sig_cloud/diskimage-builder
11
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
diskimage-builder/elements/ironic-agent
History
Ian Wienand 672705831f Add a best-effort sudo safety check 
As motivation for this; we have had two breakouts of dib in recent
memory.  One was a failure to unmount through symlinks in the core
code (I335316019ef948758392b03e91f9869102a472b9) and the other was
removing host keys on the build-system
(Ib01d71ff9415a0ae04d963f6e380aab9ac2260ce).

For the most part, dib runs unprivileged.  Bits of the core code are
hopefully well tested (modulo bugs like the first one!).  We give free
reign inside the chroot (although there is still some potential there
for adverse external affects via bind mounts).  Where we could be a
bit safer (and could have prevented at least the second of these
breakouts) is with some better checking that the "sudo" calls
*outside* the chroot at least looked sane.

This adds a basic check that we're using chroot or image paths when
calling sudo in those parts of elements that run *outside* the chroot.
Various files are updated to accomodate this check; mostly by just
ignoring it for existing code (I have not audited these calls).

Nobody is pretending this type of checking makes dib magically safe,
or removes the issues with it needing to do things as root during the
build.  But this can help find egregious errors like the key removal.

Change-Id: I161a5aea1d29dcdc7236f70d372c53246ec73749
2016-05-09 15:41:38 +10:00
..
cleanup.d Add a best-effort sudo safety check 2016-05-09 15:41:38 +10:00
environment.d Use ironic-agent for source-repositories 2015-11-22 15:03:31 -05:00
extra-data.d Support to add certificate in ironic-agent 2016-04-14 13:42:36 +00:00
finalise.d Don't remove python3 & grubby in 99-remove-extra-packages 2016-02-16 13:40:01 +11:00
install.d Merge "Support to add certificate in ironic-agent" 2016-04-14 18:30:04 +00:00
post-install.d Merge "ironic-agent postinst fails on systemd with no iptables" 2016-04-04 19:35:42 +00:00
test-elements/build-succeeds-fedora Remove zero length files 2016-01-20 19:08:54 -05:00
element-deps Install IPA in a virtual environment 2016-02-16 11:17:12 +00:00
element-provides Add element for building ramdisk with ironic-python-agent 2014-11-13 19:30:44 +02:00
package-installs.yaml Add psmisc to the packages for ironic-agent 2016-03-21 00:01:57 -07:00
pkg-map Install ironic-agent dependencies via package-installs 2015-09-21 13:10:30 +02:00
README.rst Support to add certificate in ironic-agent 2016-04-14 13:42:36 +00:00
source-repository-ironic-agent Install IPA in a virtual environment 2016-02-16 11:17:12 +00:00
svc-map [ironic-agent] Use svc-map for enabling agent 2015-09-01 07:12:52 -04:00

README.rst 

============
ironic-agent
============
Builds a ramdisk with ironic-python-agent.  More information can be found at:
    https://git.openstack.org/cgit/openstack/ironic-python-agent/

Beyond installing the ironic-python-agent, this element does the following:

* Installs the ``dhcp-all-interfaces`` so the node, upon booting, attempts to
  obtain an IP address on all available network interfaces.
* Disables the ``iptables`` service on SysV and systemd based systems.
* Disables the ``ufw`` service on Upstart based systems.
* Installs packages required for the operation of the ironic-python-agent::
    ``qemu-utils`` ``parted`` ``hdparm`` ``util-linux`` ``genisoimage``
* When installing from source, ``python-dev`` and ``gcc`` are also installed
  in order to support source based installation of ironic-python-agent and its
  dependencies.
* Install the certificate if any, which is set to the environment variable
  ``DIB_IPA_CERT`` for validating the authenticity by ironic-python-agent. The
  certificate can be self-signed certificate or CA certificate.

This element outputs three files:

- ``$IMAGE-NAME.initramfs``: The deploy ramdisk file containing the
  ironic-python-agent (IPA) service.
- ``$IMAGE-NAME.kernel``: The kernel binary file.
- ``$IMAGE-NAME.vmlinuz``: A hard link pointing to the ``$IMAGE-NAME.kernel``
  file; this is just a backward compatibility layer, please do not rely
  on this file.

.. note::
   The package based install currently only enables the service when using the
   systemd init system. This can easily be changed if there is an agent
   package which includes upstart or sysv packaging.

.. note::
   Using the ramdisk will require at least 1.5GB of ram