summaryrefslogtreecommitdiff
path: root/elements
diff options
context:
space:
mode:
Diffstat (limited to 'elements')
-rw-r--r--elements/overcloud-secure-uefi/README.rst17
-rw-r--r--elements/overcloud-secure-uefi/block-device-default.yaml103
-rw-r--r--elements/overcloud-secure-uefi/element-deps2
-rw-r--r--elements/overcloud-secure-uefi/package-installs.yaml4
4 files changed, 126 insertions, 0 deletions
diff --git a/elements/overcloud-secure-uefi/README.rst b/elements/overcloud-secure-uefi/README.rst
new file mode 100644
index 0000000..df3f613
--- /dev/null
+++ b/elements/overcloud-secure-uefi/README.rst
@@ -0,0 +1,17 @@
1overcloud-secure-uefi
2=====================
3
4CAUTION: This element is part of the security hardened images feature, that
5is delivered in this release as tech preview. The following element is not
6intended for production usage.
7
8overcloud-secure-uefi is an element to add extra security hardening features to
9the tripleo images: partition creation and unsafe package uninstall. This
10element is the equivalent of overcloud-secure one, but is used when needed to
11build images that are capable of booting from uefi.
12
13It includes the block-device-default definition, that creates independent
14partitions on the overcloud image, allowing those to accomplish the ANSSI
15security requirements. Please note that the sizes of the partitions may not
16be enough for production usage, they will need to be resized properly after
17deployment depending on the available disk size.
diff --git a/elements/overcloud-secure-uefi/block-device-default.yaml b/elements/overcloud-secure-uefi/block-device-default.yaml
new file mode 100644
index 0000000..abaa964
--- /dev/null
+++ b/elements/overcloud-secure-uefi/block-device-default.yaml
@@ -0,0 +1,103 @@
1- local_loop:
2 name: image0
3- partitioning:
4 base: image0
5 label: gpt
6 partitions:
7 - name: ESP
8 type: 'EF00'
9 size: 8MiB
10 mkfs:
11 type: vfat
12 mount:
13 mount_point: /boot/efi
14 fstab:
15 options: "defaults"
16 fsck-passno: 1
17 - name: BSP
18 type: 'EF02'
19 size: 8MiB
20 - name: root
21 flags: [ boot ]
22 size: 23G
23- lvm:
24 name: lvm
25 base: [ root ]
26 pvs:
27 - name: pv
28 base: root
29 options: [ "--force" ]
30 vgs:
31 - name: vg
32 base: [ "pv" ]
33 options: [ "--force" ]
34 lvs:
35 - name: lv_root
36 base: vg
37 extents: 28%VG
38 - name: lv_tmp
39 base: vg
40 extents: 4%VG
41 - name: lv_var
42 base: vg
43 extents: 40%VG
44 - name: lv_log
45 base: vg
46 extents: 23%VG
47 - name: lv_audit
48 base: vg
49 extents: 4%VG
50 - name: lv_home
51 base: vg
52 extents: 1%VG
53- mkfs:
54 name: fs_root
55 base: lv_root
56 type: xfs
57 label: "img-rootfs"
58 mount:
59 mount_point: /
60 fstab:
61 options: "rw,relatime"
62 fck-passno: 1
63- mkfs:
64 name: fs_tmp
65 base: lv_tmp
66 type: xfs
67 mount:
68 mount_point: /tmp
69 fstab:
70 options: "rw,nosuid,nodev,noexec,relatime"
71- mkfs:
72 name: fs_var
73 base: lv_var
74 type: xfs
75 mount:
76 mount_point: /var
77 fstab:
78 options: "rw,relatime"
79- mkfs:
80 name: fs_log
81 base: lv_log
82 type: xfs
83 mount:
84 mount_point: /var/log
85 fstab:
86 options: "rw,relatime"
87- mkfs:
88 name: fs_audit
89 base: lv_audit
90 type: xfs
91 mount:
92 mount_point: /var/log/audit
93 fstab:
94 options: "rw,relatime"
95- mkfs:
96 name: fs_home
97 base: lv_home
98 type: xfs
99 mount:
100 mount_point: /home
101 fstab:
102 options: "rw,nodev,relatime"
103
diff --git a/elements/overcloud-secure-uefi/element-deps b/elements/overcloud-secure-uefi/element-deps
new file mode 100644
index 0000000..2f1ab12
--- /dev/null
+++ b/elements/overcloud-secure-uefi/element-deps
@@ -0,0 +1,2 @@
1block-device-efi
2package-installs
diff --git a/elements/overcloud-secure-uefi/package-installs.yaml b/elements/overcloud-secure-uefi/package-installs.yaml
new file mode 100644
index 0000000..219e4be
--- /dev/null
+++ b/elements/overcloud-secure-uefi/package-installs.yaml
@@ -0,0 +1,4 @@
1kexec-tools:
2 uninstall: True
3telnet:
4 uninstall: True