History

Ian Wienand 672705831f Add a best-effort sudo safety check As motivation for this; we have had two breakouts of dib in recent memory. One was a failure to unmount through symlinks in the core code (I335316019ef948758392b03e91f9869102a472b9) and the other was removing host keys on the build-system (Ib01d71ff9415a0ae04d963f6e380aab9ac2260ce). For the most part, dib runs unprivileged. Bits of the core code are hopefully well tested (modulo bugs like the first one!). We give free reign inside the chroot (although there is still some potential there for adverse external affects via bind mounts). Where we could be a bit safer (and could have prevented at least the second of these breakouts) is with some better checking that the "sudo" calls outside the chroot at least looked sane. This adds a basic check that we're using chroot or image paths when calling sudo in those parts of elements that run outside the chroot. Various files are updated to accomodate this check; mostly by just ignoring it for existing code (I have not audited these calls). Nobody is pretending this type of checking makes dib magically safe, or removes the issues with it needing to do things as root during the build. But this can help find egregious errors like the key removal. Change-Id: I161a5aea1d29dcdc7236f70d372c53246ec73749		2016-05-09 15:41:38 +10:00
..
cleanup.d	Add a best-effort sudo safety check	2016-05-09 15:41:38 +10:00
post-install.d	Adds debian support to iso element	2015-09-23 23:55:18 -07:00
README.rst	Adds debian support to iso element	2015-09-23 23:55:18 -07:00
element-deps	Add grub2 element	2015-06-02 05:35:03 +00:00
package-installs.yaml	Adds debian support to iso element	2015-09-23 23:55:18 -07:00
pkg-map	Adds debian support to iso element	2015-09-23 23:55:18 -07:00

README.rst

iso

Generates a bootable ISO image from the kernel/ramdisk generated by the elements baremetal, ironic-agent or ramdisk. It uses isolinux to boot on BIOS machines and grub to boot on EFI machines.

This element has been tested on the following distro(s): * ubuntu * fedora * debian

NOTE: For other distros, please make sure the isolinux.bin file exists at /usr/lib/syslinux/isolinux.bin.

baremetal element

When used with baremetal element, this generates a bootable ISO image named <image-name>-boot.iso booting the generated kernel and ramdisk. It also automatically appends kernel command-line argument 'root=UUID=<uuid-of-the-root-partition>'. Any more kernel command-line arguments required may be provided by specifying them in DIB_BOOT_ISO_KERNEL_CMDLINE_ARGS.

NOTE: It uses pre-built efiboot.img by default to work for UEFI machines. This is because of a bug in latest version of grub[1]. The user may choose to avoid using pre-built binary and build efiboot.img on their own machine by setting the environment variable DIB_UEFI_ISO_BUILD_EFIBOOT to 1 (this might work only on certain versions of grub). The current efiboot.img was generated by the method build_efiboot_img() in 100-build-iso on Ubuntu 13.10 with grub 2.00-19ubuntu2.1.

ramdisk element

When used with ramdisk element, this generates a bootable ISO image named <image-name>.iso booting the generated kernel and ramdisk. It also automatically appends kernel command-line argument 'boot_method=vmedia' which is required for Ironic drivers iscsi_ilo.

ironic-agent element

When used with ironic-agent element, this generates a bootable ISO image named <image-name>.iso which boots the agent kernel and agent ramdisk.

REFERENCES

[1] https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1378658