diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/cmd.conf b/dpuos/image_tailor_cfg/custom/cfg_dpuos/cmd.conf
new file mode 100644
index 0000000000000000000000000000000000000000..6378b8212c0c7c698abef9f0dd8e7b7a447216be
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/cmd.conf
@@ -0,0 +1,2546 @@
+
+
+
+
+
+
+ default items to keep or delete from the kiwi initrd
+
+
+
+ 2.7.1
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/rpm.conf b/dpuos/image_tailor_cfg/custom/cfg_dpuos/rpm.conf
new file mode 100644
index 0000000000000000000000000000000000000000..bcfb83e8ed0ee3c241e7fa816e465c7af542621e
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/rpm.conf
@@ -0,0 +1,1995 @@
+
+
+
+
+
+
+ boot/initrd image used for LiveDVD media
+
+
+
+ 2.1.2
+ yum
+ false
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/security_s.conf b/dpuos/image_tailor_cfg/custom/cfg_dpuos/security_s.conf
new file mode 100644
index 0000000000000000000000000000000000000000..1a72a8d5f427765916d79f9413fcc83607135255
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/security_s.conf
@@ -0,0 +1,227 @@
+########################################################################
+#
+# HowTo:
+# # delete key, and difference caused by blankspace/tab on key is ignored
+# id@d@file@key
+#
+# # modify option: find line started with key, and get the value changed
+# id@m@file@key[@value]
+#
+# # modify sub-option: find line started with key, and then change the value of key2 to value2(prepositive seperator should not be blank characters) in the line
+# id@M@file@key@key2[@value2]
+#
+# # check existence of commands
+# id@which@command1 [command2 ...]
+#
+# # execute command on the files found
+# id@find@dir@condition@command
+#
+# # any command(with or without parameter), such as 'rm -f','chmod 700','which','touch', used to extend functions, return 0 is ok
+# id@command@file1 [file2 ...]
+#
+# Notes:
+# 1. The comment line should start with '#'
+# 2. "value" related with "key" should contain prepositive separator("="," " and so on), if there is any.
+# 3. When item starts with "d", "m" or "M", "file" should be a single normal file, otherwise multi-objects(separated by blankspace) are allowed.
+#
+########################################################################
+########################################################################
+# System access and authorization
+########################################################################
+# Prevent rebooting by CTRL+ALT+DEL
+201@rm -f @/etc/systemd/system/ctrl-alt-del.target
+201@rm -f @/usr/lib/systemd/system/ctrl-alt-del.target
+
+########################################################################
+# File permission setting
+########################################################################
+# Common users are not allowed to delete or modify log files
+301@chmod go-wx@/var/log/*
+
+# Control the permission of administrator resources
+302@chmod 755@/var/log /sbin /usr/sbin
+
+# Set sticky bit of /tmp, then only owner or root can rename or delete files of /tmp
+303@chmod o+t@/tmp
+
+# Set strict permission of /root
+304@chmod 700@/root
+
+# Network parameter modifications
+307@chown root@/etc/sysctl.conf
+307@chgrp root@/etc/sysctl.conf
+307@chmod 600@/etc/sysctl.conf
+
+# Disable gui login
+308@chown root@/etc/inittab
+308@chgrp root@/etc/inittab
+308@chmod 644@/etc/inittab
+
+309@chown root@/etc/X11/xdm/Xservers
+309@chgrp root@/etc/X11/xdm/Xservers
+309@chmod 444@/etc/X11/xdm/Xservers
+
+310@chown root@/etc/sysconfig/displaymanager
+310@chgrp root@/etc/sysconfig/displaymanager
+310@chmod 644@/etc/sysconfig/displaymanager
+
+311@chmod 600@/usr/Euler/conf/grub.cfg
+########################################################################
+# Account and password
+########################################################################
+### PAM auth setting, do not change the order of the configurations ###
+401@rm -f@/etc/pam.d/system-auth
+401@rm -f@/etc/pam.d/system-auth-local
+401@cp@security-tool/system-auth-local@/etc/pam.d/
+401@ln@-s@/etc/pam.d/system-auth-local@/etc/pam.d/system-auth
+
+402@rm -f@/etc/pam.d/password-auth
+402@rm -f@/etc/pam.d/password-auth-local
+402@cp@security-tool/password-auth-local@/etc/pam.d/
+402@ln@-s@/etc/pam.d/password-auth-local@/etc/pam.d/password-auth
+
+403@rm -f@/etc/pam.d/password-auth-crond
+403@cp@security-tool/password-auth-crond@/etc/pam.d/
+403@sed -i s/system-auth$/password-auth-crond/g@/etc/pam.d/crond
+
+# Limit access to the root by su
+404@rm -f@/etc/pam.d/su
+404@rm -f@/etc/pam.d/su-local
+404@cp@security-tool/su-local@/etc/pam.d/
+404@ln@-s@/etc/pam.d/su-local@/etc/pam.d/su
+
+########################################################################
+# Command checking
+########################################################################
+# delete lastlog and lastb, since last and faillog are provided and lastlog is not item of RTOS baseline
+501@rm -f@/usr/bin/lastlog /var/log/lastlog /usr/bin/lastb /var/log/btmp
+
+########################################################################
+# Kernel parameters
+########################################################################
+# Add kernel param panic on oops
+601@m@/etc/sysctl.conf@kernel.panic_on_oops@=1
+
+# Disable sched_autogroup
+610@m@/etc/sysctl.conf@kernel.sched_autogroup_enabled@=0
+
+# Clean up suspected plaintext password
+610@sed -i /password/s/assword[[:space:]]*=[[:space:]]*\".*\"/assword=\"******\"/I@/etc/openhpi/openhpi.conf
+
+# Remove chpasswd
+611@rm -f@/usr/sbin/chpasswd
+
+612@sed -i s/^#[[:space:]]*only_from[[:space:]]*=[[:space:]]*localhost/only_from=localhost/g@/etc/xinetd.conf
+
+# Clean up suspected plaintext password
+613@sed -i /password/s/flurp/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm
+613@sed -i /password/s/frodo/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm
+613@sed -i /password/s/password:a.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_upload.py
+613@sed -i /password/s/password:[[:space:]]\\+.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_upload.py
+613@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'\\?/password\',\'******\'/I@/usr/lib64/python2.7/distutils/tests/test_upload.py
+613@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_config.py
+613@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'),[[:space:]]*(/password\',\'******\'),(/I@/usr/lib64/python2.7/distutils/tests/test_config.py
+613@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.7/distutils/tests/test_register.py
+613@sed -i /Password/s/Password[[:space:]]*:[[:space:]]*\'.*\'/Password:\'******\'/I@/usr/lib64/python2.7/distutils/tests/test_register.py
+613@sed -i /password/s/password[[:space:]]*:[[:space:]]\\+.*\$/password:******/g@/usr/lib64/python2.7/distutils/command/register.py
+613@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\".*\"/_password=\"******\"/I@/etc/libvirt/qemu.conf
+613@sed -i /password/s/_password\"[[:space:]]*=[[:space:]]*\".*\"/_password\"=\"******\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug
+613@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\\\\\".*\\\\\"/_password=\\\\\"******\\\\\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug
+
+614@rm -f@/etc/openldap/certs/password
+614@rm -f@/usr/Euler/conf/menu.lst
+
+# Remove expired certificates
+621@rm -f@/etc/unbound/icannbundle.pem
+621@rm -f@/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
+621@rm -f@/etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem
+621@rm -f@/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
+621@rm -f@/etc/ssl/certs/ca-bundle.crt
+621@rm -f@/etc/pki/tls/certs/ca-bundle.crt
+621@rm -f@/etc/pki/tls/cert.pem
+
+622@rm -f@/etc/sysconfig/grub
+622@rm -f@/usr/lib/modules/*/build
+622@rm -f@/usr/lib/modules/*/source
+622@rm -f@/usr/lib/systemd/system/dbus-org.freedesktop.network1.service
+622@rm -f@/usr/lib/debug/usr/.dwz
+
+# Remove shell for security
+623@rm -f@/usr/bin/csh
+623@rm -f@/usr/bin/tcsh
+623@rm -f@/usr/bin/tclsh
+623@rm -f@/usr/bin/tclsh8.5
+623@rm -f@/usr/bin/hivexsh
+
+# Remove sysmonitor for UVP
+624@rm -f@/etc/sysmonitor/process/virtlogd-daemon
+624@rm -f@/etc/sysmonitor/process/UVPHostd-daemon
+624@rm -f@/etc/sysmonitor/process/libvirtd-daemon
+624@rm -f@/etc/sysmonitor/process/libvirt-guests-daemon
+624@rm -rf@/etc/sysmonitor.d/uvpmonitor
+624@rm -f@/etc/sysmonitor.d/clock_transition_uvp
+624@rm -f@/etc/sysmonitor.d/disk_mem_mce_monitor
+624@rm -f@/etc/sysmonitor.d/libvirtdstat
+624@rm -f@/etc/sysmonitor.d/process_monitor_ucompute
+624@rm -f@/etc/sysmonitor.d/systemd_monitor
+624@rm -f@/etc/sysmonitor.d/virtlogd_monitor
+624@rm -f@/etc/sysmonitor.d/vm_reboot_monitor
+624@rm -f@/etc/sysmonitor.d/cdemu_tls_alarm_monitor
+624@rm -f@/etc/sysmonitor.d/coredump_monitor
+624@rm -f@/etc/sysmonitor.d/hotpatch_alarm
+624@rm -f@/etc/sysmonitor.d/multipathstatus
+624@rm -f@/etc/sysmonitor.d/qemu_hotreplace_alarm
+624@rm -f@/etc/sysmonitor.d/tls_alarm_monitor
+624@rm -f@/etc/sysmonitor.d/vm_io_monitor
+624@rm -f@/etc/sysmonitor.d/checkDstat
+624@rm -f@/etc/sysmonitor.d/cpustat
+624@rm -f@/etc/sysmonitor.d/kvmtop_monitor
+624@rm -f@/etc/sysmonitor.d/net_name
+624@rm -f@/etc/sysmonitor.d/qemu_tls_alarm_monitor
+624@rm -rf@/etc/sysmonitor.d/uvpEnvironmentFiles
+624@rm -f@/etc/sysmonitor.d/vm_panic_monitor
+624@rm -f@/etc/sysmonitor/file.d/*
+624@rm -f@/etc/sysmonitor/process/UVPHostd-monitor
+624@rm -f@/usr/share/qemu-origin/edk2-arm-vars.fd
+624@rm -f@/usr/share/qemu-origin/edk2-arm-code.fd
+624@rm -f@/usr/share/qemu-origin/edk2-aarch64-code.fd
+624@rm -f@/usr/share/qemu-origin/edk2-x86_64-secure-code.fd
+624@rm -f@/usr/share/qemu-origin/edk2-x86_64-code.fd
+624@rm -f@/usr/share/qemu-origin/edk2-licenses.txt
+624@rm -f@/usr/share/qemu-origin/edk2-i386-vars.fd
+624@rm -f@/usr/share/qemu-origin/edk2-i386-secure-code.fd
+624@rm -f@/usr/share/qemu-origin/edk2-i386-code.fd
+624@rm -f@/usr/share/qemu/edk2-arm-vars.fd
+624@rm -f@/usr/share/qemu/edk2-arm-code.fd
+624@rm -f@/usr/share/qemu/edk2-aarch64-code.fd
+624@rm -f@/usr/share/qemu/edk2-x86_64-secure-code.fd
+624@rm -f@/usr/share/qemu/edk2-x86_64-code.fd
+624@rm -f@/usr/share/qemu/edk2-licenses.txt
+624@rm -f@/usr/share/qemu/edk2-i386-vars.fd
+624@rm -f@/usr/share/qemu/edk2-i386-secure-code.fd
+624@rm -f@/usr/share/qemu/edk2-i386-code.fd
+624@rm -f@/etc/systemd/system/system-extra.slice
+624@rm -f@/etc/systemd/system/system-uvp.slice
+
+# set ipv6 setting
+625@m@/etc/sysctl.conf@net.ipv6.conf.all.accept_ra=@0
+625@m@/etc/sysctl.conf@net.ipv6.conf.default.accept_ra=@0
+625@m@/etc/sysctl.conf@net.ipv6.conf.all.accept_redirects=@0
+625@m@/etc/sysctl.conf@net.ipv6.conf.default.accept_redirects=@0
+
+# Remove jdk NULL link
+626@rm -f@/etc/alternatives/mkisofs-mkisofsman
+626@rm -f@/etc/alternatives/keytool.1.gz
+626@rm -f@/etc/alternatives/pack200.1.gz
+626@rm -f@/etc/alternatives/jre_openjdk/lib/audio/default.sf2
+626@rm -f@/etc/alternatives/tnameserv.1.gz
+626@rm -f@/etc/alternatives/jre_1.8.0_openjdk/lib/audio/default.sf2
+626@rm -f@/etc/alternatives/jjs.1.gz
+626@rm -f@/etc/alternatives/mkisofs-mkhybridman
+626@rm -f@/etc/alternatives/rmiregistry.1.gz
+626@rm -f@/etc/alternatives/rmid.1.gz
+626@rm -f@/etc/alternatives/orbd.1.gz
+626@rm -f@/etc/alternatives/unpack200.1.gz
+626@rm -f@/etc/alternatives/java.1.gz
+626@rm -f@/etc/alternatives/servertool.1.gz
+626@rm -f@/etc/grub2-efi.cfg
diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/sys.conf b/dpuos/image_tailor_cfg/custom/cfg_dpuos/sys.conf
new file mode 100644
index 0000000000000000000000000000000000000000..3110685c06c24931cf433da2f396fdc510670ebe
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/sys.conf
@@ -0,0 +1,30 @@
+
+hd0 /boot 1G primary ext4 yes
+hd0 /boot/efi 200M primary vfat yes
+hd0 / 10G primary ext4
+hd0 - - extended -
+hd0 /var 10G logical ext4
+hd0 /home 5G logical ext4
+hd0 /opt 25G logical ext4
+hd0 /tmp 3G logical ext4
+
+
+
+sys_service_enable=''
+sys_service_disable=''
+sys_utc='yes'
+sys_timezone=''
+sys_cut='debug'
+sys_usrrpm_cut='no'
+sys_hostname='dpuos'
+sys_usermodules_autoload=''
+sys_gconv='GBK'
+
+
+
+BOOTPROTO="dhcp"
+DEVICE="eth0"
+IPADDR=""
+NETMASK=""
+STARTMODE="auto"
+
diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/default/grub b/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/default/grub
new file mode 100644
index 0000000000000000000000000000000000000000..a7a042622f3d7635cde0117cc931cff6e9154029
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/default/grub
@@ -0,0 +1,5 @@
+GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0 crashkernel=512M oops=panic softlockup_panic=1 reserve_kbox_mem=16M crash_kexec_post_notifiers panic=3 console=tty0 fsck.mode=auto fsck.repair=yes nmi_watchdog=1 no-steal-time use-sched-idle-time rd.shell=0"
+GRUB_DISABLE_SUBMENU="true"
+GRUB_DISABLE_RECOVERY="true"
+GRUB_TERMINAL_OUTPUT="console"
+GRUB_TIMEOUT=5
diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd b/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd
new file mode 100644
index 0000000000000000000000000000000000000000..629b7f4e68af3f9faafcb333317758ea8bc51dbe
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_file/etc/profile.d/csh.precmd
@@ -0,0 +1,9 @@
+set el_precmd_msg = `history 1|cut -f3-|sed -e "s|{||g" | sed -e "s|}||g"`
+set el_precmd_user = `whoami`
+set el_precmd_loginuser = `who -m | awk '{print $2" "$NF}'`
+set el_precmd_num = `history 1| awk -F" " '{print $1}'`
+
+if ((${el_precmd_num} != ${LastComandNum_for_history}) && (${LastComandNum_for_history} != "" || ${el_precmd_num} == 1)) then
+ logger -t "[/bin/csh]" "[${el_precmd_msg}]" "by [${el_precmd_user}] from [${el_precmd_loginuser}]" > /dev/null
+endif
+set LastComandNum_for_history = ${el_precmd_num}
diff --git a/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh b/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh
new file mode 100755
index 0000000000000000000000000000000000000000..13a88fd28ea4e4a5c2417fd6f0541c6aa95cd539
--- /dev/null
+++ b/dpuos/image_tailor_cfg/custom/cfg_dpuos/usr_install/all/addonscript/after_inssucc_hook/S01service_control.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+LOCAL_DISK_PATH=/mnt/disk
+
+chroot ${LOCAL_DISK_PATH} <
+
+
+
+
+
+ default items to keep or delete from the kiwi initrd
+
+
+
+ 2.7.1
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/rpm.conf b/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/rpm.conf
new file mode 100644
index 0000000000000000000000000000000000000000..746f3ff42fca9607c12092f21742d5a9c4b57be1
--- /dev/null
+++ b/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/rpm.conf
@@ -0,0 +1,310 @@
+
+
+
+
+
+
+ boot/initrd image used for LiveDVD media
+
+
+
+ 2.1.2
+ yum
+ false
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/security_s.conf b/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/security_s.conf
new file mode 100644
index 0000000000000000000000000000000000000000..510add09c4e23892f0200e3646cfda92d2c42387
--- /dev/null
+++ b/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/security_s.conf
@@ -0,0 +1,311 @@
+########################################################################
+# Description: Configration file for dl_sec, and support pam common-auth/password/account/session style(based on linux)
+# HowTo:
+# # delete key, and difference caused by blankspace/tab on key is ignored
+# id@d@file@key
+#
+# # modify option: find line started with key, and get the value changed
+# id@m@file@key[@value]
+#
+# # modify sub-option: find line started with key, and then change the value of key2 to value2(prepositive seperator should not be blank characters) in the line
+# id@M@file@key@key2[@value2]
+#
+# # check existence of commands
+# id@which@command1 [command2 ...]
+#
+# # execute command on the files found
+# id@find@dir@condition@command
+#
+# # any command(with or without parameter), such as 'rm -f','chmod 700','which','touch', used to extend functions, return 0 is ok
+# id@command@file1 [file2 ...]
+#
+# Notes:
+# 1. The comment line should start with '#'
+# 2. "value" related with "key" should contain prepositive separator("="," " and so on), if there is any.
+# 3. When item starts with "d", "m" or "M", "file" should be a single normal file, otherwise multi-objects(separated by blankspace) are allowed.
+#
+########################################################################
+
+########################################################################
+# SSH server setting
+########################################################################
+# Set sshd Protocol version
+101@m@/etc/ssh/sshd_config@Protocol@ 2
+
+# Set sshd password algorithm
+102@m@/etc/ssh/sshd_config@Ciphers@ aes128-ctr,aes192-ctr,aes256-ctr
+
+# Set sshd message authentication code algorithm
+103@m@/etc/ssh/sshd_config@MACs@ hmac-sha2-256
+
+# Set sshd authentication
+104@m@/etc/ssh/sshd_config@PubkeyAuthentication@ yes
+104@m@/etc/ssh/sshd_config@RSAAuthentication@ yes
+# Don't read the user's ~/.rhosts and ~/.shosts files
+104@m@/etc/ssh/sshd_config@IgnoreRhosts@ yes
+# no /etc/ssh/ssh_known_hosts in RTOS, so close it
+104@m@/etc/ssh/sshd_config@RhostsRSAAuthentication@ no
+# To disable tunneled clear text passwords, change to no here
+104@m@/etc/ssh/sshd_config@PasswordAuthentication no
+# To disable host authentication
+104@m@/etc/ssh/sshd_config@HostbasedAuthentication@ no
+
+# Make sshd check file modes and ownership of the user's files and home directory before accepting login
+105@m@/etc/ssh/sshd_config@StrictModes@ yes
+
+# Make sshd print warning banner
+106@m@/etc/ssh/sshd_config@Banner@ /etc/issue.net
+
+# Set ssh log level, logging login/logout on /var/log/messages
+107@m@/etc/ssh/sshd_config@SyslogFacility@ AUTH
+107@m@/etc/ssh/sshd_config@LogLevel@ INFO
+
+# Prevent user without password from remote ssh login
+108@m@/etc/ssh/sshd_config@PermitEmptyPasswords@ no
+
+# Set this to 'yes' to enable PAM authentication, account processing, and session processing.
+109@m@/etc/ssh/sshd_config@UsePAM yes
+
+# Set this to 'no', root is not allowed to log in using ssh.
+110@m@/etc/ssh/sshd_config@PermitRootLogin@ no
+
+# Set this to record sftp log
+111@m@/etc/ssh/sshd_config@Subsystem sftp /usr/libexec/openssh/sftp-server @-l INFO -f AUTH
+
+########################################################################
+# System access and authorization
+########################################################################
+# Prevent rebooting by CTRL+ALT+DEL
+201@m@/etc/inittab@ca::ctrlaltdel:@/bin/false
+
+# Set timeout seconds of inactive sessions
+202@m@/etc/profile@TMOUT@=900
+202@m@/etc/profile@export TMOUT
+
+# Set a proper size above 0 of history commands number modify 100 to 5000
+203@m@/etc/profile@HISTSIZE@=5000
+203@m@/etc/profile@export HISTSIZE
+
+# close the kernel request debugging functionality
+204@m@/etc/sysctl.conf@kernel.sysrq@=0
+204@m@/etc/init.d/boot.local@/sbin/sysctl -p /etc/sysctl.conf
+
+########################################################################
+# File permission setting
+########################################################################
+# Common users are not allowed to delete or modify log files
+301@chmod go-wx@/var/log/*
+
+# Control the permission of administrator resources
+302@chmod 755@/var/log /sbin /usr/sbin
+
+# Set sticky bit of /tmp, then only owner or root can rename or delete files of /tmp
+303@chmod o+t@/tmp
+
+# Set strict permission of /root
+304@chmod 700@/root
+
+# Set ssh key permission
+305@chmod 400@/etc/ssh/*key
+305@chmod 400@/etc/ssh/*key.pub
+
+# Set shadow file permission
+306@chmod 400@/etc/shadow
+306@chmod 400@/etc/shadow.old
+
+# no coredump file
+307@m@/etc/profile@ulimit -c@ 0
+
+# TTYs list of PAM login, restrict root logins to system console
+308@touch@/etc/securetty
+308@chown root@/etc/securetty
+308@chgrp root@/etc/securetty
+308@chmod 400@/etc/securetty
+308@m@/etc/permissions.local@/etc/securetty @ root:root 400
+308@m@/etc/securetty@console
+
+# Create files used by last and faillog command
+309@touch@/var/log/wtmp /var/log/faillog
+
+# Restrict common user to use command at
+310@rm -f@/etc/at.deny
+310@rm -f@/etc/at.allow
+310@touch@/etc/at.allow
+310@m@/etc/at.allow@root
+310@m@/etc/permissions.local@/etc/at.allow @ root:root 400
+
+# Restrict at and cron authorized
+311@rm -f@/etc/cron.deny
+311@rm -f@/etc/cron.allow
+311@touch@/etc/cron.allow
+311@m@/etc/cron.allow@root
+311@m@/etc/permissions.local@/etc/cron.allow @ root:root 400
+
+# Set daemon umask
+312@m@/etc/rc.status@umask@ 027
+
+# Set user default umask
+314@m@/etc/profile@umask@ 077
+314@m@/etc/permissions.local@/etc/profile @ root:root 644
+314@m@/etc/csh.login@umask@ 077
+314@m@/etc/permissions.local@/etc/csh.login @ root:root 444
+314@m@/etc/csh.cshrc@umask@ 077
+314@m@/etc/permissions.local@/etc/csh.cshrc @ root:root 444
+314@m@/etc/bash.bashrc@umask@ 077
+314@m@/etc/permissions.local@/etc/bash.bashrc @ root:root 444
+# Add umask to /root/.bash_profile /root/.bashrc /root/.cshrc /root/.tcshrc
+314@touch@/root/.bash_profile /root/.bashrc /root/.cshrc /root/.tcshrc
+314@m@/root/.bash_profile@umask@ 077
+314@m@/etc/permissions.local@/root/.bash_profile @ root:root 600
+314@m@/root/.bashrc@umask@ 077
+314@m@/etc/permissions.local@/root/.bashrc @ root:root 600
+314@m@/root/.cshrc@umask@ 077
+314@m@/etc/permissions.local@/root/.cshrc @ root:root 600
+314@m@/root/.tcshrc@umask@ 077
+314@m@/etc/permissions.local@/root/.tcshrc @ root:root 600
+
+315@m@/etc/permissions.local@/etc/crontab @ root:root 400
+315@m@/etc/permissions.local@/var/spool/cron/lastrun @ root:root 400
+315@m@/etc/permissions.local@/var/spool/cron/tabs @ root:root 400
+
+# Network parameter modifications
+316@chown root@/etc/sysctl.conf
+316@chgrp root@/etc/sysctl.conf
+316@chmod 600@/etc/sysctl.conf
+316@m@/etc/permissions.local@/etc/sysctl.conf @ root:root 600
+
+# Disable gui login
+317@chown root@/etc/inittab
+317@chgrp root@/etc/inittab
+317@chmod 644@/etc/inittab
+317@m@/etc/permissions.local@/etc/inittab @ root:root 644
+
+318@chown root@/etc/X11/xdm/Xservers
+318@chgrp root@/etc/X11/xdm/Xservers
+318@chmod 444@/etc/X11/xdm/Xservers
+318@m@/etc/permissions.local@/etc/X11/xdm/Xservers @ root:root 444
+
+319@chown root@/etc/sysconfig/displaymanager
+319@chgrp root@/etc/sysconfig/displaymanager
+319@chmod 644@/etc/sysconfig/displaymanager
+319@m@/etc/permissions.local@/etc/sysconfig/displaymanager @ root:root 644
+
+########################################################################
+# Account and password
+########################################################################
+### PAM auth setting, do not change the order of the configurations ###
+401@rm -f@/etc/pam.d/common-auth-pc
+401@touch@/etc/pam.d/common-auth-pc
+# Prevent logins of users in /etc/login.user.deny
+401@touch@/etc/login.user.deny
+401@m@/etc/pam.d/common-auth-pc@#%PAM-1.0\\n#\\n# This file is autogenerated by pam-config. All changes\\n# will be overwritten.\\n#\\n# Authentication-related modules common to all services\\n#\\n# This file is included from other service-specific PAM config files,\\n# and should contain a list of the authentication modules that define\\n# the central authentication scheme for use on the system\\n# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the\\n# traditional Unix authentication mechanisms.\\n#\\n
+401@m@/etc/pam.d/common-auth-pc@auth requisite pam_listfile.so item=user onerr=succeed sense=deny file=/etc/login.user.deny
+402@m@/etc/pam.d/common-auth-pc@auth required pam_env.so
+402@m@/etc/pam.d/common-auth-pc@auth required pam_unix2.so
+# Login failed 3 times will be locked for 5 minutes, even for root
+403@m@/etc/pam.d/common-auth-pc@auth required pam_tally2.so onerr=fail deny=3 unlock_time=300 even_deny_root root_unlock_time=300
+
+### PAM password setting, do not change the order of the configurations ###
+404@rm -f@/etc/pam.d/common-password-pc
+404@touch@/etc/pam.d/common-password-pc
+404@m@/etc/pam.d/common-password-pc@#%PAM-1.0\\n#\\n# This file is autogenerated by pam-config. All changes\\n# will be overwritten.\\n#\\n# Password-related modules common to all services\\n#\\n# This file is included from other service-specific PAM config files,\\n# and should contain a list of modules that define the services to be\\n# used to change user passwords.\\n#\\n
+# Set user(including root) password complexity, contain upper and lower characters, digit and other character;
+# length is no less than 8; cannot contain username; cannot use the latest 12 passwords
+404@m@/etc/pam.d/common-password-pc@password required pam_sek_pwck.so minlen=8 min_class=2 min_upper=0 min_lower=0 min_digits=0 min_special=0 remember=12 tries=5 enforce_for_root no_username use_cracklib cracklib=/usr/share/cracklib/pw_dict root_check_dict
+# Use the default password shadow file
+405@m@/etc/pam.d/common-password-pc@password required pam_unix2.so nullok use_authtok even_for_root
+# Use sha256 to encrypt password
+406@m@/etc/default/passwd@CRYPT=@sha256
+406@m@/etc/default/passwd@CRYPT_FILES=@sha256
+
+### PAM account setting, do not change the order of the configurations ###
+407@rm -f@/etc/pam.d/common-account-pc
+407@touch@/etc/pam.d/common-account-pc
+407@m@/etc/pam.d/common-account-pc@#%PAM-1.0\\n#\\n# This file is autogenerated by pam-config. All changes\\n# will be overwritten.\\n#\\n# Account-related modules common to all services\\n#\\n# This file is included from other service-specific PAM config files,\\n# and should contain a list of the accountorization modules that define\\n# the central access policy for use on the system. The default is to\\n# only deny service to users whose accounts are expired.\\n#\\n
+# Basic account verification
+407@m@/etc/pam.d/common-account-pc@account required pam_unix2.so
+# Maintain the failed login data
+408@m@/etc/pam.d/common-account-pc@account required pam_tally2.so
+
+# Set password lifetime and length of new added users
+409@m@/etc/login.defs@PASS_MAX_DAYS@ 30
+409@m@/etc/login.defs@PASS_MIN_DAYS@ 0
+409@m@/etc/login.defs@PASS_WARN_AGE@ 7
+
+### PAM login setting, do not change the order of the configurations ###
+# do not show login info of last user
+410@d@/etc/pam.d/login@session required pam_lastlog.so
+# no mail system on RTOS
+411@d@/etc/pam.d/login@session optional pam_mail.so
+
+# Limit access to the root by su
+412@m@/etc/pam.d/su@auth required pam_wheel.so use_uid group=wheel
+412@m@/etc/pam.d/su-l@auth required pam_wheel.so use_uid group=wheel
+
+# Lock system account
+413@user@/etc/passwd
+
+########################################################################
+# Command checking
+########################################################################
+# Check root permission control command
+501@which@su
+
+# Check last and faillog command
+502@which@last faillog
+
+# delete lastlog and lastb, since last and faillog are provided and lastlog is not item of RTOS baseline
+503@rm -f@/usr/bin/lastlog /var/log/lastlog /usr/bin/lastb /var/log/btmp
+
+# Check logrotate command which is necessary for logging security
+504@which@logrotate
+
+
+########################################################################
+# DTS
+#######################################################################
+# Do not display architecture of OS
+601@rm -f@/etc/issue.net
+601@touch@/etc/issue.net
+601@m@/etc/issue.net@Welcome!
+601@m@/etc/permissions.local@/etc/issue.net @ root:root 644
+602@rm -f@/etc/issue
+602@touch@/etc/issue
+602@m@/etc/issue@Welcome!
+602@m@/etc/permissions.local@/etc/issue @ root:root 644
+603@rm -f@/etc/motd
+603@touch@/etc/motd
+603@m@/etc/motd@Authorized users only. All activities may be monitored and reported.\\n
+603@m@/etc/permissions.local@/etc/motd @ root:root 644
+
+# Clean up suspected plaintext password
+604@sed -i /password/s/assword[[:space:]]*=[[:space:]]*\".*\"/assword=\"******\"/I@/etc/openhpi/openhpi.conf
+
+# Add kernel param panic on oops
+605@m@/etc/sysctl.conf@kernel.panic_on_oops@=1
+605@m@/etc/init.d/boot.local@/sbin/sysctl -p /etc/sysctl.conf
+
+# Display user date when use history command.
+606@m@/etc/profile@HISTTIMEFORMAT@=\"%F %T \`whoami\` \"
+
+# Rremove chpasswd
+607@rm -f@/usr/sbin/chpasswd
+
+608@sed -i s/^#[[:space:]]*only_from[[:space:]]*=[[:space:]]*localhost/only_from=localhost/g@/etc/xinetd.conf
+
+# Clean up suspected plaintext password
+609@sed -i /password/s/flurp/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm
+609@sed -i /password/s/frodo/******/g@/usr/lib/perl5/vendor_perl/5.10.0/XML/Simple.pm
+609@sed -i /password/s/password:a.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_upload.py
+609@sed -i /password/s/password:[[:space:]]\\+.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_upload.py
+609@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'\\?/password\',\'******\'/I@/usr/lib64/python2.6/distutils/tests/test_upload.py
+609@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_config.py
+609@sed -i /password/s/password\'[[:space:]]*,[[:space:]]*\'.*\'),[[:space:]]*(/password\',\'******\'),(/I@/usr/lib64/python2.6/distutils/tests/test_config.py
+609@sed -i /password/s/password[[:space:]]*:[[:space:]]*.*\$/password:******/I@/usr/lib64/python2.6/distutils/tests/test_register.py
+609@sed -i /Password/s/Password[[:space:]]*:[[:space:]]*\'.*\'/Password:\'******\'/I@/usr/lib64/python2.6/distutils/tests/test_register.py
+609@sed -i /password/s/password[[:space:]]*:[[:space:]]\\+.*\$/password:******/g@/usr/lib64/python2.6/distutils/command/register.py
+609@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\".*\"/_password=\"******\"/I@/etc/libvirt/qemu.conf
+609@sed -i /password/s/_password\"[[:space:]]*=[[:space:]]*\".*\"/_password\"=\"******\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug
+609@sed -i /password/s/_password[[:space:]]*=[[:space:]]*\\\\\".*\\\\\"/_password=\\\\\"******\\\\\"/I@/usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug
+609@sed -i /userPassword/s/userPassword\"[[:space:]]*=>[[:space:]]*\".*\"/userPassword\"=>\"******\"/I@/usr/share/YaST2/modules/YaPI/USERS.pm
+609@sed -i /password/s/password[[:space:]]*#.*[[:space:]]*\\*/password#******/I@/usr/share/YaST2/modules/Provider.ycp
diff --git a/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/sys.conf b/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/sys.conf
new file mode 100644
index 0000000000000000000000000000000000000000..fd219ac77d482112321bfc93db3a7e68e16445fa
--- /dev/null
+++ b/dpuos/image_tailor_cfg/kiwi/minios/cfg_dpuos/sys.conf
@@ -0,0 +1,18 @@
+
+
+sys_service_enable='boot.udev boot.debugfs boot.ldconfig boot.localnet boot.sysctl syslog network sshd rpcbind irq_balancer'
+sys_utc='yes'
+sys_timezone=''
+sys_cut='yes'
+sys_usrrpm_cut='no'
+sys_hostname='dpuos'
+sys_usermodules_autoload=''
+
+
+
+BOOTPROTO="dhcp"
+DEVICE="eth0"
+IPADDR=""
+NETMASK=""
+STARTMODE="auto"
+