@key2[@value2] +# +# # check existence of commands +# id@which@command1 [command2 ...] +# +# # execute command on the files found +# id@find@dir@condition@command +# +# # any command(with or without parameter), such as 'rm -f','chmod 700','which','touch', used to extend functions, return 0 is ok +# id@command@file1 [file2 ...] +# +# Notes: +# 1. The comment line should start with '#' +# 2. "value" related with "key" should contain prepositive separator("="," " and so on), if there is any. +# 3. When item starts with "d", "m" or "M", "file" should be a single normal file, otherwise multi-objects(separated by blankspace) are allowed. +# +######################################################################## +######################################################################## +# System access and authorization +######################################################################## +# Prevent rebooting by CTRL+ALT+DEL +201@rm -f @/etc/systemd/system/ctrl-alt-del.target +201@rm -f @/usr/lib/systemd/system/ctrl-alt-del.target + +######################################################################## +# File permission setting +######################################################################## +# Common users are not allowed to delete or modify log files +301@chmod go-wx@/var/log/* + +# Control the permission of administrator resources +302@chmod 755@/var/log /sbin /usr/sbin + +# Set sticky bit of /tmp, then only owner or root can rename or delete files of /tmp +303@chmod o+t@/tmp + +# Set strict permission of /root +304@chmod 700@/root + +# Network parameter modifications +307@chown root@/etc/sysctl.conf +307@chgrp root@/etc/sysctl.conf +307@chmod 600@/etc/sysctl.conf + +# Disable gui login +308@chown root@/etc/inittab +308@chgrp root@/etc/inittab +308@chmod 644@/etc/inittab + +309@chown root@/etc/X11/xdm/Xservers +309@chgrp root@/etc/X11/xdm/Xservers +309@chmod 444@/etc/X11/xdm/Xservers + +310@chown root@/etc/sysconfig/displaymanager +310@chgrp root@/etc/sysconfig/displaymanager +310@chmod 644@/etc/sysconfig/displaymanager + +311@chmod 600@/usr/Euler/conf/grub.cfg +######################################################################## +# Account and password +######################################################################## +### PAM auth setting, do not change the order of the configurations ### +401@rm -f@/etc/pam.d/system-auth +401@rm -f@/etc/pam.d/system-auth-local +401@cp@security-tool/system-auth-local@/etc/pam.d/ +401@ln@-s@/etc/pam.d/system-auth-local@/etc/pam.d/system-auth + +402@rm -f@/etc/pam.d/password-auth +402@rm -f@/etc/pam.d/password-auth-local +402@cp@security-tool/password-auth-local@/etc/pam.d/ +402@ln@-s@/etc/pam.d/password-auth-local@/etc/pam.d/password-auth + +403@rm -f@/etc/pam.d/password-auth-crond +403@cp@security-tool/password-auth-crond@/etc/pam.d/ +403@sed -i s/system-auth$/password-auth-crond/g@/etc/pam.d/crond + +# Limit access to the root by su +404@rm -f@/etc/pam.d/su +404@rm -f@/etc/pam.d/su-local +404@cp@security-tool/su-local@/etc/pam.d/ +404@ln@-s@/etc/pam.d/su-local@/etc/pam.d/su + +######################################################################## +# Command checking +######################################################################## +# delete lastlog and lastb, since last and faillog are provided and lastlog is not item of RTOS baseline +501@rm -f@/usr/bin/lastlog /var/log/lastlog /usr/bin/lastb /var/log/btmp + +######################################################################## +# Kernel parameters +######################################################################## +# Add kernel param panic on oops +601@m@/etc/sysctl.conf@kernel.panic_on_oops@=1 + +# Disable sched_autogroup +610@m@/etc/sysctl.conf@kernel.sched_autogroup_enabled@=0 + +# Clean up suspected plaintext password +610@sed -i /password/s/assword[[:space:]]*=[[:space:]]*\".*\"/assword=\"******\"/I@/etc/openhpi/openhpi.conf + +# Remove chpasswd +611@rm -f@/usr/sbin/chpasswd + +612@sed -i s/^#[[:space:]]*only_from[[:space:]]*=[[:space:]]*localhost/only_from=localhost/g@/etc/xinetd.conf + +# Clean up suspected plaintext password +613@sed -i /password/s/flurp/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm +613@sed -i /password/s/frodo/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm +613@sed -i /password/s/password:a.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_upload.py +613@sed -i /password/s/password:[[:space:]]\\+.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_upload.py +613@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'\\?/password\',\'******\'/I@/usr/lib64/python2.7/distutils/tests/test_upload.py +613@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_config.py +613@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'),[[:space:]]*(/password\',\'******\'),(/I@/usr/lib64/python2.7/distutils/tests/test_config.py +613@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_register.py +613@sed -i /Password/s/Password[[:space:]]*:[[:space:]]*\'.*\'/Password:\'******\'/I@/usr/lib64/python2.7/distutils/tests/test_register.py +613@sed -i /password/s/password[[:space:]]*:[[:space:]]\\+.*\$/password:******/g@/usr/lib64/python2.7/distutils/command/register.py +613@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\".*\"/_password=\"******\"/I@/etc/libvirt/qemu.conf +613@sed -i /password/s/_password\"[[:space:]]*=[[:space:]]*\".*\"/_password\"=\"******\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug +613@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\\\\\".*\\\\\"/_password=\\\\\"******\\\\\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug + +614@rm -f@/etc/openldap/certs/password +614@rm -f@/usr/Euler/conf/menu.lst + +# Remove expired certificates +621@rm -f@/etc/unbound/icannbundle.pem +621@rm -f@/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem +621@rm -f@/etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem +621@rm -f@/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem +621@rm -f@/etc/ssl/certs/ca-bundle.crt +621@rm -f@/etc/pki/tls/certs/ca-bundle.crt +621@rm -f@/etc/pki/tls/cert.pem + +622@rm -f@/etc/sysconfig/grub +622@rm -f@/usr/lib/modules/*/build +622@rm -f@/usr/lib/modules/*/source +622@rm -f@/usr/lib/systemd/system/dbus-org.freedesktop.network1.service +622@rm -f@/usr/lib/debug/usr/.dwz + +# Remove shell for security +623@rm -f@/usr/bin/csh +623@rm -f@/usr/bin/tcsh +623@rm -f@/usr/bin/tclsh +623@rm -f@/usr/bin/tclsh8.5 +623@rm -f@/usr/bin/hivexsh + +# Remove sysmonitor for UVP +624@rm -f@/etc/sysmonitor/process/virtlogd-daemon +624@rm -f@/etc/sysmonitor/process/UVPHostd-daemon +624@rm -f@/etc/sysmonitor/process/libvirtd-daemon +624@rm -f@/etc/sysmonitor/process/libvirt-guests-daemon +624@rm -rf@/etc/sysmonitor.d/uvpmonitor +624@rm -f@/etc/sysmonitor.d/clock_transition_uvp +624@rm -f@/etc/sysmonitor.d/disk_mem_mce_monitor +624@rm -f@/etc/sysmonitor.d/libvirtdstat +624@rm -f@/etc/sysmonitor.d/process_monitor_ucompute +624@rm -f@/etc/sysmonitor.d/systemd_monitor +624@rm -f@/etc/sysmonitor.d/virtlogd_monitor +624@rm -f@/etc/sysmonitor.d/vm_reboot_monitor +624@rm -f@/etc/sysmonitor.d/cdemu_tls_alarm_monitor +624@rm -f@/etc/sysmonitor.d/coredump_monitor +624@rm -f@/etc/sysmonitor.d/hotpatch_alarm +624@rm -f@/etc/sysmonitor.d/multipathstatus +624@rm -f@/etc/sysmonitor.d/qemu_hotreplace_alarm +624@rm -f@/etc/sysmonitor.d/tls_alarm_monitor +624@rm -f@/etc/sysmonitor.d/vm_io_monitor +624@rm -f@/etc/sysmonitor.d/checkDstat +624@rm -f@/etc/sysmonitor.d/cpustat +624@rm -f@/etc/sysmonitor.d/kvmtop_monitor +624@rm -f@/etc/sysmonitor.d/net_name +624@rm -f@/etc/sysmonitor.d/qemu_tls_alarm_monitor +624@rm -rf@/etc/sysmonitor.d/uvpEnvironmentFiles +624@rm -f@/etc/sysmonitor.d/vm_panic_monitor +624@rm -f@/etc/sysmonitor/file.d/* +624@rm -f@/etc/sysmonitor/process/UVPHostd-monitor +624@rm -f@/usr/share/qemu-origin/edk2-arm-vars.fd +624@rm -f@/usr/share/qemu-origin/edk2-arm-code.fd +624@rm -f@/usr/share/qemu-origin/edk2-x86_64-code.fd +624@rm -f@/usr/share/qemu-origin/edk2-x86_64-secure-code.fd +624@rm -f@/usr/share/qemu-origin/edk2-x86_64-code.fd +624@rm -f@/usr/share/qemu-origin/edk2-licenses.txt +624@rm -f@/usr/share/qemu-origin/edk2-i386-vars.fd +624@rm -f@/usr/share/qemu-origin/edk2-i386-secure-code.fd +624@rm -f@/usr/share/qemu-origin/edk2-i386-code.fd +624@rm -f@/usr/share/qemu/edk2-arm-vars.fd +624@rm -f@/usr/share/qemu/edk2-arm-code.fd +624@rm -f@/usr/share/qemu/edk2-x86_64-code.fd +624@rm -f@/usr/share/qemu/edk2-x86_64-secure-code.fd +624@rm -f@/usr/share/qemu/edk2-x86_64-code.fd +624@rm -f@/usr/share/qemu/edk2-licenses.txt +624@rm -f@/usr/share/qemu/edk2-i386-vars.fd +624@rm -f@/usr/share/qemu/edk2-i386-secure-code.fd +624@rm -f@/usr/share/qemu/edk2-i386-code.fd +624@rm -f@/etc/systemd/system/system-extra.slice +624@rm -f@/etc/systemd/system/system-uvp.slice + +# set ipv6 setting +625@m@/etc/sysctl.conf@net.ipv6.conf.all.accept_ra=@0 +625@m@/etc/sysctl.conf@net.ipv6.conf.default.accept_ra=@0 +625@m@/etc/sysctl.conf@net.ipv6.conf.all.accept_redirects=@0 +625@m@/etc/sysctl.conf@net.ipv6.conf.default.accept_redirects=@0 + +# Remove jdk NULL link +626@rm -f@/etc/alternatives/mkisofs-mkisofsman +626@rm -f@/etc/alternatives/keytool.1.gz +626@rm -f@/etc/alternatives/pack200.1.gz +626@rm -f@/etc/alternatives/jre_openjdk/lib/audio/default.sf2 +626@rm -f@/etc/alternatives/tnameserv.1.gz +626@rm -f@/etc/alternatives/jre_1.8.0_openjdk/lib/audio/default.sf2 +626@rm -f@/etc/alternatives/jjs.1.gz +626@rm -f@/etc/alternatives/mkisofs-mkhybridman +626@rm -f@/etc/alternatives/rmiregistry.1.gz +626@rm -f@/etc/alternatives/rmid.1.gz +626@rm -f@/etc/alternatives/orbd.1.gz +626@rm -f@/etc/alternatives/unpack200.1.gz +626@rm -f@/etc/alternatives/java.1.gz +626@rm -f@/etc/alternatives/servertool.1.gz +626@rm -f@/etc/grub2-efi.cfg diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/sys.conf b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/sys.conf new file mode 100644 index 0000000000000000000000000000000000000000..3110685c06c24931cf433da2f396fdc510670ebe --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/sys.conf @@ -0,0 +1,30 @@ + +hd0 /boot 1G primary ext4 yes +hd0 /boot/efi 200M primary vfat yes +hd0 / 10G primary ext4 +hd0 - - extended - +hd0 /var 10G logical ext4 +hd0 /home 5G logical ext4 +hd0 /opt 25G logical ext4 +hd0 /tmp 3G logical ext4 + + + +sys_service_enable='' +sys_service_disable='' +sys_utc='yes' +sys_timezone='' +sys_cut='debug' +sys_usrrpm_cut='no' +sys_hostname='dpuos' +sys_usermodules_autoload='' +sys_gconv='GBK' + + + +BOOTPROTO="dhcp" +DEVICE="eth0" +IPADDR="" +NETMASK="" +STARTMODE="auto" + diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/default/grub b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/default/grub new file mode 100644 index 0000000000000000000000000000000000000000..a7a042622f3d7635cde0117cc931cff6e9154029 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/default/grub @@ -0,0 +1,5 @@ +GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0 crashkernel=512M oops=panic softlockup_panic=1 reserve_kbox_mem=16M crash_kexec_post_notifiers panic=3 console=tty0 fsck.mode=auto fsck.repair=yes nmi_watchdog=1 no-steal-time use-sched-idle-time rd.shell=0" +GRUB_DISABLE_SUBMENU="true" +GRUB_DISABLE_RECOVERY="true" +GRUB_TERMINAL_OUTPUT="console" +GRUB_TIMEOUT=5 diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd new file mode 100644 index 0000000000000000000000000000000000000000..629b7f4e68af3f9faafcb333317758ea8bc51dbe --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd @@ -0,0 +1,9 @@ +set el_precmd_msg = `history 1|cut -f3-|sed -e "s|{||g" | sed -e "s|}||g"` +set el_precmd_user = `whoami` +set el_precmd_loginuser = `who -m | awk '{print $2" "$NF}'` +set el_precmd_num = `history 1| awk -F" " '{print $1}'` + +if ((${el_precmd_num} != ${LastComandNum_for_history}) && (${LastComandNum_for_history} != "" || ${el_precmd_num} == 1)) then + logger -t "[/bin/csh]" "[${el_precmd_msg}]" "by [${el_precmd_user}] from [${el_precmd_loginuser}]" > /dev/null +endif +set LastComandNum_for_history = ${el_precmd_num} diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/qtfs/whitelist b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/qtfs/whitelist new file mode 100644 index 0000000000000000000000000000000000000000..ed537a33c74897ef2d88805e456df063ad1d42a8 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/qtfs/whitelist @@ -0,0 +1,35 @@ +[Open] +Path=/var/lib/libvirt/qemu + +[Write] +Path=/var/lib/libvirt/qemu + +[Read] +Path=/var/lib/libvirt/qemu + +[Readdir] +Path=/var/lib/libvirt/qemu + +[Mkdir] +Path=/var/lib/libvirt/qemu + +[Rmdir] +Path=/var/lib/libvirt/qemu + +[Create] +Path=/var/lib/libvirt/qemu + +[Unlink] +Path=/var/lib/libvirt/qemu + +[Rename] +Path=/var/lib/libvirt/qemu + +[Setattr] +Path=/var/lib/libvirt/qemu + +[Setxattr] +Path=/var/lib/libvirt/qemu + +[Mount] +Path=/var/lib/libvirt diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/rexec/whitelist b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/rexec/whitelist new file mode 100644 index 0000000000000000000000000000000000000000..b7f34b553f680335d5f2a268f457237e0419c70f --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_file/etc/rexec/whitelist @@ -0,0 +1 @@ +/usr/bin/qemu-kvm diff --git a/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh new file mode 100755 index 0000000000000000000000000000000000000000..13a88fd28ea4e4a5c2417fd6f0541c6aa95cd539 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +LOCAL_DISK_PATH=/mnt/disk + +chroot ${LOCAL_DISK_PATH} < + + + + + + default items to keep or delete from the kiwi initrd + + + + 2.7.1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/rpm.conf b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/rpm.conf new file mode 100644 index 0000000000000000000000000000000000000000..6968f9689f45f6866e0fc0b96cca9ab2f84f0994 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/rpm.conf @@ -0,0 +1,318 @@ + + + + + + + boot/initrd image used for LiveDVD media + + + + 2.1.2 + yum + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/security_s.conf b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/security_s.conf new file mode 100644 index 0000000000000000000000000000000000000000..510add09c4e23892f0200e3646cfda92d2c42387 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/security_s.conf @@ -0,0 +1,311 @@ +######################################################################## +# Description: Configration file for dl_sec, and support pam common-auth/password/account/session style(based on linux) +# HowTo: +# # delete key, and difference caused by blankspace/tab on key is ignored +# id@d@file@key +# +# # modify option: find line started with key, and get the value changed +# id@m@file@key[@value] +# +# # modify sub-option: find line started with key, and then change the value of key2 to value2(prepositive seperator should not be blank characters) in the line +# id@M@file@key@key2[@value2] +# +# # check existence of commands +# id@which@command1 [command2 ...] +# +# # execute command on the files found +# id@find@dir@condition@command +# +# # any command(with or without parameter), such as 'rm -f','chmod 700','which','touch', used to extend functions, return 0 is ok +# id@command@file1 [file2 ...] +# +# Notes: +# 1. The comment line should start with '#' +# 2. "value" related with "key" should contain prepositive separator("="," " and so on), if there is any. +# 3. When item starts with "d", "m" or "M", "file" should be a single normal file, otherwise multi-objects(separated by blankspace) are allowed. +# +######################################################################## + +######################################################################## +# SSH server setting +######################################################################## +# Set sshd Protocol version +101@m@/etc/ssh/sshd_config@Protocol@ 2 + +# Set sshd password algorithm +102@m@/etc/ssh/sshd_config@Ciphers@ aes128-ctr,aes192-ctr,aes256-ctr + +# Set sshd message authentication code algorithm +103@m@/etc/ssh/sshd_config@MACs@ hmac-sha2-256 + +# Set sshd authentication +104@m@/etc/ssh/sshd_config@PubkeyAuthentication@ yes +104@m@/etc/ssh/sshd_config@RSAAuthentication@ yes +# Don't read the user's ~/.rhosts and ~/.shosts files +104@m@/etc/ssh/sshd_config@IgnoreRhosts@ yes +# no /etc/ssh/ssh_known_hosts in RTOS, so close it +104@m@/etc/ssh/sshd_config@RhostsRSAAuthentication@ no +# To disable tunneled clear text passwords, change to no here +104@m@/etc/ssh/sshd_config@PasswordAuthentication no +# To disable host authentication +104@m@/etc/ssh/sshd_config@HostbasedAuthentication@ no + +# Make sshd check file modes and ownership of the user's files and home directory before accepting login +105@m@/etc/ssh/sshd_config@StrictModes@ yes + +# Make sshd print warning banner +106@m@/etc/ssh/sshd_config@Banner@ /etc/issue.net + +# Set ssh log level, logging login/logout on /var/log/messages +107@m@/etc/ssh/sshd_config@SyslogFacility@ AUTH +107@m@/etc/ssh/sshd_config@LogLevel@ INFO + +# Prevent user without password from remote ssh login +108@m@/etc/ssh/sshd_config@PermitEmptyPasswords@ no + +# Set this to 'yes' to enable PAM authentication, account processing, and session processing. +109@m@/etc/ssh/sshd_config@UsePAM yes + +# Set this to 'no', root is not allowed to log in using ssh. +110@m@/etc/ssh/sshd_config@PermitRootLogin@ no + +# Set this to record sftp log +111@m@/etc/ssh/sshd_config@Subsystem sftp /usr/libexec/openssh/sftp-server @-l INFO -f AUTH + +######################################################################## +# System access and authorization +######################################################################## +# Prevent rebooting by CTRL+ALT+DEL +201@m@/etc/inittab@ca::ctrlaltdel:@/bin/false + +# Set timeout seconds of inactive sessions +202@m@/etc/profile@TMOUT@=900 +202@m@/etc/profile@export TMOUT + +# Set a proper size above 0 of history commands number modify 100 to 5000 +203@m@/etc/profile@HISTSIZE@=5000 +203@m@/etc/profile@export HISTSIZE + +# close the kernel request debugging functionality +204@m@/etc/sysctl.conf@kernel.sysrq@=0 +204@m@/etc/init.d/boot.local@/sbin/sysctl -p /etc/sysctl.conf + +######################################################################## +# File permission setting +######################################################################## +# Common users are not allowed to delete or modify log files +301@chmod go-wx@/var/log/* + +# Control the permission of administrator resources +302@chmod 755@/var/log /sbin /usr/sbin + +# Set sticky bit of /tmp, then only owner or root can rename or delete files of /tmp +303@chmod o+t@/tmp + +# Set strict permission of /root +304@chmod 700@/root + +# Set ssh key permission +305@chmod 400@/etc/ssh/*key +305@chmod 400@/etc/ssh/*key.pub + +# Set shadow file permission +306@chmod 400@/etc/shadow +306@chmod 400@/etc/shadow.old + +# no coredump file +307@m@/etc/profile@ulimit -c@ 0 + +# TTYs list of PAM login, restrict root logins to system console +308@touch@/etc/securetty +308@chown root@/etc/securetty +308@chgrp root@/etc/securetty +308@chmod 400@/etc/securetty +308@m@/etc/permissions.local@/etc/securetty @ root:root 400 +308@m@/etc/securetty@console + +# Create files used by last and faillog command +309@touch@/var/log/wtmp /var/log/faillog + +# Restrict common user to use command at +310@rm -f@/etc/at.deny +310@rm -f@/etc/at.allow +310@touch@/etc/at.allow +310@m@/etc/at.allow@root +310@m@/etc/permissions.local@/etc/at.allow @ root:root 400 + +# Restrict at and cron authorized +311@rm -f@/etc/cron.deny +311@rm -f@/etc/cron.allow +311@touch@/etc/cron.allow +311@m@/etc/cron.allow@root +311@m@/etc/permissions.local@/etc/cron.allow @ root:root 400 + +# Set daemon umask +312@m@/etc/rc.status@umask@ 027 + +# Set user default umask +314@m@/etc/profile@umask@ 077 +314@m@/etc/permissions.local@/etc/profile @ root:root 644 +314@m@/etc/csh.login@umask@ 077 +314@m@/etc/permissions.local@/etc/csh.login @ root:root 444 +314@m@/etc/csh.cshrc@umask@ 077 +314@m@/etc/permissions.local@/etc/csh.cshrc @ root:root 444 +314@m@/etc/bash.bashrc@umask@ 077 +314@m@/etc/permissions.local@/etc/bash.bashrc @ root:root 444 +# Add umask to /root/.bash_profile /root/.bashrc /root/.cshrc /root/.tcshrc +314@touch@/root/.bash_profile /root/.bashrc /root/.cshrc /root/.tcshrc +314@m@/root/.bash_profile@umask@ 077 +314@m@/etc/permissions.local@/root/.bash_profile @ root:root 600 +314@m@/root/.bashrc@umask@ 077 +314@m@/etc/permissions.local@/root/.bashrc @ root:root 600 +314@m@/root/.cshrc@umask@ 077 +314@m@/etc/permissions.local@/root/.cshrc @ root:root 600 +314@m@/root/.tcshrc@umask@ 077 +314@m@/etc/permissions.local@/root/.tcshrc @ root:root 600 + +315@m@/etc/permissions.local@/etc/crontab @ root:root 400 +315@m@/etc/permissions.local@/var/spool/cron/lastrun @ root:root 400 +315@m@/etc/permissions.local@/var/spool/cron/tabs @ root:root 400 + +# Network parameter modifications +316@chown root@/etc/sysctl.conf +316@chgrp root@/etc/sysctl.conf +316@chmod 600@/etc/sysctl.conf +316@m@/etc/permissions.local@/etc/sysctl.conf @ root:root 600 + +# Disable gui login +317@chown root@/etc/inittab +317@chgrp root@/etc/inittab +317@chmod 644@/etc/inittab +317@m@/etc/permissions.local@/etc/inittab @ root:root 644 + +318@chown root@/etc/X11/xdm/Xservers +318@chgrp root@/etc/X11/xdm/Xservers +318@chmod 444@/etc/X11/xdm/Xservers +318@m@/etc/permissions.local@/etc/X11/xdm/Xservers @ root:root 444 + +319@chown root@/etc/sysconfig/displaymanager +319@chgrp root@/etc/sysconfig/displaymanager +319@chmod 644@/etc/sysconfig/displaymanager +319@m@/etc/permissions.local@/etc/sysconfig/displaymanager @ root:root 644 + +######################################################################## +# Account and password +######################################################################## +### PAM auth setting, do not change the order of the configurations ### +401@rm -f@/etc/pam.d/common-auth-pc +401@touch@/etc/pam.d/common-auth-pc +# Prevent logins of users in /etc/login.user.deny +401@touch@/etc/login.user.deny +401@m@/etc/pam.d/common-auth-pc@#%PAM-1.0\\n#\\n# This file is autogenerated by pam-config. All changes\\n# will be overwritten.\\n#\\n# Authentication-related modules common to all services\\n#\\n# This file is included from other service-specific PAM config files,\\n# and should contain a list of the authentication modules that define\\n# the central authentication scheme for use on the system\\n# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the\\n# traditional Unix authentication mechanisms.\\n#\\n +401@m@/etc/pam.d/common-auth-pc@auth requisite pam_listfile.so item=user onerr=succeed sense=deny file=/etc/login.user.deny +402@m@/etc/pam.d/common-auth-pc@auth required pam_env.so +402@m@/etc/pam.d/common-auth-pc@auth required pam_unix2.so +# Login failed 3 times will be locked for 5 minutes, even for root +403@m@/etc/pam.d/common-auth-pc@auth required pam_tally2.so onerr=fail deny=3 unlock_time=300 even_deny_root root_unlock_time=300 + +### PAM password setting, do not change the order of the configurations ### +404@rm -f@/etc/pam.d/common-password-pc +404@touch@/etc/pam.d/common-password-pc +404@m@/etc/pam.d/common-password-pc@#%PAM-1.0\\n#\\n# This file is autogenerated by pam-config. All changes\\n# will be overwritten.\\n#\\n# Password-related modules common to all services\\n#\\n# This file is included from other service-specific PAM config files,\\n# and should contain a list of modules that define the services to be\\n# used to change user passwords.\\n#\\n +# Set user(including root) password complexity, contain upper and lower characters, digit and other character; +# length is no less than 8; cannot contain username; cannot use the latest 12 passwords +404@m@/etc/pam.d/common-password-pc@password required pam_sek_pwck.so minlen=8 min_class=2 min_upper=0 min_lower=0 min_digits=0 min_special=0 remember=12 tries=5 enforce_for_root no_username use_cracklib cracklib=/usr/share/cracklib/pw_dict root_check_dict +# Use the default password shadow file +405@m@/etc/pam.d/common-password-pc@password required pam_unix2.so nullok use_authtok even_for_root +# Use sha256 to encrypt password +406@m@/etc/default/passwd@CRYPT=@sha256 +406@m@/etc/default/passwd@CRYPT_FILES=@sha256 + +### PAM account setting, do not change the order of the configurations ### +407@rm -f@/etc/pam.d/common-account-pc +407@touch@/etc/pam.d/common-account-pc +407@m@/etc/pam.d/common-account-pc@#%PAM-1.0\\n#\\n# This file is autogenerated by pam-config. All changes\\n# will be overwritten.\\n#\\n# Account-related modules common to all services\\n#\\n# This file is included from other service-specific PAM config files,\\n# and should contain a list of the accountorization modules that define\\n# the central access policy for use on the system. The default is to\\n# only deny service to users whose accounts are expired.\\n#\\n +# Basic account verification +407@m@/etc/pam.d/common-account-pc@account required pam_unix2.so +# Maintain the failed login data +408@m@/etc/pam.d/common-account-pc@account required pam_tally2.so + +# Set password lifetime and length of new added users +409@m@/etc/login.defs@PASS_MAX_DAYS@ 30 +409@m@/etc/login.defs@PASS_MIN_DAYS@ 0 +409@m@/etc/login.defs@PASS_WARN_AGE@ 7 + +### PAM login setting, do not change the order of the configurations ### +# do not show login info of last user +410@d@/etc/pam.d/login@session required pam_lastlog.so +# no mail system on RTOS +411@d@/etc/pam.d/login@session optional pam_mail.so + +# Limit access to the root by su +412@m@/etc/pam.d/su@auth required pam_wheel.so use_uid group=wheel +412@m@/etc/pam.d/su-l@auth required pam_wheel.so use_uid group=wheel + +# Lock system account +413@user@/etc/passwd + +######################################################################## +# Command checking +######################################################################## +# Check root permission control command +501@which@su + +# Check last and faillog command +502@which@last faillog + +# delete lastlog and lastb, since last and faillog are provided and lastlog is not item of RTOS baseline +503@rm -f@/usr/bin/lastlog /var/log/lastlog /usr/bin/lastb /var/log/btmp + +# Check logrotate command which is necessary for logging security +504@which@logrotate + + +######################################################################## +# DTS +####################################################################### +# Do not display architecture of OS +601@rm -f@/etc/issue.net +601@touch@/etc/issue.net +601@m@/etc/issue.net@Welcome! +601@m@/etc/permissions.local@/etc/issue.net @ root:root 644 +602@rm -f@/etc/issue +602@touch@/etc/issue +602@m@/etc/issue@Welcome! +602@m@/etc/permissions.local@/etc/issue @ root:root 644 +603@rm -f@/etc/motd +603@touch@/etc/motd +603@m@/etc/motd@Authorized users only. All activities may be monitored and reported.\\n +603@m@/etc/permissions.local@/etc/motd @ root:root 644 + +# Clean up suspected plaintext password +604@sed -i /password/s/assword[[:space:]]*=[[:space:]]*\".*\"/assword=\"******\"/I@/etc/openhpi/openhpi.conf + +# Add kernel param panic on oops +605@m@/etc/sysctl.conf@kernel.panic_on_oops@=1 +605@m@/etc/init.d/boot.local@/sbin/sysctl -p /etc/sysctl.conf + +# Display user date when use history command. +606@m@/etc/profile@HISTTIMEFORMAT@=\"%F %T \`whoami\` \" + +# Rremove chpasswd +607@rm -f@/usr/sbin/chpasswd + +608@sed -i s/^#[[:space:]]*only_from[[:space:]]*=[[:space:]]*localhost/only_from=localhost/g@/etc/xinetd.conf + +# Clean up suspected plaintext password +609@sed -i /password/s/flurp/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm +609@sed -i /password/s/frodo/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm +609@sed -i /password/s/password:a.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_upload.py +609@sed -i /password/s/password:[[:space:]]\\+.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_upload.py +609@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'\\?/password\',\'******\'/I@/usr/lib64/python2.6/distutils/tests/test_upload.py +609@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_config.py +609@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'),[[:space:]]*(/password\',\'******\'),(/I@/usr/lib64/python2.6/distutils/tests/test_config.py +609@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_register.py +609@sed -i /Password/s/Password[[:space:]]*:[[:space:]]*\'.*\'/Password:\'******\'/I@/usr/lib64/python2.6/distutils/tests/test_register.py +609@sed -i /password/s/password[[:space:]]*:[[:space:]]\\+.*\$/password:******/g@/usr/lib64/python2.6/distutils/command/register.py +609@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\".*\"/_password=\"******\"/I@/etc/libvirt/qemu.conf +609@sed -i /password/s/_password\"[[:space:]]*=[[:space:]]*\".*\"/_password\"=\"******\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug +609@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\\\\\".*\\\\\"/_password=\\\\\"******\\\\\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug +609@sed -i /userPassword/s/userPassword\"[[:space:]]*=>[[:space:]]*\".*\"/userPassword\"=>\"******\"/I@/usr/share/YaST2/modules/YaPI/USERS.pm +609@sed -i /password/s/password[[:space:]]*#.*[[:space:]]*\\*/password#******/I@/usr/share/YaST2/modules/Provider.ycp diff --git a/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/sys.conf b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/sys.conf new file mode 100644 index 0000000000000000000000000000000000000000..fd219ac77d482112321bfc93db3a7e68e16445fa --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/sys.conf @@ -0,0 +1,18 @@ + + +sys_service_enable='boot.udev boot.debugfs boot.ldconfig boot.localnet boot.sysctl syslog network sshd rpcbind irq_balancer' +sys_utc='yes' +sys_timezone='' +sys_cut='yes' +sys_usrrpm_cut='no' +sys_hostname='dpuos' +sys_usermodules_autoload='' + + + +BOOTPROTO="dhcp" +DEVICE="eth0" +IPADDR="" +NETMASK="" +STARTMODE="auto" + diff --git a/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/usr_file/etc/modules b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/usr_file/etc/modules new file mode 100644 index 0000000000000000000000000000000000000000..9d09d126b8cfcb0bfe07b3e6b7bec8a9350156d7 --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/cfg_dpuos/usr_file/etc/modules @@ -0,0 +1,43 @@ +8250_dw +ahci +ata_generic +ata_piix +sg +sr_mod +sd_mod +scsi_transport_iscsi +scsi_transport_sas +bnx2 +mlx4_en +mlx4_core +cdrom +crc-t10dif +dm-mod +e1000 +ext3 +vfat +igb +iscsi_tcp +libahci +libata +libiscsi +libiscsi_tcp +loop +mbcache +megaraid_sas +mpt2sas +mptbase +mptctl +mptsas +mptscsih +nfs +nfsv3 +nfsv4 +raid0 +raid1 +raid10 +raid456 +raid_class +tg3 +usb-storage +ext4 \ No newline at end of file diff --git a/dpuos/image_tailor_cfg/x86_64/kiwi/minios/minios.sha256 b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/minios.sha256 new file mode 100644 index 0000000000000000000000000000000000000000..771597fe90166508a3e2fb4286136c301ebeb07e --- /dev/null +++ b/dpuos/image_tailor_cfg/x86_64/kiwi/minios/minios.sha256 @@ -0,0 +1,5 @@ +e0d62428a6b7fd73635ec8ac40dc89366c6bd19770c09b350ae17a6affa00377 cfg_minios/rpm.conf +63eeb7a12efc3c26e94eb398edb8d37ee05312844244a786dd17e67c80e38bea cfg_minios/sys.conf +bb649346458f7e5c0716692860749191c0f82d602cb74e0cf3e1fb0d59dadd63 cfg_minios/filelist +19d5697710f65fdaea4a7b04e8fd051df8218616ca86e9251b0130a6306eb258 cfg_minios/security_s.conf +6a8908782072d29ecf2f4d4a0192092d4c3ba11867a286b3f150ff14acd18273 cfg_minios/cmd.conf diff --git a/dpuos/image_tailor_cfg/x86_64/rpms/qtfs-client-1.4-2.oe2203sp2.x86_64.rpm b/dpuos/image_tailor_cfg/x86_64/rpms/qtfs-client-1.4-2.oe2203sp2.x86_64.rpm new file mode 100644 index 0000000000000000000000000000000000000000..9be91837bc7cbadf4c81119006e22f3be25e9c8f Binary files /dev/null and b/dpuos/image_tailor_cfg/x86_64/rpms/qtfs-client-1.4-2.oe2203sp2.x86_64.rpm differ diff --git a/dpuos/image_tailor_cfg/x86_64/rpms/qtfs-server-1.4-2.oe2203sp2.x86_64.rpm b/dpuos/image_tailor_cfg/x86_64/rpms/qtfs-server-1.4-2.oe2203sp2.x86_64.rpm new file mode 100644 index 0000000000000000000000000000000000000000..a9b19241c0cb18009fb0ffb89c01b1657c74b51f Binary files /dev/null and b/dpuos/image_tailor_cfg/x86_64/rpms/qtfs-server-1.4-2.oe2203sp2.x86_64.rpm differ