diff --git a/common/tasks/boot.py b/common/tasks/boot.py new file mode 100644 index 0000000..039a36e --- /dev/null +++ b/common/tasks/boot.py @@ -0,0 +1,29 @@ +from base import Task +from common import phases +import os + + +class BlackListModules(Task): + description = 'Blacklisting kernel modules' + phase = phases.system_modification + + def run(self, info): + blacklist_path = os.path.join(info.root, 'etc/modprobe.d/blacklist.conf') + with open(blacklist_path, 'a') as blacklist: + blacklist.write(('# disable pc speaker\n' + 'blacklist pcspkr')) + + +class DisableGetTTYs(Task): + description = 'Disabling getty processes' + phase = phases.system_modification + + def run(self, info): + from common.tools import sed_i + inittab_path = os.path.join(info.root, 'etc/inittab') + tty1 = '1:2345:respawn:/sbin/getty 38400 tty1' + sed_i(inittab_path, '^'+tty1, '#'+tty1) + ttyx = ':23:respawn:/sbin/getty 38400 tty' + for i in range(2, 6): + i = str(i) + sed_i(inittab_path, '^'+i+ttyx+i, '#'+i+ttyx+i) diff --git a/providers/ec2/__init__.py b/providers/ec2/__init__.py index a5eb2c4..a4e6954 100644 --- a/providers/ec2/__init__.py +++ b/providers/ec2/__init__.py @@ -11,6 +11,7 @@ from tasks import bootstrap from tasks import locale from common.tasks import apt from tasks import boot +from common.tasks import boot as common_boot from tasks import security from tasks import network from tasks import initd @@ -44,8 +45,8 @@ def tasks(tasklist, manifest): apt.AptUpgrade(), boot.ConfigureGrub(), filesystem.ModifyFstab(), - boot.BlackListModules(), - boot.DisableGetTTYs(), + common_boot.BlackListModules(), + common_boot.DisableGetTTYs(), security.EnableShadowConfig(), security.DisableSSHPasswordAuthentication(), security.DisableSSHDNSLookup(), diff --git a/providers/ec2/tasks/boot.py b/providers/ec2/tasks/boot.py index 4265b9d..375cf1d 100644 --- a/providers/ec2/tasks/boot.py +++ b/providers/ec2/tasks/boot.py @@ -32,29 +32,3 @@ class ConfigureGrub(Task): from common.tools import log_check_call log_check_call(['/usr/sbin/chroot', info.root, '/usr/sbin/update-grub']) log_check_call(['/usr/sbin/chroot', info.root, 'ln', '-s', '/boot/grub/grub.cfg', '/boot/grub/menu.lst']) - - -class BlackListModules(Task): - description = 'Blacklisting kernel modules' - phase = phases.system_modification - - def run(self, info): - blacklist_path = os.path.join(info.root, 'etc/modprobe.d/blacklist.conf') - with open(blacklist_path, 'a') as blacklist: - blacklist.write(('# disable pc speaker\n' - 'blacklist pcspkr')) - - -class DisableGetTTYs(Task): - description = 'Disabling getty processes' - phase = phases.system_modification - - def run(self, info): - from common.tools import sed_i - inittab_path = os.path.join(info.root, 'etc/inittab') - tty1 = '1:2345:respawn:/sbin/getty 38400 tty1' - sed_i(inittab_path, '^'+tty1, '#'+tty1) - ttyx = ':23:respawn:/sbin/getty 38400 tty' - for i in range(2, 6): - i = str(i) - sed_i(inittab_path, '^'+i+ttyx+i, '#'+i+ttyx+i) diff --git a/providers/raw/__init__.py b/providers/raw/__init__.py index 0c2814e..7614d0e 100644 --- a/providers/raw/__init__.py +++ b/providers/raw/__init__.py @@ -7,11 +7,13 @@ from tasks import bootstrap from tasks import locale from common.tasks import apt from tasks import boot +from common.tasks import boot as common_boot from tasks import security from tasks import network from tasks import initd from tasks import cleanup + def initialize(): # Regardless of of loglevel, we don't want boto debug stuff, it's very noisy logging.getLogger('boto').setLevel(logging.INFO) @@ -41,8 +43,8 @@ def tasks(tasklist, manifest): #apt.AptUpgrade(), boot.ConfigureGrub(), filesystem.ModifyFstab(), - boot.BlackListModules(), - boot.DisableGetTTYs(), + common_boot.BlackListModules(), + common_boot.DisableGetTTYs(), security.EnableShadowConfig(), security.SetRootPassword(), security.DisableSSHPasswordAuthentication(), diff --git a/providers/raw/tasks/boot.py b/providers/raw/tasks/boot.py index 6ae840c..ec55a61 100644 --- a/providers/raw/tasks/boot.py +++ b/providers/raw/tasks/boot.py @@ -18,64 +18,28 @@ class ConfigureGrub(Task): for cfg in [os.path.join(grubd, f) for f in os.listdir(grubd)]: os.chmod(cfg, os.stat(cfg).st_mode & ~ x_all) - from common.tools import log_check_call from shutil import copy - script_src = os.path.normpath(os.path.join(os.path.dirname(__file__), '../assets/grub.d/40_custom')) script_dst = os.path.join(info.root, 'etc/grub.d/40_custom') copy(script_src, script_dst) os.chmod(script_dst, rwxr_xr_x) - if info.manifest.virtualization == 'virtio': - modules_path = os.path.join(info.root, - 'etc/initramfs-tools/modules') - with open(modules_path, 'a') as modules: - modules.write("\nvirtio_pci\nvirtio_blk\n") - - - grub_def = os.path.join(info.root, 'etc/default/grub') + if info.manifest.virtualization == 'virtio': + modules_path = os.path.join(info.root, 'etc/initramfs-tools/modules') + with open(modules_path, 'a') as modules: + modules.write("\nvirtio_pci\nvirtio_blk\n") + from common.tools import log_check_call log_check_call(['/usr/sbin/chroot', info.root, 'ln', '-s', '/boot/grub/grub.cfg', '/boot/grub/menu.lst']) log_check_call(['/usr/sbin/chroot', info.root, 'update-initramfs', '-u']) log_check_call(['grub-install', '--boot-directory='+info.root+"/boot/", '/dev/loop0']) - log_check_call(['/usr/sbin/chroot', info.root, '/usr/sbin/update-grub']) - log_check_call(['/usr/sbin/chroot', info.root, '/usr/sbin/update-grub']) - from common.tools import sed_i - if info.manifest.virtualization == 'virtio': - grub_cfg = os.path.join(info.root, 'boot/grub/grub.cfg') - sed_i(grub_cfg, 'sda', 'vda') - device_map = os.path.join(info.root, - 'boot/grub/device.map') - sed_i(device_map, 'sda', 'vda') - #log_check_call(['/usr/sbin/chroot', info.root, '/usr/sbin/update-grub']) - - - -class BlackListModules(Task): - description = 'Blacklisting kernel modules' - phase = phases.system_modification - - def run(self, info): - blacklist_path = os.path.join(info.root, 'etc/modprobe.d/blacklist.conf') - with open(blacklist_path, 'a') as blacklist: - blacklist.write(('# disable pc speaker\n' - 'blacklist pcspkr')) - - -class DisableGetTTYs(Task): - description = 'Disabling getty processes' - phase = phases.system_modification - - def run(self, info): from common.tools import sed_i - inittab_path = os.path.join(info.root, 'etc/inittab') - tty1 = '1:2345:respawn:/sbin/getty 38400 tty1' - sed_i(inittab_path, '^'+tty1, '#'+tty1) - ttyx = ':23:respawn:/sbin/getty 38400 tty' - for i in range(2, 6): - i = str(i) - sed_i(inittab_path, '^'+i+ttyx+i, '#'+i+ttyx+i) + if info.manifest.virtualization == 'virtio': + grub_cfg = os.path.join(info.root, 'boot/grub/grub.cfg') + sed_i(grub_cfg, 'sda', 'vda') + device_map = os.path.join(info.root, 'boot/grub/device.map') + sed_i(device_map, 'sda', 'vda')