| Class | BoxGrinder::EC2Plugin |
| In: |
lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb
lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb |
| Parent: | BasePlugin |
Adds ec2-user will full sudo access without password per Fedora security guidelines. We should not use root access on AMIs as it is not secure and prohibited by AWS.
issues.jboss.org/browse/BGBUILD-110
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 159
159: def add_ec2_user(guestfs)
160: @log.debug "Adding ec2-user user..."
161:
162: # We need to add ec2-user only when it doesn't exists
163: #
164: # https://issues.jboss.org/browse/BGBUILD-313
165: unless guestfs.fgrep("ec2-user", "/etc/passwd").empty?
166: @log.debug("ec2-user already exists, skipping.")
167: return
168: end
169:
170: guestfs.sh("useradd ec2-user")
171: guestfs.sh("echo -e 'ec2-user\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers")
172:
173: @log.debug "User ec2-user added."
174: end
Adds ec2-user will full sudo access without password per Fedora security guidelines. We should not use root access on AMIs as it is not secure and prohibited by AWS.
issues.jboss.org/browse/BGBUILD-110
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 159
159: def add_ec2_user(guestfs)
160: @log.debug "Adding ec2-user user..."
161:
162: # We need to add ec2-user only when it doesn't exists
163: #
164: # https://issues.jboss.org/browse/BGBUILD-313
165: unless guestfs.fgrep("ec2-user", "/etc/passwd").empty?
166: @log.debug("ec2-user already exists, skipping.")
167: return
168: end
169:
170: guestfs.sh("useradd ec2-user")
171: guestfs.sh("echo -e 'ec2-user\tALL=(ALL)\tNOPASSWD: ALL' >> /etc/sudoers")
172:
173: @log.debug "User ec2-user added."
174: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 27
27: def after_init
28: register_deliverable(:disk => "#{@appliance_config.name}.ec2")
29:
30: register_supported_os('fedora', ['13', '14', '15', '16', '17'])
31: register_supported_os('centos', ['5', '6'])
32: register_supported_os('sl', ['5', '6'])
33: register_supported_os('rhel', ['5', '6'])
34: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 27
27: def after_init
28: register_deliverable(:disk => "#{@appliance_config.name}.ec2")
29:
30: register_supported_os('fedora', ['13', '14', '15', '16', '17'])
31: register_supported_os('centos', ['5', '6'])
32: register_supported_os('sl', ['5', '6'])
33: register_supported_os('rhel', ['5', '6'])
34: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 217
217: def change_configuration(guestfs_helper)
218: guestfs_helper.augeas do
219: # disable password authentication
220: set("/etc/ssh/sshd_config", "PasswordAuthentication", "no")
221:
222: # disable root login
223: set("/etc/ssh/sshd_config", "PermitRootLogin", "no")
224: end
225: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 217
217: def change_configuration(guestfs_helper)
218: guestfs_helper.augeas do
219: # disable password authentication
220: set("/etc/ssh/sshd_config", "PasswordAuthentication", "no")
221:
222: # disable root login
223: set("/etc/ssh/sshd_config", "PermitRootLogin", "no")
224: end
225: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 90
90: def create_devices(guestfs)
91: return if guestfs.exists('/sbin/MAKEDEV') == 0
92:
93: @log.debug "Creating required devices..."
94: guestfs.sh("/sbin/MAKEDEV -d /dev -x console")
95: guestfs.sh("/sbin/MAKEDEV -d /dev -x null")
96: guestfs.sh("/sbin/MAKEDEV -d /dev -x zero")
97: @log.debug "Devices created."
98: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 90
90: def create_devices(guestfs)
91: return if guestfs.exists('/sbin/MAKEDEV') == 0
92:
93: @log.debug "Creating required devices..."
94: guestfs.sh("/sbin/MAKEDEV -d /dev -x console")
95: guestfs.sh("/sbin/MAKEDEV -d /dev -x null")
96: guestfs.sh("/sbin/MAKEDEV -d /dev -x zero")
97: @log.debug "Devices created."
98: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 100
100: def disk_device_prefix
101: disk = 'xv'
102: disk = 's' if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5'
103:
104: disk
105: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 100
100: def disk_device_prefix
101: disk = 'xv'
102: disk = 's' if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5'
103:
104: disk
105: end
enable networking on default runlevels
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 177
177: def enable_networking(guestfs)
178: @log.debug "Enabling networking..."
179: guestfs.sh("/sbin/chkconfig network on")
180: guestfs.upload("#{File.dirname(__FILE__)}/src/ifcfg-eth0", "/etc/sysconfig/network-scripts/ifcfg-eth0")
181: @log.debug "Networking enabled."
182: end
enable networking on default runlevels
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 177
177: def enable_networking(guestfs)
178: @log.debug "Enabling networking..."
179: guestfs.sh("/sbin/chkconfig network on")
180: guestfs.upload("#{File.dirname(__FILE__)}/src/ifcfg-eth0", "/etc/sysconfig/network-scripts/ifcfg-eth0")
181: @log.debug "Networking enabled."
182: end
This fixes issues with Fedora 14 on EC2: bugzilla.redhat.com/show_bug.cgi?id=651861#c39
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 148
148: def enable_nosegneg_flag(guestfs)
149: @log.debug "Enabling nosegneg flag..."
150: guestfs.sh("echo \"hwcap 1 nosegneg\" > /etc/ld.so.conf.d/libc6-xen.conf")
151: guestfs.sh("/sbin/ldconfig")
152: @log.debug "Nosegneg enabled."
153: end
This fixes issues with Fedora 14 on EC2: bugzilla.redhat.com/show_bug.cgi?id=651861#c39
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 148
148: def enable_nosegneg_flag(guestfs)
149: @log.debug "Enabling nosegneg flag..."
150: guestfs.sh("echo \"hwcap 1 nosegneg\" > /etc/ld.so.conf.d/libc6-xen.conf")
151: guestfs.sh("/sbin/ldconfig")
152: @log.debug "Nosegneg enabled."
153: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 36
36: def execute
37: @linux_helper = LinuxHelper.new(:log => @log)
38:
39: @log.info "Converting #{@appliance_config.name} appliance image to EC2 format..."
40:
41: @image_helper.create_disk(@deliverables.disk, 10) # 10 GB destination disk
42:
43: @image_helper.customize([@previous_deliverables.disk, @deliverables.disk], :automount => false) do |guestfs, guestfs_helper|
44: @image_helper.sync_filesystem(guestfs, guestfs_helper)
45:
46: # TODO is this really needed?
47: @log.debug "Uploading '/etc/resolv.conf'..."
48: guestfs.upload("/etc/resolv.conf", "/etc/resolv.conf")
49: @log.debug "'/etc/resolv.conf' uploaded."
50:
51: if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5'
52: # Remove normal kernel
53: guestfs.sh("yum -y remove kernel")
54: # because we need to install kernel-xen package
55: guestfs_helper.sh("yum -y install kernel-xen", :arch => @appliance_config.hardware.arch)
56: # and add require modules
57: @linux_helper.recreate_kernel_image(guestfs, ['xenblk', 'xennet'])
58: end
59:
60: create_devices(guestfs)
61:
62: guestfs.mkdir("/data") if @appliance_config.is64bit?
63:
64: upload_fstab(guestfs)
65: enable_networking(guestfs)
66: upload_rc_local(guestfs)
67: add_ec2_user(guestfs)
68: change_configuration(guestfs_helper)
69: install_menu_lst(guestfs)
70:
71: enable_nosegneg_flag(guestfs) if @appliance_config.os.name == 'fedora'
72:
73: execute_post(guestfs_helper)
74: end
75:
76: @log.info "Image converted to EC2 format."
77: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 36
36: def execute
37: @linux_helper = LinuxHelper.new(:log => @log)
38:
39: @log.info "Converting #{@appliance_config.name} appliance image to EC2 format..."
40:
41: @image_helper.create_disk(@deliverables.disk, 10) # 10 GB destination disk
42:
43: @image_helper.customize([@previous_deliverables.disk, @deliverables.disk], :automount => false) do |guestfs, guestfs_helper|
44: @image_helper.sync_filesystem(guestfs, guestfs_helper)
45:
46: # TODO is this really needed?
47: @log.debug "Uploading '/etc/resolv.conf'..."
48: guestfs.upload("/etc/resolv.conf", "/etc/resolv.conf")
49: @log.debug "'/etc/resolv.conf' uploaded."
50:
51: if (@appliance_config.os.name == 'rhel' or @appliance_config.os.name == 'centos') and @appliance_config.os.version == '5'
52: # Remove normal kernel
53: guestfs.sh("yum -y remove kernel")
54: # because we need to install kernel-xen package
55: guestfs_helper.sh("yum -y install kernel-xen", :arch => @appliance_config.hardware.arch)
56: # and add require modules
57: @linux_helper.recreate_kernel_image(guestfs, ['xenblk', 'xennet'])
58: end
59:
60: create_devices(guestfs)
61:
62: guestfs.mkdir("/data") if @appliance_config.is64bit?
63:
64: upload_fstab(guestfs)
65: enable_networking(guestfs)
66: upload_rc_local(guestfs)
67: add_ec2_user(guestfs)
68: change_configuration(guestfs_helper)
69: install_menu_lst(guestfs)
70:
71: enable_nosegneg_flag(guestfs) if @appliance_config.os.name == 'fedora'
72:
73: execute_post(guestfs_helper)
74: end
75:
76: @log.info "Image converted to EC2 format."
77: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 79
79: def execute_post(guestfs_helper)
80: unless @appliance_config.post['ec2'].nil?
81: @appliance_config.post['ec2'].each do |cmd|
82: guestfs_helper.sh(cmd, :arch => @appliance_config.hardware.arch)
83: end
84: @log.debug "Post commands from appliance definition file executed."
85: else
86: @log.debug "No commands specified, skipping."
87: end
88: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 79
79: def execute_post(guestfs_helper)
80: unless @appliance_config.post['ec2'].nil?
81: @appliance_config.post['ec2'].each do |cmd|
82: guestfs_helper.sh(cmd, :arch => @appliance_config.hardware.arch)
83: end
84: @log.debug "Post commands from appliance definition file executed."
85: else
86: @log.debug "No commands specified, skipping."
87: end
88: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 127
127: def install_menu_lst(guestfs)
128: @log.debug "Uploading '/boot/grub/menu.lst' file..."
129: menu_lst_data = File.open("#{File.dirname(__FILE__)}/src/menu.lst").read
130:
131: menu_lst_data.gsub!(/#TITLE#/, @appliance_config.name)
132: menu_lst_data.gsub!(/#KERNEL_VERSION#/, @linux_helper.kernel_version(guestfs))
133: menu_lst_data.gsub!(/#KERNEL_IMAGE_NAME#/, @linux_helper.kernel_image_name(guestfs))
134:
135: menu_lst = Tempfile.new('menu_lst')
136: menu_lst << menu_lst_data
137: menu_lst.flush
138:
139: menu_d = '/boot/grub'
140: guestfs.mkdir_p(menu_d) if guestfs.exists(menu_d) == 0
141: guestfs.upload(menu_lst.path, '/boot/grub/menu.lst')
142:
143: menu_lst.close
144: @log.debug "'/boot/grub/menu.lst' file uploaded."
145: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 127
127: def install_menu_lst(guestfs)
128: @log.debug "Uploading '/boot/grub/menu.lst' file..."
129: menu_lst_data = File.open("#{File.dirname(__FILE__)}/src/menu.lst").read
130:
131: menu_lst_data.gsub!(/#TITLE#/, @appliance_config.name)
132: menu_lst_data.gsub!(/#KERNEL_VERSION#/, @linux_helper.kernel_version(guestfs))
133: menu_lst_data.gsub!(/#KERNEL_IMAGE_NAME#/, @linux_helper.kernel_image_name(guestfs))
134:
135: menu_lst = Tempfile.new('menu_lst')
136: menu_lst << menu_lst_data
137: menu_lst.flush
138:
139: menu_d = '/boot/grub'
140: guestfs.mkdir_p(menu_d) if guestfs.exists(menu_d) == 0
141: guestfs.upload(menu_lst.path, '/boot/grub/menu.lst')
142:
143: menu_lst.close
144: @log.debug "'/boot/grub/menu.lst' file uploaded."
145: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 107
107: def upload_fstab(guestfs)
108: @log.debug "Uploading '/etc/fstab' file..."
109:
110: fstab_file = @appliance_config.is64bit? ? "#{File.dirname(__FILE__)}/src/fstab_64bit" : "#{File.dirname(__FILE__)}/src/fstab_32bit"
111:
112: fstab_data = File.open(fstab_file).read
113: fstab_data.gsub!(/#DISK_DEVICE_PREFIX#/, disk_device_prefix)
114: fstab_data.gsub!(/#FILESYSTEM_TYPE#/, @appliance_config.hardware.partitions['/']['type'])
115:
116: fstab = Tempfile.new('fstab')
117: fstab << fstab_data
118: fstab.flush
119:
120: guestfs.upload(fstab.path, "/etc/fstab")
121:
122: fstab.close
123:
124: @log.debug "'/etc/fstab' file uploaded."
125: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 107
107: def upload_fstab(guestfs)
108: @log.debug "Uploading '/etc/fstab' file..."
109:
110: fstab_file = @appliance_config.is64bit? ? "#{File.dirname(__FILE__)}/src/fstab_64bit" : "#{File.dirname(__FILE__)}/src/fstab_32bit"
111:
112: fstab_data = File.open(fstab_file).read
113: fstab_data.gsub!(/#DISK_DEVICE_PREFIX#/, disk_device_prefix)
114: fstab_data.gsub!(/#FILESYSTEM_TYPE#/, @appliance_config.hardware.partitions['/']['type'])
115:
116: fstab = Tempfile.new('fstab')
117: fstab << fstab_data
118: fstab.flush
119:
120: guestfs.upload(fstab.path, "/etc/fstab")
121:
122: fstab.close
123:
124: @log.debug "'/etc/fstab' file uploaded."
125: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 184
184: def upload_rc_local(guestfs)
185: @log.debug "Uploading '/etc/rc.d/rc.local' file..."
186: rc_local = Tempfile.new('rc_local')
187:
188: if guestfs.exists("/etc/rc.d/rc.local") == 1
189: # We're appending
190: rc_local << guestfs.read_file("/etc/rc.d/rc.local")
191: else
192: # We're creating new file
193: rc_local << "#!/bin/bash\n\n"
194: end
195:
196: rc_local << File.read("#{File.dirname(__FILE__)}/src/rc_local")
197: rc_local.flush
198:
199: guestfs.upload(rc_local.path, "/etc/rc.d/rc.local")
200:
201: rc_local.close
202:
203: # Fedora 16 doesn't have /etc/rc.local file and we need to
204: # enable rc.local compatibility with systemd
205: # We need to make sure that network is available when executing rc.local
206: if (@appliance_config.os.name == 'fedora' and @appliance_config.os.version >= '16')
207: guestfs.cp("/lib/systemd/system/rc-local.service", "/etc/systemd/system/")
208: guestfs.sh("sed -i '/^ConditionFileIsExecutable/a After=network.target' /etc/systemd/system/rc-local.service")
209: guestfs.sh("systemctl enable rc-local.service")
210: guestfs.ln_sf("/etc/rc.d/rc.local", "/etc/rc.local")
211: guestfs.chmod(0755, "/etc/rc.d/rc.local")
212: end
213:
214: @log.debug "'/etc/rc.d/rc.local' file uploaded."
215: end
# File lib/boxgrinder-build/plugins/platform/ec2/ec2-plugin.rb, line 184
184: def upload_rc_local(guestfs)
185: @log.debug "Uploading '/etc/rc.d/rc.local' file..."
186: rc_local = Tempfile.new('rc_local')
187:
188: if guestfs.exists("/etc/rc.d/rc.local") == 1
189: # We're appending
190: rc_local << guestfs.read_file("/etc/rc.d/rc.local")
191: else
192: # We're creating new file
193: rc_local << "#!/bin/bash\n\n"
194: end
195:
196: rc_local << File.read("#{File.dirname(__FILE__)}/src/rc_local")
197: rc_local.flush
198:
199: guestfs.upload(rc_local.path, "/etc/rc.d/rc.local")
200:
201: rc_local.close
202:
203: # Fedora 16 doesn't have /etc/rc.local file and we need to
204: # enable rc.local compatibility with systemd
205: # We need to make sure that network is available when executing rc.local
206: if (@appliance_config.os.name == 'fedora' and @appliance_config.os.version >= '16')
207: guestfs.cp("/lib/systemd/system/rc-local.service", "/etc/systemd/system/")
208: guestfs.sh("sed -i '/^ConditionFileIsExecutable/a After=network.target' /etc/systemd/system/rc-local.service")
209: guestfs.sh("systemctl enable rc-local.service")
210: guestfs.ln_sf("/etc/rc.d/rc.local", "/etc/rc.local")
211: guestfs.chmod(0755, "/etc/rc.d/rc.local")
212: end
213:
214: @log.debug "'/etc/rc.d/rc.local' file uploaded."
215: end