diskimage-builder/elements/iso
Shivanand Tendulker f0315b4ed4 Fix to load only signed kernel in UEFI secure boot
This fix prevents loading of unsigned ubuntu kernel in UEFI secure
boot environment when image is created using 'iso' element.

'iso' element uses 'linux' and 'initrd' modules of grub2 to load
kernel and initrd respectively. The grub2 implementation of Ubuntu
can load unsigned kernel when these modules are used.

Ubuntu has Grub2 modules 'linuxefi' and 'initrdefi' which exits
boot process if unsigned kernel is used in UEFI secure boot mode.
The 'iso' element should use these modules in grub.cfg to prevent
loading of unsigned kernel when node is booted in the UEFI secure
boot environment.

'linuxefi' and 'initrdefi' works seamlessly when node is booted in
normal UEFI boot mode (non-secure).

Fedora do not have this issue. This fix has been tested in Fedora
environment. It works fine.

Closes-Bug: 1443114
Change-Id: If256ba1f7d7c149482d0f37fabcdfa8ed22e3f91
2015-04-13 13:20:12 +00:00
..
cleanup.d Fix to load only signed kernel in UEFI secure boot 2015-04-13 13:20:12 +00:00
post-install.d UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
element-deps UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
package-installs.yaml UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
pkg-map UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
README.rst Create docs site containing element READMEs 2015-02-10 11:45:35 -08:00

===
iso
===
Generates a bootable ISO image from the kernel/ramdisk generated by the
elements ``baremetal`` or ``ramdisk``. It uses isolinux to boot on BIOS
machines and grub to boot on EFI machines.

This element has been tested on the following distro(s):
* ubuntu
* fedora

**NOTE**: For other distros, please make sure the ``isolinux.bin`` file
exists at ``/usr/lib/syslinux/isolinux.bin``.

baremetal element
-----------------
When used with ``baremetal`` element, this generates a bootable ISO image
named ``<image-name>-boot.iso`` booting the generated kernel and ramdisk.
It also automatically appends kernel command-line argument
'root=UUID=<uuid-of-the-root-partition>'.  Any more kernel command-line
arguments required may be provided by specifying them in
``DIB_BOOT_ISO_KERNEL_CMDLINE_ARGS``.

**NOTE**: It uses pre-built efiboot.img by default to work for UEFI machines.
This is because of a bug in latest version of grub[1].  The user may choose
to avoid using pre-built binary and build efiboot.img on their own machine
by setting the environment variable DIB\_UEFI\_ISO\_BUILD\_EFIBOOT to 1 (this
might work only on certain versions of grub). The current efiboot.img was
generated by the method build\_efiboot\_img() in 100-build-iso on
Ubuntu 13.10 with grub 2.00-19ubuntu2.1.

ramdisk element
---------------
When used with ``ramdisk`` element, this generates a bootable ISO image
named ``<image-name>.iso`` booting the generated kernel and ramdisk. It also
automatically appends kernel command-line argument 'boot\_method=vmedia'
which is required for Ironic drivers ``iscsi_ilo``.

**REFERENCES**

[1] https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1378658