diff --git a/sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild b/sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild new file mode 100644 index 00000000000..38c270998fe --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild @@ -0,0 +1,9 @@ +# Copyright 2026 The Flatcar Maintainers. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=9 + +inherit acct-group + +ACCT_GROUP_ID=500 +ACCT_GROUP_ENFORCE_ID=yes diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/metadata.xml b/sdk_container/src/third_party/coreos-overlay/acct-group/core/metadata.xml similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/metadata.xml rename to sdk_container/src/third_party/coreos-overlay/acct-group/core/metadata.xml diff --git a/sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild b/sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild new file mode 100644 index 00000000000..bcbca0a4937 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild @@ -0,0 +1,64 @@ +# Copyright 2026 Flatcar Maintainers +# Distributed under the terms of the GNU General Public License v2 + +# Can't be 9 - tmpfiles eclass does not support it yet. +EAPI=8 + +TMPFILES_OPTIONAL=yes +inherit acct-user tmpfiles + +ACCT_USER_ID=500 +ACCT_USER_ENFORCE_ID=yes +ACCT_USER_COMMENT="Flatcar Admin" +ACCT_USER_HOME="/home/core" +ACCT_USER_SHELL="/bin/bash" +ACCT_USER_GROUPS=( core docker wheel systemd-journal portage ) + +acct-user_add_deps + +# coreutils for realpath +BDEPEND+=" + sys-apps/coreutils +" + +declare -A CORE_BASH_SYMLINKS +CORE_BASH_SYMLINKS=( + ['.bash_logout']='/usr/share/flatcar/etc/skel/.bash_logout' + ['.bash_profile']='/usr/share/flatcar/etc/skel/.bash_profile' + ['.bashrc']='/usr/share/flatcar/etc/skel/.bashrc' +) + +src_compile() { + # Generate the tmpfiles config file for bash symlinks in + # core's home directory. + local config config_tmp name target + config="${T}/home-core-bash-symlinks.conf" + config_tmp="${config}.tmp" + truncate --size 0 "${config_tmp}" + for name in "${!CORE_BASH_SYMLINKS[@]}"; do + target=${CORE_BASH_SYMLINKS["${name}"]} + target=$(realpath --relative-to="${ACCT_USER_HOME}" --canonicalize-missing --no-symlinks "${target}") + echo "L ${ACCT_USER_HOME}/${name} - core core - ${target}" >>"${config_tmp}" + done + LC_ALL=C sort "${config_tmp}" >"${config}" +} + +src_install() { + acct-user_src_install + dotmpfiles "${T}/home-core-bash-symlinks.conf" +} + +pkg_postinst() { + acct-user_pkg_postinst + local t n i name + read t n i <"${EROOT}/usr/lib/sysusers.d/acct-group-core.conf" || die + for name in "${!CORE_BASH_SYMLINKS[@]}"; do + target=${CORE_BASH_SYMLINKS["${name}"]} + link="${ACCT_USER_HOME}/${name}" + ln -sfT "${target}" "${EROOT}${link}" || die + chown --no-dereference ${ACCT_USER_ID}:${i} "${EROOT}${link}" || die + done + # we are putting things into the home directory, drop the + # keepdir artifact + rm -f "${EROOT}${ACCT_USER_HOME}/.keep_acct-user_core-"* || die +} diff --git a/sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml b/sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml new file mode 100644 index 00000000000..7c900b19e8e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml @@ -0,0 +1,4 @@ + + + + diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index e7023163305..155746c2533 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -114,7 +114,7 @@ RDEPEND="${RDEPEND} coreos-base/afterburn coreos-base/coreos-cloudinit coreos-base/coreos-init - coreos-base/misc-files + coreos-base/old-oem-files coreos-base/update-ssh-keys coreos-base/update_engine coreos-base/ue-rs @@ -219,9 +219,11 @@ RDEPEND+=" # Group and user packages to eventually replace passwd in baselayout. RDEPEND="${RDEPEND} + acct-group/core acct-group/floppy acct-group/man acct-group/uucp + acct-user/core acct-user/man " diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules deleted file mode 100644 index f43e62771cc..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules +++ /dev/null @@ -1,3 +0,0 @@ -# First rule - delete all -# This is to clear out old rules, so we don't append to them. --D diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules deleted file mode 100644 index 627b17db3f4..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules +++ /dev/null @@ -1,4 +0,0 @@ -# Enable all SELinux related events -# 1400 to 1499 are for kernel SELinux use (see /include/uapi/linux/audit.h) - --a exclude,never -F msgtype>=1400 -F msgtype<=1499 diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules deleted file mode 100644 index cc373d84068..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules +++ /dev/null @@ -1,5 +0,0 @@ -# Always report changes to the audit subsystem itself. --a exclude,never -F msgtype=CONFIG_CHANGE - -# Ignore everything else. --a exclude,always -F msgtype>0 diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash deleted file mode 100644 index 15ca68cd81c..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash +++ /dev/null @@ -1,5 +0,0 @@ -for iovisor_bcc_tool in tcpretrans tcpconnect tcpaccept biolatency; do - alias "iovisor-${iovisor_bcc_tool}=docker run --rm -it -v /lib/modules:/lib/modules -v /sys/kernel/debug:/sys/kernel/debug -v /sys/fs/cgroup:/sys/fs/cgroup -v /sys/fs/bpf:/sys/fs/bpf --privileged --net host --pid host quay.io/iovisor/bcc /usr/share/bcc/tools/${iovisor_bcc_tool}" -done - -unset -v iovisor_bcc_tool diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf deleted file mode 100644 index f2947d94d1a..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Service] -Environment="SERVER=0.flatcar.pool.ntp.org 1.flatcar.pool.ntp.org 2.flatcar.pool.ntp.org 3.flatcar.pool.ntp.org" diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf deleted file mode 100644 index cc9a441b7be..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf +++ /dev/null @@ -1,68 +0,0 @@ -# NOTES: -# DHCP clients can append or replace NTP configuration files. -# You should consult your DHCP client documentation about its -# default behaviour and how to change it. - -# Name of the servers ntpd should sync with -# Please respect the access policy as stated by the responsible person. -#server ntp.example.tld iburst - -# Common pool for random people -#server pool.ntp.org - -# AWS Time Sync Service. -server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4 -# AWS Time Sync Service IPv6: -server fd00:ec2::123 prefer iburst minpoll 4 maxpoll 4 - -# GCP NTP Service -server metadata.google.internal prefer iburst - -# Pools for Flatcar users -server 0.flatcar.pool.ntp.org -server 1.flatcar.pool.ntp.org -server 2.flatcar.pool.ntp.org -server 3.flatcar.pool.ntp.org - -## -# A list of available servers can be found here: -# http://www.pool.ntp.org/ -# http://www.pool.ntp.org/#use -# A good way to get servers for your machine is: -# netselect -s 3 pool.ntp.org -## - -# you should not need to modify the following paths -driftfile /var/lib/ntp/ntp.drift - -#server ntplocal.example.com prefer -#server timeserver.example.org - -# Warning: Using default NTP settings will leave your NTP -# server accessible to all hosts on the Internet. - -# If you want to deny all machines (including your own) -# from accessing the NTP server, uncomment: -#restrict default ignore - - -# Default configuration: -# - Allow only time queries, at a limited rate, sending KoD when in excess. -# - Allow all local queries (IPv4, IPv6) -# From commit da515112395ea7ce0da7cba7103de65d53fc93c9: -# -# net-misc/ntp: add notrap to default restrict config -# -# It's a common security hardening option and doesn't seem likely to -# affect any actual usage. -restrict default nomodify nopeer noquery notrap limited kod -restrict 127.0.0.1 -restrict [::1] - - -# To allow machines within your network to synchronize -# their clocks with your server, but ensure they are -# not allowed to configure the server or used as peers -# to synchronize against, uncomment this line. -# -#restrict 192.168.0.0 mask 255.255.255.0 nomodify nopeer notrap diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf deleted file mode 100644 index a73e63da667..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf +++ /dev/null @@ -1,14 +0,0 @@ -[Service] -# From commit 5e5abb4d7ea48a9238b9baa22941fda6a6bbda8c: -# -# ntpd: always restart, required to handle large time jumps. -# -# Some VM platforms suspend machines by simply stopping them instead of -# gracefully suspending them like real hardware would. This means that -# when the system is resumed the kernel's time will be completely wrong -# and it doesn't have a way to fix it. Additionally ntp will abort if the -# clock offset is greater than 1000 seconds (conveniently without logging -# any error messages). We can tune that in ntp.conf but ntpd has so many -# knobs related to how it skews the clock and other update strategies that -# the easiest option is to just restart. -Restart=always diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf deleted file mode 100644 index 1a88c1614ca..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf +++ /dev/null @@ -1 +0,0 @@ -# Use defaults for ssh client system-wide configuration. diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf deleted file mode 100644 index bdad9639ad6..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf +++ /dev/null @@ -1,22 +0,0 @@ -# Use most defaults for sshd configuration. -Subsystem sftp internal-sftp -ClientAliveInterval 180 - -# These are either defaults or already set up by config generated by -# the Gentoo ebuild. But we need to keep them, as the older -# installations may still use the old symlink from -# /etc/ssh/sshd_config to /usr/share/ssh/sshd_config. -# -# BEGIN SETTINGS KEPT FOR COMPATIBILITY -UseDNS no -UsePAM yes -# handled by PAM -PrintLastLog no -# handled by PAM -PrintMotd no -# END SETTINGS KEPT FOR COMPATIBILITY - -# Temporarily accept ssh-rsa algorithm for openssh >= 8.8, -# until most ssh clients could deprecate ssh-rsa. -HostkeyAlgorithms +ssh-rsa -PubkeyAcceptedAlgorithms +ssh-rsa diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf deleted file mode 100644 index da57a42f47b..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Socket] -TriggerLimitBurst=0 diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf deleted file mode 100644 index f763cf3e45f..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf +++ /dev/null @@ -1,2 +0,0 @@ -#Type Path Mode UID GID Age Argument -L /var/lib/selinux/ - - - - ../../usr/lib/selinux/policy diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild deleted file mode 100644 index 15a0374c975..00000000000 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild +++ /dev/null @@ -1,207 +0,0 @@ -# Copyright (c) 2023 The Flatcar Maintainers. -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -TMPFILES_OPTIONAL=1 -inherit systemd tmpfiles - -DESCRIPTION='Flatcar miscellaneous files' -HOMEPAGE='https://www.flatcar.org/' - -LICENSE='Apache-2.0' -SLOT='0' -KEYWORDS='amd64 arm64' -IUSE="audit ntp openssh policycoreutils" - -# No source directory. -S="${WORKDIR}" - -# Versions listed below are version of packages that shedded the -# modifications in their ebuilds. -# -# net-misc/openssh must be installed on host for enabling its unit to -# work during installation. -DEPEND=" - openssh? ( >=net-misc/openssh-9.4_p1 ) -" - -# Versions listed below are version of packages that shedded the -# modifications in their ebuilds. -RDEPEND=" - ${DEPEND} - >=app-shells/bash-5.2_p15-r2 - ntp? ( >=net-misc/ntp-4.2.8_p17 ) - policycoreutils? ( >=sys-apps/policycoreutils-3.6 ) - audit? ( >=sys-process/audit-4.0.1-r1 ) -" - -declare -A CORE_BASH_SYMLINKS -CORE_BASH_SYMLINKS=( - ['.bash_logout']='../../usr/share/flatcar/etc/skel/.bash_logout' - ['.bash_profile']='../../usr/share/flatcar/etc/skel/.bash_profile' - ['.bashrc']='../../usr/share/flatcar/etc/skel/.bashrc' -) - -src_compile() { - # An empty file for temporary symlink destinations under - # /usr/share/flatcar/etc. - touch "${T}/empty-file" - # Generate the tmpfiles config file for bash symlinks in core home - # directory. - local name config config_tmp target - config="${T}/home-core-bash-symlinks.conf" - config_tmp="${config}.tmp" - truncate --size 0 "${config_tmp}" - for name in "${!CORE_BASH_SYMLINKS[@]}"; do - target=${CORE_BASH_SYMLINKS["${name}"]} - echo "L /home/core/${name} - core core - ${target}" >>"${config_tmp}" - done - LC_ALL=C sort "${config_tmp}" >"${config}" -} - -misc_files_install_dropin() { - local unit conf - unit=${1}; shift - conf=${1}; shift - - [[ -n ${unit} ]] || die "No unit specified" - [[ -n ${conf} ]] || die "No conf file specified" - [[ ${conf} = *.conf ]] || die "Conf file must have .conf suffix" - - local override_dir - override_dir="$(systemd_get_systemunitdir)/${unit}.d" - ( - insopts -m 0644 - insinto "${override_dir}" - doins "${conf}" - ) -} - -src_install() { - # Use absolute paths to be clear about what locations are used. The - # dosym below will make relative paths out of them. - # - # For files inside /usr/share/flatcar/etc the ebuild will create empty - # files to avoid having dangling symlinks. During the assembly of the - # image, the /usr/share/flatcar/etc directory will be removed, and - # /etc will be moved in its place. - # - # These links exist because old installations can still have - # references to them. - local -A compat_symlinks - compat_symlinks=( - ['/usr/share/bash/bash_logout']='/usr/share/flatcar/etc/bash/bash_logout' - ['/usr/share/bash/bashrc']='/usr/share/flatcar/etc/bash/bashrc' - ['/usr/share/skel/.bash_logout']='/usr/share/flatcar/etc/skel/.bash_logout' - ['/usr/share/skel/.bash_profile']='/usr/share/flatcar/etc/skel/.bash_profile' - ['/usr/share/skel/.bashrc']='/usr/share/flatcar/etc/skel/.bashrc' - ['/usr/lib/selinux/config']='/usr/share/flatcar/etc/selinux/config' - ['/usr/lib/selinux/mcs']='/usr/share/flatcar/etc/selinux/mcs' - ['/usr/lib/selinux/semanage.conf']='/usr/share/flatcar/etc/selinux/semanage.conf' - ) - if use audit; then - compat_symlinks+=( - ['/usr/share/audit/rules.d/00-clear.rules']='/usr/share/flatcar/etc/audit/rules.d/00-clear.rules' - ['/usr/share/audit/rules.d/80-selinux.rules']='/usr/share/flatcar/etc/audit/rules.d/80-selinux.rules' - ['/usr/share/audit/rules.d/99-default.rules']='/usr/share/flatcar/etc/audit/rules.d/99-default.rules' - ['/usr/share/auditd/auditd.conf']='/usr/share/flatcar/etc/audit/auditd.conf' - ) - fi - if use ntp; then - compat_symlinks+=( - ['/usr/share/ntp/ntp.conf']='/usr/share/flatcar/etc/ntp.conf' - ) - fi - if use openssh; then - compat_symlinks+=( - ['/usr/share/ssh/ssh_config']='/usr/share/flatcar/etc/ssh/ssh_config.d/50-flatcar-ssh.conf' - ['/usr/share/ssh/sshd_config']='/usr/share/flatcar/etc/ssh/sshd_config.d/50-flatcar-sshd.conf' - ) - fi - - local link target - for link in "${!compat_symlinks[@]}"; do - target=${compat_symlinks["${link}"]} - dosym -r "${target}" "${link}" - if [[ "${target}" = /usr/share/flatcar/etc/* ]]; then - insinto "${target%/*}" - newins "${T}/empty-file" "${target##*/}" - fi - done - - insinto '/etc/bash/bashrc.d' - doins "${FILESDIR}/bash/99-flatcar-bcc.bash" - - insinto '/usr/share/flatcar' - # The "oems" folder should contain a file "$OEMID" for each expected OEM sysext and - # either be empty or contain a newline-separated list of files to delete during the - # migration (done from the initrd). The existence of the file will help old clients - # to do the fallback download of the sysext payload in the postinstall hook. - # The paths should use /oem instead of /usr/share/oem/ to avoid symlink resolution. - doins -r "${FILESDIR}"/oems - - dotmpfiles "${T}/home-core-bash-symlinks.conf" - # Ideally we would be calling systemd-tmpfiles to create the - # symlinks, but at this point systemd may not have any info about - # the core user. Thus we hardcode the id 500. - dodir /home/core - fowners 500:500 /home/core - local name - for name in "${!CORE_BASH_SYMLINKS[@]}"; do - target=${CORE_BASH_SYMLINKS["${name}"]} - link="/home/core/${name}" - dosym "${target}" "${link}" - fowners --no-dereference 500:500 "${link}" - done - - if use audit; then - # Install our rules. - insinto /etc/audit/rules.d - for name in 00-clear.rules 80-selinux.rules 99-default.rules; do - doins "${FILESDIR}/audit/${name}" - # Upstream wants these to have restrictive perms. - fperms 0640 "/etc/audit/rules.d/${name}" - done - # Enable audit-rules.service by default. - systemd_enable_service multi-user.target audit-rules.service - fi - - if use ntp; then - insinto /etc - doins "${FILESDIR}/ntp/ntp.conf" - misc_files_install_dropin ntpd.service "${FILESDIR}/ntp/ntpd-always-restart.conf" - misc_files_install_dropin ntpdate.service "${FILESDIR}/ntp/ntp-environment.conf" - misc_files_install_dropin sntp.service "${FILESDIR}/ntp/ntp-environment.conf" - fi - - if use openssh; then - # Install our configuration snippets. - insinto /etc/ssh/ssh_config.d - doins "${FILESDIR}/openssh/50-flatcar-ssh.conf" - insinto /etc/ssh/sshd_config.d - doins "${FILESDIR}/openssh/50-flatcar-sshd.conf" - - # Install our socket drop-in file that disables the rate - # limiting on the sshd socket. - misc_files_install_dropin sshd.socket "${FILESDIR}/openssh/no-trigger-limit-burst.conf" - - # Enable some sockets that aren't enabled by their own ebuilds. - systemd_enable_service sockets.target sshd.socket - fi - - if use policycoreutils; then - # Exceptionally, the location for policy definitions is set up - # in profiles/coreos/base/profile.bashrc. See the comment for - # cros_post_src_install_set_up_var_lib_selinux for reasoning. - # - # Recreate the symlink in /var in case of wiping the root - # filesystem. - dotmpfiles "${FILESDIR}/selinux/10-var-lib-selinux.conf" - fi - - # Create a symlink for Kubernetes to redirect writes from /usr/libexec/... to /var/kubernetes/... - # (The below keepdir will result in a tmpfiles entry in base_image_var.conf) - keepdir /var/kubernetes/kubelet-plugins/volume/exec - dosym /var/kubernetes/kubelet-plugins/volume/exec /usr/libexec/kubernetes/kubelet-plugins/volume/exec -} diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/ami b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/ami similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/ami rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/ami diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/azure b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/azure similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/azure rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/azure diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/digitalocean b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/digitalocean similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/digitalocean rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/digitalocean diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/gce b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/gce similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/gce rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/gce diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/openstack b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/openstack similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/openstack rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/openstack diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/packet b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/packet similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/packet rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/packet diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/qemu b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/qemu similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/qemu rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/qemu diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/vmware b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/vmware similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/vmware rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/vmware diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml new file mode 100644 index 00000000000..7c900b19e8e --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml @@ -0,0 +1,4 @@ + + + + diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild new file mode 100644 index 00000000000..2e9e8b38d5a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild @@ -0,0 +1,24 @@ +# Copyright (c) 2026 The Flatcar Maintainers. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=9 + +DESCRIPTION='Listings of old OEM files' +HOMEPAGE='https://www.flatcar.org/' + +LICENSE='Apache-2.0' +SLOT='0' +KEYWORDS='amd64 arm64' + +# No source directory. +S="${WORKDIR}" + +src_install() { + insinto '/usr/share/flatcar' + # The "oems" folder should contain a file "$OEMID" for each expected OEM sysext and + # either be empty or contain a newline-separated list of files to delete during the + # migration (done from the initrd). The existence of the file will help old clients + # to do the fallback download of the sysext payload in the postinstall hook. + # The paths should use /oem instead of /usr/share/oem/ to avoid symlink resolution. + doins -r "${FILESDIR}"/oems +} diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash index b7b266cfe9d..d29e363fdaf 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash @@ -1 +1,28 @@ export bash_cv_getcwd_malloc=yes + +cros_post_src_install_flatcar_modifications() { + # These links exist because old installations can still have + # references to them. + dosym -r '/usr/share/flatcar/etc/bash/bash_logout' '/usr/share/bash/bash_logout' + dosym -r '/usr/share/flatcar/etc/bash/bashrc' '/usr/share/bash/bashrc' + insinto '/usr/share/flatcar/etc/bash' + newins - 'bash_logout' + newins - 'bashrc' + + dosym -r '/usr/share/flatcar/etc/skel/.bash_logout' '/usr/share/skel/.bash_logout' + dosym -r '/usr/share/flatcar/etc/skel/.bash_profile' '/usr/share/skel/.bash_profile' + dosym -r '/usr/share/flatcar/etc/skel/.bashrc' '/usr/share/skel/.bashrc' + insinto '/usr/share/flatcar/etc/skel' + newins - '.bash_logout' + newins - '.bash_profile' + newins - '.bashrc' + + insinto '/etc/bash/bashrc.d' + newins - '99-flatcar-bcc.bash' <<'EOF' +for iovisor_bcc_tool in tcpretrans tcpconnect tcpaccept biolatency; do + alias "iovisor-${iovisor_bcc_tool}=docker run --rm -it -v /lib/modules:/lib/modules -v /sys/kernel/debug:/sys/kernel/debug -v /sys/fs/cgroup:/sys/fs/cgroup -v /sys/fs/bpf:/sys/fs/bpf --privileged --net host --pid host quay.io/iovisor/bcc /usr/share/bcc/tools/${iovisor_bcc_tool}" +done + +unset -v iovisor_bcc_tool +EOF +} diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp index bc72eb5c0a1..e6fdefbb75c 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp @@ -1,15 +1,115 @@ -ntp_install_mask='' # Do not install ntpdate or sntp systemd files in /etc. -ntp_install_mask+=" /etc/systemd" -# Do not install the default ntp.conf, we provide our own in -# coreos-base/misc-files. -ntp_install_mask+=" /etc/ntp.conf" +INSTALL_MASK+=" /etc/systemd " # Do not install perl scripts to /usr/bin. -ntp_install_mask+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap" -# Do not install perl package to /usr/share/ntp. -ntp_install_mask+=" /usr/share/ntp" - -ntp_install_mask+=' ' -INSTALL_MASK+=${ntp_install_mask} -PKG_INSTALL_MASK+=${ntp_install_mask} -unset ntp_install_mask +INSTALL_MASK+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap " + +cros_post_src_install_ntp_flatcar_modifications() { + # Drop perl package. Not in install mask, because we install our own symlink here. + rm -rf "${ED}/usr/share/ntp/"* || die + dosym -r /usr/share/flatcar/etc/ntp.conf /usr/share/ntp/ntp.conf + insinto /usr/share/flatcar/etc/ + newins - ntp.conf + + rm -f "${ED}/etc/ntp/ntp.conf" + insinto /etc + newins - ntp.conf <<'EOF' +# NOTES: +# DHCP clients can append or replace NTP configuration files. +# You should consult your DHCP client documentation about its +# default behaviour and how to change it. + +# Name of the servers ntpd should sync with +# Please respect the access policy as stated by the responsible person. +#server ntp.example.tld iburst + +# Common pool for random people +#server pool.ntp.org + +# AWS Time Sync Service. +server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4 +# AWS Time Sync Service IPv6: +server fd00:ec2::123 prefer iburst minpoll 4 maxpoll 4 + +# GCP NTP Service +server metadata.google.internal prefer iburst + +# Pools for Flatcar users +server 0.flatcar.pool.ntp.org +server 1.flatcar.pool.ntp.org +server 2.flatcar.pool.ntp.org +server 3.flatcar.pool.ntp.org + +## +# A list of available servers can be found here: +# http://www.pool.ntp.org/ +# http://www.pool.ntp.org/#use +# A good way to get servers for your machine is: +# netselect -s 3 pool.ntp.org +## + +# you should not need to modify the following paths +driftfile /var/lib/ntp/ntp.drift + +#server ntplocal.example.com prefer +#server timeserver.example.org + +# Warning: Using default NTP settings will leave your NTP +# server accessible to all hosts on the Internet. + +# If you want to deny all machines (including your own) +# from accessing the NTP server, uncomment: +#restrict default ignore + + +# Default configuration: +# - Allow only time queries, at a limited rate, sending KoD when in excess. +# - Allow all local queries (IPv4, IPv6) +# From commit da515112395ea7ce0da7cba7103de65d53fc93c9: +# +# net-misc/ntp: add notrap to default restrict config +# +# It's a common security hardening option and doesn't seem likely to +# affect any actual usage. +restrict default nomodify nopeer noquery notrap limited kod +restrict 127.0.0.1 +restrict [::1] + + +# To allow machines within your network to synchronize +# their clocks with your server, but ensure they are +# not allowed to configure the server or used as peers +# to synchronize against, uncomment this line. +# +#restrict 192.168.0.0 mask 255.255.255.0 nomodify nopeer notrap +EOF + + ( + insopts -m 0644 + unit_dir=$(systemd_get_systemunitdir) + insinto "${unit_dir}/ntpd.service.d" + newins - ntpd-always-restart.conf <<'EOF' +[Service] +# From commit 5e5abb4d7ea48a9238b9baa22941fda6a6bbda8c: +# +# ntpd: always restart, required to handle large time jumps. +# +# Some VM platforms suspend machines by simply stopping them instead of +# gracefully suspending them like real hardware would. This means that +# when the system is resumed the kernel's time will be completely wrong +# and it doesn't have a way to fix it. Additionally ntp will abort if the +# clock offset is greater than 1000 seconds (conveniently without logging +# any error messages). We can tune that in ntp.conf but ntpd has so many +# knobs related to how it skews the clock and other update strategies that +# the easiest option is to just restart. +Restart=always +EOF + cat >"${T}/ntp-environment.conf" <<'EOF' +[Service] +Environment="SERVER=0.flatcar.pool.ntp.org 1.flatcar.pool.ntp.org 2.flatcar.pool.ntp.org 3.flatcar.pool.ntp.org" +EOF + insinto "${unit_dir}/ntpdate.service.d" + doins "${T}/ntp-environment.conf" + insinto "${unit_dir}/sntp.service.d" + doins "${T}/ntp-environment.conf" + ) +} diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh index 77a32cfa39c..7dbfbb61c45 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh @@ -3,12 +3,61 @@ # Do not install the config snippet that defines a subsystem. We have # our own definition in coreos-init. if [[ $(flatcar_target) != 'sdk' ]] ; then - openssh_mask=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf " - PKG_INSTALL_MASK+="${openssh_mask}" - INSTALL_MASK+="${openssh_mask}" - unset openssh_mask + INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf " fi -cros_post_src_install_vendorize_pam() { +cros_post_src_install_flatcar_modifications() { vendorize_pam_files + + if [[ $(flatcar_target) != 'sdk' ]] ; then + dosym -r /usr/share/flatcar/etc/ssh/ssh_config.d/50-flatcar-ssh.conf /usr/share/ssh/ssh_config + insinto /usr/share/flatcar/etc/ssh/ssh_config.d/ + newins - 50-flatcar-ssh.conf + insinto /etc/ssh/ssh_config.d + newins - 50-flatcar-ssh.conf <<'EOF' +# Use defaults for ssh client system-wide configuration. +EOF + + dosym -r /usr/share/flatcar/etc/ssh/sshd_config.d/50-flatcar-sshd.conf /usr/share/ssh/sshd_config + insinto /usr/share/flatcar/etc/ssh/sshd_config.d/ + newins - 50-flatcar-sshd.conf + insinto /etc/ssh/sshd_config.d + newins - 50-flatcar-sshd.conf <<'EOF' +# Use most defaults for sshd configuration. +Subsystem sftp internal-sftp +ClientAliveInterval 180 + +# These are either defaults or already set up by config generated by +# the Gentoo ebuild. But we need to keep them, as the older +# installations may still use the old symlink from +# /etc/ssh/sshd_config to /usr/share/ssh/sshd_config. +# +# BEGIN SETTINGS KEPT FOR COMPATIBILITY +UseDNS no +UsePAM yes +# handled by PAM +PrintLastLog no +# handled by PAM +PrintMotd no +# END SETTINGS KEPT FOR COMPATIBILITY + +# Temporarily accept ssh-rsa algorithm for openssh >= 8.8, +# until most ssh clients could deprecate ssh-rsa. +HostkeyAlgorithms +ssh-rsa +PubkeyAcceptedAlgorithms +ssh-rsa +EOF + # Install our socket drop-in file that disables the rate + # limiting on the sshd socket. + ( + insopts -m 0644 + unit_dir=$(systemd_get_systemunitdir) + insinto "${unit_dir}/sshd.socket" + newins - no-trigger-limit-burst.conf <<'EOF' +[Socket] +TriggerLimitBurst=0 +EOF + # Enable some sockets that aren't enabled by their own ebuilds. + systemd_enable_service sockets.target sshd.socket + ) + fi } diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base new file mode 100644 index 00000000000..e27c1c1c385 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base @@ -0,0 +1,9 @@ +cros_post_src_install_flatcar_modifications() { + # These links exist because old installations can still have + # references to them. + dosym -r '/usr/share/flatcar/etc/selinux/mcs' '/usr/lib/selinux/mcs' + dosym -r '/usr/share/flatcar/etc/selinux/config' '/usr/lib/selinux/config' + insinto '/usr/share/flatcar/etc/selinux' + newins - 'mcs' + newins - 'config' +} diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils index 8b6c1ef2cdd..89592475820 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils @@ -1,20 +1,24 @@ # sys-apps/policycoreutils creates /var/lib/selinux directory in # src_install and then needs it to be available when running -# pkg_postinst, because it does a policy module rebuild there. We -# initially have put /var/lib/selinux into INSTALL_MASK and told -# coreos-base/misc-files to install the directory at -# /usr/lib/selinux/policy together with a symlink at /var/lib/selinux -# pointing to the directory. But this is done too late - at -# sys-apps/policycoreutils' pkg_postinst time, /var/lib/selinux does -# not exist, because coreos-base/misc-files was not yet emerged. So we -# need to fall back to this hack, where we set up /var/lib/selinux and -# /usr/lib/selinux/policy the way we want. -cros_post_src_install_set_up_var_lib_selinux() { +# pkg_postinst, because it does a policy module rebuild there. We want +# the policies to be in /usr/lib/selinux/policy and /var/lib/selinux +# to be a symlink to it, so we need to fall back to this hack, where +# we set the paths up the way we want. +cros_post_src_install_flatcar_modifications() { + vendorize_pam_files + dodir /usr/lib/selinux mv "${ED}/var/lib/selinux" "${ED}/usr/lib/selinux/policy" dosym -r /usr/lib/selinux/policy /var/lib/selinux -} -cros_post_src_install_vendorize_pam() { - vendorize_pam_files + # the ebuild does not inherit the tmpfiles eclass, so we opencode + # the newtmpfiles function here + ( + insopts -m 0644 + insinto /usr/lib/tmpfiles.d + newins - 10-var-lib-selinux.conf <<'EOF' +#Type Path Mode UID GID Age Argument +L /var/lib/selinux/ - - - - ../../usr/lib/selinux/policy +EOF + ) } diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage new file mode 100644 index 00000000000..6b3d3591005 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage @@ -0,0 +1,7 @@ +cros_post_src_install_flatcar_modifications() { + # This links exist because old installations can still have + # references to them. + dosym -r '/usr/share/flatcar/etc/selinux/semanage.conf' '/usr/lib/selinux/semanage.conf' + insinto '/usr/share/flatcar/etc/selinux' + newins - 'semanage.conf' +} diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit index 31d2888b547..ffd737e7f08 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit +++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit @@ -1,9 +1,43 @@ # Do not install Gentoo-provided audit rules, we will install our own -# in coreos-base/misc-files. Also skip installing legacy initscripts -# stuff in /usr/libexec. +# in the hook below. Also skip installing legacy initscripts stuff in +# /usr/libexec. INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec " cros_post_src_install_audit_flatcar_modifications() { + # install these for backward compatibility + dosym -r /usr/share/flatcar/etc/audit/rules.d/00-clear.rules /usr/share/audit/rules.d/00-clear.rules + dosym -r /usr/share/flatcar/etc/audit/rules.d/80-selinux.rules /usr/share/audit/rules.d/80-selinux.rules + dosym -r /usr/share/flatcar/etc/audit/rules.d/99-default.rules /usr/share/audit/rules.d/99-default.rules + insinto /usr/share/flatcar/etc/audit/rules.d/ + newins - 00-clear.rules 80-selinux.rules 99-default.rules + dosym -r /usr/share/flatcar/etc/audit/auditd.conf /usr/share/auditd/auditd.conf + insinto /usr/share/flatcar/etc/audit/ + newins - auditd.conf + + insinto /etc/audit/rules.d + newins - 00-clear.rules <<'EOF' +# First rule - delete all +# This is to clear out old rules, so we don't append to them. +-D +EOF + newins - 80-selinux.rules <<'EOF' +# Enable all SELinux related events +# 1400 to 1499 are for kernel SELinux use (see /include/uapi/linux/audit.h) + +-a exclude,never -F msgtype>=1400 -F msgtype<=1499 +EOF + newins - 99-default.rules <<'EOF' +# Always report changes to the audit subsystem itself. +-a exclude,never -F msgtype=CONFIG_CHANGE + +# Ignore everything else. +-a exclude,always -F msgtype>0 +EOF + # Upstream wants these to have restrictive perms. + fperms 0640 /etc/audit/rules.d/{00-clear.rules,80-selinux.rules,99-default.rules} + # Enable audit-rules.service by default. + systemd_enable_service multi-user.target audit-rules.service + # Upstream installs its tmpfiles config file with unnecessarilly # restrictive mode, relax it. # diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use index 5ba41170fd8..8684aafb416 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use @@ -7,11 +7,6 @@ app-editors/vim minimal -crypt # minimal: Don't pull app-vim/gentoo-syntax app-editors/vim-core minimal -# Install our modifications and compatibility symlinks for ssh and ntp -# -# Install a SELinux policy directory symlink -coreos-base/misc-files audit ntp openssh policycoreutils - dev-lang/python gdbm dev-libs/dbus-glib tools dev-libs/elfutils -utils diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r23.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r24.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r23.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r24.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild index 5c5da8ebe23..87996e72730 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild @@ -87,6 +87,11 @@ src_install() { doins Makefile exeinto /usr/share/baselayout doexe dumb-tmpfiles-proc.sh + + # Create a symlink for Kubernetes to redirect writes from /usr/libexec/... to /var/kubernetes/... + # (The below keepdir will result in a tmpfiles entry in base_image_var.conf) + keepdir /var/kubernetes/kubelet-plugins/volume/exec + dosym /var/kubernetes/kubelet-plugins/volume/exec /usr/libexec/kubernetes/kubelet-plugins/volume/exec } pkg_preinst() {