diff --git a/release/tools/azure.conf b/release/tools/azure.conf index a633e6e508d4..e13b63067fee 100644 --- a/release/tools/azure.conf +++ b/release/tools/azure.conf @@ -1,58 +1,56 @@ #!/bin/sh # # # Convention of Linux type VM on Azure is 30G export VMSIZE=30g # Set to a list of packages to install. export VM_EXTRA_PACKAGES="azure-agent python python3 firstboot-freebsd-update firstboot-pkgs" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="ntpd sshd waagent firstboot_freebsd_update firstboot_pkgs" # No swap space; waagent will allocate swap space on the resource disk. # See ResourceDisk.EnableSwap and ResourceDisk.SwapSizeMB in waagent.conf export NOSWAP=YES # https://learn.microsoft.com/en-us/partner-center/marketplace/azure-vm-certification-faq#vm-images-must-have-1-mb-of-free-space export VM_BOOTPARTSOFFSET=1M vm_extra_pre_umount() { mount -t devfs devfs ${DESTDIR}/dev # The firstboot_pkgs rc.d script will download the repository # catalogue and install or update pkg when the instance first # launches, so these files would just be replaced anyway; removing # them from the image allows it to boot faster. chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ /usr/sbin/pkg delete -f -y pkg rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods chroot ${DESTDIR} ${EMULATOR} pw usermod root -h - umount ${DESTDIR}/dev cat << EOF >> ${DESTDIR}/etc/rc.conf ifconfig_hn0="SYNCDHCP" ntpd_sync_on_start="YES" EOF cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay="-1" beastie_disable="YES" loader_logo="none" hw.memtest.tests="0" console="comconsole efi vidconsole" comconsole_speed="115200" boot_multicons="YES" boot_serial="YES" mlx4en_load="YES" mlx5en_load="YES" EOF - touch ${DESTDIR}/firstboot - return 0 } diff --git a/release/tools/basic-ci.conf b/release/tools/basic-ci.conf index 4bcb87aec791..e235c03d39fe 100644 --- a/release/tools/basic-ci.conf +++ b/release/tools/basic-ci.conf @@ -1,36 +1,34 @@ #!/bin/sh # # # Should be enough for base image, image can be resized in needed export VMSIZE=5g # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="sshd growfs nuageinit" vm_extra_pre_umount() { cat << EOF >> ${DESTDIR}/etc/rc.conf dumpdev="AUTO" ifconfig_DEFAULT="DHCP" sshd_enable="YES" EOF cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay="-1" beastie_disable="YES" loader_logo="none" console="comconsole,vidconsole" EOF metalog_add_data ./boot/loader.conf cat <> ${DESTDIR}/etc/ssh/sshd_config PermitRootLogin yes PasswordAuthentication yes PermitEmptyPasswords yes UsePAM no EOF - touch_firstboot - return 0 } diff --git a/release/tools/basic-cloudinit.conf b/release/tools/basic-cloudinit.conf index 7088c0a5f72a..f8554c42f49c 100644 --- a/release/tools/basic-cloudinit.conf +++ b/release/tools/basic-cloudinit.conf @@ -1,40 +1,38 @@ #!/bin/sh # Should be enough for base image, image can be resized in needed export VMSIZE=5g # 1M config drive should be enough in most cases export CONFIG_DRIVE=YES export CONFIG_DRIVE_SIZE=1M # Packages to install into the image we're creating. # * firstboot-freebsd-update, to install security updates at first boot. export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} firstboot-freebsd-update" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="${VM_RC_LIST} firstboot_freebsd_update growfs sshd nuageinit" vm_extra_pre_umount() { cat << EOF >> ${DESTDIR}/etc/rc.conf dumpdev="AUTO" ifconfig_DEFAULT="SYNCDHCP accept_rtadv" # RSA host keys are obsolete and also very slow to generate sshd_rsa_enable="NO" EOF cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay="-1" beastie_disable="YES" loader_logo="none" console="comconsole,vidconsole" EOF cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config PasswordAuthentication yes UsePAM no EOF - touch ${DESTDIR}/firstboot - return 0 } diff --git a/release/tools/ec2.conf b/release/tools/ec2.conf index 31f40962b19d..704a8f3f0073 100644 --- a/release/tools/ec2.conf +++ b/release/tools/ec2.conf @@ -1,162 +1,159 @@ #!/bin/sh # Package which should be installed onto all EC2 AMIs: # * ebsnvme-id, which is very minimal and provides important EBS-specific # functionality, export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} ebsnvme-id" # Services which should be enabled by default in rc.conf(5). export VM_RC_LIST="dev_aws_disk ntpd" # Build with a 7.9 GB partition; the growfs rc.d script will expand # the partition to fill the root disk after the EC2 instance is launched. # Note that if this is set to G, we will end up with an GB disk # image since VMSIZE is the size of the filesystem partition, not the disk # which it resides within. export VMSIZE=8000m # No swap space; it doesn't make sense to provision any as part of the disk # image when we could be launching onto a system with anywhere between 0.5 # and 4096 GB of RAM. export NOSWAP=YES ec2_common() { # Delete the pkg package and the repo database; they will likely be # long out of date before the EC2 instance is launched. mount -t devfs devfs ${DESTDIR}/dev chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ /usr/sbin/pkg delete -f -y pkg umount ${DESTDIR}/dev rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods # Turn off IPv6 Duplicate Address Detection; the EC2 networking # configuration makes it unnecessary. echo 'net.inet6.ip6.dad_count=0' >> ${DESTDIR}/etc/sysctl.conf # Booting quickly is more important than giving users a chance to # access the boot loader via the serial port. echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf # The EFI RNG on Graviton 2 is particularly slow if we ask for the # default 2048 bytes of entropy; ask for 64 bytes instead. echo 'entropy_efi_seed_size="64"' >> ${DESTDIR}/boot/loader.conf # Tell gptboot not to wait 3 seconds for a keypress which will # never arrive. printf -- "-n\n" > ${DESTDIR}/boot.config # The emulated keyboard attached to EC2 instances is inaccessible to # users, and there is no mouse attached at all; disable to keyboard # and the keyboard controller (to which the mouse would attach, if # one existed) in order to save time in device probing. echo 'hint.atkbd.0.disabled=1' >> ${DESTDIR}/boot/loader.conf echo 'hint.atkbdc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf # There is no floppy drive on EC2 instances so disable the driver. echo 'hint.fd.0.disabled=1' >> ${DESTDIR}/boot/loader.conf echo 'hint.fdc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf # There is no parallel port on EC2 instances so disable driver. echo 'hint.ppc.0.disabled=1' >> ${DESTDIR}/boot/loader.conf # EC2 has two consoles: An emulated serial port ("system log"), # which has been present since 2006; and a VGA console ("instance # screenshot") which was introduced in 2016. echo 'boot_multicons="YES"' >> ${DESTDIR}/boot/loader.conf # Graviton 1 through Graviton 4 have a bug in their ACPI where they # mark the PL061's pins as needing to be configured in PullUp mode # (in fact the PL061 has no pullup/pulldown resistors). Graviton 1 # through Graviton 3 have non-functional PCI _EJ0 and need a value # written to the PCI power status register in order to eject a # device. EC2 instances with PCI (not PCIe) buses need a short # delay before rescanning upon device detach. echo 'debug.acpi.quirks="56"' >> ${DESTDIR}/boot/loader.conf # The default behaviour of re-routing INTx interrupts causes a # resource leak on INTRng (aka on Graviton systems). Repeated # hotplug/unplug on PCI (not PCIe) Graviton systems ends up with # a kernel panic unless we disable this. echo 'hw.pci.intx_reroute=0' >> ${DESTDIR}/boot/loader.conf # Load the kernel module for the Amazon "Elastic Network Adapter" echo 'if_ena_load="YES"' >> ${DESTDIR}/boot/loader.conf # Use the "nda" driver for accessing NVMe disks rather than the # historical "nvd" driver. echo 'hw.nvme.use_nvd="0"' >> ${DESTDIR}/boot/loader.conf # Reduce the timeout for PCIe Eject ("hotunplug") requests. PCIe # mandates a 5 second timeout to allow someone to cancel the eject # by pressing the "Attention button" a second time, but in the EC2 # environment this delay serves no purpose. echo 'hw.pci.pcie_hp_detach_timeout="0"' >> ${DESTDIR}/boot/loader.conf # Disable KbdInteractiveAuthentication according to EC2 requirements. sed -i '' -e \ 's/^#KbdInteractiveAuthentication yes/KbdInteractiveAuthentication no/' \ ${DESTDIR}/etc/ssh/sshd_config # RSA host keys are obsolete and also very slow to generate echo 'sshd_rsa_enable="NO"' >> ${DESTDIR}/etc/rc.conf # Use FreeBSD Update mirrors hosted in AWS sed -i '' -e 's/update.FreeBSD.org/aws.update.FreeBSD.org/' \ ${DESTDIR}/etc/freebsd-update.conf # Use the NTP service provided by Amazon sed -i '' -e 's/^pool/#pool/' \ -e '1,/^#server/s/^#server.*/server 169.254.169.123 iburst/' \ ${DESTDIR}/etc/ntp.conf # Provide a map for accessing Elastic File System mounts cat > ${DESTDIR}/etc/autofs/special_efs <<'EOF' #!/bin/sh if [ $# -eq 0 ]; then # No way to know which EFS filesystems exist and are # accessible to this EC2 instance. exit 0 fi # Provide instructions on how to mount the requested filesystem. FS=$1 REGION=`fetch -qo- http://169.254.169.254/latest/meta-data/placement/availability-zone | sed -e 's/[a-z]$//'` echo "-nfsv4,minorversion=1,oneopenown ${FS}.efs.${REGION}.amazonaws.com:/" EOF chmod 755 ${DESTDIR}/etc/autofs/special_efs - # The first time the AMI boots, run "first boot" scripts. - touch ${DESTDIR}/firstboot - return 0 } ec2_base_networking () { # EC2 instances use DHCP to get their network configuration. IPv6 # requires accept_rtadv. echo 'ifconfig_DEFAULT="SYNCDHCP accept_rtadv"' >> ${DESTDIR}/etc/rc.conf # The EC2 DHCP server can be trusted to know whether an IP address is # assigned to us; we don't need to ARP to check if anyone else is using # the address before we start using it. echo 'dhclient_arpwait="NO"' >> ${DESTDIR}/etc/rc.conf # Enable IPv6 on all interfaces, and spawn DHCPv6 via rtsold echo 'ipv6_activate_all_interfaces="YES"' >> ${DESTDIR}/etc/rc.conf echo 'rtsold_enable="YES"' >> ${DESTDIR}/etc/rc.conf echo 'rtsold_flags="-M /usr/local/libexec/rtsold-M -a"' >> ${DESTDIR}/etc/rc.conf # Provide a script which rtsold can use to launch DHCPv6 mkdir -p ${DESTDIR}/usr/local/libexec cat > ${DESTDIR}/usr/local/libexec/rtsold-M <<'EOF' #!/bin/sh /usr/local/sbin/dhclient -6 -nw -N -cf /dev/null $1 EOF chmod 755 ${DESTDIR}/usr/local/libexec/rtsold-M return 0 } diff --git a/release/tools/gce.conf b/release/tools/gce.conf index 382a839786f3..dc56be30c7ca 100644 --- a/release/tools/gce.conf +++ b/release/tools/gce.conf @@ -1,135 +1,133 @@ #!/bin/sh # # # The default of 3GB is too small for GCE, so override the size here. export VMSIZE=20g # Set to a list of packages to install. export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} firstboot-freebsd-update \ firstboot-pkgs google-cloud-sdk panicmail sudo \ sysutils/py-google-compute-engine lang/python \ lang/python3" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="ntpd sshd growfs \ firstboot_pkgs firstboot_freebsd_update google_startup \ google_accounts_daemon google_clock_skew_daemon \ google_instance_setup google_network_daemon" vm_extra_install_base() { echo 'search google.internal' > ${DESTDIR}/etc/resolv.conf echo 'nameserver 169.254.169.254' >> ${DESTDIR}/etc/resolv.conf echo 'nameserver 8.8.8.8' >> ${DESTDIR}/etc/resolv.conf } vm_extra_pre_umount() { local DEVFSISOURS # Enable growfs on every boot, not only the first, as as instance's disk can # be enlarged post-creation sed -i -e '/KEYWORD: firstboot/d' /etc/rc.d/growfs cat << EOF >> ${DESTDIR}/etc/rc.conf dumpdev="AUTO" ifconfig_DEFAULT="SYNCDHCP mtu 1460" ntpd_sync_on_start="YES" # need to fill in something here #firstboot_pkgs_list="" panicmail_autosubmit="YES" EOF cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay="-1" beastie_disable="YES" loader_logo="none" hw.memtest.tests="0" console="comconsole,vidconsole" hw.vtnet.mq_disable=1 kern.timecounter.hardware=ACPI-safe aesni_load="YES" nvme_load="YES" EOF echo '169.254.169.254 metadata.google.internal metadata' >> \ ${DESTDIR}/etc/hosts # overwrite ntp.conf cat << EOF > ${DESTDIR}/etc/ntp.conf server metadata.google.internal iburst restrict default kod nomodify notrap nopeer noquery restrict -6 default kod nomodify notrap nopeer noquery restrict 127.0.0.1 restrict -6 ::1 restrict 127.127.1.0 EOF cat << EOF >> ${DESTDIR}/etc/syslog.conf *.err;kern.warning;auth.notice;mail.crit /dev/console EOF cat << EOF >> ${DESTDIR}/etc/ssh/sshd_config KbdInteractiveAuthentication no X11Forwarding no AcceptEnv LANG AllowAgentForwarding no ClientAliveInterval 420 EOF cat << EOF >> ${DESTDIR}/etc/crontab 0 3 * * * root /usr/sbin/freebsd-update cron EOF cat << EOF >> ${DESTDIR}/etc/sysctl.conf net.inet.icmp.drop_redirect=1 net.inet.ip.redirect=0 kern.ipc.soacceptqueue=1024 debug.trace_on_panic=1 debug.debugger_on_panic=0 EOF # To meet GCE marketplace requirements, extract the src.txz and # ports.txz distributions to the target virtual machine disk image # and fetch the sources for the third-party software installed on # the image. if [ ! -c "${DESTDIR}/dev/null" ]; then DEVFSISOURS=1 mkdir -p ${DESTDIR}/dev mount -t devfs devfs ${DESTDIR}/dev fi if [ -e "${DESTDIR}/../ftp/src.txz" ]; then tar fxJ ${DESTDIR}/../ftp/src.txz -C ${DESTDIR} fi if [ -e "${DESTDIR}/../ftp/ports.txz" ]; then tar fxJ ${DESTDIR}/../ftp/ports.txz -C ${DESTDIR} _INSTALLED_PACKAGES=$(chroot ${DESTDIR} pkg info -o -q -a) for PACKAGE in ${_INSTALLED_PACKAGES}; do chroot ${DESTDIR} \ make -C /usr/ports/${PACKAGE} fetch done fi if [ "$DEVFSISOURS" = "1" ]; then umount_loop ${DESTDIR}/dev fi ## XXX: Verify this is needed. I do not see this requirement ## in the docs, and it impairs the ability to boot-test a copy ## of the image prior to packaging for upload to GCE. #sed -E -i '' 's/^([^#].*[[:space:]])on/\1off/' ${DESTDIR}/etc/ttys - touch ${DESTDIR}/firstboot - return 0 } # Do everything except deleting resolv.conf since we construct our own # Googlized resolv.conf file in vm_extra_install_base. vm_emulation_cleanup() { if [ -n "${QEMUSTATIC}" ]; then rm -f ${DESTDIR}/${EMULATOR} fi umount_loop ${DESTDIR}/dev return 0 } diff --git a/release/tools/openstack.conf b/release/tools/openstack.conf index 05d2d13bbb39..b73734a4fd04 100644 --- a/release/tools/openstack.conf +++ b/release/tools/openstack.conf @@ -1,52 +1,51 @@ #!/bin/sh # # # Set to a list of packages to install. export VM_EXTRA_PACKAGES="net/cloud-init devel/py-pbr devel/py-iso8601 \ net/py-eventlet net/py-netaddr comms/py-serial devel/py-six \ devel/py-babel net/py-oauth net/py-netifaces" # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="cloudinit" export NOSWAP=YES vm_extra_pre_umount() { #Enable sshd by default echo 'sshd_enable="YES"' >> ${DESTDIR}/etc/rc.conf # Disable DNS lookups by default to make SSH connect quickly echo 'UseDNS no' >> ${DESTDIR}/etc/ssh/sshd_config # Allow root to ssh using keys echo 'PermitRootLogin without-password' >> ${DESTDIR}/etc/ssh/sshd_config # Disable sendmail echo 'sendmail_enable="NO"' >> ${DESTDIR}/etc/rc.conf echo 'sendmail_submit_enable="NO"' >> ${DESTDIR}/etc/rc.conf echo 'sendmail_outbound_enable="NO"' >> ${DESTDIR}/etc/rc.conf echo 'sendmail_msp_queue_enable="NO"' >> ${DESTDIR}/etc/rc.conf # Enable DHCP for the OpenStack instance echo 'ifconfig_DEFAULT="SYNCDHCP"' >> ${DESTDIR}/etc/rc.conf # Openstack wants sudo(8) usable by default without a password. echo 'ALL ALL=(ALL) NOPASSWD:ALL' >> \ ${DESTDIR}/usr/local/etc/sudoers.d/cloud-init # The console is not interactive, so we might as well boot quickly. echo 'autoboot_delay="-1"' >> ${DESTDIR}/boot/loader.conf echo 'beastie_disable="YES"' >> ${DESTDIR}/boot/loader.conf echo 'boot_multicons="YES"' >> ${DESTDIR}/boot/loader.conf echo 'console="comconsole vidconsole"' >> ${DESTDIR}/boot/loader.conf echo 'comconsole_speed="115200"' >> ${DESTDIR}/boot/loader.conf # Reboot quickly, Don't wait at the panic screen echo 'debug.trace_on_panic=1' >> ${DESTDIR}/etc/sysctl.conf echo 'debug.debugger_on_panic=0' >> ${DESTDIR}/etc/sysctl.conf echo 'kern.panic_reboot_wait_time=0' >> ${DESTDIR}/etc/sysctl.conf - touch ${DESTDIR}/firstboot return 0 } diff --git a/release/tools/oracle.conf b/release/tools/oracle.conf index 72c8dd9ded78..688820be9cbe 100644 --- a/release/tools/oracle.conf +++ b/release/tools/oracle.conf @@ -1,93 +1,91 @@ #!/bin/sh # Set to a list of packages to install. export VM_EXTRA_PACKAGES=" comms/py-pyserial converters/base64 devel/oci-cli devel/py-babel devel/py-iso8601 devel/py-pbr devel/py-six ftp/curl lang/python lang/python3 net/cloud-init net/py-eventlet net/py-netaddr net/py-netifaces net/py-oauth net/rsync security/ca_root_nss security/sudo@default sysutils/firstboot-freebsd-update sysutils/firstboot-pkgs sysutils/panicmail textproc/jq " # Should be enough for base image, image can be resized in needed export VMSIZE=8g # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST=" cloudinit firstboot_pkgs firstboot_freebsd_update growfs ntpd ntpd_sync_on_start sshd zfs" vm_extra_pre_umount() { cat <<-'EOF' >> ${DESTDIR}/etc/rc.conf dumpdev=AUTO sendmail_enable=NONE EOF cat <<-'EOF' >> ${DESTDIR}/boot/loader.conf autoboot_delay="5" beastie_disable="YES" boot_serial="YES" loader_logo="none" cryptodev_load="YES" opensolaris_load="YES" xz_load="YES" zfs_load="YES" EOF cat <<-'EOF' >> ${DESTDIR}/etc/ssh/sshd_config # S11 Configure the SSH service to prevent password-based login PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no UseDNS no EOF # S14 Root user login must be disabled on serial-over-ssh console pw -R ${DESTDIR} usermod root -w no # Oracle requirements override the default FreeBSD cloud-init settings cat <<-'EOF' >> ${DESTDIR}/usr/local/etc/cloud/cloud.cfg.d/98_oracle.cfg disable_root: true system_info: distro: freebsd default_user: name: freebsd lock_passwd: True gecos: "Oracle Cloud Default User" groups: [wheel] sudo: ["ALL=(ALL) NOPASSWD:ALL"] shell: /bin/sh network: renderers: ['freebsd'] EOF # Use Oracle Cloud Infrastructure NTP server sed -i '' -E -e 's/^pool.*iburst/server 169.254.169.254 iburst/' \ ${DESTDIR}/etc/ntp.conf - touch ${DESTDIR}/firstboot - return 0 } diff --git a/release/tools/vmimage.subr b/release/tools/vmimage.subr index 32eec6f220e7..41f889a1e665 100644 --- a/release/tools/vmimage.subr +++ b/release/tools/vmimage.subr @@ -1,382 +1,381 @@ #!/bin/sh # # # # Common functions for virtual machine image build scripts. # scriptdir=$(dirname $(realpath $0)) . ${scriptdir}/../scripts/tools.subr . ${scriptdir}/../../tools/boot/install-boot.sh export PATH="/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin" trap "cleanup" INT QUIT TRAP ABRT TERM # Platform-specific large-scale setup # Most platforms use GPT, so put that as default, then special cases PARTSCHEME=gpt ROOTLABEL="gpt" case "${TARGET}:${TARGET_ARCH}" in powerpc:powerpc*) PARTSCHEME=mbr ROOTLABEL="ufs" NOSWAP=yes # Can't label swap partition with MBR, so no swap ;; esac err() { printf "${@}\n" cleanup return 1 } cleanup() { if [ -c "${DESTDIR}/dev/null" ]; then umount_loop ${DESTDIR}/dev 2>/dev/null fi return 0 } metalog_add_data() { local file mode type if [ -n "${NO_ROOT}" ]; then file=$1 if [ -f ${DESTDIR}/${file} ]; then type=file mode=${2:-0644} elif [ -d ${DESTDIR}/${file} ]; then type=dir mode=${2:-0755} else echo "metalog_add_data: ${file} not found" >&2 return 1 fi echo "${file} type=${type} uname=root gname=wheel mode=${mode}" >> \ ${DESTDIR}/METALOG fi } vm_create_base() { mkdir -p ${DESTDIR} return 0 } vm_copy_base() { # Defunct return 0 } vm_install_base() { # Installs the FreeBSD userland/kernel to the virtual machine disk. cd ${WORLDDIR} && \ make DESTDIR=${DESTDIR} ${INSTALLOPTS} \ installworld installkernel distribution || \ err "\n\nCannot install the base system to ${DESTDIR}." # Bootstrap etcupdate(8) database. mkdir -p ${DESTDIR}/var/db/etcupdate etcupdate extract -B \ -M "TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH}" \ -s ${WORLDDIR} -d ${DESTDIR}/var/db/etcupdate \ -L /dev/stdout ${NO_ROOT:+-N} if [ -n "${NO_ROOT}" ]; then # Reroot etcupdate's internal METALOG to the whole tree sed -n 's,^\.,./var/db/etcupdate/current,p' \ ${DESTDIR}/var/db/etcupdate/current/METALOG | \ env -i LC_COLLATE=C sort >> ${DESTDIR}/METALOG rm ${DESTDIR}/var/db/etcupdate/current/METALOG fi echo '# Custom /etc/fstab for FreeBSD VM images' \ > ${DESTDIR}/etc/fstab if [ "${VMFS}" != zfs ]; then echo "/dev/${ROOTLABEL}/rootfs / ${VMFS} rw,noatime 1 1" \ >> ${DESTDIR}/etc/fstab fi if [ -z "${NOSWAP}" ]; then echo '/dev/gpt/swapfs none swap sw 0 0' \ >> ${DESTDIR}/etc/fstab fi metalog_add_data ./etc/fstab local hostname hostname="$(echo $(uname -o) | tr '[:upper:]' '[:lower:]')" echo "hostname=\"${hostname}\"" >> ${DESTDIR}/etc/rc.conf metalog_add_data ./etc/rc.conf if [ "${VMFS}" = zfs ]; then echo "zfs_enable=\"YES\"" >> ${DESTDIR}/etc/rc.conf echo "zpool_reguid=\"zroot\"" >> ${DESTDIR}/etc/rc.conf echo "zpool_upgrade=\"zroot\"" >> ${DESTDIR}/etc/rc.conf echo "kern.geom.label.disk_ident.enable=0" >> ${DESTDIR}/boot/loader.conf echo "zfs_load=YES" >> ${DESTDIR}/boot/loader.conf metalog_add_data ./boot/loader.conf fi return 0 } vm_emulation_setup() { if [ -n "${WITHOUT_QEMU}" ]; then return 0 fi if [ -n "${QEMUSTATIC}" ]; then export EMULATOR=/qemu cp ${QEMUSTATIC} ${DESTDIR}/${EMULATOR} fi mkdir -p ${DESTDIR}/dev mount -t devfs devfs ${DESTDIR}/dev chroot ${DESTDIR} ${EMULATOR} /bin/sh /etc/rc.d/ldconfig forcestart cp /etc/resolv.conf ${DESTDIR}/etc/resolv.conf return 0 } vm_extra_install_base() { # Prototype. When overridden, runs extra post-installworld commands # as needed, based on the target virtual machine image or cloud # provider image target. return 0 } vm_extra_enable_services() { if [ -n "${VM_RC_LIST}" ]; then for _rcvar in ${VM_RC_LIST}; do echo ${_rcvar}_enable="YES" >> ${DESTDIR}/etc/rc.conf done fi if [ -z "${VMCONFIG}" -o -c "${VMCONFIG}" ]; then echo 'ifconfig_DEFAULT="DHCP inet6 accept_rtadv"' >> \ ${DESTDIR}/etc/rc.conf # Expand the filesystem to fill the disk. echo 'growfs_enable="YES"' >> ${DESTDIR}/etc/rc.conf - touch ${DESTDIR}/firstboot fi return 0 } vm_extra_install_packages() { if [ -n "${WITHOUT_QEMU}" ]; then return 0 fi if [ -z "${VM_EXTRA_PACKAGES}" ]; then return 0 fi chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ /usr/sbin/pkg bootstrap -y for p in ${VM_EXTRA_PACKAGES}; do chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ /usr/sbin/pkg install -y ${p} done return 0 } vm_extra_install_ports() { # Prototype. When overridden, installs additional ports within the # virtual machine environment. return 0 } vm_extra_pre_umount() { # Prototype. When overridden, performs additional tasks within the # virtual machine environment prior to unmounting the filesystem. return 0 } vm_emulation_cleanup() { if [ -n "${WITHOUT_QEMU}" ]; then return 0 fi if ! [ -z "${QEMUSTATIC}" ]; then rm -f ${DESTDIR}/${EMULATOR} fi rm -f ${DESTDIR}/etc/resolv.conf umount_loop ${DESTDIR}/dev return 0 } vm_extra_pkg_rmcache() { if [ -e ${DESTDIR}/usr/local/sbin/pkg ]; then chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ /usr/local/sbin/pkg clean -y -a fi return 0 } buildfs() { local md tmppool case "${VMFS}" in ufs) cd ${DESTDIR} && ${MAKEFS} ${MAKEFSARGS} -o label=rootfs -o version=2 -o softupdates=1 \ ${VMBASE} .${NO_ROOT:+/METALOG} ;; zfs) cd ${DESTDIR} && ${MAKEFS} -t zfs ${MAKEFSARGS} \ -o poolname=zroot -o bootfs=zroot/ROOT/default -o rootpath=/ \ -o fs=zroot\;mountpoint=none \ -o fs=zroot/ROOT\;mountpoint=none \ -o fs=zroot/ROOT/default\;mountpoint=/\;canmount=noauto \ -o fs=zroot/home\;mountpoint=/home \ -o fs=zroot/tmp\;mountpoint=/tmp\;exec=on\;setuid=off \ -o fs=zroot/usr\;mountpoint=/usr\;canmount=off \ -o fs=zroot/usr/ports\;setuid=off \ -o fs=zroot/usr/src \ -o fs=zroot/usr/obj \ -o fs=zroot/var\;mountpoint=/var\;canmount=off \ -o fs=zroot/var/audit\;setuid=off\;exec=off \ -o fs=zroot/var/crash\;setuid=off\;exec=off \ -o fs=zroot/var/log\;setuid=off\;exec=off \ -o fs=zroot/var/mail\;atime=on \ -o fs=zroot/var/tmp\;setuid=off \ ${VMBASE} .${NO_ROOT:+/METALOG} ;; *) echo "Unexpected VMFS value '${VMFS}'" exit 1 ;; esac } umount_loop() { DIR=$1 i=0 sync while ! umount ${DIR}; do i=$(( $i + 1 )) if [ $i -ge 10 ]; then # This should never happen. But, it has happened. echo "Cannot umount(8) ${DIR}" echo "Something has gone horribly wrong." return 1 fi sleep 1 done return 0 } vm_create_disk() { local BOOTFILES BOOTPARTSOFFSET FSPARTTYPE X86GPTBOOTFILE if [ -z "${NOSWAP}" ]; then SWAPOPT="-p freebsd-swap/swapfs::${SWAPSIZE}" fi if [ -n "${VM_BOOTPARTSOFFSET}" ]; then BOOTPARTSOFFSET=":${VM_BOOTPARTSOFFSET}" fi if [ -n "${CONFIG_DRIVE}" ]; then CONFIG_DRIVE="-p freebsd/config-drive::${CONFIG_DRIVE_SIZE}" fi case "${VMFS}" in ufs) FSPARTTYPE=freebsd-ufs X86GPTBOOTFILE=i386/gptboot/gptboot ;; zfs) FSPARTTYPE=freebsd-zfs X86GPTBOOTFILE=i386/gptzfsboot/gptzfsboot ;; *) echo "Unexpected VMFS value '${VMFS}'" return 1 ;; esac echo "Creating image... Please wait." echo BOOTFILES="$(env TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH} \ WITH_UNIFIED_OBJDIR=yes \ make -C ${WORLDDIR}/stand -V .OBJDIR)" BOOTFILES="$(realpath ${BOOTFILES})" MAKEFSARGS="-s ${VMSIZE} -D" case "${TARGET}:${TARGET_ARCH}" in amd64:amd64 | i386:i386) ESP=yes BOOTPARTS="-b ${BOOTFILES}/i386/pmbr/pmbr \ -p freebsd-boot/bootfs:=${BOOTFILES}/${X86GPTBOOTFILE}${BOOTPARTSOFFSET}" ROOTFSPART="-p ${FSPARTTYPE}/rootfs:=${VMBASE}" MAKEFSARGS="$MAKEFSARGS -B little" ;; arm:armv7 | arm64:aarch64 | riscv:riscv64*) ESP=yes BOOTPARTS= ROOTFSPART="-p ${FSPARTTYPE}/rootfs:=${VMBASE}" MAKEFSARGS="$MAKEFSARGS -B little" ;; powerpc:powerpc*) ESP=no BOOTPARTS="-p prepboot:=${BOOTFILES}/powerpc/boot1.chrp/boot1.elf -a 1" ROOTFSPART="-p freebsd:=${VMBASE}" if [ ${TARGET_ARCH} = powerpc64le ]; then MAKEFSARGS="$MAKEFSARGS -B little" else MAKEFSARGS="$MAKEFSARGS -B big" fi ;; *) echo "vmimage.subr: unsupported target '${TARGET}:${TARGET_ARCH}'" >&2 exit 1 ;; esac if [ ${ESP} = "yes" ]; then # Create an ESP espfilename=$(mktemp /tmp/efiboot.XXXXXX) make_esp_file ${espfilename} ${fat32min} ${BOOTFILES}/efi/loader_lua/loader_lua.efi BOOTPARTS="${BOOTPARTS} -p efi/efiboot0:=${espfilename}" # Add this to fstab mkdir -p ${DESTDIR}/boot/efi echo "/dev/${ROOTLABEL}/efiboot0 /boot/efi msdosfs rw 2 2" \ >> ${DESTDIR}/etc/fstab fi + # Add a marker file which indicates that this image has never + # been booted. Some services run only upon the first boot. + touch ${DESTDIR}/firstboot + metalog_add_data ./firstboot + echo "Building filesystem... Please wait." buildfs echo "Building final disk image... Please wait." ${MKIMG} -s ${PARTSCHEME} -f ${VMFORMAT} \ ${BOOTPARTS} \ ${SWAPOPT} \ ${CONFIG_DRIVE} \ ${ROOTFSPART} \ -o ${VMIMAGE} echo "Disk image ${VMIMAGE} created." if [ ${ESP} = "yes" ]; then rm ${espfilename} fi return 0 } vm_extra_create_disk() { return 0 } - -touch_firstboot() { - touch ${DESTDIR}/firstboot - metalog_add_data ./firstboot -} diff --git a/tests/ci/tools/ci.conf b/tests/ci/tools/ci.conf index 1d2921ab75f3..2302fc479a47 100644 --- a/tests/ci/tools/ci.conf +++ b/tests/ci/tools/ci.conf @@ -1,136 +1,135 @@ #!/bin/sh # # SPDX-License-Identifier: BSD-2-Clause # # Copyright (c) 2024 The FreeBSD Foundation # # This software was developed by Cybermancer Infosec # under sponsorship from the FreeBSD Foundation. # # Set to a list of third-party software to enable in rc.conf(5). export VM_RC_LIST="auditd freebsdci" if [ "${CITYPE}" != "smoke" ]; then export VM_EXTRA_PACKAGES=" archivers/gtar devel/git devel/gdb devel/py-pytest perl5 lang/python lang/python3 net/isc-dhcp44-server net/ndisc6 net/py-dpkt net/scapy net/tcptestsuite security/nist-kat security/nmap security/openvpn security/sudo shells/ksh93 sysutils/coreutils sysutils/porch sysutils/sg3_utils textproc/jq " if [ "${TARGET}" = "amd64" ]; then export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} devel/linux-ltp" fi fi vm_extra_pre_umount() { cat << EOF >> ${DESTDIR}/boot/loader.conf autoboot_delay=1 beastie_disable="YES" loader_logo="none" console="comconsole,vidconsole" net.fibs=3 net.inet.ip.fw.default_to_accept=1 mac_bsdextended_load="YES" vfs.zfs.arc_max=4294967296 kern.vty=sc EOF cat << EOF >> ${DESTDIR}/etc/kyua/kyua.conf test_suites.FreeBSD.ci = 'true' test_suites.FreeBSD.fibs = '1 2' test_suites.FreeBSD.allow_sysctl_side_effects = '1' test_suites.FreeBSD.cam_test_device = '/dev/ada0' test_suites.FreeBSD.disks = '/dev/vtbd2 /dev/vtbd3 /dev/vtbd4 /dev/vtbd5 /dev/vtbd6' EOF cat << EOF >> ${DESTDIR}/etc/rc.conf kld_list="" # Load modules needed by tests kld_list="\${kld_list} accf_data" # sys/kern/socket_accf kld_list="\${kld_list} accf_dns" # sys/kern/socket_accf kld_list="\${kld_list} accf_http" # sys/kern/socket_accf kld_list="\${kld_list} accf_tls" # sys/kern/socket_accf kld_list="\${kld_list} blake2" # sys/opencrypto kld_list="\${kld_list} carp" # sys/netinet/carp kld_list="\${kld_list} cryptodev" # sys/opencrypto kld_list="\${kld_list} dummymbuf" # sys/netpfil kld_list="\${kld_list} dummynet" # sys/netpfil/common kld_list="\${kld_list} fusefs" # sys/fs/fusefs kld_list="\${kld_list} if_bridge" # sys/net/if_bridge_test kld_list="\${kld_list} if_enc" # sys/netpfil/pf kld_list="\${kld_list} if_epair" # sys/net/if_epair_test kld_list="\${kld_list} if_ovpn" # sys/net/if_ovpn kld_list="\${kld_list} if_stf" # sys/net/if_stf kld_list="\${kld_list} ipdivert" # sys/netinet (loads ipdivert) kld_list="\${kld_list} ipfw" # sys/netpfil/ipfw (loads ipfw) kld_list="\${kld_list} ipfw_nat" # sys/netpfil/ipfw (loads ipfw_nat) kld_list="\${kld_list} ipl" # sys/sbin/ipf (loads ipfilter) kld_list="\${kld_list} ipsec" # sys/netipsec kld_list="\${kld_list} mac_portacl" # sys/mac/portacl kld_list="\${kld_list} mqueuefs" # sys/kern/mqueue_test kld_list="\${kld_list} pf" # sys/netpfil/pf kld_list="\${kld_list} pflog" # sys/netpfil/pf kld_list="\${kld_list} pflow" # sys/netpfil/pf kld_list="\${kld_list} pfsync" # sys/netpfil/pf (loads pf) kld_list="\${kld_list} sctp" # sys/netpfil/pf kld_list="\${kld_list} tarfs" # sys/fs/tarfs kld_list="\${kld_list} tcpmd5" # sys/netinet background_fsck="NO" sendmail_enable="NONE" cron_enable="NO" syslogd_enable="NO" newsyslog_enable="NO" EOF if [ "${CITYPE}" = "smoke" ]; then cat << EOF >> ${DESTDIR}/etc/rc.conf freebsdci_type="smoke" EOF elif [ "${CITYPE}" = "full" ]; then cat << EOF >> ${DESTDIR}/etc/rc.conf freebsdci_type="full" freebsdci_test_filters="${KYUA_TEST_FILTERS}" EOF fi cat << EOF >> ${DESTDIR}/etc/sysctl.conf kern.cryptodevallowsoft=1 kern.ipc.tls.enable=1 net.add_addr_allfibs=0 security.mac.bsdextended.enabled=0 vfs.aio.enable_unsafe=1 vfs.usermount=1 EOF cat << EOF >> ${DESTDIR}/etc/fstab fdesc /dev/fd fdescfs rw 0 0 EOF mkdir -p ${DESTDIR}/usr/local/etc/rc.d cp -p ${scriptdir}/../../tests/ci/tools/freebsdci ${DESTDIR}/usr/local/etc/rc.d/ - touch ${DESTDIR}/firstboot return 0 } vm_extra_pkg_rmcache() { if [ -e ${DESTDIR}/usr/local/sbin/pkg ]; then mount -t devfs devfs ${DESTDIR}/dev chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \ /usr/local/sbin/pkg clean -a umount_loop ${DESTDIR}/dev fi return 0 }