mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-11-14 17:40:43 -05:00
image: remove old mkosi config
This commit is contained in:
Malte Poll
Malte Poll
parent
0979a483b4
commit
fc1045a4f7
85 changed files with 0 additions and 2033 deletions
8
image/.gitignore
vendored
8
image/.gitignore
vendored
|
|
@ -1,8 +0,0 @@
|
||||||
mkosi.cache
|
|
||||||
mkosi.extra
|
|
||||||
pki
|
|
||||||
image.*
|
|
||||||
!image.go
|
|
||||||
mkosi.output.*
|
|
||||||
pki_*/*.key
|
|
||||||
pki_*/*.vmgs
|
|
||||||
113
image/Makefile
113
image/Makefile
|
|
@ -1,113 +0,0 @@
|
||||||
SHELL = /bin/bash
|
|
||||||
SRC_PATH = $(CURDIR)
|
|
||||||
BASE_PATH ?= $(SRC_PATH)
|
|
||||||
BOOTSTRAPPER_BINARY ?= $(BASE_PATH)/../build/bootstrapper
|
|
||||||
DISK_MAPPER_BINARY ?= $(BASE_PATH)/../build/disk-mapper
|
|
||||||
UPGRADE_AGENT_BINARY ?= $(BASE_PATH)/../build/upgrade-agent
|
|
||||||
DEBUGD_BINARY ?= $(BASE_PATH)/../build/debugd
|
|
||||||
MEASUREMENT_READER_BINARY ?= $(BASE_PATH)/../build/measurement-reader
|
|
||||||
PKI ?= $(BASE_PATH)/pki
|
|
||||||
MKOSI_EXTRA ?= $(BASE_PATH)/mkosi.extra
|
|
||||||
EXTRA_SEARCH_PATHS ?=
|
|
||||||
IMAGE_VERSION ?= v0.0.0
|
|
||||||
DEBUG ?= false
|
|
||||||
AUTOLOGIN ?= false
|
|
||||||
AUTOLOGIN_ARGS := $(if $(filter true,$(AUTOLOGIN)),--autologin) # set "--autologin" if AUTOLOGIN is true
|
|
||||||
KERNEL_DEBUG_CMDLNE := $(if $(filter true,$(DEBUG)),constellation.debug) # set "constellation.debug" if DEBUG is true
|
|
||||||
SEARCH_PATHS_PARAM := $(if $(EXTRA_SEARCH_PATHS),--extra-search-path=$(EXTRA_SEARCH_PATHS))
|
|
||||||
export INSTALL_DEBUGD ?= $(DEBUG)
|
|
||||||
export CONSOLE_MOTD = $(AUTOLOGIN)
|
|
||||||
-include $(CURDIR)/config.mk
|
|
||||||
csps := aws azure gcp openstack qemu
|
|
||||||
variants := aws_aws-sev-snp aws_aws-nitro-tpm azure_azure-sev-snp gcp_gcp-sev-es gcp_gcp-sev-snp openstack_qemu-vtpm qemu_qemu-vtpm
|
|
||||||
certs := $(PKI)/PK.cer $(PKI)/KEK.cer $(PKI)/db.cer
|
|
||||||
|
|
||||||
SYSTEMD_FIXED_RPMS := systemd-251.11-2.fc37.x86_64.rpm systemd-libs-251.11-2.fc37.x86_64.rpm systemd-networkd-251.11-2.fc37.x86_64.rpm systemd-pam-251.11-2.fc37.x86_64.rpm systemd-resolved-251.11-2.fc37.x86_64.rpm systemd-udev-251.11-2.fc37.x86_64.rpm
|
|
||||||
KERNEL_RPMS := kernel-6.1.46-100.constellation.fc38.x86_64.rpm kernel-core-6.1.46-100.constellation.fc38.x86_64.rpm kernel-modules-6.1.46-100.constellation.fc38.x86_64.rpm kernel-modules-core-6.1.46-100.constellation.fc38.x86_64.rpm
|
|
||||||
PREBUILD_RPMS_SYSTEMD := $(addprefix prebuilt/rpms/systemd/,$(SYSTEMD_FIXED_RPMS))
|
|
||||||
PREBUILD_RPMS_KERNEL := $(addprefix prebuilt/rpms/kernel/,$(KERNEL_RPMS))
|
|
||||||
|
|
||||||
.PHONY: all clean inject-bins $(csps) $(variants)
|
|
||||||
|
|
||||||
.NOTPARALLEL: mkosi.output.%/fedora~38/image.raw clean-%
|
|
||||||
|
|
||||||
all: $(csps)
|
|
||||||
|
|
||||||
aws: aws_aws-sev-snp aws_aws-nitro-tpm
|
|
||||||
azure: azure_azure-sev-snp
|
|
||||||
gcp: gcp_gcp-sev-es gcp_gcp-sev-snp
|
|
||||||
openstack: openstack_qemu-vtpm
|
|
||||||
qemu: qemu_qemu-vtpm
|
|
||||||
|
|
||||||
$(variants): %: mkosi.output.%/fedora~38/image.raw
|
|
||||||
|
|
||||||
prebuilt/rpms/systemd/%.rpm:
|
|
||||||
@echo "Downloading $*"
|
|
||||||
@mkdir -p $(@D)
|
|
||||||
@curl -fsSL -o $@ https://kojipkgs.fedoraproject.org/packages/systemd/251.11/2.fc37/x86_64/$*.rpm
|
|
||||||
|
|
||||||
prebuilt/rpms/kernel/%.rpm:
|
|
||||||
@echo "Downloading $*"
|
|
||||||
@mkdir -p $(@D)
|
|
||||||
@curl -fsSL -o $@ https://cdn.confidential.cloud/constellation/kernel/6.1.46-100.constellation/$*.rpm
|
|
||||||
|
|
||||||
mkosi.output.%/fedora~38/image.raw: inject-bins inject-certs
|
|
||||||
rm -rf .csp/
|
|
||||||
mkdir -p .csp/
|
|
||||||
$(eval csp := $(firstword $(subst _, ,$*)))
|
|
||||||
$(eval attestation_variant := $(lastword $(subst _, ,$*)))
|
|
||||||
touch .csp/$(csp)
|
|
||||||
mkosi \
|
|
||||||
--image-version=$(IMAGE_VERSION) \
|
|
||||||
$(AUTOLOGIN_ARGS) \
|
|
||||||
--environment=INSTALL_DEBUGD \
|
|
||||||
--environment=CONSOLE_MOTD \
|
|
||||||
--kernel-command-line="$(KERNEL_DEBUG_CMDLNE)" \
|
|
||||||
--kernel-command-line="constel.attestation-variant=$(attestation_variant)" \
|
|
||||||
--kernel-command-line="constel.csp=$(csp)" \
|
|
||||||
--output-dir=mkosi.output.$* \
|
|
||||||
$(SEARCH_PATHS_PARAM) \
|
|
||||||
build
|
|
||||||
secure-boot/signed-shim.sh $@
|
|
||||||
@if [ -n $(SUDO_UID) ] && [ -n $(SUDO_GID) ]; then \
|
|
||||||
chown -R $(SUDO_UID):$(SUDO_GID) mkosi.output.$*; \
|
|
||||||
fi
|
|
||||||
rm -rf .csp/
|
|
||||||
@echo "Image is ready: $@"
|
|
||||||
|
|
||||||
inject-bins: $(PREBUILD_RPMS_SYSTEMD) $(PREBUILD_RPMS_KERNEL)
|
|
||||||
mkdir -p $(MKOSI_EXTRA)/usr/bin
|
|
||||||
mkdir -p $(MKOSI_EXTRA)/usr/sbin
|
|
||||||
cp $(UPGRADE_AGENT_BINARY) $(MKOSI_EXTRA)/usr/bin/upgrade-agent
|
|
||||||
cp $(DISK_MAPPER_BINARY) $(MKOSI_EXTRA)/usr/sbin/disk-mapper
|
|
||||||
cp $(MEASUREMENT_READER_BINARY) $(MKOSI_EXTRA)/usr/sbin/measurement-reader
|
|
||||||
if [ "$(DEBUG)" = "true" ]; then \
|
|
||||||
cp $(DEBUGD_BINARY) $(MKOSI_EXTRA)/usr/bin/debugd; \
|
|
||||||
rm -f $(MKOSI_EXTRA)/usr/bin/bootstrapper; \
|
|
||||||
rm -f $(MKOSI_EXTRA)/usr/bin/upgrade-agent; \
|
|
||||||
else \
|
|
||||||
cp $(BOOTSTRAPPER_BINARY) $(MKOSI_EXTRA)/usr/bin/bootstrapper; \
|
|
||||||
rm -f $(MKOSI_EXTRA)/usr/bin/debugd; \
|
|
||||||
fi
|
|
||||||
|
|
||||||
inject-certs: $(certs)
|
|
||||||
# for auto enrollment using systemd-boot (not working yet)
|
|
||||||
mkdir -p "$(MKOSI_EXTRA)/boot/loader/keys/auto"
|
|
||||||
cp $(PKI)/{PK,KEK,db}.cer "$(MKOSI_EXTRA)/boot/loader/keys/auto"
|
|
||||||
cp $(PKI)/{MicWinProPCA2011_2011-10-19,MicCorUEFCA2011_2011-06-27,MicCorKEKCA2011_2011-06-24}.crt "$(MKOSI_EXTRA)/boot/loader/keys/auto"
|
|
||||||
|
|
||||||
clean-cache:
|
|
||||||
rm -rf mkosi.cache/*
|
|
||||||
|
|
||||||
clean-%:
|
|
||||||
rm -rf .csp/
|
|
||||||
mkdir -p .csp/
|
|
||||||
touch .csp/$*
|
|
||||||
mkosi clean
|
|
||||||
rm -rf .csp/
|
|
||||||
|
|
||||||
clean:
|
|
||||||
rm -rf mkosi.output.*
|
|
||||||
rm -rf prebuilt/rpms
|
|
||||||
rm -rf $(MKOSI_EXTRA)
|
|
||||||
mkdir -p $(MKOSI_EXTRA)
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
[Content]
|
|
||||||
Packages=
|
|
||||||
ec2-utils
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
[Content]
|
|
||||||
Packages=
|
|
||||||
WALinuxAgent-udev
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
[Content]
|
|
||||||
Packages=
|
|
||||||
containerd,
|
|
||||||
containernetworking-plugins,
|
|
||||||
iptables-nft,
|
|
||||||
ethtool,
|
|
||||||
socat,
|
|
||||||
iproute-tc,
|
|
||||||
conntrack-tools,
|
|
||||||
podman
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
[Content]
|
|
||||||
Packages=
|
|
||||||
nvme-cli
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
[Match]
|
|
||||||
PathExists=../.csp/aws
|
|
||||||
|
|
||||||
[Output]
|
|
||||||
KernelCommandLine=mitigations=auto idle=poll
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
[Match]
|
|
||||||
PathExists=../.csp/azure
|
|
||||||
|
|
||||||
[Output]
|
|
||||||
KernelCommandLine=mitigations=auto,nosmt
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
[Distribution]
|
|
||||||
Distribution=fedora
|
|
||||||
Release=38
|
|
||||||
|
|
||||||
[Output]
|
|
||||||
Format=disk
|
|
||||||
ManifestFormat=json,changelog
|
|
||||||
Bootable=yes
|
|
||||||
KernelCommandLine=preempt=full rd.shell=0 rd.emergency=reboot loglevel=8 console=ttyS0
|
|
||||||
SplitArtifacts=yes
|
|
||||||
# Enable Secure Boot with own PKI
|
|
||||||
SecureBoot=yes
|
|
||||||
SecureBootKey=pki/db.key
|
|
||||||
SecureBootCertificate=pki/db.crt
|
|
||||||
# TODO(malt3): Wait for systemd 252 to bring systemd-measure
|
|
||||||
# Measure=yes
|
|
||||||
ImageId=constellation
|
|
||||||
Output=image.raw
|
|
||||||
|
|
||||||
[Content]
|
|
||||||
Packages=prebuilt/rpms/kernel/kernel-6.1.46-100.constellation.fc38.x86_64.rpm
|
|
||||||
prebuilt/rpms/kernel/kernel-core-6.1.46-100.constellation.fc38.x86_64.rpm
|
|
||||||
prebuilt/rpms/kernel/kernel-modules-6.1.46-100.constellation.fc38.x86_64.rpm
|
|
||||||
prebuilt/rpms/kernel/kernel-modules-core-6.1.46-100.constellation.fc38.x86_64.rpm
|
|
||||||
prebuilt/rpms/systemd/systemd-251.11-2.fc37.x86_64.rpm
|
|
||||||
prebuilt/rpms/systemd/systemd-libs-251.11-2.fc37.x86_64.rpm
|
|
||||||
prebuilt/rpms/systemd/systemd-networkd-251.11-2.fc37.x86_64.rpm
|
|
||||||
prebuilt/rpms/systemd/systemd-pam-251.11-2.fc37.x86_64.rpm
|
|
||||||
prebuilt/rpms/systemd/systemd-resolved-251.11-2.fc37.x86_64.rpm
|
|
||||||
prebuilt/rpms/systemd/systemd-udev-251.11-2.fc37.x86_64.rpm
|
|
||||||
dracut
|
|
||||||
util-linux
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
[Match]
|
|
||||||
PathExists=../.csp/gcp
|
|
||||||
|
|
||||||
[Output]
|
|
||||||
KernelCommandLine=mitigations=auto,nosmt
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
[Match]
|
|
||||||
PathExists=../.csp/openstack
|
|
||||||
|
|
||||||
[Output]
|
|
||||||
KernelCommandLine=mem_encrypt=on kvm_amd.sev=1 module_blacklist=qemu_fw_cfg console=tty0 console=ttyS0 mitigations=auto,nosmt
|
|
||||||
|
|
||||||
[Content]
|
|
||||||
Autologin=yes
|
|
||||||
Environment=CONSOLE_MOTD=true
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
[Match]
|
|
||||||
PathExists=../.csp/qemu
|
|
||||||
|
|
||||||
[Content]
|
|
||||||
Autologin=yes
|
|
||||||
Environment=CONSOLE_MOTD=true
|
|
||||||
|
|
||||||
[Output]
|
|
||||||
KernelCommandLine=mitigations=auto,nosmt
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
[Content]
|
|
||||||
Packages=
|
|
||||||
iproute,
|
|
||||||
dbus-broker,
|
|
||||||
systemd-networkd,
|
|
||||||
systemd-resolved,
|
|
||||||
dracut-network,
|
|
||||||
dhclient, # prevent NetworkManager from being pulled in by dracut-network
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
[Content]
|
|
||||||
# Secure Boot / EFI related packages for manual enrollment / verification of Secure Boot
|
|
||||||
Packages=
|
|
||||||
e2fsprogs,
|
|
||||||
sbsigntools,
|
|
||||||
efitools,
|
|
||||||
mokutil,
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
[Output]
|
|
||||||
# set selinux to permissive
|
|
||||||
KernelCommandLine=!selinux=0 selinux=1 enforcing=0 audit=0
|
|
||||||
|
|
||||||
[Content]
|
|
||||||
# Secure Boot / EFI related packages for manual enrollment / verification of Secure Boot
|
|
||||||
Packages=selinux-policy,
|
|
||||||
selinux-policy-targeted,
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
[Content]
|
|
||||||
Packages=
|
|
||||||
passwd,
|
|
||||||
nano,
|
|
||||||
nano-default-editor,
|
|
||||||
vim,
|
|
||||||
curl,
|
|
||||||
wget
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
set -euxo pipefail
|
|
||||||
|
|
||||||
# cleanup dracut generation files (disk-mapper) to save space
|
|
||||||
rm -rf "${BUILDROOT}/usr/lib/dracut/modules.d/39constellation-mount/"
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
set -euxo pipefail
|
|
||||||
|
|
||||||
# This will work in sd-boot 251 to auto-enroll secure boot keys.
|
|
||||||
# https://www.freedesktop.org/software/systemd/man/systemd-boot.html
|
|
||||||
# > CHANGES WITH 252 in spe:
|
|
||||||
# > [...]
|
|
||||||
# > * sd-boot can automatically enroll SecureBoot keys from files found on
|
|
||||||
# > the ESP. This enrollment can be either automatic ('force' mode) or
|
|
||||||
# > controlled by the user ('manual' mode).
|
|
||||||
# > [...]
|
|
||||||
#
|
|
||||||
# echo "secure-boot-enroll force" >> /boot/loader/loader.conf
|
|
||||||
|
|
||||||
# create mountpoints in /etc
|
|
||||||
mkdir -p /etc/{cni,kubernetes}
|
|
||||||
|
|
||||||
# move issue files away from /etc
|
|
||||||
# to allow /run/issue and /run/issue.d to take precedence
|
|
||||||
mv /etc/issue.d /usr/lib/issue.d || true
|
|
||||||
rm -f /etc/issue
|
|
||||||
rm -f /etc/issue.net
|
|
||||||
|
|
||||||
# add motd for constellation console access
|
|
||||||
if [[ ${CONSOLE_MOTD:-false} == "true" ]]; then
|
|
||||||
cat << EOF > /usr/lib/motd.d/10-constellation-console-access.motd
|
|
||||||
~ Welcome to Constellation! ~
|
|
||||||
Usually, on release versions of Constellation running in the cloud, you are not able to login through the serial console.
|
|
||||||
This shell access is specifically granted for debug images and MiniConstellation to allow users to research the environment Constellation runs in.
|
|
||||||
Have fun! Feel free to report any issues to GitHub or security@edgeless.systems (for security vulnerabilities only).
|
|
||||||
EOF
|
|
||||||
fi
|
|
||||||
|
|
||||||
# update /etc/os-release
|
|
||||||
echo "IMAGE_ID=\"${IMAGE_ID}\"" >> /etc/os-release
|
|
||||||
echo "IMAGE_VERSION=\"${IMAGE_VERSION}\"" >> /etc/os-release
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
set -euxo pipefail
|
|
||||||
|
|
||||||
# set selinux to permissive
|
|
||||||
sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
|
|
||||||
|
|
||||||
# backport of https://github.com/dracutdevs/dracut/commit/dcbe23c14d13ca335ad327b7bb985071ca442f12
|
|
||||||
sed -i 's/WantedBy=multi-user.target/WantedBy=basic.target/' /usr/lib/systemd/system/systemd-resolved.service
|
|
||||||
|
|
||||||
# write + enable debugd.service if INSTALL_DEBUGD is set
|
|
||||||
if [[ ${INSTALL_DEBUGD:-false} == "true" ]]; then
|
|
||||||
cat << EOF > /usr/lib/systemd/system/debugd.service
|
|
||||||
[Unit]
|
|
||||||
Description=Constellation Debug Daemon
|
|
||||||
Wants=network-online.target
|
|
||||||
After=network-online.target configure-constel-csp.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
RemainAfterExit=yes
|
|
||||||
Restart=on-failure
|
|
||||||
EnvironmentFile=/run/constellation.env
|
|
||||||
Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
|
|
||||||
ExecStart=/usr/bin/debugd
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
EOF
|
|
||||||
echo "enable debugd.service" > /usr/lib/systemd/system-preset/31-constellation-debug.preset
|
|
||||||
systemctl enable debugd.service
|
|
||||||
# ensure constellation-bootstrapper.service uses downloaded binaries on reboots
|
|
||||||
sed -i 's#ExecStart=.*#ExecStart=/run/state/bin/bootstrapper#' /usr/lib/systemd/system/constellation-bootstrapper.service
|
|
||||||
fi
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
[Partition]
|
|
||||||
Type=esp
|
|
||||||
Format=vfat
|
|
||||||
CopyFiles=/boot:/
|
|
||||||
SizeMinBytes=256M
|
|
||||||
SizeMaxBytes=512M
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
[Partition]
|
|
||||||
Type=root
|
|
||||||
Format=squashfs
|
|
||||||
Verity=data
|
|
||||||
VerityMatchKey=root
|
|
||||||
CopyFiles=/
|
|
||||||
Minimize=guess
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
[Partition]
|
|
||||||
Type=root-verity
|
|
||||||
Verity=hash
|
|
||||||
VerityMatchKey=root
|
|
||||||
SizeMinBytes=64M
|
|
||||||
SizeMaxBytes=64M
|
|
||||||
|
|
@ -1,39 +0,0 @@
|
||||||
[amzn2-core]
|
|
||||||
name=Amazon Linux 2 core repository
|
|
||||||
#mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/$releasever/$product/$target/$basearch/mirror.list
|
|
||||||
mirrorlist=https://amazonlinux-2-repos-us-east-2.s3.dualstack.us-east-2.amazonaws.com/2/core/latest/x86_64/mirror.list
|
|
||||||
priority=10
|
|
||||||
gpgcheck=1
|
|
||||||
#gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
|
|
||||||
gpgkey=https://cdn.amazonlinux.com/_assets/11CF1F95C87F5B1A.asc
|
|
||||||
enabled=1
|
|
||||||
metadata_expire=300
|
|
||||||
mirrorlist_expire=300
|
|
||||||
report_instanceid=yes
|
|
||||||
includepkgs=ec2-utils
|
|
||||||
|
|
||||||
# [amzn2-core-source]
|
|
||||||
# name=Amazon Linux 2 core repository - source packages
|
|
||||||
# mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/$releasever/$product/$target/SRPMS/mirror.list
|
|
||||||
# priority=10
|
|
||||||
# gpgcheck=1
|
|
||||||
# #gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
|
|
||||||
# gpgkey=https://cdn.amazonlinux.com/_assets/11CF1F95C87F5B1A.asc
|
|
||||||
# enabled=0
|
|
||||||
# metadata_expire=300
|
|
||||||
# mirrorlist_expire=300
|
|
||||||
# report_instanceid=yes
|
|
||||||
# includepkgs=ec2-utils
|
|
||||||
|
|
||||||
# [amzn2-core-debuginfo]
|
|
||||||
# name=Amazon Linux 2 core repository - debuginfo packages
|
|
||||||
# mirrorlist=$awsproto://$amazonlinux.$awsregion.$awsdomain/$releasever/$product/$target/debuginfo/$basearch/mirror.list
|
|
||||||
# priority=10
|
|
||||||
# gpgcheck=1
|
|
||||||
# #gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-linux-2
|
|
||||||
# gpgkey=https://cdn.amazonlinux.com/_assets/11CF1F95C87F5B1A.asc
|
|
||||||
# enabled=0
|
|
||||||
# metadata_expire=300
|
|
||||||
# mirrorlist_expire=300
|
|
||||||
# report_instanceid=yes
|
|
||||||
# includepkgs=ec2-utils
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
runtime-endpoint: "unix:///run/containerd/containerd.sock"
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
# enable networking in initrd (initramfs) with dracut and systemd-networkd
|
|
||||||
install_items+=" /usr/lib/systemd/network/20-wired.network "
|
|
||||||
install_items+=" /usr/lib/systemd/network/21-azure.network "
|
|
||||||
# see https://github.com/dracutdevs/dracut/tree/master/modules.d for a list of modules
|
|
||||||
add_dracutmodules+=" systemd-networkd systemd-resolved "
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
# add Amazon ena driver to the list of drivers to be loaded
|
|
||||||
force_drivers+=" ena "
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
# add hyperv drivers to initramfs
|
|
||||||
# (important for early networking)
|
|
||||||
force_drivers+=" hv_netvsc hv_sock hv_storvsc hv_vmbus "
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
# Include NVMe driver in initrd to boot on NVMe devices.
|
|
||||||
force_drivers+=" nvme "
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
/dev/mapper/state /run/state ext4 defaults,x-systemd.makefs,x-mount.mkdir 0 0
|
|
||||||
/run/state/var /var none defaults,bind,x-mount.mkdir 0 0
|
|
||||||
/run/state/kubernetes /etc/kubernetes none defaults,bind,x-mount.mkdir 0 0
|
|
||||||
/run/state/etccni /etc/cni/ none defaults,bind,x-mount.mkdir 0 0
|
|
||||||
/run/state/opt /opt none defaults,bind,x-mount.mkdir 0 0
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
# Note: This script is sourced.
|
|
||||||
|
|
||||||
export TERM=linux
|
|
||||||
export PATH=/run/state/bin:${PATH}
|
|
||||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
|
||||||
alias k=kubectl
|
|
||||||
|
|
@ -1,216 +0,0 @@
|
||||||
disabled_plugins = []
|
|
||||||
imports = []
|
|
||||||
oom_score = 0
|
|
||||||
plugin_dir = ""
|
|
||||||
required_plugins = []
|
|
||||||
root = "/var/lib/containerd"
|
|
||||||
state = "/run/containerd"
|
|
||||||
version = 2
|
|
||||||
|
|
||||||
[cgroup]
|
|
||||||
path = ""
|
|
||||||
|
|
||||||
[debug]
|
|
||||||
address = ""
|
|
||||||
format = ""
|
|
||||||
gid = 0
|
|
||||||
level = ""
|
|
||||||
uid = 0
|
|
||||||
|
|
||||||
[grpc]
|
|
||||||
address = "/run/containerd/containerd.sock"
|
|
||||||
gid = 0
|
|
||||||
max_recv_message_size = 16777216
|
|
||||||
max_send_message_size = 16777216
|
|
||||||
tcp_address = ""
|
|
||||||
tcp_tls_cert = ""
|
|
||||||
tcp_tls_key = ""
|
|
||||||
uid = 0
|
|
||||||
|
|
||||||
[metrics]
|
|
||||||
address = ""
|
|
||||||
grpc_histogram = false
|
|
||||||
|
|
||||||
[plugins]
|
|
||||||
|
|
||||||
[plugins."io.containerd.gc.v1.scheduler"]
|
|
||||||
deletion_threshold = 0
|
|
||||||
mutation_threshold = 100
|
|
||||||
pause_threshold = 0.02
|
|
||||||
schedule_delay = "0s"
|
|
||||||
startup_delay = "100ms"
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri"]
|
|
||||||
disable_apparmor = false
|
|
||||||
disable_cgroup = false
|
|
||||||
disable_hugetlb_controller = true
|
|
||||||
disable_proc_mount = false
|
|
||||||
disable_tcp_service = true
|
|
||||||
enable_selinux = false
|
|
||||||
enable_tls_streaming = false
|
|
||||||
ignore_image_defined_volumes = false
|
|
||||||
max_concurrent_downloads = 3
|
|
||||||
max_container_log_line_size = 16384
|
|
||||||
netns_mounts_under_state_dir = false
|
|
||||||
restrict_oom_score_adj = false
|
|
||||||
sandbox_image = "registry.k8s.io/pause:3.9@sha256:7031c1b283388d2c2e09b57badb803c05ebed362dc88d84b480cc47f72a21097"
|
|
||||||
selinux_category_range = 1024
|
|
||||||
stats_collect_period = 10
|
|
||||||
stream_idle_timeout = "4h0m0s"
|
|
||||||
stream_server_address = "127.0.0.1"
|
|
||||||
stream_server_port = "0"
|
|
||||||
systemd_cgroup = false
|
|
||||||
tolerate_missing_hugetlb_controller = true
|
|
||||||
unset_seccomp_profile = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".cni]
|
|
||||||
bin_dir = "/opt/cni/bin"
|
|
||||||
conf_dir = "/etc/cni/net.d"
|
|
||||||
conf_template = ""
|
|
||||||
max_conf_num = 1
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd]
|
|
||||||
default_runtime_name = "runc"
|
|
||||||
disable_snapshot_annotations = true
|
|
||||||
discard_unpacked_layers = false
|
|
||||||
no_pivot = false
|
|
||||||
snapshotter = "overlayfs"
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
|
|
||||||
base_runtime_spec = ""
|
|
||||||
container_annotations = []
|
|
||||||
pod_annotations = []
|
|
||||||
privileged_without_host_devices = false
|
|
||||||
runtime_engine = ""
|
|
||||||
runtime_root = ""
|
|
||||||
runtime_type = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
|
|
||||||
base_runtime_spec = ""
|
|
||||||
container_annotations = []
|
|
||||||
pod_annotations = []
|
|
||||||
privileged_without_host_devices = false
|
|
||||||
runtime_engine = ""
|
|
||||||
runtime_root = ""
|
|
||||||
runtime_type = "io.containerd.runc.v2"
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
|
|
||||||
BinaryName = ""
|
|
||||||
CriuImagePath = ""
|
|
||||||
CriuPath = ""
|
|
||||||
CriuWorkPath = ""
|
|
||||||
IoGid = 0
|
|
||||||
IoUid = 0
|
|
||||||
NoNewKeyring = false
|
|
||||||
NoPivotRoot = false
|
|
||||||
Root = ""
|
|
||||||
ShimCgroup = ""
|
|
||||||
SystemdCgroup = true
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
|
|
||||||
base_runtime_spec = ""
|
|
||||||
container_annotations = []
|
|
||||||
pod_annotations = []
|
|
||||||
privileged_without_host_devices = false
|
|
||||||
runtime_engine = ""
|
|
||||||
runtime_root = ""
|
|
||||||
runtime_type = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".image_decryption]
|
|
||||||
key_model = "node"
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".registry]
|
|
||||||
config_path = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".registry.auths]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".registry.configs]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".registry.headers]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
|
|
||||||
|
|
||||||
[plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
|
|
||||||
tls_cert_file = ""
|
|
||||||
tls_key_file = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.internal.v1.opt"]
|
|
||||||
path = "/opt/containerd"
|
|
||||||
|
|
||||||
[plugins."io.containerd.internal.v1.restart"]
|
|
||||||
interval = "10s"
|
|
||||||
|
|
||||||
[plugins."io.containerd.metadata.v1.bolt"]
|
|
||||||
content_sharing_policy = "shared"
|
|
||||||
|
|
||||||
[plugins."io.containerd.monitor.v1.cgroups"]
|
|
||||||
no_prometheus = false
|
|
||||||
|
|
||||||
[plugins."io.containerd.runtime.v1.linux"]
|
|
||||||
no_shim = false
|
|
||||||
runtime = "runc"
|
|
||||||
runtime_root = ""
|
|
||||||
shim = "containerd-shim"
|
|
||||||
shim_debug = false
|
|
||||||
|
|
||||||
[plugins."io.containerd.runtime.v2.task"]
|
|
||||||
platforms = ["linux/amd64"]
|
|
||||||
|
|
||||||
[plugins."io.containerd.service.v1.diff-service"]
|
|
||||||
default = ["walking"]
|
|
||||||
|
|
||||||
[plugins."io.containerd.snapshotter.v1.aufs"]
|
|
||||||
root_path = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.snapshotter.v1.btrfs"]
|
|
||||||
root_path = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.snapshotter.v1.devmapper"]
|
|
||||||
async_remove = false
|
|
||||||
base_image_size = ""
|
|
||||||
pool_name = ""
|
|
||||||
root_path = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.snapshotter.v1.native"]
|
|
||||||
root_path = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.snapshotter.v1.overlayfs"]
|
|
||||||
root_path = ""
|
|
||||||
|
|
||||||
[plugins."io.containerd.snapshotter.v1.zfs"]
|
|
||||||
root_path = ""
|
|
||||||
|
|
||||||
[proxy_plugins]
|
|
||||||
|
|
||||||
[stream_processors]
|
|
||||||
|
|
||||||
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
|
|
||||||
accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
|
|
||||||
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
|
|
||||||
env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
|
|
||||||
path = "ctd-decoder"
|
|
||||||
returns = "application/vnd.oci.image.layer.v1.tar"
|
|
||||||
|
|
||||||
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
|
|
||||||
accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
|
|
||||||
args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
|
|
||||||
env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
|
|
||||||
path = "ctd-decoder"
|
|
||||||
returns = "application/vnd.oci.image.layer.v1.tar+gzip"
|
|
||||||
|
|
||||||
[timeouts]
|
|
||||||
"io.containerd.timeout.shim.cleanup" = "5s"
|
|
||||||
"io.containerd.timeout.shim.load" = "5s"
|
|
||||||
"io.containerd.timeout.shim.shutdown" = "3s"
|
|
||||||
"io.containerd.timeout.task.state" = "2s"
|
|
||||||
|
|
||||||
[ttrpc]
|
|
||||||
address = ""
|
|
||||||
gid = 0
|
|
||||||
uid = 0
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
[network]
|
|
||||||
network_config_dir = "/run/containers/networks"
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
unqualified-search-registries = ["docker.io"]
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Azure Provisioning
|
|
||||||
After=network-online.target
|
|
||||||
Wants=network-online.target
|
|
||||||
ConditionKernelCommandLine=constel.csp=azure
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
ExecStart=/usr/local/bin/azure-provisioning
|
|
||||||
RemainAfterExit=yes
|
|
||||||
StandardOutput=tty
|
|
||||||
StandardInput=tty
|
|
||||||
StandardError=tty
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# source https://learn.microsoft.com/en-us/azure/virtual-machines/linux/no-agent
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
attempts=1
|
|
||||||
until [[ ${attempts} -gt 5 ]]; do
|
|
||||||
echo "obtaining goal state - attempt ${attempts}"
|
|
||||||
goalstate=$(curl --fail -v -X 'GET' -H "x-ms-agent-name: azure-vm-register" \
|
|
||||||
-H "Content-Type: text/xml;charset=utf-8" \
|
|
||||||
-H "x-ms-version: 2012-11-30" \
|
|
||||||
"http://168.63.129.16/machine/?comp=goalstate")
|
|
||||||
if [[ $? -eq 0 ]]; then
|
|
||||||
echo "successfully retrieved goal state"
|
|
||||||
retrieved_goal_state=true
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
sleep 5
|
|
||||||
attempts=$((attempts + 1))
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ ${retrieved_goal_state} != "true" ]]; then
|
|
||||||
echo "failed to obtain goal state - cannot register this VM"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
container_id=$(grep ContainerId <<< "${goalstate}" | sed 's/\s*<\/*ContainerId>//g' | sed 's/\r$//')
|
|
||||||
instance_id=$(grep InstanceId <<< "${goalstate}" | sed 's/\s*<\/*InstanceId>//g' | sed 's/\r$//')
|
|
||||||
|
|
||||||
ready_doc=$(
|
|
||||||
cat << EOF
|
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<Health xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
|
|
||||||
<GoalStateIncarnation>1</GoalStateIncarnation>
|
|
||||||
<Container>
|
|
||||||
<ContainerId>${container_id}</ContainerId>
|
|
||||||
<RoleInstanceList>
|
|
||||||
<Role>
|
|
||||||
<InstanceId>${instance_id}</InstanceId>
|
|
||||||
<Health>
|
|
||||||
<State>Ready</State>
|
|
||||||
</Health>
|
|
||||||
</Role>
|
|
||||||
</RoleInstanceList>
|
|
||||||
</Container>
|
|
||||||
</Health>
|
|
||||||
EOF
|
|
||||||
)
|
|
||||||
|
|
||||||
attempts=1
|
|
||||||
until [[ ${attempts} -gt 5 ]]; do
|
|
||||||
echo "registering with Azure - attempt ${attempts}"
|
|
||||||
curl --fail -v -X 'POST' -H "x-ms-agent-name: azure-vm-register" \
|
|
||||||
-H "Content-Type: text/xml;charset=utf-8" \
|
|
||||||
-H "x-ms-version: 2012-11-30" \
|
|
||||||
-d "${ready_doc}" \
|
|
||||||
"http://168.63.129.16/machine?comp=health"
|
|
||||||
if [[ $? -eq 0 ]]; then
|
|
||||||
echo "successfully register with Azure"
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
sleep 5 # sleep to prevent throttling from wire server
|
|
||||||
done
|
|
||||||
|
|
@ -1,34 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
# Note: This script is sourced.
|
|
||||||
|
|
||||||
depends() {
|
|
||||||
echo systemd
|
|
||||||
}
|
|
||||||
|
|
||||||
install_and_enable_unit() {
|
|
||||||
unit="$1"
|
|
||||||
shift
|
|
||||||
target="$1"
|
|
||||||
shift
|
|
||||||
inst_simple "${moddir:?}/${unit}" "${systemdsystemunitdir:?}/${unit}"
|
|
||||||
mkdir -p "${initdir:?}${systemdsystemconfdir:?}/${target}.wants"
|
|
||||||
ln_r "${systemdsystemunitdir}/${unit}" \
|
|
||||||
"${systemdsystemconfdir}/${target}.wants/${unit}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install() {
|
|
||||||
inst_multiple \
|
|
||||||
bash \
|
|
||||||
curl \
|
|
||||||
grep \
|
|
||||||
sed
|
|
||||||
|
|
||||||
inst_script "${moddir}/azure-provisioning.sh" \
|
|
||||||
"/usr/local/bin/azure-provisioning"
|
|
||||||
install_and_enable_unit "azure-provisioning.service" \
|
|
||||||
"basic.target"
|
|
||||||
}
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Force symlink creation for AWS nvme disks
|
|
||||||
Before=prepare-state-disk.service
|
|
||||||
After=network-online.target
|
|
||||||
Wants=network-online.target
|
|
||||||
ConditionKernelCommandLine=constel.csp=aws
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
ExecStart=/bin/bash /usr/sbin/aws-nvme-disk
|
|
||||||
RemainAfterExit=yes
|
|
||||||
StandardOutput=tty
|
|
||||||
StandardInput=tty
|
|
||||||
StandardError=tty
|
|
||||||
TimeoutSec=infinity
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s extglob nullglob inherit_errexit
|
|
||||||
|
|
||||||
AWS_STATE_DISK_DEVICENAME="sdb"
|
|
||||||
AWS_STATE_DISK_SYMLINK="/dev/${AWS_STATE_DISK_DEVICENAME}"
|
|
||||||
|
|
||||||
# hack: aws nvme udev rules are never executed. Create symlinks for the nvme devices manually.
|
|
||||||
while [[ ! -L ${AWS_STATE_DISK_SYMLINK} ]]; do
|
|
||||||
for nvmedisk in /dev/nvme*n1; do
|
|
||||||
linkname=$(nvme amzn id-ctrl -b "${nvmedisk}" | tail -c +3073 | head -c 32 | tr -d ' ') || true
|
|
||||||
if [[ -n ${linkname} ]] && [[ ${linkname} == "${AWS_STATE_DISK_DEVICENAME}" ]]; then
|
|
||||||
ln -s "${nvmedisk}" "${AWS_STATE_DISK_SYMLINK}"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
if [[ -L ${AWS_STATE_DISK_SYMLINK} ]]; then
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
echo "Waiting for state disk to appear.."
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "AWS state disk found"
|
|
||||||
echo "${AWS_STATE_DISK_SYMLINK}" → "$(readlink -f "${AWS_STATE_DISK_SYMLINK}")"
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
../../../systemd/system/configure-constel-csp.service
|
|
||||||
|
|
@ -1,94 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
# Note: This script is sourced.
|
|
||||||
|
|
||||||
depends() {
|
|
||||||
# systemd-network-management expands to: systemd systemd-hostnamed systemd-networkd systemd-resolved systemd-timedated systemd-timesyncd
|
|
||||||
echo dracut-systemd systemd-network-management systemd-veritysetup systemd-udevd
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
install_and_enable_unit() {
|
|
||||||
unit="$1"
|
|
||||||
shift
|
|
||||||
target="$1"
|
|
||||||
shift
|
|
||||||
inst_simple "${moddir:?}/${unit}" "${systemdsystemunitdir:?}/${unit}"
|
|
||||||
mkdir -p "${initdir:?}${systemdsystemconfdir:?}/${target}.wants"
|
|
||||||
ln_r "${systemdsystemunitdir}/${unit}" \
|
|
||||||
"${systemdsystemconfdir}/${target}.wants/${unit}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_path() {
|
|
||||||
local dir="$1"
|
|
||||||
shift
|
|
||||||
mkdir -p "${initdir}/${dir}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install() {
|
|
||||||
inst_multiple \
|
|
||||||
bash
|
|
||||||
inst_script "/usr/sbin/disk-mapper" \
|
|
||||||
"/usr/sbin/disk-mapper"
|
|
||||||
|
|
||||||
inst_script "${moddir}/prepare-state-disk.sh" \
|
|
||||||
"/usr/sbin/prepare-state-disk"
|
|
||||||
install_and_enable_unit "prepare-state-disk.service" \
|
|
||||||
"basic.target"
|
|
||||||
install_and_enable_unit "configure-constel-csp.service" \
|
|
||||||
"basic.target"
|
|
||||||
|
|
||||||
# aws nvme disks
|
|
||||||
inst_multiple \
|
|
||||||
tail \
|
|
||||||
tr \
|
|
||||||
head
|
|
||||||
|
|
||||||
# azure scsi disks
|
|
||||||
inst_multiple \
|
|
||||||
cut \
|
|
||||||
readlink
|
|
||||||
|
|
||||||
# gcp nvme disks
|
|
||||||
inst_multiple \
|
|
||||||
date \
|
|
||||||
xxd \
|
|
||||||
grep \
|
|
||||||
sed \
|
|
||||||
ln \
|
|
||||||
command \
|
|
||||||
readlink
|
|
||||||
|
|
||||||
inst_script "/usr/sbin/nvme" \
|
|
||||||
"/usr/sbin/nvme"
|
|
||||||
inst_script "/usr/lib/udev/google_nvme_id" \
|
|
||||||
"/usr/lib/udev/google_nvme_id"
|
|
||||||
inst_rules "64-gce-disk-removal.rules" "65-gce-disk-naming.rules"
|
|
||||||
|
|
||||||
inst_script "${moddir}/aws-nvme-disk.sh" \
|
|
||||||
"/usr/sbin/aws-nvme-disk"
|
|
||||||
install_and_enable_unit "aws-nvme-disk.service" \
|
|
||||||
"basic.target"
|
|
||||||
|
|
||||||
# TLS / CA store in initramfs
|
|
||||||
install_path /etc/pki/tls/certs/
|
|
||||||
inst_simple /etc/pki/tls/certs/ca-bundle.crt \
|
|
||||||
/etc/pki/tls/certs/ca-bundle.crt
|
|
||||||
|
|
||||||
# backport of https://github.com/dracutdevs/dracut/commit/dcbe23c14d13ca335ad327b7bb985071ca442f12
|
|
||||||
inst_simple "${moddir}/sysusers-dracut.conf" "${systemdsystemunitdir}/systemd-sysusers.service.d/sysusers-dracut.conf"
|
|
||||||
# force systemd-networkd in initrd
|
|
||||||
install_and_enable_unit "systemd-networkd.service" \
|
|
||||||
"basic.target"
|
|
||||||
# shellcheck disable=SC2154
|
|
||||||
inst_multiple -o \
|
|
||||||
"${tmpfilesdir}"/systemd-network.conf \
|
|
||||||
"${systemdnetwork}"/80-6rd-tunnel.network \
|
|
||||||
"${systemdnetwork}"/80-container-vb.network \
|
|
||||||
"${systemdsystemunitdir}"/systemd-networkd-wait-online@.service
|
|
||||||
inst_simple /usr/lib/systemd/resolved.conf.d/fallback_dns.conf \
|
|
||||||
/usr/lib/systemd/resolved.conf.d/fallback_dns.conf
|
|
||||||
}
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Prepare encrypted state disk
|
|
||||||
Before=initrd-fs.target
|
|
||||||
After=network-online.target nss-lookup.target configure-constel-csp.service
|
|
||||||
Wants=network-online.target
|
|
||||||
Requires=initrd-root-fs.target
|
|
||||||
FailureAction=reboot-immediate
|
|
||||||
After=export_constellation_debug.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
EnvironmentFile=/run/constellation.env
|
|
||||||
ExecStart=/bin/bash /usr/sbin/prepare-state-disk $CONSTELLATION_DEBUG_FLAGS
|
|
||||||
RemainAfterExit=yes
|
|
||||||
StandardOutput=tty
|
|
||||||
StandardInput=tty
|
|
||||||
StandardError=tty
|
|
||||||
TimeoutSec=infinity
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
# parsing of the command line arguments. check if argv[1] is --debug
|
|
||||||
verbosity=0
|
|
||||||
if [[ $# -gt 0 ]]; then
|
|
||||||
if [[ $1 == "--debug" ]]; then
|
|
||||||
verbosity=-1
|
|
||||||
echo "[Constellation] Debug mode enabled"
|
|
||||||
else
|
|
||||||
echo "[Constellation] Unknown argument: $1"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
echo "[Constellation] Debug mode disabled"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Prepare the encrypted volume by either initializing it with a random key or by aquiring the key from another bootstrapper.
|
|
||||||
# Store encryption key (random or recovered key) in /run/cryptsetup-keys.d/state.key
|
|
||||||
disk-mapper \
|
|
||||||
-csp "${CONSTEL_CSP}" \
|
|
||||||
-v "${verbosity}"
|
|
||||||
|
|
||||||
if [[ $? -ne 0 ]]; then
|
|
||||||
echo "Failed to prepare state disk"
|
|
||||||
sleep 2 # give the serial console time to print the error message
|
|
||||||
exit $? # exit with the same error code as disk-mapper
|
|
||||||
fi
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
# backport of https://github.com/dracutdevs/dracut/commit/dcbe23c14d13ca335ad327b7bb985071ca442f12
|
|
||||||
[Unit]
|
|
||||||
ConditionNeedsUpdate=
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
PATH=/run/state/bin:$PATH
|
|
||||||
KUBECONFIG=/etc/kubernetes/admin.conf
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
\S{IMAGE_ID} \S{IMAGE_VERSION}
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
overlay
|
|
||||||
br_netfilter
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
# See https://github.com/cilium/cilium/issues/10645
|
|
||||||
net.ipv4.conf.lxc*.rp_filter = 0
|
|
||||||
net.ipv4.conf.cilium_*.rp_filter = 0
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
net.bridge.bridge-nf-call-ip6tables = 1
|
|
||||||
net.bridge.bridge-nf-call-iptables = 1
|
|
||||||
net.ipv4.ip_forward = 1
|
|
||||||
fs.inotify.max_user_instances = 8192
|
|
||||||
fs.inotify.max_user_watches = 524288
|
|
||||||
# kubernetes hardening (protectKernelDefaults=true)
|
|
||||||
vm.overcommit_memory = 1
|
|
||||||
kernel.panic = 10
|
|
||||||
kernel.panic_on_oops = 1
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
[Match]
|
|
||||||
Name=en*
|
|
||||||
|
|
||||||
[Network]
|
|
||||||
DHCP=yes
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
# Used as a fallback rule for Azure NICs as they are not named with "en*"
|
|
||||||
[Match]
|
|
||||||
Driver=hv_netvsc
|
|
||||||
|
|
||||||
[Network]
|
|
||||||
DHCP=yes
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
[Resolve]
|
|
||||||
FallbackDNS=1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001 8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844 9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::9
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
enable configure-constel-csp.service
|
|
||||||
enable constellation-upgrade-agent.service
|
|
||||||
enable constellation-bootstrapper.service
|
|
||||||
enable containerd.service
|
|
||||||
enable kubelet.service
|
|
||||||
enable systemd-networkd.service
|
|
||||||
enable systemd-networkd.socket
|
|
||||||
enable systemd-resolved.service
|
|
||||||
enable measurements.service
|
|
||||||
enable export_constellation_debug.service
|
|
||||||
enable systemd-timesyncd
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Configures constellation cloud service provider environment variable
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
ExecStart=/bin/bash -c "CSP=$(< /proc/cmdline tr ' ' '\n' | grep constel.csp | sed 's/constel.csp=//'); echo CONSTEL_CSP=$CSP >> /run/constellation.env"
|
|
||||||
ExecStart=/bin/bash -c "ATTESTATION=$(< /proc/cmdline tr ' ' '\n' | grep constel.attestation-variant | sed 's/constel.attestation-variant=//'); echo CONSTEL_ATTESTATION_VARIANT=$ATTESTATION >> /run/constellation.env"
|
|
||||||
RemainAfterExit=yes
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Constellation Bootstrapper
|
|
||||||
Wants=network-online.target
|
|
||||||
After=network-online.target configure-constel-csp.service
|
|
||||||
After=export_constellation_debug.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
RemainAfterExit=yes
|
|
||||||
Restart=on-failure
|
|
||||||
EnvironmentFile=/run/constellation.env
|
|
||||||
Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
|
|
||||||
ExecStart=/usr/bin/bootstrapper $CONSTELLATION_DEBUG_FLAGS
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Constellation Upgrade Agent
|
|
||||||
After=export_constellation_debug.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
RemainAfterExit=yes
|
|
||||||
Restart=on-failure
|
|
||||||
EnvironmentFile=/run/constellation.env
|
|
||||||
Environment=PATH=/run/state/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
|
|
||||||
ExecStart=/usr/bin/upgrade-agent $CONSTELLATION_DEBUG_FLAGS
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
[Service]
|
|
||||||
ExecStart=
|
|
||||||
ExecStart=/usr/bin/containerd --config /usr/etc/containerd/config.toml
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Export Constellation Debug Level to Environment
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
ExecStart=/bin/bash -c "tr ' ' '\n' < /proc/cmdline | grep -q 'constellation.debug' && echo CONSTELLATION_DEBUG_FLAGS=--debug >> /run/constellation.env"
|
|
||||||
RemainAfterExit=yes
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=kubelet: The Kubernetes Node Agent
|
|
||||||
Documentation=https://kubernetes.io/docs/home/
|
|
||||||
Wants=network-online.target
|
|
||||||
After=network-online.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"
|
|
||||||
Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
|
|
||||||
# This is a file that "kubeadm init" and "kubeadm join" generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
|
|
||||||
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
|
|
||||||
# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
|
|
||||||
# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
|
|
||||||
EnvironmentFile=-/etc/default/kubelet
|
|
||||||
ExecStart=/run/state/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS
|
|
||||||
Restart=always
|
|
||||||
StartLimitInterval=0
|
|
||||||
RestartSec=10
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Print image measurements on startup
|
|
||||||
Before=constellation-bootstrapper.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=oneshot
|
|
||||||
RemainAfterExit=yes
|
|
||||||
EnvironmentFile=/run/constellation.env
|
|
||||||
ExecStart=/usr/libexec/constellation-pcrs
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
FallbackNTP=time.google.com time.cloudflare.com time.windows.com time.apple.com time.nist.gov europe.pool.ntp.org 0.rhel.pool.ntp.org 1.rhel.pool.ntp.org 2.rhel.pool.ntp.org 3.rhel.pool.ntp.org
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
#Type Name ID GECOS Home directory Shell
|
|
||||||
u etcd 998:997 "etcd user" /var/lib/etcd
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
#Type Path Mode User Group Age Argument
|
|
||||||
d /var/lib/etcd 0700 998 997 - -
|
|
||||||
d /var/log/kubernetes/audit/ 0700 0 0 - -
|
|
||||||
d /run/state/bin 0755 0 0 - -
|
|
||||||
C /run/issue.d - - - - /usr/lib/issue.d/
|
|
||||||
C /run/issue - - - - /usr/lib/issue
|
|
||||||
C /run/motd.d - - - - /usr/lib/motd.d/
|
|
||||||
C /run/motd - - - - /usr/lib/motd
|
|
||||||
# merge all CNI binaries in writable folder until containerd can use multiple CNI bins: https://github.com/containerd/containerd/issues/6600
|
|
||||||
C /opt/cni/bin - - - - /usr/libexec/cni/
|
|
||||||
|
|
@ -1,248 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# Copyright 2020 Google Inc. All Rights Reserved.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
|
|
||||||
# Used to generate symlinks for PD-NVMe devices using the disk names reported by
|
|
||||||
# the metadata server
|
|
||||||
|
|
||||||
# Locations of the script's dependencies
|
|
||||||
readonly nvme_cli_bin=/usr/sbin/nvme
|
|
||||||
|
|
||||||
# Bash regex to parse device paths and controller identification
|
|
||||||
readonly NAMESPACE_NUMBER_REGEX="/dev/nvme[[:digit:]]+n([[:digit:]]+).*"
|
|
||||||
readonly PARTITION_NUMBER_REGEX="/dev/nvme[[:digit:]]+n[[:digit:]]+p([[:digit:]]+)"
|
|
||||||
|
|
||||||
# Globals used to generate the symlinks for a PD-NVMe disk. These are populated
|
|
||||||
# by the identify_pd_disk function and exported for consumption by udev rules.
|
|
||||||
ID_SERIAL=''
|
|
||||||
ID_SERIAL_SHORT=''
|
|
||||||
|
|
||||||
#######################################
|
|
||||||
# Helper function to log an error message to stderr.
|
|
||||||
# Globals:
|
|
||||||
# None
|
|
||||||
# Arguments:
|
|
||||||
# String to print as the log message
|
|
||||||
# Outputs:
|
|
||||||
# Writes error to STDERR
|
|
||||||
#######################################
|
|
||||||
function err() {
|
|
||||||
echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')]: $*" >&2
|
|
||||||
}
|
|
||||||
|
|
||||||
#######################################
|
|
||||||
# Retrieves the device name for an NVMe namespace using nvme-cli.
|
|
||||||
# Globals:
|
|
||||||
# Uses nvme_cli_bin
|
|
||||||
# Arguments:
|
|
||||||
# The path to the nvme namespace (/dev/nvme0n?)
|
|
||||||
# Outputs:
|
|
||||||
# The device name parsed from the JSON in the vendor ext of the ns-id command.
|
|
||||||
# Returns:
|
|
||||||
# 0 if the device name for the namespace could be retrieved, 1 otherwise
|
|
||||||
#######################################
|
|
||||||
function get_namespace_device_name() {
|
|
||||||
local nvme_json
|
|
||||||
nvme_json="$("${nvme_cli_bin}" id-ns -b "$1" | xxd -p -seek 384 | xxd -p -r)"
|
|
||||||
if [[ $? -ne 0 ]]; then
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z ${nvme_json} ]]; then
|
|
||||||
err "NVMe Vendor Extension disk information not present"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
local device_name
|
|
||||||
device_name="$(echo "${nvme_json}" | grep device_name | sed -e 's/.*"device_name":[ \t]*"\([a-zA-Z0-9_-]\+\)".*/\1/')"
|
|
||||||
|
|
||||||
# Error if our device name is empty
|
|
||||||
if [[ -z ${device_name} ]]; then
|
|
||||||
err "Empty name"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "${device_name}"
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
#######################################
|
|
||||||
# Retrieves the nsid for an NVMe namespace
|
|
||||||
# Globals:
|
|
||||||
# None
|
|
||||||
# Arguments:
|
|
||||||
# The path to the nvme namespace (/dev/nvme0n*)
|
|
||||||
# Outputs:
|
|
||||||
# The namespace number/id
|
|
||||||
# Returns:
|
|
||||||
# 0 if the namespace id could be retrieved, 1 otherwise
|
|
||||||
#######################################
|
|
||||||
function get_namespace_number() {
|
|
||||||
local dev_path="$1"
|
|
||||||
local namespace_number
|
|
||||||
if [[ ${dev_path} =~ ${NAMESPACE_NUMBER_REGEX} ]]; then
|
|
||||||
namespace_number="${BASH_REMATCH[1]}"
|
|
||||||
else
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "${namespace_number}"
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
#######################################
|
|
||||||
# Retrieves the partition number for a device path if it exists
|
|
||||||
# Globals:
|
|
||||||
# None
|
|
||||||
# Arguments:
|
|
||||||
# The path to the device partition (/dev/nvme0n*p*)
|
|
||||||
# Outputs:
|
|
||||||
# The value after 'p' in the device path, or an empty string if the path has
|
|
||||||
# no partition.
|
|
||||||
#######################################
|
|
||||||
function get_partition_number() {
|
|
||||||
local dev_path="$1"
|
|
||||||
local partition_number
|
|
||||||
if [[ ${dev_path} =~ ${PARTITION_NUMBER_REGEX} ]]; then
|
|
||||||
partition_number="${BASH_REMATCH[1]}"
|
|
||||||
echo "${partition_number}"
|
|
||||||
else
|
|
||||||
echo ''
|
|
||||||
fi
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
#######################################
|
|
||||||
# Generates a symlink for a PD-NVMe device using the metadata's disk name.
|
|
||||||
# Primarily used for testing but can be used if the script is directly invoked.
|
|
||||||
# Globals:
|
|
||||||
# Uses ID_SERIAL_SHORT (can be populated by identify_pd_disk)
|
|
||||||
# Arguments:
|
|
||||||
# The device path for the disk
|
|
||||||
#######################################
|
|
||||||
function gen_symlink() {
|
|
||||||
local dev_path="$1"
|
|
||||||
local partition_number
|
|
||||||
partition_number="$(get_partition_number "${dev_path}")"
|
|
||||||
|
|
||||||
if [[ -n ${partition_number} ]]; then
|
|
||||||
ln -s "${dev_path}" /dev/disk/by-id/google-"${ID_SERIAL_SHORT}"-part"${partition_number}" > /dev/null 2>&1
|
|
||||||
else
|
|
||||||
ln -s "${dev_path}" /dev/disk/by-id/google-"${ID_SERIAL_SHORT}" > /dev/null 2>&1
|
|
||||||
fi
|
|
||||||
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
#######################################
|
|
||||||
# Populates the ID_* global variables with a disk's device name and namespace
|
|
||||||
# Globals:
|
|
||||||
# Populates ID_SERIAL_SHORT, and ID_SERIAL
|
|
||||||
# Arguments:
|
|
||||||
# The device path for the disk
|
|
||||||
# Returns:
|
|
||||||
# 0 on success and 1 if an error occurrs
|
|
||||||
#######################################
|
|
||||||
function identify_pd_disk() {
|
|
||||||
local dev_path="$1"
|
|
||||||
local dev_name
|
|
||||||
dev_name="$(get_namespace_device_name "${dev_path}")"
|
|
||||||
if [[ $? -ne 0 ]]; then
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
ID_SERIAL_SHORT="${dev_name}"
|
|
||||||
ID_SERIAL="Google_PersistentDisk_${ID_SERIAL_SHORT}"
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
function print_help_message() {
|
|
||||||
echo "Usage: google_nvme_id [-s] [-h] -d device_path"
|
|
||||||
echo " -d <device_path> (Required): Specifies the path to generate a name"
|
|
||||||
echo " for. This needs to be a path to an nvme device or namespace"
|
|
||||||
echo " -s: Create symbolic link for the disk under /dev/disk/by-id."
|
|
||||||
echo " Otherwise, the disk name will be printed to STDOUT"
|
|
||||||
echo " -h: Print this help message"
|
|
||||||
}
|
|
||||||
|
|
||||||
function main() {
|
|
||||||
local opt_gen_symlink='false'
|
|
||||||
local device_path=''
|
|
||||||
|
|
||||||
while getopts :d:sh flag; do
|
|
||||||
case "${flag}" in
|
|
||||||
d) device_path="${OPTARG}" ;;
|
|
||||||
s) opt_gen_symlink='true' ;;
|
|
||||||
h)
|
|
||||||
print_help_message
|
|
||||||
return 0
|
|
||||||
;;
|
|
||||||
:)
|
|
||||||
echo "Invalid option: ${OPTARG} requires an argument" 1>&2
|
|
||||||
return 1
|
|
||||||
;;
|
|
||||||
*) return 1 ;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ -z ${device_path} ]]; then
|
|
||||||
echo "Device path (-d) argument required. Use -h for full usage." 1>&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Ensure the nvme-cli command is installed
|
|
||||||
command -v "${nvme_cli_bin}" > /dev/null 2>&1
|
|
||||||
if [[ $? -ne 0 ]]; then
|
|
||||||
err "The nvme utility (/usr/sbin/nvme) was not found. You may need to run \
|
|
||||||
with sudo or install nvme-cli."
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Ensure the passed device is actually an NVMe device
|
|
||||||
"${nvme_cli_bin}" id-ctrl "${device_path}" &> /dev/null
|
|
||||||
if [[ $? -ne 0 ]]; then
|
|
||||||
err "Passed device was not an NVMe device. (You may need to run this \
|
|
||||||
script as root/with sudo)."
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Detect the type of attached nvme device
|
|
||||||
local controller_id
|
|
||||||
controller_id=$("${nvme_cli_bin}" id-ctrl "${device_path}")
|
|
||||||
if [[ ! ${controller_id} =~ nvme_card-pd ]]; then
|
|
||||||
err "Device is not a PD-NVMe device"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Fill the global variables for the id command for the given disk type
|
|
||||||
# Error messages will be printed closer to error, no need to reprint here
|
|
||||||
identify_pd_disk "${device_path}"
|
|
||||||
ret=$?
|
|
||||||
if [[ ${ret} -ne 0 ]]; then
|
|
||||||
return "${ret}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Gen symlinks or print out the globals set by the identify command
|
|
||||||
if [[ ${opt_gen_symlink} == 'true' ]]; then
|
|
||||||
gen_symlink "${device_path}"
|
|
||||||
else
|
|
||||||
# These will be consumed by udev
|
|
||||||
echo "ID_SERIAL_SHORT=${ID_SERIAL_SHORT}"
|
|
||||||
echo "ID_SERIAL=${ID_SERIAL}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
return $?
|
|
||||||
|
|
||||||
}
|
|
||||||
main "$@"
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
# Copyright 2016 Google Inc. All Rights Reserved.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
# When a disk is removed, unmount any remaining attached volumes.
|
|
||||||
|
|
||||||
ACTION=="remove", SUBSYSTEM=="block", KERNEL=="sd*|vd*|nvme*", RUN+="/bin/sh -c '/bin/umount -fl /dev/$name && /usr/bin/logger -p daemon.warn -s WARNING: hot-removed /dev/$name that was still mounted, data may have been corrupted'"
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
# Copyright 2016 Google Inc. All Rights Reserved.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
#
|
|
||||||
# Name the attached disks as the specified by deviceName.
|
|
||||||
|
|
||||||
ACTION!="add|change", GOTO="gce_disk_naming_end"
|
|
||||||
SUBSYSTEM!="block", GOTO="gce_disk_naming_end"
|
|
||||||
|
|
||||||
# SCSI naming
|
|
||||||
KERNEL=="sd*|vd*", IMPORT{program}="scsi_id --export --whitelisted -d $tempnode"
|
|
||||||
|
|
||||||
# NVME Local SSD naming
|
|
||||||
KERNEL=="nvme*n*", ATTRS{model}=="nvme_card", PROGRAM="/bin/sh -c 'nsid=$$(echo %k|sed -re s/nvme[0-9]+n\([0-9]+\).\*/\\1/); echo $$((nsid-1))'", ENV{ID_SERIAL_SHORT}="local-nvme-ssd-%c"
|
|
||||||
KERNEL=="nvme*", ATTRS{model}=="nvme_card", ENV{ID_SERIAL}="Google_EphemeralDisk_$env{ID_SERIAL_SHORT}"
|
|
||||||
|
|
||||||
# NVME Persistent Disk IO Timeout
|
|
||||||
KERNEL=="nvme*n*", ENV{DEVTYPE}=="disk", ATTRS{model}=="nvme_card-pd", ATTR{queue/io_timeout}="4294967295"
|
|
||||||
|
|
||||||
# NVME Persistent Disk Naming
|
|
||||||
KERNEL=="nvme*n*", ATTRS{model}=="nvme_card-pd", IMPORT{program}="google_nvme_id -d $tempnode"
|
|
||||||
|
|
||||||
# Symlinks
|
|
||||||
KERNEL=="sd*|vd*|nvme*", ENV{DEVTYPE}=="disk", SYMLINK+="disk/by-id/google-$env{ID_SERIAL_SHORT}"
|
|
||||||
KERNEL=="sd*|vd*|nvme*", ENV{DEVTYPE}=="partition", SYMLINK+="disk/by-id/google-$env{ID_SERIAL_SHORT}-part%n"
|
|
||||||
|
|
||||||
LABEL="gce_disk_naming_end"
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
# prevent systemd udev rules from marking unformatted device mapper device as unready (SYSTEMD_READY=0)
|
|
||||||
# this is the offending rule from systemd: SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
|
|
||||||
SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}="constellation-encrypted-disk"
|
|
||||||
SUBSYSTEM=="block", ENV{DM_NAME}=="state", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}="constellation-state"
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
# This script reads the measurements of the system
|
|
||||||
# and prints the message to the serial console
|
|
||||||
|
|
||||||
main() {
|
|
||||||
pcr_state="$(/usr/sbin/measurement-reader)"
|
|
||||||
echo -e "${pcr_state}\n" > /run/issue.d/35_constellation_pcrs.issue
|
|
||||||
}
|
|
||||||
|
|
||||||
main
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
TMPDIR=$(mktemp -d /tmp/uefivars-XXXXXXXXXXXXXX)
|
|
||||||
git clone --branch v1.0.0 https://github.com/awslabs/python-uefivars "${TMPDIR}"
|
|
||||||
cd "${TMPDIR}" && git reset 9679002a4392d8e7831d2dbda3fab41ccc5c6b8c --hard
|
|
||||||
|
|
||||||
"${TMPDIR}/uefivars.py" -i none -o aws -O "$1" -P "${PKI}"/PK.esl -K "${PKI}"/KEK.esl --db "${PKI}"/db.esl
|
|
||||||
|
|
||||||
rm -rf "${TMPDIR}"
|
|
||||||
|
|
@ -1,76 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
. "${CONFIG_FILE}"
|
|
||||||
fi
|
|
||||||
POSITIONAL_ARGS=()
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case $1 in
|
|
||||||
-n | --name)
|
|
||||||
AZURE_VM_NAME="$2"
|
|
||||||
shift # past argument
|
|
||||||
shift # past value
|
|
||||||
;;
|
|
||||||
-*)
|
|
||||||
echo "Unknown option $1"
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
POSITIONAL_ARGS+=("$1") # save positional arg
|
|
||||||
shift # past argument
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
|
|
||||||
|
|
||||||
AZ_VM_INFO=$(az vm show --name "${AZURE_VM_NAME}" --resource-group "${AZURE_RESOURCE_GROUP_NAME}" -o json)
|
|
||||||
NIC=$(echo "${AZ_VM_INFO}" | jq -r '.networkProfile.networkInterfaces[0].id')
|
|
||||||
NIC_INFO=$(az network nic show --ids "${NIC}" -o json)
|
|
||||||
PUBIP=$(echo "${NIC_INFO}" | jq -r '.ipConfigurations[0].publicIpAddress.id')
|
|
||||||
NSG=$(echo "${NIC_INFO}" | jq -r '.networkSecurityGroup.id')
|
|
||||||
SUBNET=$(echo "${NIC_INFO}" | jq -r '.ipConfigurations[0].subnet.id')
|
|
||||||
VNET=${SUBNET//\/subnets\/.*/}
|
|
||||||
DISK=$(echo "${AZ_VM_INFO}" | jq -r '.storageProfile.osDisk.managedDisk.id')
|
|
||||||
|
|
||||||
delete_vm() {
|
|
||||||
az vm delete -y --name "${AZURE_VM_NAME}" \
|
|
||||||
--resource-group "${AZURE_RESOURCE_GROUP_NAME}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_vnet() {
|
|
||||||
az network vnet delete --ids "${VNET}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_subnet() {
|
|
||||||
az network vnet subnet delete --ids "${SUBNET}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_nsg() {
|
|
||||||
az network nsg delete --ids "${NSG}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_pubip() {
|
|
||||||
az network public-ip delete --ids "${PUBIP}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_disk() {
|
|
||||||
az disk delete -y --ids "${DISK}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_nic() {
|
|
||||||
az network nic delete --ids "${NIC}" || true
|
|
||||||
}
|
|
||||||
|
|
||||||
delete_vm
|
|
||||||
delete_disk
|
|
||||||
delete_nic
|
|
||||||
delete_nsg
|
|
||||||
delete_subnet
|
|
||||||
delete_vnet
|
|
||||||
delete_pubip
|
|
||||||
|
|
@ -1,68 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
. "${CONFIG_FILE}"
|
|
||||||
fi
|
|
||||||
AZURE_SUBSCRIPTION=$(az account show --query id -o tsv)
|
|
||||||
POSITIONAL_ARGS=()
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case $1 in
|
|
||||||
-n | --name)
|
|
||||||
AZURE_VM_NAME="$2"
|
|
||||||
shift # past argument
|
|
||||||
shift # past value
|
|
||||||
;;
|
|
||||||
-*)
|
|
||||||
echo "Unknown option $1"
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
POSITIONAL_ARGS+=("$1") # save positional arg
|
|
||||||
shift # past argument
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
|
|
||||||
|
|
||||||
VM_DISK=$(az vm show -g "${AZURE_RESOURCE_GROUP_NAME}" --name "${AZURE_VM_NAME}" --query "storageProfile.osDisk.managedDisk.id" -o tsv)
|
|
||||||
LOCATION=$(az disk show --ids "${VM_DISK}" --query "location" -o tsv)
|
|
||||||
|
|
||||||
az snapshot create \
|
|
||||||
-g "${AZURE_RESOURCE_GROUP_NAME}" \
|
|
||||||
--source "${VM_DISK}" \
|
|
||||||
--name "${AZURE_SNAPSHOT_NAME}" \
|
|
||||||
-l "${LOCATION}"
|
|
||||||
|
|
||||||
# Azure CLI does not implement getSecureVMGuestStateSAS for snapshots yet
|
|
||||||
# az snapshot grant-access \
|
|
||||||
# --duration-in-seconds 3600 \
|
|
||||||
# --access-level Read \
|
|
||||||
# --name "${AZURE_SNAPSHOT_NAME}" \
|
|
||||||
# -g "${AZURE_RESOURCE_GROUP_NAME}"
|
|
||||||
|
|
||||||
BEGIN=$(az rest \
|
|
||||||
--method post \
|
|
||||||
--url "https://management.azure.com/subscriptions/${AZURE_SUBSCRIPTION}/resourceGroups/${AZURE_RESOURCE_GROUP_NAME}/providers/Microsoft.Compute/snapshots/${AZURE_SNAPSHOT_NAME}/beginGetAccess" \
|
|
||||||
--uri-parameters api-version="2021-12-01" \
|
|
||||||
--body '{"access": "Read", "durationInSeconds": 3600, "getSecureVMGuestStateSAS": true}' \
|
|
||||||
--verbose 2>&1)
|
|
||||||
ASYNC_OPERATION_URI=$(echo "${BEGIN}" | grep Azure-AsyncOperation | cut -d ' ' -f 7 | tr -d "'")
|
|
||||||
sleep 10
|
|
||||||
ACCESS=$(az rest --method get --url "${ASYNC_OPERATION_URI}")
|
|
||||||
VMGS_URL=$(echo "${ACCESS}" | jq -r '.properties.output.securityDataAccessSAS')
|
|
||||||
|
|
||||||
curl -fsSL -o "${AZURE_VMGS_FILENAME}" "${VMGS_URL}"
|
|
||||||
|
|
||||||
az snapshot revoke-access \
|
|
||||||
--name "${AZURE_SNAPSHOT_NAME}" \
|
|
||||||
-g "${AZURE_RESOURCE_GROUP_NAME}"
|
|
||||||
az snapshot delete \
|
|
||||||
--name "${AZURE_SNAPSHOT_NAME}" \
|
|
||||||
-g "${AZURE_RESOURCE_GROUP_NAME}"
|
|
||||||
echo "VMGS saved to ${AZURE_VMGS_FILENAME}"
|
|
||||||
|
|
@ -1,104 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
. "${CONFIG_FILE}"
|
|
||||||
fi
|
|
||||||
POSITIONAL_ARGS=()
|
|
||||||
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case $1 in
|
|
||||||
-n | --name)
|
|
||||||
AZURE_VM_NAME="$2"
|
|
||||||
shift # past argument
|
|
||||||
shift # past value
|
|
||||||
;;
|
|
||||||
-g | --gallery)
|
|
||||||
CREATE_FROM_GALLERY=YES
|
|
||||||
shift # past argument
|
|
||||||
;;
|
|
||||||
-d | --disk)
|
|
||||||
CREATE_FROM_GALLERY=NO
|
|
||||||
shift # past argument
|
|
||||||
;;
|
|
||||||
--secure-boot)
|
|
||||||
AZURE_SECURE_BOOT="$2"
|
|
||||||
shift # past argument
|
|
||||||
shift # past value
|
|
||||||
;;
|
|
||||||
--disk-name)
|
|
||||||
AZURE_DISK_NAME="$2"
|
|
||||||
shift # past argument
|
|
||||||
shift # past value
|
|
||||||
;;
|
|
||||||
-*)
|
|
||||||
echo "Unknown option $1"
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
POSITIONAL_ARGS+=("$1") # save positional arg
|
|
||||||
shift # past argument
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
|
|
||||||
|
|
||||||
if [[ ${AZURE_SECURITY_TYPE} == "ConfidentialVM" ]]; then
|
|
||||||
VMSIZE="Standard_DC2as_v5"
|
|
||||||
elif [[ ${AZURE_SECURITY_TYPE} == "TrustedLaunch" ]]; then
|
|
||||||
VMSIZE="standard_D2as_v5"
|
|
||||||
else
|
|
||||||
echo "Unknown security type: ${AZURE_SECURITY_TYPE}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
create_vm_from_disk() {
|
|
||||||
AZURE_DISK_REFERENCE=$(az disk show --resource-group "${AZURE_RESOURCE_GROUP_NAME}" --name "${AZURE_DISK_NAME}" --query id -o tsv)
|
|
||||||
az vm create --name "${AZURE_VM_NAME}" \
|
|
||||||
--resource-group "${AZURE_RESOURCE_GROUP_NAME}" \
|
|
||||||
-l "${AZURE_REGION}" \
|
|
||||||
--size "${VMSIZE}" \
|
|
||||||
--public-ip-sku Standard \
|
|
||||||
--os-type Linux \
|
|
||||||
--attach-os-disk "${AZURE_DISK_REFERENCE}" \
|
|
||||||
--security-type "${AZURE_SECURITY_TYPE}" \
|
|
||||||
--os-disk-security-encryption-type VMGuestStateOnly \
|
|
||||||
--enable-vtpm true \
|
|
||||||
--enable-secure-boot "${AZURE_SECURE_BOOT}" \
|
|
||||||
--boot-diagnostics-storage "" \
|
|
||||||
--no-wait
|
|
||||||
}
|
|
||||||
|
|
||||||
create_vm_from_sig() {
|
|
||||||
AZURE_IMAGE_REFERENCE=$(az sig image-version show \
|
|
||||||
--gallery-image-definition "${AZURE_IMAGE_DEFINITION}" \
|
|
||||||
--gallery-image-version "${AZURE_IMAGE_VERSION}" \
|
|
||||||
--gallery-name "${AZURE_GALLERY_NAME}" \
|
|
||||||
-g "${AZURE_RESOURCE_GROUP_NAME}" \
|
|
||||||
--query id -o tsv)
|
|
||||||
az vm create --name "${AZURE_VM_NAME}" \
|
|
||||||
--resource-group "${AZURE_RESOURCE_GROUP_NAME}" \
|
|
||||||
-l "${AZURE_REGION}" \
|
|
||||||
--size "${VMSIZE}" \
|
|
||||||
--public-ip-sku Standard \
|
|
||||||
--image "${AZURE_IMAGE_REFERENCE}" \
|
|
||||||
--security-type "${AZURE_SECURITY_TYPE}" \
|
|
||||||
--os-disk-security-encryption-type VMGuestStateOnly \
|
|
||||||
--enable-vtpm true \
|
|
||||||
--enable-secure-boot "${AZURE_SECURE_BOOT}" \
|
|
||||||
--boot-diagnostics-storage "" \
|
|
||||||
--no-wait
|
|
||||||
}
|
|
||||||
|
|
||||||
if [[ ${CREATE_FROM_GALLERY} == "YES" ]]; then
|
|
||||||
create_vm_from_sig
|
|
||||||
else
|
|
||||||
create_vm_from_disk
|
|
||||||
fi
|
|
||||||
|
|
||||||
sleep 30
|
|
||||||
az vm boot-diagnostics enable --name "${AZURE_VM_NAME}" --resource-group "${AZURE_RESOURCE_GROUP_NAME}"
|
|
||||||
|
|
@ -1,95 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &> /dev/null && pwd)
|
|
||||||
BASE_DIR=$(realpath "${SCRIPT_DIR}/..")
|
|
||||||
|
|
||||||
# Set to qemu+tcp://localhost:16599/system for dockerized libvirt setup
|
|
||||||
if [[ -z ${LIBVIRT_SOCK} ]]; then
|
|
||||||
LIBVIRT_SOCK=qemu:///system
|
|
||||||
fi
|
|
||||||
|
|
||||||
libvirt_nvram_gen() {
|
|
||||||
local image_path="${1}"
|
|
||||||
if test -f "${BASE_DIR}/image.nvram.template"; then
|
|
||||||
echo "NVRAM template already generated: $(realpath "--relative-to=$(pwd)" "${BASE_DIR}"/image.nvram.template)"
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
if ! test -f "${image_path}"; then
|
|
||||||
echo "Image \"${image_path}\" does not exist yet. To generate nvram, create disk image first."
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
|
|
||||||
OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
|
|
||||||
OVMF_VARS=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
|
|
||||||
if ! test -f "${OVMF_CODE}"; then
|
|
||||||
OVMF_CODE=/usr/share/OVMF/OVMF_CODE.secboot.fd
|
|
||||||
fi
|
|
||||||
if ! test -f "${OVMF_VARS}"; then
|
|
||||||
OVMF_VARS=/usr/share/OVMF/OVMF_VARS.secboot.fd
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Using OVMF_CODE: ${OVMF_CODE}"
|
|
||||||
echo "Using OVMF_VARS: ${OVMF_VARS}"
|
|
||||||
|
|
||||||
# generate nvram file using libvirt
|
|
||||||
virt-install --name constell-nvram-gen \
|
|
||||||
--connect "${LIBVIRT_SOCK}" \
|
|
||||||
--nonetworks \
|
|
||||||
--description 'Constellation' \
|
|
||||||
--ram 1024 \
|
|
||||||
--vcpus 1 \
|
|
||||||
--osinfo detect=on,require=off \
|
|
||||||
--disk "${image_path},format=raw" \
|
|
||||||
--boot "machine=q35,menu=on,loader=${OVMF_CODE},loader.readonly=yes,loader.type=pflash,nvram.template=${OVMF_VARS},nvram=${BASE_DIR}/image.nvram,loader_secure=yes" \
|
|
||||||
--features smm.state=on \
|
|
||||||
--noautoconsole
|
|
||||||
echo -e 'connect using'
|
|
||||||
echo -e ' \u001b[1mvirsh console constell-nvram-gen\u001b[0m'
|
|
||||||
echo -e ''
|
|
||||||
echo -e 'Load db cert with MokManager or enroll full PKI with firmware setup'
|
|
||||||
echo -e ''
|
|
||||||
echo -e ' \u001b[1mMokManager\u001b[0m'
|
|
||||||
echo -e ' For mokmanager, try to boot as usual. You will see this message:'
|
|
||||||
echo -e ' > "Verification failed: (0x1A) Security Violation"'
|
|
||||||
echo -e ' Press OK, then ENTER, then "Enroll key from disk"'
|
|
||||||
echo -e ' Select the following key:'
|
|
||||||
echo -e ' > \u001b[1m/EFI/loader/keys/auto/db.cer\u001b[0m'
|
|
||||||
echo -e ' Press Continue, then choose "Yes" to the question "Enroll the key(s)?"'
|
|
||||||
echo -e ' Choose reboot and continue this script.'
|
|
||||||
echo -e ''
|
|
||||||
echo -e ' \u001b[1mFirmware setup\u001b[0m'
|
|
||||||
echo -e ' For firmware setup, press F2.'
|
|
||||||
echo -e ' Go to "Device Manager">"Secure Boot Configuration">"Secure Boot Mode"'
|
|
||||||
echo -e ' Choose "Custom Mode"'
|
|
||||||
echo -e ' Go to "Custom Securee Boot Options"'
|
|
||||||
echo -e ' Go to "PK Options">"Enroll PK", Press "Y" if queried, "Enroll PK using File"'
|
|
||||||
echo -e ' Select the following cert: \u001b[1m/EFI/loader/keys/auto/PK.cer\u001b[0m'
|
|
||||||
echo -e ' Choose "Commit Changes and Exit"'
|
|
||||||
echo -e ' Go to "KEK Options">"Enroll KEK", Press "Y" if queried, "Enroll KEK using File"'
|
|
||||||
echo -e ' Select the following cert: \u001b[1m/EFI/loader/keys/auto/KEK.cer\u001b[0m'
|
|
||||||
echo -e ' Choose "Commit Changes and Exit"'
|
|
||||||
echo -e ' Go to "DB Options">"Enroll Signature">"Enroll Signature using File"'
|
|
||||||
echo -e ' Select the following cert: \u001b[1m/EFI/loader/keys/auto/db.cer\u001b[0m'
|
|
||||||
echo -e ' Choose "Commit Changes and Exit"'
|
|
||||||
echo -e ' Repeat the last step for the following certs:'
|
|
||||||
echo -e ' > \u001b[1m/EFI/loader/keys/auto/MicWinProPCA2011_2011-10-19.crt\u001b[0m'
|
|
||||||
echo -e ' > \u001b[1m/EFI/loader/keys/auto/MicCorUEFCA2011_2011-06-27.crt\u001b[0m'
|
|
||||||
echo -e ' Reboot and continue this script.'
|
|
||||||
echo -e ''
|
|
||||||
echo -e 'Press ENTER to continue after you followed one of the guides from above.'
|
|
||||||
read -r
|
|
||||||
sudo cp "${BASE_DIR}/image.nvram" "${BASE_DIR}/image.nvram.template"
|
|
||||||
virsh --connect "${LIBVIRT_SOCK}" destroy --domain constell-nvram-gen
|
|
||||||
virsh --connect "${LIBVIRT_SOCK}" undefine --nvram constell-nvram-gen
|
|
||||||
rm -f "${BASE_DIR}/image.nvram"
|
|
||||||
|
|
||||||
echo "NVRAM template generated: $(realpath "--relative-to=$(pwd)" "${BASE_DIR}"/image.nvram.template)"
|
|
||||||
}
|
|
||||||
|
|
||||||
libvirt_nvram_gen "$1"
|
|
||||||
|
|
@ -1,66 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
# This script generates a PKI for secure boot.
|
|
||||||
# It is based on the example from https://github.com/systemd/systemd/blob/main/man/loader.conf.xml
|
|
||||||
# This is meant to be used for development purposes only.
|
|
||||||
# Release images are signed using a different set of keys.
|
|
||||||
# Set PKI to an empty folder and PKI_SET to "dev".
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &> /dev/null && pwd)
|
|
||||||
templates=${script_dir}/templates
|
|
||||||
base_dir=$(realpath "${script_dir}/..")
|
|
||||||
pki="${PKI:-${base_dir}/pki}"
|
|
||||||
pki_set="${PKI_SET:-dev}"
|
|
||||||
|
|
||||||
gen_pki() {
|
|
||||||
# Only use for non-production images.
|
|
||||||
# Use real PKI for production images instead.
|
|
||||||
mkdir -p "${pki}"
|
|
||||||
count=$(find "${pki}" -maxdepth 1 \( -name '*.key' -o -name '*.crt' -o -name '*.cer' -o -name '*.esl' -o -name '*.auth' \) 2> /dev/null | wc -l)
|
|
||||||
if [[ ${count} != 0 ]]; then
|
|
||||||
echo PKI files "$(ls -1 "$(realpath "--relative-to=$(pwd)" "${pki}")"/*.{key,crt,cer,esl,auth})" already exist
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
pushd "${pki}" || exit 1
|
|
||||||
|
|
||||||
uuid=$(systemd-id128 new --uuid)
|
|
||||||
for key in PK KEK db; do
|
|
||||||
openssl req -new -x509 -config "${templates}/${pki_set}_${key}.conf" -keyout "${key}.key" -out "${key}.crt" -nodes
|
|
||||||
openssl x509 -outform DER -in "${key}.crt" -out "${key}.cer"
|
|
||||||
cert-to-efi-sig-list -g "${uuid}" "${key}.crt" "${key}.esl"
|
|
||||||
done
|
|
||||||
|
|
||||||
for key in MicWinProPCA2011_2011-10-19.crt MicCorUEFCA2011_2011-06-27.crt MicCorKEKCA2011_2011-06-24.crt; do
|
|
||||||
curl -fsSL "https://www.microsoft.com/pkiops/certs/${key}" --output "${key}"
|
|
||||||
sbsiglist --owner 77fa9abd-0359-4d32-bd60-28f4e78f784b --type x509 --output "${key%crt}esl" "${key}"
|
|
||||||
done
|
|
||||||
|
|
||||||
# Optionally add Microsoft Windows Production CA 2011 (needed to boot into Windows).
|
|
||||||
cat MicWinProPCA2011_2011-10-19.esl >> db.esl
|
|
||||||
|
|
||||||
# Optionally add Microsoft Corporation UEFI CA 2011 (for firmware drivers / option ROMs
|
|
||||||
# and third-party boot loaders (including shim). This is highly recommended on real
|
|
||||||
# hardware as not including this may soft-brick your device (see next paragraph).
|
|
||||||
cat MicCorUEFCA2011_2011-06-27.esl >> db.esl
|
|
||||||
|
|
||||||
# Optionally add Microsoft Corporation KEK CA 2011. Recommended if either of the
|
|
||||||
# Microsoft keys is used as the official UEFI revocation database is signed with this
|
|
||||||
# key. The revocation database can be updated with [fwupdmgr(1)](https://www.freedesktop.org/software/systemd/man/fwupdmgr.html#).
|
|
||||||
cat MicCorKEKCA2011_2011-06-24.esl >> KEK.esl
|
|
||||||
|
|
||||||
sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
|
|
||||||
sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
|
|
||||||
sign-efi-sig-list -c KEK.crt -k KEK.key db db.esl db.auth
|
|
||||||
|
|
||||||
popd || exit 1
|
|
||||||
}
|
|
||||||
|
|
||||||
# gen_pki generates a PKI for testing purposes only.
|
|
||||||
# if keys/certs are already present in the pki folder, they are not regenerated.
|
|
||||||
gen_pki
|
|
||||||
|
|
@ -1,48 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# Copyright (c) Edgeless Systems GmbH
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-only
|
|
||||||
|
|
||||||
# This script is used to add a signed shim to the image.raw file EFI partition after running `mkosi build`.
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
shopt -s inherit_errexit
|
|
||||||
|
|
||||||
if (($# != 1)); then
|
|
||||||
echo "Usage: $0 <image.raw>"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# SOURCE is the URL used to download the signed shim RPM
|
|
||||||
SOURCE=https://kojipkgs.fedoraproject.org/packages/shim/15.6/2/x86_64/shim-x64-15.6-2.x86_64.rpm
|
|
||||||
# EXPECTED_SHA512 is the SHA512 checksum of the signed shim RPM
|
|
||||||
EXPECTED_SHA512=971978bddee95a6a134ef05c4d88cf5df41926e631de863b74ef772307f3e106c82c8f6889c18280d47187986abd774d8671c5be4b85b1b0bb3d1858b65d02cf
|
|
||||||
TMPDIR=$(mktemp -d)
|
|
||||||
|
|
||||||
pushd "${TMPDIR}"
|
|
||||||
|
|
||||||
curl -fsSL -o shim.rpm "${SOURCE}"
|
|
||||||
echo "Checking SHA512 checksum of signed shim..."
|
|
||||||
sha512sum -c <<< "${EXPECTED_SHA512} shim.rpm"
|
|
||||||
rpm2cpio shim.rpm | cpio -idmv
|
|
||||||
echo "${TMPDIR}"
|
|
||||||
|
|
||||||
popd
|
|
||||||
|
|
||||||
MOUNTPOINT=$(mktemp -d)
|
|
||||||
sectoroffset=$(sfdisk -J "${1}" | jq -r '.partitiontable.partitions[0].start')
|
|
||||||
byteoffset=$((sectoroffset * 512))
|
|
||||||
mount -o offset="${byteoffset}" "${1}" "${MOUNTPOINT}"
|
|
||||||
|
|
||||||
mkdir -p "${MOUNTPOINT}/EFI/BOOT/"
|
|
||||||
cp "${TMPDIR}/boot/efi/EFI/BOOT/BOOTX64.EFI" "${MOUNTPOINT}/EFI/BOOT/"
|
|
||||||
cp "${TMPDIR}/boot/efi/EFI/fedora/mmx64.efi" "${MOUNTPOINT}/EFI/BOOT/"
|
|
||||||
cp "${MOUNTPOINT}/EFI/systemd/systemd-bootx64.efi" "${MOUNTPOINT}/EFI/BOOT/grubx64.efi"
|
|
||||||
|
|
||||||
# Remove unused kernel and initramfs from EFI to save space
|
|
||||||
# We boot from unified kernel image anyway
|
|
||||||
rm -f "${MOUNTPOINT}"/*/*/{linux,initrd}
|
|
||||||
|
|
||||||
umount "${MOUNTPOINT}"
|
|
||||||
rm -rf "${MOUNTPOINT}"
|
|
||||||
rm -rf "${TMPDIR}"
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Development KEK CA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Development UEFI CA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Development PCA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation KEK CA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation UEFI CA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Production PCA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Testing KEK CA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Testing UEFI CA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
req_extensions = v3_req
|
|
||||||
prompt = no
|
|
||||||
|
|
||||||
dirstring_type = nobmp
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
C = DE
|
|
||||||
ST = Nordrhein Westfalen
|
|
||||||
L = Bochum
|
|
||||||
O = Edgeless Systems GmbH
|
|
||||||
CN = Constellation Testing PCA 2022
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
subjectKeyIdentifier = hash
|
|
||||||
basicConstraints = critical,CA:true
|
|
||||||
keyUsage = digitalSignature,keyCertSign,cRLSign
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue