imageboot.sh wrote /etc/netplan/10-<iface>-confluentcfg.yaml with the
default mode 0644, and netplan warns that its configuration should not
be accessible by others. confignet already writes its files 0600, but
it leaves an identical file in place, so the boot-time one stayed 0644.
extract_untethered_rootimg reports failure, for example when the image
does not fit into the memory backed root, but imageboot.sh ignored it and
booted into the partly extracted root, which then hung later on. Stop
with a message saying why instead.
Without netplan, nmcli or wicked the manager variable was never set and
confignet died with a NameError. Say what is missing instead. Also pick
netplan over nmcli in the retry pass, as the first pass does, instead of
switching to NetworkManager on systems that have both.
image2disk rewrote root= in the boot loader entries but kept their
linux and initrd paths. Those come from where the image was built: in a
diskless image from imgutil they carry the scratch directory of the
server (grub2-mkrelpath sees its bind mount), and a /boot/ path does not
match the separate /boot filesystem image2disk creates for such images.
grub then fails with "you need to load the kernel". Make the paths
relative to the boot filesystem of the target.
An untethered or uncompressed diskless boot downloaded the root image
only from the deployment server and retried it forever when that server
failed. Try the other managers that answered discovery as well, as the
tethered urlmount already does.
urlmount limits each small range request to 10 seconds, but the single
whole-image download cannot take a total limit. Give up on a connect
after 10 seconds and on a transfer that stalls for 30 seconds instead,
so a hung server moves on to the next one.
The initramfs writes the overlay upper layer before the SELinux policy
is loaded, so those files are unlabeled_t. On an enforcing image /
itself is unlabeled, and logind, getty and sshd fail.
Label exactly the upper layer paths like el9-diskless does. The root
is an overlay in untethered mode too, so this covers both. chcon comes
from the image, the initramfs has none.
Without it the server is only found by link-local discovery, so nodes
behind a DHCP relay never boot. Ported from el9-diskless. The initramfs
has dhcpcd from 24.04 on and only ipconfig before.
Without it the server is only found by link-local discovery, so nodes
behind a DHCP relay never boot. Ported from el9-diskless, with dhcpcd
in place of dhclient.
Removing it afterwards copied /etc/dracut.conf.d up unlabeled in
tethered mode on images built with SELinux. Skip the whiteout that the
removal leaves in the upper layer.
The install runs before a policy is loaded, so the module index from
kernel-install and files of later post scripts stayed unlabeled and
systemd-modules-load failed. Relabel every local filesystem last.
On an untethered root, files the initramfs writes before policy load
and sockets that unsquashfs creates without attributes have no label.
Label every inode without one, as the upper layer is in tethered mode.
With a tethered root (and on EL8 always), the initramfs writes the
overlay upper layer before the SELinux policy is loaded, so those files
are unlabeled_t. On a captured enforcing image sshd-keygen then cannot
search / and the node comes up without sshd.
Label exactly the upper layer paths with matchpathcon and chcon.
setfiles would recurse into the merged tree and restorecon is a no-op
before policy load. Built images have SELinux disabled and skip this.
With installtodisk and confluent_imagemethod=untethered (or
uncompressed) imageboot.sh first extracts the image to RAM and tears
down the image mount and the cryptimg device. installimage then hands
the empty /mnt/remote to image2disk.py, which wipes the target disk and
fails with:
FileNotFoundError: [Errno 2] No such file or directory: '/dev/mapper/cryptimg'
Writing the image to disk never needs the RAM copy, so treat the image
method as tethered when installtodisk is set. The same profile can then
be switched between untethered and installtodisk by only adding or
removing installtodisk.
The attribute help promises "a specific device name", but getinstalldisk
only understood "m2" and "/dev/<name>". A plain "nvme0n1" aborted the
install with "Unknown deployment.storage specification", and a
"/dev/<name>" that matched no disk was silently ignored, so the OS went
to whatever disk the default ordering picked. For an attribute meant to
pin the OS disk that is the dangerous failure mode.
Accept a kernel name with or without /dev/ and resolve /dev/disk/by-*
links to their kernel name, so a disk can be pinned by a stable path.
When nothing matches, fail with "No disks match" like the m2 filter
already does. Document the accepted forms in the attribute help.
netplan and NetworkManager both scope dns to interface.
In certain cases, it can really mean it, so try to match the nameservers to the appropriate interface,
falling back to adding to every interface with a gateway.
This reverts commit be6c7a3794.
They do not exist in Leap/SLE 16 installer initrd.
The diskless hook keeps its copies. imgutil's installkernel instmods
all four, so they are in that image and the calls do work there.
SLES 16 ships no ISC dhclient and nothing provides dhcp-client, so the
image could not be built from SLES media at all. Leap carries dhcpcd
too, so one client covers both. el10 made the same move when RHEL
dropped dhclient.
The deploycfg carries the literal 'null', which went into the profile as
a password hash, so the installed root account reported a usable
password instead of a locked one. 15 substitutes '!' for this; the sed
delimiter has to move off '!' to carry it.
The default Etc/UTC is not in the tzdata list agama validates against,
so the load failed and the install fell through to agama defaults and
still reported completion. Normalize it and halt if the load fails.
The attached-media branch could never be taken: the label pattern built
from os-release is opensuse-leap-16.0 or sles-16.0, while the media is
labelled Install-Leap-16.0-x86_64 and Install-SUSE-SLE-16-x86_64. Had it
matched, it would have written an inst.repo to the dracut cmdline that
agama does not read, and skipped inst.script entirely.
They stayed commented out when the hook was forked from el8, so an
IPoIB-only node had no path to the deploy server. The diskless hook
loads them already.
Jarrod Johnson
Markus Hilger
Robert Caliman
Jarrod Johnson