diskimage-builder/elements/iso
Ian Wienand 672705831f Add a best-effort sudo safety check
As motivation for this; we have had two breakouts of dib in recent
memory.  One was a failure to unmount through symlinks in the core
code (I335316019ef948758392b03e91f9869102a472b9) and the other was
removing host keys on the build-system
(Ib01d71ff9415a0ae04d963f6e380aab9ac2260ce).

For the most part, dib runs unprivileged.  Bits of the core code are
hopefully well tested (modulo bugs like the first one!).  We give free
reign inside the chroot (although there is still some potential there
for adverse external affects via bind mounts).  Where we could be a
bit safer (and could have prevented at least the second of these
breakouts) is with some better checking that the "sudo" calls
*outside* the chroot at least looked sane.

This adds a basic check that we're using chroot or image paths when
calling sudo in those parts of elements that run *outside* the chroot.
Various files are updated to accomodate this check; mostly by just
ignoring it for existing code (I have not audited these calls).

Nobody is pretending this type of checking makes dib magically safe,
or removes the issues with it needing to do things as root during the
build.  But this can help find egregious errors like the key removal.

Change-Id: I161a5aea1d29dcdc7236f70d372c53246ec73749
2016-05-09 15:41:38 +10:00
..
cleanup.d Add a best-effort sudo safety check 2016-05-09 15:41:38 +10:00
post-install.d Adds debian support to iso element 2015-09-23 23:55:18 -07:00
element-deps Add grub2 element 2015-06-02 05:35:03 +00:00
package-installs.yaml Adds debian support to iso element 2015-09-23 23:55:18 -07:00
pkg-map Adds debian support to iso element 2015-09-23 23:55:18 -07:00
README.rst Adds debian support to iso element 2015-09-23 23:55:18 -07:00

===
iso
===
Generates a bootable ISO image from the kernel/ramdisk generated by the
elements ``baremetal``, ``ironic-agent`` or ``ramdisk``. It uses isolinux to boot on BIOS
machines and grub to boot on EFI machines.

This element has been tested on the following distro(s):
* ubuntu
* fedora
* debian

**NOTE**: For other distros, please make sure the ``isolinux.bin`` file
exists at ``/usr/lib/syslinux/isolinux.bin``.

baremetal element
-----------------
When used with ``baremetal`` element, this generates a bootable ISO image
named ``<image-name>-boot.iso`` booting the generated kernel and ramdisk.
It also automatically appends kernel command-line argument
'root=UUID=<uuid-of-the-root-partition>'.  Any more kernel command-line
arguments required may be provided by specifying them in
``DIB_BOOT_ISO_KERNEL_CMDLINE_ARGS``.

**NOTE**: It uses pre-built efiboot.img by default to work for UEFI machines.
This is because of a bug in latest version of grub[1].  The user may choose
to avoid using pre-built binary and build efiboot.img on their own machine
by setting the environment variable DIB\_UEFI\_ISO\_BUILD\_EFIBOOT to 1 (this
might work only on certain versions of grub). The current efiboot.img was
generated by the method build\_efiboot\_img() in 100-build-iso on
Ubuntu 13.10 with grub 2.00-19ubuntu2.1.

ramdisk element
---------------
When used with ``ramdisk`` element, this generates a bootable ISO image
named ``<image-name>.iso`` booting the generated kernel and ramdisk. It also
automatically appends kernel command-line argument 'boot\_method=vmedia'
which is required for Ironic drivers ``iscsi_ilo``.

ironic-agent element
--------------------
When used with ``ironic-agent`` element, this generates a bootable ISO image named ``<image-name>.iso`` which boots the agent kernel and agent ramdisk.

**REFERENCES**

[1] https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1378658