The security response headers added to xcat.conf are wrapped in
<IfModule mod_headers.c>, so they only take effect where mod_headers is loaded.
EL loads it by default and the Debian postinst enables it with a2enmod, but SUSE
apache2 does not load it by default, so the headers stayed inactive there. Enable
it in the RPM %post for the apache2 case, guarded so it is a no-op on EL (where
a2enmod is absent and mod_headers is already loaded).
Verified on openSUSE Leap 15.6: mod_headers is off by default, the hardened
config still starts, and after a2enmod the served response carries all four
security headers. The need to load mod_headers on SUSE was identified in the
lenovobuild branch (660df81379 / xcat.conf.apach24.sles), here done via
a2enmod rather than a separate config file.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
Add standard security response headers (X-Frame-Options, X-Content-Type-
Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies) to the
/install and /tftpboot directories, mask the server banner with
"ServerTokens Prod", and drop the Includes (SSI) and MultiViews options from
those file-serving directories. Indexes on /install/postscripts, /install/post
and the doc directory are left intact so directory browsing still works where
xCAT relies on it.
The Header directives are wrapped in <IfModule mod_headers.c> so a server
whose mod_headers is not loaded still starts cleanly instead of failing on an
unknown directive. On Debian/Ubuntu, where mod_headers is not enabled by
default, the xCAT and xCATsn package postinst scripts run "a2enmod headers"
before restarting Apache so the headers take effect there as well; on
RHEL/SLES the module is loaded by default and needs no action.
Recovered from the unmerged lenovobuild branch (originals 7ee0c129, 85c8bc09,
d4d1783a), adapted: the deprecated X-XSS-Protection header and the
mod_allowmethods-dependent AllowMethods directive are omitted, and the Header
directives use "set" rather than "append".
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The postscript rewrites host= in the freshly fetched /etc/xcat/cfgloc to point
at MASTER, discarding the database location the credentials came with. That is
the only record of it when the database does not live on the management node.
Keep it as cfgloc.orig; the existing chmod 600 /etc/xcat/cfgloc* covers it.
Recovered from the unmerged lenovobuild branch (10090a9d). The original also
replaced the atomic write with mv-then-sed, which leaves cfgloc truncated if
sed fails, so the write itself is left alone.
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The reboot postscript backgrounds "(sleep 75; reboot) &". On SUSE that can
fire while the installer is still finishing, rebooting the node mid-install.
Use a systemd timer (systemd-run --on-active=90 /sbin/reboot) on SUSE, which
the installer teardown does not race; EL and Ubuntu keep the existing
backgrounded sleep.
Gated on SUSE and the presence of systemd-run, so no other platform changes.
Recovered from the unmerged lenovobuild branch (6785eb3a, 4fe2a72c, ac04f5ad;
net effect, consolidated).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
xCAT and xCATsn hard-required elilo-xcat on every non-s390x install. elilo only
provides the ia64 (Itanium) UEFI loader; modern x86-64 UEFI netboot uses
xnba.efi and aarch64 uses grub2, so the dependency pulls a loader no current
platform needs. Drop the Requires (xnba-undi, which the UEFI path does use, is
kept). elilo-xcat can still be installed by hand for legacy ia64.
An OVMF x86-64 UEFI client netboots through xnba.efi with no elilo involved.
Recovered from the unmerged lenovobuild branch (e53b62e0).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The etc.tar.gz payload is unpacked into the buildroot and the resulting
etc/logrotate.d/xcat inherits whatever mode the build umask produced.
logrotate silently skips (and warns about) config files that are group- or
world-writable, so a loose umask can disable xCAT log rotation entirely.
chmod the file to 644 after extraction so the shipped config is always
honored.
Recovered from the unmerged lenovobuild branch (original cb8d671d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The RPM %post runs `xcatconfig -u -V >> /var/log/xcat/upgrade.log` with only
stdout redirected, so any errors or warnings the upgrade emits go to the
package manager's output and are lost from the log a later diagnosis relies
on.
Redirect stderr into the same log with 2>&1.
Recovered from the unmerged lenovobuild branch (original 51d87d4d).
Co-authored-by: Jarrod Johnson <10814490+jjohnson42@users.noreply.github.com>
The single flat xcat-core repo serves el8/el9/el10 from one build, but two spec
decisions were resolved at BUILD time and so were wrong for the other ELs that
share the same repo.
1. DHCP backend. xCAT.spec and xCATsn.spec selected the dhcp provider with a
build-time %if (rhel >= 10 -> kea, else dhcpd), so an el10 build wrongly
required kea on el8/el9 (and an el8/el9 build wrongly required dhcpd on
el10). Replace it with an install-time RPM rich dependency:
Requires: (kea if (system-release >= 10) else /usr/sbin/dhcpd)
Requires: (kea-hooks if (system-release >= 10))
dnf now resolves it per client: kea on el10+ (which dropped ISC dhcp from the
distro), dhcpd on el8/el9. SLES has no "system-release" provide, so the
condition is false there and it falls back to /usr/sbin/dhcpd, preserving
prior behavior. system-release is versioned per release package
(el10=10.x, el9=9.x, el8=8.x).
2. openssl. Make the xCAT-server openssl Requires uniform across EL (non-SUSE)
instead of el10-only, so the produced package set does not depend on which EL
the build host happened to be.
Also drop xCAT-genesis-base from the default @PACKAGES set in buildrpms.pl: its
initramfs bundles the build-chroot kernel/glibc and is therefore OS- and
arch-dependent, so it cannot ship in the single flat core. It is now built per
target by the xcat-dep pipeline (mockbuild-all.pl, via
`buildrpms.pl --package xCAT-genesis-base`) and ships in xcat-dep/rh<N>. The
explicit `--package xCAT-genesis-base` build path is retained.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
xcat and xcatsn declared a hard dependency on xcat-genesis-scripts-ppc64. In
an amd64-only build that package is never produced, so apt could not satisfy
the dependency and refused to install xcat. Depend only on the amd64
genesis-scripts package.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Port the -r option from the deprecated confignics postscript to
confignetwork. This allows removing network configuration for NICs
that are not defined in xCAT, useful when nodes have extra interfaces
that get DHCP addresses by default.
Safety checks ported from confignics:
- Skip non-ethernet interfaces
- Skip bridge members
- Skip xCAT-defined NICs
- Skip install NIC
- Skip VLAN interfaces
- Skip bonding members (SLAVE/MASTER)
Closes: https://github.com/xcat2/xcat-core/issues/6142
Supersedes: https://github.com/xcat2/xcat-core/pull/7092
Co-Authored-By: Christopher Walker <cjw1006@gmail.com>
NetworkManager auto-generates connection names that can contain spaces
(e.g. "Wired connection 2"). Multiple devices can also share the same
auto-generated name. Both cases cause failures when names are passed
to nmcli in bridge and bond setup paths.
Resolve active connection UUID via nmcli device show (GENERAL.CON-UUID)
instead of by name, which avoids both word-splitting on spaces and
ambiguity when multiple connections share the same name.
Changes:
- Bridge slave setup: resolve UUID via device show instead of by name
- Bond slave setup: same UUID-via-device approach for con down/mod
- Bridge rollback: preserve original xcat-prefixed connection name so
rollback paths restore the correct name instead of a UUID
- Utility functions: quote connection name arguments in
is_nmcli_connection_exist, is_connection_activate_intime, and
wait_nic_connect_intime for defensive correctness
- Add -F flag to grep in is_nmcli_connection_exist for literal matching
- Log both human-readable name and UUID when reusing existing connections
Tested on EL10 host with duplicate "Ethernet connection 1/2" profiles
across multiple NICs — UUID resolution via device returns exactly one
UUID per device regardless of name collisions.
Follows up on #7562 and #7483.
Co-authored-by: OliverTUBAF <86062666+OliverTUBAF@users.noreply.github.com>
NetworkManager can auto-generate connection names with spaces (e.g.
"Wired connection 2"). The bridge slave setup in create_bridge_interface_nmcli
stored this name in a variable that was later expanded unquoted in nmcli
commands, breaking both the initial con mod and all downstream operations
(con up, con delete on rollback). Resolve the connection to its UUID
before use, which is space-safe and valid for all nmcli operations.
Closes: #7483
bool_install_nic on line 99 should be boot_install_nic, matching
the variable used everywhere else in the script. This caused the
SETINSTALLNIC environment variable to have no effect.
Fixes: xcat2/xcat-core#7472
On RHEL 9.x minimal installs, the yum package may not exist as a
separate RPM — only dnf is present with /usr/bin/yum as a symlink.
The previous detection using rpm -q yum would fail, causing hasyum
to remain 0 and skipping repo file creation entirely.
Replace rpm -q based detection with executable checks for /usr/bin/dnf
and /usr/bin/yum. Introduce yumcmd variable to carry the actual command
name through all package operations instead of hardcoding yum.
Fixes: xcat2/xcat-core#7497
The default xCAT Apache configuration shipped with Options Indexes
enabled for the /install and /tftpboot directories. This allowed
unauthenticated users to browse directory listings, disclosing the
full tree of postscripts, boot files, and (in production deployments)
potentially kickstart files with password hashes, custom scripts with
embedded credentials, and cluster topology details.
Replace Options Indexes with -Indexes in all four shipped Apache config
files (MN and SN, Apache 2.2 and 2.4 variants). Direct file access
by known path continues to work, so all provisioning workflows are
unaffected. Directory browsing for /xcat-doc is preserved as it
contains only public documentation.
Additionally, add an Apache hardening guide documenting recommended
permissions for sensitive directories under /install, network binding
best practices, and IP-based access control options.
Addresses #7450
Docker container lifecycle management (mgt=docker, mkdocker, rmdocker,
lsdocker) was added in 2015-2016 as an experiment targeting Docker API
v1.22 on Ubuntu only. Documentation and man pages were deliberately
removed in 2019 (PRs #6222 and #6324) with the original developer's
approval, noting that "the interface of Docker has become very simple
right now, so there is no value for xCAT to offer such functions."
The plugin was still being shipped but has had no functional code changes
since April 2016, was never listed as a valid mgt value in Schema.pm,
and no user ever filed an issue about it.
Removed:
- xCAT-server/lib/xcat/plugins/docker.pm (1,142 lines)
- xCAT/postscripts/setupdockerhost
- xCAT-server/share/xcat/scripts/setup-dockerhost-cert.sh
- xCAT-test/autotest/testcase/dockercommand/ (test cases)
- Docker attribute definitions in Schema.pm
- Client symlinks (mkdocker, rmdocker, lsdocker)
- Usage entries and dockerhost cert handling in credentials.pm
- Docker attribute documentation in man7 pages
The "Running xCAT in Docker" documentation (dockerized_xcat/) is
retained as it documents containerizing xCAT itself, not the removed
mgt=docker feature.
Closes#7518
This fixes a problem where the dracut image was pulling artifacts from
the build host and not the mock image, e.g. building for EL9 in EL10.
Signed-off-by: Daniel Hilst Selli <392820+dhilst@users.noreply.github.com>
Fix warning in xCAT/xCAT.spec about macro inside comments
Fix missing build dependencies in .spec files
Enable passsing gitinfo as command line argument in perl-xCAT.spec
Signed-off-by: Daniel Hilst Selli <392820+dhilst@users.noreply.github.com>
BREAKING CHANGE: This disables the automatic installation of
xCAT genesis packages.
Signed-off-by: Daniel Hilst Selli <392820+dhilst@users.noreply.github.com>
* take out useless arp_ignore/arp_filter lines
* create logic to use con add if con doesn't exist, else con modify
* swap the con modify vs con add logic so that it matches the test logic
* add back arp_filter and arp_ignore
---------
Co-authored-by: dmarm <dmarm@dmarms-MBP.lan>
* Use 'nmcli con modify' for nicextraparams on RHEL9
* update configeth to support nic extra params for RHEL9
* fix new rc logic
* update configeth to support nic extra params for RHEL9, pt 2
* Add alma9+rocky9 for configeth
* Add alma9+rocky9 to nicutils.sh
* configib: use nmcli calls for el9
* configib: fix tabs
* Fix tabs
---------
Co-authored-by: Markus Hilger <markus.hilger@megware.com>
Vinícius Ferrão
Daniel Hilst
Vinícius Ferrão
Markus Hilger
dubmarm
Simon Fowler
Alex Richert
sgr
abhishek-sa1
Markus Hilger
Alex Richert