Class | BoxGrinder::EC2Plugin |
In: |
lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb
lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb |
Parent: | BasePlugin |
Adds ec2-user will full sudo access without password per Fedora security guidelines. We should not use root access on AMIs as it is not secure and prohibited by AWS.
issues.jboss.org/browse/BGBUILD-110
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 159 159: def add_ec2_user(guestfs) 160: @log.debug "Adding ec2-user user..." 161: 162: # We need to add ec2-user only when it doesn't exists 163: # 164: # https://issues.jboss.org/browse/BGBUILD-313 165: unless guestfs.fgrep("ec2-user", "/etc/passwd").empty? 166: @log.debug("ec2-user already exists, skipping.") 167: return 168: end 169: 170: guestfs.sh("useradd ec2-user") 171: guestfs.sh("echo -e 'ec2-user\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers") 172: 173: @log.debug "User ec2-user added." 174: end
Adds ec2-user will full sudo access without password per Fedora security guidelines. We should not use root access on AMIs as it is not secure and prohibited by AWS.
issues.jboss.org/browse/BGBUILD-110
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 159 159: def add_ec2_user(guestfs) 160: @log.debug "Adding ec2-user user..." 161: 162: # We need to add ec2-user only when it doesn't exists 163: # 164: # https://issues.jboss.org/browse/BGBUILD-313 165: unless guestfs.fgrep("ec2-user", "/etc/passwd").empty? 166: @log.debug("ec2-user already exists, skipping.") 167: return 168: end 169: 170: guestfs.sh("useradd ec2-user") 171: guestfs.sh("echo -e 'ec2-user\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers") 172: 173: @log.debug "User ec2-user added." 174: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 27 27: def after_init 28: register_deliverable(:disk => "#{@appliance_config.name}.ec2") 29: 30: register_supported_os('fedora', ['13', '14', '15', '16', '17']) 31: register_supported_os('centos', ['5', '6']) 32: register_supported_os('sl', ['5', '6']) 33: register_supported_os('rhel', ['5', '6']) 34: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 27 27: def after_init 28: register_deliverable(:disk => "#{@appliance_config.name}.ec2") 29: 30: register_supported_os('fedora', ['13', '14', '15', '16', '17']) 31: register_supported_os('centos', ['5', '6']) 32: register_supported_os('sl', ['5', '6']) 33: register_supported_os('rhel', ['5', '6']) 34: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 217 217: def change_configuration(guestfs_helper) 218: guestfs_helper.augeas do 219: # disable password authentication 220: set("/etc/ssh/sshd_config", "PasswordAuthentication", "no") 221: 222: # disable root login 223: set("/etc/ssh/sshd_config", "PermitRootLogin", "no") 224: end 225: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 217 217: def change_configuration(guestfs_helper) 218: guestfs_helper.augeas do 219: # disable password authentication 220: set("/etc/ssh/sshd_config", "PasswordAuthentication", "no") 221: 222: # disable root login 223: set("/etc/ssh/sshd_config", "PermitRootLogin", "no") 224: end 225: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 90 90: def create_devices(guestfs) 91: return if guestfs.exists('/sbin/MAKEDEV') == 0 92: 93: @log.debug "Creating required devices..." 94: guestfs.sh("/sbin/MAKEDEV -d /dev -x console") 95: guestfs.sh("/sbin/MAKEDEV -d /dev -x null") 96: guestfs.sh("/sbin/MAKEDEV -d /dev -x zero") 97: @log.debug "Devices created." 98: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 90 90: def create_devices(guestfs) 91: return if guestfs.exists('/sbin/MAKEDEV') == 0 92: 93: @log.debug "Creating required devices..." 94: guestfs.sh("/sbin/MAKEDEV -d /dev -x console") 95: guestfs.sh("/sbin/MAKEDEV -d /dev -x null") 96: guestfs.sh("/sbin/MAKEDEV -d /dev -x zero") 97: @log.debug "Devices created." 98: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 100 100: def disk_device_prefix 101: disk = 'xv' 102: disk = 's' if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5' 103: 104: disk 105: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 100 100: def disk_device_prefix 101: disk = 'xv' 102: disk = 's' if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5' 103: 104: disk 105: end
enable networking on default runlevels
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 177 177: def enable_networking(guestfs) 178: @log.debug "Enabling networking..." 179: guestfs.sh("/sbin/chkconfig network on") 180: guestfs.upload("#{File.dirname(__FILE__)}/src/ifcfg-eth0", "/etc/sysconfig/network-scripts/ifcfg-eth0") 181: @log.debug "Networking enabled." 182: end
enable networking on default runlevels
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 177 177: def enable_networking(guestfs) 178: @log.debug "Enabling networking..." 179: guestfs.sh("/sbin/chkconfig network on") 180: guestfs.upload("#{File.dirname(__FILE__)}/src/ifcfg-eth0", "/etc/sysconfig/network-scripts/ifcfg-eth0") 181: @log.debug "Networking enabled." 182: end
This fixes issues with Fedora 14 on EC2: bugzilla.redhat.com/show_bug.cgi?id=651861#c39
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 148 148: def enable_nosegneg_flag(guestfs) 149: @log.debug "Enabling nosegneg flag..." 150: guestfs.sh("echo \"hwcap 1 nosegneg\" > /etc/ld.so.conf.d/libc6-xen.conf") 151: guestfs.sh("/sbin/ldconfig") 152: @log.debug "Nosegneg enabled." 153: end
This fixes issues with Fedora 14 on EC2: bugzilla.redhat.com/show_bug.cgi?id=651861#c39
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 148 148: def enable_nosegneg_flag(guestfs) 149: @log.debug "Enabling nosegneg flag..." 150: guestfs.sh("echo \"hwcap 1 nosegneg\" > /etc/ld.so.conf.d/libc6-xen.conf") 151: guestfs.sh("/sbin/ldconfig") 152: @log.debug "Nosegneg enabled." 153: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 36 36: def execute 37: @linux_helper = LinuxHelper.new(:log => @log) 38: 39: @log.info "Converting #{@appliance_config.name} appliance image to EC2 format..." 40: 41: @image_helper.create_disk(@deliverables.disk, 10) # 10 GB destination disk 42: 43: @image_helper.customize([@previous_deliverables.disk, @deliverables.disk], :automount => false) do |guestfs, guestfs_helper| 44: @image_helper.sync_filesystem(guestfs, guestfs_helper) 45: 46: # TODO is this really needed? 47: @log.debug "Uploading '/etc/resolv.conf'..." 48: guestfs.upload("/etc/resolv.conf", "/etc/resolv.conf") 49: @log.debug "'/etc/resolv.conf' uploaded." 50: 51: if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5' 52: # Remove normal kernel 53: guestfs.sh("yum -y remove kernel") 54: # because we need to install kernel-xen package 55: guestfs_helper.sh("yum -y install kernel-xen", :arch => @appliance_config.hardware.arch) 56: # and add require modules 57: @linux_helper.recreate_kernel_image(guestfs, ['xenblk', 'xennet']) 58: end 59: 60: create_devices(guestfs) 61: 62: guestfs.mkdir("/data") if @appliance_config.is64bit? 63: 64: upload_fstab(guestfs) 65: enable_networking(guestfs) 66: upload_rc_local(guestfs) 67: add_ec2_user(guestfs) 68: change_configuration(guestfs_helper) 69: install_menu_lst(guestfs) 70: 71: enable_nosegneg_flag(guestfs) if @appliance_config.os.name == 'fedora' 72: 73: execute_post(guestfs_helper) 74: end 75: 76: @log.info "Image converted to EC2 format." 77: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 36 36: def execute 37: @linux_helper = LinuxHelper.new(:log => @log) 38: 39: @log.info "Converting #{@appliance_config.name} appliance image to EC2 format..." 40: 41: @image_helper.create_disk(@deliverables.disk, 10) # 10 GB destination disk 42: 43: @image_helper.customize([@previous_deliverables.disk, @deliverables.disk], :automount => false) do |guestfs, guestfs_helper| 44: @image_helper.sync_filesystem(guestfs, guestfs_helper) 45: 46: # TODO is this really needed? 47: @log.debug "Uploading '/etc/resolv.conf'..." 48: guestfs.upload("/etc/resolv.conf", "/etc/resolv.conf") 49: @log.debug "'/etc/resolv.conf' uploaded." 50: 51: if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5' 52: # Remove normal kernel 53: guestfs.sh("yum -y remove kernel") 54: # because we need to install kernel-xen package 55: guestfs_helper.sh("yum -y install kernel-xen", :arch => @appliance_config.hardware.arch) 56: # and add require modules 57: @linux_helper.recreate_kernel_image(guestfs, ['xenblk', 'xennet']) 58: end 59: 60: create_devices(guestfs) 61: 62: guestfs.mkdir("/data") if @appliance_config.is64bit? 63: 64: upload_fstab(guestfs) 65: enable_networking(guestfs) 66: upload_rc_local(guestfs) 67: add_ec2_user(guestfs) 68: change_configuration(guestfs_helper) 69: install_menu_lst(guestfs) 70: 71: enable_nosegneg_flag(guestfs) if @appliance_config.os.name == 'fedora' 72: 73: execute_post(guestfs_helper) 74: end 75: 76: @log.info "Image converted to EC2 format." 77: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 79 79: def execute_post(guestfs_helper) 80: unless @appliance_config.post['ec2'].nil? 81: @appliance_config.post['ec2'].each do |cmd| 82: guestfs_helper.sh(cmd, :arch => @appliance_config.hardware.arch) 83: end 84: @log.debug "Post commands from appliance definition file executed." 85: else 86: @log.debug "No commands specified, skipping." 87: end 88: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 79 79: def execute_post(guestfs_helper) 80: unless @appliance_config.post['ec2'].nil? 81: @appliance_config.post['ec2'].each do |cmd| 82: guestfs_helper.sh(cmd, :arch => @appliance_config.hardware.arch) 83: end 84: @log.debug "Post commands from appliance definition file executed." 85: else 86: @log.debug "No commands specified, skipping." 87: end 88: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 127 127: def install_menu_lst(guestfs) 128: @log.debug "Uploading '/boot/grub/menu.lst' file..." 129: menu_lst_data = File.open("#{File.dirname(__FILE__)}/src/menu.lst").read 130: 131: menu_lst_data.gsub!(/#TITLE#/, @appliance_config.name) 132: menu_lst_data.gsub!(/#KERNEL_VERSION#/, @linux_helper.kernel_version(guestfs)) 133: menu_lst_data.gsub!(/#KERNEL_IMAGE_NAME#/, @linux_helper.kernel_image_name(guestfs)) 134: 135: menu_lst = Tempfile.new('menu_lst') 136: menu_lst << menu_lst_data 137: menu_lst.flush 138: 139: menu_d = '/boot/grub' 140: guestfs.mkdir_p(menu_d) if guestfs.exists(menu_d) == 0 141: guestfs.upload(menu_lst.path, '/boot/grub/menu.lst') 142: 143: menu_lst.close 144: @log.debug "'/boot/grub/menu.lst' file uploaded." 145: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 127 127: def install_menu_lst(guestfs) 128: @log.debug "Uploading '/boot/grub/menu.lst' file..." 129: menu_lst_data = File.open("#{File.dirname(__FILE__)}/src/menu.lst").read 130: 131: menu_lst_data.gsub!(/#TITLE#/, @appliance_config.name) 132: menu_lst_data.gsub!(/#KERNEL_VERSION#/, @linux_helper.kernel_version(guestfs)) 133: menu_lst_data.gsub!(/#KERNEL_IMAGE_NAME#/, @linux_helper.kernel_image_name(guestfs)) 134: 135: menu_lst = Tempfile.new('menu_lst') 136: menu_lst << menu_lst_data 137: menu_lst.flush 138: 139: menu_d = '/boot/grub' 140: guestfs.mkdir_p(menu_d) if guestfs.exists(menu_d) == 0 141: guestfs.upload(menu_lst.path, '/boot/grub/menu.lst') 142: 143: menu_lst.close 144: @log.debug "'/boot/grub/menu.lst' file uploaded." 145: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 107 107: def upload_fstab(guestfs) 108: @log.debug "Uploading '/etc/fstab' file..." 109: 110: fstab_file = @appliance_config.is64bit? ? "#{File.dirname(__FILE__)}/src/fstab_64bit" : "#{File.dirname(__FILE__)}/src/fstab_32bit" 111: 112: fstab_data = File.open(fstab_file).read 113: fstab_data.gsub!(/#DISK_DEVICE_PREFIX#/, disk_device_prefix) 114: fstab_data.gsub!(/#FILESYSTEM_TYPE#/, @appliance_config.hardware.partitions['/']['type']) 115: 116: fstab = Tempfile.new('fstab') 117: fstab << fstab_data 118: fstab.flush 119: 120: guestfs.upload(fstab.path, "/etc/fstab") 121: 122: fstab.close 123: 124: @log.debug "'/etc/fstab' file uploaded." 125: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 107 107: def upload_fstab(guestfs) 108: @log.debug "Uploading '/etc/fstab' file..." 109: 110: fstab_file = @appliance_config.is64bit? ? "#{File.dirname(__FILE__)}/src/fstab_64bit" : "#{File.dirname(__FILE__)}/src/fstab_32bit" 111: 112: fstab_data = File.open(fstab_file).read 113: fstab_data.gsub!(/#DISK_DEVICE_PREFIX#/, disk_device_prefix) 114: fstab_data.gsub!(/#FILESYSTEM_TYPE#/, @appliance_config.hardware.partitions['/']['type']) 115: 116: fstab = Tempfile.new('fstab') 117: fstab << fstab_data 118: fstab.flush 119: 120: guestfs.upload(fstab.path, "/etc/fstab") 121: 122: fstab.close 123: 124: @log.debug "'/etc/fstab' file uploaded." 125: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 184 184: def upload_rc_local(guestfs) 185: @log.debug "Uploading '/etc/rc.d/rc.local' file..." 186: rc_local = Tempfile.new('rc_local') 187: 188: if guestfs.exists("/etc/rc.d/rc.local") == 1 189: # We're appending 190: rc_local << guestfs.read_file("/etc/rc.d/rc.local") 191: else 192: # We're creating new file 193: rc_local << "#!/bin/bash\n\n" 194: end 195: 196: rc_local << File.read("#{File.dirname(__FILE__)}/src/rc_local") 197: rc_local.flush 198: 199: guestfs.upload(rc_local.path, "/etc/rc.d/rc.local") 200: 201: rc_local.close 202: 203: # Fedora 16 doesn't have /etc/rc.local file and we need to 204: # enable rc.local compatibility with systemd 205: # We need to make sure that network is available when executing rc.local 206: if (@appliance_config.os.name == 'fedora' and @appliance_config.os.version >= '16') 207: guestfs.cp("/lib/systemd/system/rc-local.service", "/etc/systemd/system/") 208: guestfs.sh("sed -i '/^ConditionFileIsExecutable/a After=network.target' /etc/systemd/system/rc-local.service") 209: guestfs.sh("systemctl enable rc-local.service") 210: guestfs.ln_sf("/etc/rc.d/rc.local", "/etc/rc.local") 211: guestfs.chmod(0755, "/etc/rc.d/rc.local") 212: end 213: 214: @log.debug "'/etc/rc.d/rc.local' file uploaded." 215: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 184 184: def upload_rc_local(guestfs) 185: @log.debug "Uploading '/etc/rc.d/rc.local' file..." 186: rc_local = Tempfile.new('rc_local') 187: 188: if guestfs.exists("/etc/rc.d/rc.local") == 1 189: # We're appending 190: rc_local << guestfs.read_file("/etc/rc.d/rc.local") 191: else 192: # We're creating new file 193: rc_local << "#!/bin/bash\n\n" 194: end 195: 196: rc_local << File.read("#{File.dirname(__FILE__)}/src/rc_local") 197: rc_local.flush 198: 199: guestfs.upload(rc_local.path, "/etc/rc.d/rc.local") 200: 201: rc_local.close 202: 203: # Fedora 16 doesn't have /etc/rc.local file and we need to 204: # enable rc.local compatibility with systemd 205: # We need to make sure that network is available when executing rc.local 206: if (@appliance_config.os.name == 'fedora' and @appliance_config.os.version >= '16') 207: guestfs.cp("/lib/systemd/system/rc-local.service", "/etc/systemd/system/") 208: guestfs.sh("sed -i '/^ConditionFileIsExecutable/a After=network.target' /etc/systemd/system/rc-local.service") 209: guestfs.sh("systemctl enable rc-local.service") 210: guestfs.ln_sf("/etc/rc.d/rc.local", "/etc/rc.local") 211: guestfs.chmod(0755, "/etc/rc.d/rc.local") 212: end 213: 214: @log.debug "'/etc/rc.d/rc.local' file uploaded." 215: end