summaryrefslogtreecommitdiff
path: root/data/live-build-config/hooks/live
AgeCommit message (Collapse)Author
2024-09-25T861: sign all Kernel modules with an ephemeral keyChristian Breunig
The shim review board (which is the secure boot base loader) recommends using ephemeral keys when signing the Linux Kernel. This commit enables the Kernel build system to generate a one-time ephemeral key that is used to: * sign all build-in Kernel modules * sign all other out-of-tree Kernel modules The key lives in /tmp and is destroyed after the build container exits and is named: "VyOS build time autogenerated kernel key". In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it unable to load any Kernel Module to the image that is NOT signed by the ephemeral key.
2024-09-22T861: stripping Kernel modules would also remove module signaturesChristian Breunig
As the VyOS Linux Kernel will be compiled with CONFIG_MODULE_SIG_FORCE all driver modules need to be cryptographically signed. This happens during build of the Kernel and it's 3rd party modules. Stripping the objects would remove said signature and the system will be unable to boot b/c of CONFIG_MODULE_SIG_FORCE.
2024-09-14T861: add UEFI Secure Boot supportChristian Breunig
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux Kernel and enforces module signing. This results in an additional security layer where untrusted (unsigned) Kernel modules can no longer be loaded into the live system. NOTE: This commit will not work unless signing keys are present. Arbitrary keys can be generated using instructions found in: data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
2024-07-23podman: T6598: add custom podman build for version 4.9.5Christian Breunig
2024-05-16hooks: T6346: set default boot target to multi-user.targetChristian Breunig
2024-05-14Merge pull request #582 from 0xThiebaut/suricataChristian Breunig
suricata: T751: Disable suricata.service by default
2024-05-14T3420: Remove service upnpViacheslav Hletenko
2024-05-03suricata: T751: Disable suricata.service by defaultMaxime THIEBAUT
2024-04-11Merge pull request #556 from sever-sever/T6228Christian Breunig
T6228: Cleanup of not existing systemd units
2024-04-11T6228: Cleanup of not existing systemd unitsViacheslav Hletenko
Delete not existing units: ``` 06:12:51 Failed to disable unit, unit logd.service does not exist. 06:12:51 Failed to disable unit, unit heartbeat.service does not exist. ```
2024-04-11T1797: Delete not exist disable vpp serviceViacheslav Hletenko
The builder log: ``` 06:12:53 Failed to disable unit, unit vpp.service does not exist. ```
2023-12-20ssh: T5841: Remove ssh-session-cleanup.serviceIndrajit Raychaudhuri
With libpam-systemd >= 230-2, ssh-session-cleanup.service is no longer necessary because when `UsePAM yes` in `/etc/ssh/sshd_config` (which is the default), SSH sessions are cleaned up automatically when ssh-server is shutdown or the system is rebooted.
2023-12-09Merge pull request #336 from sarthurdev/keaChristian Breunig
dhcp: T3316: Disable Kea services
2023-12-03T4426: disable arpwatch.service by defaultChristian Breunig
2023-11-15image: T4516: enable vyos-grub-update serviceJohn Estabrook
2023-10-05dhcp: T3316: Disable Kea servicessarthurdev
2023-10-04T5589: Nonstripped binaries exists in VyOSApachez
2023-09-26T5589: Nonstripped binaries exists in VyOSApachez
2023-09-26T5589: Nonstripped binaries exists in VyOSApachez
2023-09-16T5511: drop empty hooksChristian Breunig
This is a roundup commit to 0be277647 ("T5511: Cleanup of unused directories (and files) in order to shrink image-size") that dropy empty/commented out live-build hook scripts.
2023-09-16T5511: Cleanup of unused directories (and files) in order to shrink image-sizeApachez
2023-09-14live: T5568: Add serial boot option to live ISOsarthurdev
2023-09-11frr: T5239: remove daemons.conf generated by chroot hookChristian Breunig
Daemon configuration is now generated during boot via vyos-1x repo. See https://github.com/vyos/vyos-1x/pull/2245
2023-09-01frr: T5518: enable pim6dChristian Breunig
2023-08-30T5524: Add config directory for livecdViacheslav Hletenko
Add the '/config' directory for live image boot One of the reasons the DHCP-server uses lease from this directory T2958
2023-08-27T5511: Cleanup of unused directories (and files) in order to shrink image-sizeApachez
2023-08-24T5468: Remove unused manpages to free up spaceApachez
2023-08-08T5448: Disable zabbix-agent service by defaultViacheslav Hletenko
2023-08-06systemd: T5003: sendmail.service no longer existsChristian Breunig
2023-08-05systemd: T5003: cleanup timersChristian Breunig
2023-08-04frr: T5415: make mgmtd only listen on localhostChristian Breunig
2023-07-15T3355: enable vyos-router.serviceChristian Breunig
2023-06-27T1797: Disable vpp.serviceViacheslav Hletenko
2023-06-08T5003: disable non required GPG user servicesChristian Breunig
2023-06-08T5239: disable FRR service - will by started in order by VyOS startupChristian Breunig
2023-05-21T5003: disable sendmail serviceChristian Breunig
2023-05-17T5208: disable nvmf-autoconnect.serviceChristian Breunig
2023-05-05T5203: Disable by default vyos-wan-load-balance.serviceViacheslav Hletenko
2023-04-11Revert "systemd: services: remove autostart of sendmail and rsyslogd"Christian Breunig
This reverts commit 0b91d71b9cd7e9641287433ea0d0fed3982edb23. Somehow FRR does not like it to be started with no logging daemon present and Smoketests fail.
2023-04-08systemd: services: remove autostart of sendmail and rsyslogdChristian Breunig
2023-04-04T5142: systemd-journald-audit must not show logs from auditdViacheslav Hletenko
auditd logs must no be displayed for journalctl mask it
2023-03-14T5086: Disable by default hsflowd serviceViacheslav Hletenko
2023-03-11systemd: services: T5003: disable podman servicesChristian Breunig
2023-03-07T4977: Enable BabeldYuxiang Zhu
Babeld support has been merged https://github.com/vyos/vyos-1x/pull/1800 however I just noticed `/etc/frr/daemons` came from this file.
2023-02-15Merge pull request #306 from sarthurdev/bookwormChristian Breunig
debian: T5003: Upgrade base system to Debian 12 "Bookworm"
2023-02-14strongSwan: T4593: move to charon-systemdChristian Breunig
2023-02-13debian: T5003: Disable `strongswan.service` provided by charon_systemdsarthurdev
2023-01-31Revert "Resolve resource deadlock for udev iface shuffle"Christian Poessinger
This reverts commit 8e6d765be123be9d937970ee96b7d6d0b5053ed5. This breaks existing configurations: https://forum.vyos.io/t/yesterday-and-todays-build-causes-network-interface-getting-corrupted-vyos-1-4-rolling-202301280924-amd64-iso
2023-01-29Resolve resource deadlock for udev iface shuffleRageLtMan
UDEV contains a default rule triggered early-on which renames all NICs by their index to eX, systemd-udevd subsequently renames the eX interface to ethX. Systemd-udevd can fail to rename the iface if it still has resource locks from the prior renaming which then fails to apply all manner of configurations resulting in a booted zombie which cannot handle L3 traffic. Fix the concern by removing 62-temporary-interface-rename.rules from /etc/udev/rules.d during the cleanup hook executed in data/live-build-config/hooks/live/82-cleanup-udev-rules.chroot. Testing: Boot-tested in OpenStack under identical infrastructure-as-code states. Verified DHCP-assigned routes, execution of cloud-init, and configuration stanzas injected through cloud-init applied to the FW and system.
2023-01-14ntp: T3008: move from ntpd to chronyChristian Breunig
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-05 21:01:44 +0000