| Age | Commit message (Collapse) | Author |
|---|
|
With all the latest serial interface changes - and the resulting patching of
the default configuration based on the build flavor - the serial console
was always injected by a helper named write-config-file-value.py, even if the
console_type was set to tty instead of ttyS or ttyAMA.
This was a pending issue in the rolling tests for the PROXMOX flavor. It is
applicable to every other flavor using tty as default console.
|
|
config.boot.default
We do have different default console configurations per flavor used. We will
set the serial console to the default configuration for the flavor once during
ISO image assembly.
|
|
T8047: replace netplugd with vyos-netlinkd
|
|
Fix typos and mistakes in the comments
No functional changes
|
|
|
|
found error
|
|
T8311: move to GNU coreutils when building GLIBC multiarch variable
|
|
Related to commit 39dc9c98c68 ("T8311: fix initramfs hook "dpkg-architecture:
command not found"). Drop dpkg-dev implementation in favour of GNU coreutils.
On x86_64 (aka amd64) both yield the same result:
$ echo $(uname -m)-linux-gnu
x86_64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
x86_64-linux-gnu
On aarch64 (aka arm64) both yield the same result:
$ echo $(uname -m)-linux-gnu
aarch64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
aarch64-linux-gnu
|
|
When building an ISO image the files which are probed for no longer exist.
This means it makes no sense to longer carry an unused hook.
|
|
|
|
|
|
|
|
Apart from pmacctd service, package pmacct also provided nfacctd,
sfacctd and uacctd. Remove mention about them as we've removed pmacct.
|
|
Add support to dynamically assemble cloud-init NoCloud ISO image and attach
it to an existing qcow2 image file.
The config data injected via NoCloud is later validated if it has been properly
configured on the OS level.
|
|
|
|
kea: T7281: Update Kea to 3.0
|
|
|
|
|
|
|
|
T7367: syslog.service links to rsyslog.service - thus disable it, too
|
|
The default syslog implementation should make syslog.service a symlink to
itself, so that this socket activates the right actual syslog service. As
rsyslog service is already disabled - also take care of the linked service.
|
|
to be disabled by default
|
|
Netplug daemon is started last after all interfaces got initialized to
properly monitor them for up/down events.
|
|
|
|
|
|
|
|
T7121: Set up communication vyconfd to vyos-commitd
|
|
that may be generated by postinstall scripts
to prevent accidental use of non-unique keys
baked into images
|
|
|
|
T6989: disable rsyslog service
|
|
|
|
|
|
T6718: use the vyconf daemon for validation of set commands
|
|
|
|
|
|
The shim review board (which is the secure boot base loader) recommends using
ephemeral keys when signing the Linux Kernel. This commit enables the Kernel
build system to generate a one-time ephemeral key that is used to:
* sign all build-in Kernel modules
* sign all other out-of-tree Kernel modules
The key lives in /tmp and is destroyed after the build container exits and is
named: "VyOS build time autogenerated kernel key".
In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it
unable to load any Kernel Module to the image that is NOT signed by the
ephemeral key.
|
|
As the VyOS Linux Kernel will be compiled with CONFIG_MODULE_SIG_FORCE all
driver modules need to be cryptographically signed. This happens during build
of the Kernel and it's 3rd party modules.
Stripping the objects would remove said signature and the system will be unable
to boot b/c of CONFIG_MODULE_SIG_FORCE.
|
|
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux
Kernel and enforces module signing. This results in an additional security
layer where untrusted (unsigned) Kernel modules can no longer be loaded into
the live system.
NOTE: This commit will not work unless signing keys are present. Arbitrary
keys can be generated using instructions found in:
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
|
|
|
|
|
|
suricata: T751: Disable suricata.service by default
|
|
|
|
|
|
T6228: Cleanup of not existing systemd units
|
|
Delete not existing units:
```
06:12:51 Failed to disable unit, unit logd.service does not exist.
06:12:51 Failed to disable unit, unit heartbeat.service does not exist.
```
|
|
The builder log:
```
06:12:53 Failed to disable unit, unit vpp.service does not exist.
```
|
|
With libpam-systemd >= 230-2, ssh-session-cleanup.service is no longer
necessary because when `UsePAM yes` in `/etc/ssh/sshd_config` (which is
the default), SSH sessions are cleaned up automatically when ssh-server
is shutdown or the system is rebooted.
|
|
dhcp: T3316: Disable Kea services
|
|
|
|
|
