matthew/sonic-buildimage
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1b8897eec0
sonic-buildimage/build_debian.sh

571 lines
26 KiB
Bash
Raw Normal View History

New release v1.0.0
2016-03-08 13:42:20 -06:00
#!/bin/bash
## This script is to automate the preparation for a debian file system, which will be used for
## an ONIE installer image.
##
## USAGE:
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
## USERNAME=username PASSWORD=password ./build_debian
## ENVIRONMENT:
New release v1.0.0
2016-03-08 13:42:20 -06:00
## USERNAME
## The name of the default admin user
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
## PASSWORD
## The password, expected by chpasswd command
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Default user
[ -n "$USERNAME" ] || {
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
echo "Error: no or empty USERNAME"
New release v1.0.0
2016-03-08 13:42:20 -06:00
exit 1
}
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
## Password for the default user
[ -n "$PASSWORD" ] || {
echo "Error: no or empty PASSWORD"
New release v1.0.0
2016-03-08 13:42:20 -06:00
exit 1
}
## Include common functions
. functions.sh
## Enable debug output for script
set -x -e
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
CONFIGURED_ARCH=$([ -f .arch ] && cat .arch || echo amd64)
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## docker engine version (with platform)
[build_debian] docker version update for ARM arch (#3353) Docker version above 18 has inconsistent behaviour with qemu. Hence using the same version 18 used in sonic-slave Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-08-28 20:38:21 -05:00
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
# Version name differs between ARCH, copying same version as in sonic-slave docker
DOCKER_VERSION=18.06.3~ce~3-0~debian
else
DOCKER_VERSION=5:18.09.8~3-0~debian-stretch
fi
[kernel]: security kernel update to 4.9.189 (#3913) This patch upgrade the kernel from version 4.9.0-9-2 (4.9.168-1+deb9u3) to 4.9.0-11-2 (4.9.189-3+deb9u2) Co-authored-by: rajendra-dendukuri <47423477+rajendra-dendukuri@users.noreply.github.com>
2020-02-12 19:41:58 -06:00
LINUX_KERNEL_VERSION=4.9.0-11-2
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Working directory to prepare the file system
FILESYSTEM_ROOT=./fsroot
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
PLATFORM_DIR=platform
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Hostname for the linux image
Rename hostname (#6)
2016-09-15 17:22:29 -05:00
HOSTNAME=sonic
New release v1.0.0
2016-03-08 13:42:20 -06:00
DEFAULT_USERINFO="Default admin user,,,"
## Read ONIE image related config file
. ./onie-image.conf
[ -n "$ONIE_IMAGE_PART_SIZE" ] || {
echo "Error: Invalid ONIE_IMAGE_PART_SIZE in onie image config file"
exit 1
}
[ -n "$ONIE_INSTALLER_PAYLOAD" ] || {
echo "Error: Invalid ONIE_INSTALLER_PAYLOAD in onie image config file"
exit 1
}
[ -n "$FILESYSTEM_SQUASHFS" ] || {
echo "Error: Invalid FILESYSTEM_SQUASHFS in onie image config file"
exit 1
}
## Prepare the file system directory
if [[ -d $FILESYSTEM_ROOT ]]; then
[build_debian]: install deps in rootfs instead of just extracting the packages (#280) packages contains post-install that needs to be performed
2017-02-10 09:39:05 -06:00
sudo rm -rf $FILESYSTEM_ROOT || die "Failed to clean chroot directory"
New release v1.0.0
2016-03-08 13:42:20 -06:00
fi
mkdir -p $FILESYSTEM_ROOT
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
mkdir -p $FILESYSTEM_ROOT/$PLATFORM_DIR
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
mkdir -p $FILESYSTEM_ROOT/$PLATFORM_DIR/x86_64-grub
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
touch $FILESYSTEM_ROOT/$PLATFORM_DIR/firsttime
New release v1.0.0
2016-03-08 13:42:20 -06:00
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
## make / as a mountpoint in chroot env, needed by dockerd
pushd $FILESYSTEM_ROOT
sudo mount --bind . .
popd
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Build a basic Debian system by debootstrap
echo '[INFO] Debootstrap...'
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
# qemu arm bin executable for cross-building
sudo mkdir -p $FILESYSTEM_ROOT/usr/bin
sudo cp /usr/bin/qemu*static $FILESYSTEM_ROOT/usr/bin || true
sudo http_proxy=$http_proxy debootstrap --variant=minbase --arch $CONFIGURED_ARCH stretch $FILESYSTEM_ROOT http://deb.debian.org/debian
else
sudo http_proxy=$http_proxy debootstrap --variant=minbase --arch $CONFIGURED_ARCH stretch $FILESYSTEM_ROOT http://debian-archive.trafficmanager.net/debian
fi
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Config hostname and hosts, otherwise 'sudo ...' will complain 'sudo: unable to resolve host ...'
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '$HOSTNAME' > /etc/hostname"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '127.0.0.1 $HOSTNAME' >> /etc/hosts"
Add support for cavium SAI (#5)
2016-09-25 23:48:25 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '127.0.0.1 localhost' >> /etc/hosts"
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Config basic fstab
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'echo "proc /proc proc defaults 0 0" >> /etc/fstab'
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'echo "sysfs /sys sysfs defaults 0 0" >> /etc/fstab'
[build]: allow to use http(s) proxy in the build (#1265) * allow to use http(s) proxy in the build To enable this, use following command http_proxy=[your_proxy] https_proxy=[your_proxy] make
2017-12-24 01:34:15 -06:00
## Setup proxy
[ -n "$http_proxy" ] && sudo /bin/bash -c "echo 'Acquire::http::Proxy \"$http_proxy\";' > $FILESYSTEM_ROOT/etc/apt/apt.conf.d/01proxy"
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Note: mounting is necessary to makedev and install linux image
echo '[INFO] Mount all'
## Output all the mounted device for troubleshooting
mount
trap_push 'sudo umount $FILESYSTEM_ROOT/proc || true'
sudo LANG=C chroot $FILESYSTEM_ROOT mount proc /proc -t proc
## Pointing apt to public apt mirrors and getting latest packages, needed for latest security updates
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
sudo cp files/apt/sources.list.$CONFIGURED_ARCH $FILESYSTEM_ROOT/etc/apt/sources.list
[docker-base-stretch]: Do not check expire for stretch-backports repo (#3958) * [docker-base-stretch]: Do not check expire for stretch-backports repo Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-12-31 18:30:10 -06:00
sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages},no-check-valid-until} $FILESYSTEM_ROOT/etc/apt/apt.conf.d/
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c 'apt-mark auto `apt-mark showmanual`'
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Note: set lang to prevent locale warnings in your chroot
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y update
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y upgrade
echo '[INFO] Install packages for building image'
[baseimage]: install systemd-sysv in the base image
2017-09-02 17:29:21 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install makedev psmisc systemd-sysv
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Create device files
echo '[INFO] MAKEDEV'
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'cd /dev && MAKEDEV generic-arm'
else
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'cd /dev && MAKEDEV generic'
fi
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Install initramfs-tools and linux kernel
## Note: initramfs-tools recommends depending on busybox, and we really want busybox for
## 1. commands such as touch
## 2. mount supports squashfs
## However, 'dpkg -i' plus 'apt-get install -f' will ignore the recommended dependency. So
## we install busybox explicitly
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install busybox
Changed ACS references to SONiC in image, added timestamp to base image volume label
2016-09-06 15:15:10 -05:00
echo '[INFO] Install SONiC linux kernel image'
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Note: duplicate apt-get command to ensure every line return zero
[build]: put stretch debian packages under target/debs/stretch/ (#2519) * [build]: put stretch debian packages under target/debs/stretch/ * in stretch build phase, all debian packages built in that stage are placed under target/debs/stretch directory. * for python-based debian packages, since they are really the same for jessie and stretch, they are placed under target/python-debs directory. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-05 00:06:37 -06:00
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/initramfs-tools-core_*.deb || \
[baseimage]: upgrade initramfs to 0.130
2017-09-01 03:53:21 -05:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
[build]: put stretch debian packages under target/debs/stretch/ (#2519) * [build]: put stretch debian packages under target/debs/stretch/ * in stretch build phase, all debian packages built in that stage are placed under target/debs/stretch directory. * for python-based debian packages, since they are really the same for jessie and stretch, they are placed under target/python-debs directory. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-05 00:06:37 -06:00
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/initramfs-tools_*.deb || \
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
[build]: build ARM kernel support from sonic-linux-kernel (#3556) * Makefile: ARM kernel support from sonic-linux-kernel * Fix for multiarch build docker spawn Platform: Install the DTB deb for the platform Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-10-10 17:11:26 -05:00
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/linux-image-${LINUX_KERNEL_VERSION}-*_${CONFIGURED_ARCH}.deb || \
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
[baseimage]: install acl package
2017-12-11 11:00:41 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install acl
[image]: Add SSD maintenance utility - hdparm. (#4177) Signed-off-by: Nazarii Hnydyn <nazariig@mellanox.com>
2020-02-26 13:27:52 -06:00
if [[ $CONFIGURED_ARCH == amd64 ]]; then
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install dmidecode hdparm
fi
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
[baseimage]: build root filesystem via overlay fs instead of aufs
2017-09-02 17:32:31 -05:00
## Update initramfs for booting with squashfs+overlay
New release v1.0.0
2016-03-08 13:42:20 -06:00
cat files/initramfs-tools/modules | sudo tee -a $FILESYSTEM_ROOT/etc/initramfs-tools/modules > /dev/null
[Arista]: Add support to convert vfat file system to ext4 (#201) This commit will convert the existing file system of flash drive on Arista switches from VFAT to EXT4 in the booting of SONiC. It will take the whole flash and therefore remove the recovery partition. There is a check in the script making sure that the conversion operation will not happen on a non-Arista switch or if the existing file system is not VFAT.
2017-01-24 00:25:47 -06:00
## Hook into initramfs: change fs type from vfat to ext4 on arista switches
sudo mkdir -p $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/
sudo cp files/initramfs-tools/arista-convertfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-convertfs
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-convertfs
Add initramfs hook for Arista devices (#2595) We are going to use initramfs hook for firmware upgrades To install Arista hook: - create folder /mnt/flash/<image dir>/platform/hooks/boot1/ from Aboot or /host/<image dir>/platform/hooks/boot1/ from Sonic - add executable script to created folder
2019-02-27 12:28:04 -06:00
sudo cp files/initramfs-tools/arista-hook $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-hook
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-hook
[Arista]: Add support to convert vfat file system to ext4 (#201) This commit will convert the existing file system of flash drive on Arista switches from VFAT to EXT4 in the booting of SONiC. It will take the whole flash and therefore remove the recovery partition. There is a check in the script making sure that the conversion operation will not happen on a non-Arista switch or if the existing file system is not VFAT.
2017-01-24 00:25:47 -06:00
sudo cp files/initramfs-tools/mke2fs $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/mke2fs
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/mke2fs
[aboot]: Add setfacl in the initramfs (#1185) Arista platforms need the filesystem ACLs to be removed on boot to prevent invalid permission to be set for new files.
2017-11-24 19:30:11 -06:00
sudo cp files/initramfs-tools/setfacl $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/setfacl
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/setfacl
[Arista]: Add support to convert vfat file system to ext4 (#201) This commit will convert the existing file system of flash drive on Arista switches from VFAT to EXT4 in the booting of SONiC. It will take the whole flash and therefore remove the recovery partition. There is a check in the script making sure that the conversion operation will not happen on a non-Arista switch or if the existing file system is not VFAT.
2017-01-24 00:25:47 -06:00
Add arista-net initramfs hook (#899)
2017-08-19 23:32:10 -05:00
# Hook into initramfs: rename the management interfaces on arista switches
sudo cp files/initramfs-tools/arista-net $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-net
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-net
Reduce SONiC migration partition from 8G to 1G. (#1343) * Reduce SONiC migration partition from 8G to 1G. * Changes to create 1G partition with ability to resize post migration. * Remove redundant changes in varlog * Use findfs to interpret root. Move resize in case cmdline params are reordered
2018-02-07 08:07:01 -06:00
# Hook into initramfs: resize root partition after migration from another NOS to SONiC on Dell switches
sudo cp files/initramfs-tools/resize-rootfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/resize-rootfs
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/resize-rootfs
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Hook into initramfs: after partition mount and loop file mount
## 1. Prepare layered file system
[build]: Update comments on build_debian.sh (#3533)
2019-10-09 19:38:53 -05:00
## 2. Bind-mount docker working directory (docker overlay storage cannot work over overlay rootfs)
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo cp files/initramfs-tools/union-mount $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/union-mount
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/union-mount
[baseimage]: allocate varlog disk in the initramfs stage (#936) moving to initramfs unifies disk allocate on different platforms. use fallocate instead of dd to speed up the disk allocation. By default, mkfs.ext4 has -E discard option which discards the blocks at the mkfs time, also speed up the initialization time.
2017-09-06 22:07:32 -05:00
sudo cp files/initramfs-tools/varlog $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/varlog
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/varlog
[fast-reboot]: Support OS9 -> SONiC fast-reboot migration (#1414) * Support OS9 -> SONiC fast-reboot migration * Address review comments. Update NOS mac in EEPROM and net.rules for eth0 * Address review comments. Update sonic-platform-modules-dell to fac81d... * Fix script for POSIX compliance
2018-03-08 18:42:41 -06:00
# Management interface (eth0) dhcp can be optionally turned off (during a migration from another NOS to SONiC)
removing dhcp- turn- off option from initrd (#2555) * removing dhcp changes from initrd * removing mgmt-intf-dhcp file
2019-04-02 17:48:04 -05:00
#sudo cp files/initramfs-tools/mgmt-intf-dhcp $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/mgmt-intf-dhcp
#sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/mgmt-intf-dhcp
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo cp files/initramfs-tools/union-fsck $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/union-fsck
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/union-fsck
[baseimage]: build root filesystem via overlay fs instead of aufs
2017-09-02 17:32:31 -05:00
pushd $FILESYSTEM_ROOT/usr/share/initramfs-tools/scripts/init-bottom && sudo patch -p1 < $OLDPWD/files/initramfs-tools/udev.patch; popd
[initramfs] Updated required tools for initramfs (#3734) * [initramfs] Updated reuired tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Updated required tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [Platform] [Marvell] Platform specific debian package for et6448m device Signed-off-by: Antony Rheneus <arheneus@marvell.com> * Removed auto-generated files Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Marvell arm modules update and platform config update Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [iniramfs] add initramfs uboot-utils hook script only for ARM Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-15 10:25:01 -06:00
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
sudo cp files/initramfs-tools/uboot-utils $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/uboot-utils
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/uboot-utils
cat files/initramfs-tools/modules.arm | sudo tee -a $FILESYSTEM_ROOT/etc/initramfs-tools/modules > /dev/null
fi
New release v1.0.0
2016-03-08 13:42:20 -06:00
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
if [[ $CONFIGURED_ARCH == amd64 ]]; then
## Install latest intel ixgbe driver
sudo cp $files_path/ixgbe.ko $FILESYSTEM_ROOT/lib/modules/${LINUX_KERNEL_VERSION}-amd64/kernel/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
fi
[Platform] Add Ingrasys S9130-32X and S9230-64X with Nephos Switch ASIC (#1245) * Add switch ASIC vendor and platforms for Nephos - What I did Add switch ASIC vendor: Nephos Add Nephos platforms: Ingrasys S9130-32X, Ingrasys S9230-64X - How I did it Add platform/nephos files Add platform/nephos/sonic-platform-modules-ingrasys submodule Add device/ingrasys/x86_64-ingrasys_s9130_32x-r0 files Add device/ingrasys/x86_64-ingrasys_s9230_64x-r0 files Add SONiC to support Nephos platform - How to verify it To build SONiC installer image and docker images, run the following commands: make configure PLATFORM=nephos make target/sonic-nephos.bin Check system and network feature is worked as well - Description for the changelog Add switch ASIC vendor and platforms for Nephos - A picture of a cute animal (not mandatory but encouraged) Signed-off-by: Sam Yang <yang.kaiyu@gmail.com> * Advance sonic-sairedis submodule to include #271 (Add Nephos ASIC)
2017-12-22 12:04:29 -06:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Install docker
echo '[INFO] Install docker'
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Install apparmor utils since they're missing and apparmor is enabled in the kernel
## Otherwise Docker will fail to start
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apparmor
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apt-transport-https \
ca-certificates \
curl \
gnupg2 \
software-properties-common
[build]: apply proxy setting to curl. (#2544)
2019-02-09 00:01:29 -06:00
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/docker.gpg -fsSL https://download.docker.com/linux/debian/gpg
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-key add /tmp/docker.gpg
sudo LANG=C chroot $FILESYSTEM_ROOT rm /tmp/docker.gpg
sudo LANG=C chroot $FILESYSTEM_ROOT add-apt-repository \
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
"deb [arch=$CONFIGURED_ARCH] https://download.docker.com/linux/debian stretch stable"
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get update
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install docker-ce=${DOCKER_VERSION}
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y remove software-properties-common gnupg2
Simplify script to install docker (#1925) Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>
2018-08-13 20:30:00 -05:00
[build]: Update comments on build_debian.sh (#3533)
2019-10-09 19:38:53 -05:00
## Add docker config drop-in to specify dockerd command line
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo mkdir -p $FILESYSTEM_ROOT/etc/systemd/system/docker.service.d/
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Note: $_ means last argument of last command
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo cp files/docker/docker.service.conf $_
[docker-engine] fix systemd shutdown hang (#2451) When rebooting without the platform_reboot plugin, systemd takes a few minutes to properly shutdown. It's blocking on some docker cleanup operation. As described by https://github.com/docker/for-linux/issues/421 there is a race between docker.service and containerd.service. docker needs containerd to properly stop the containers.
2019-01-16 03:54:14 -06:00
## Fix systemd race between docker and containerd
sudo sed -i '/After=/s/$/ containerd.service/' $FILESYSTEM_ROOT/lib/systemd/system/docker.service
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Create default user
## Note: user should be in the group with the same name, and also in sudo/docker group
sudo LANG=C chroot $FILESYSTEM_ROOT useradd -G sudo,docker $USERNAME -c "$DEFAULT_USERINFO" -m -s /bin/bash
## Create password for the default user
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
echo "$USERNAME:$PASSWORD" | sudo LANG=C chroot $FILESYSTEM_ROOT chpasswd
New release v1.0.0
2016-03-08 13:42:20 -06:00
[Makefile/slave docker] ARM arch doesn't support few packages (#3273) * [Makefile/slave docker] ARM arch doesn't support few packages iproute2 is missing for ARM sonic-slave docker Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-08-06 23:33:14 -05:00
if [[ $CONFIGURED_ARCH == amd64 ]]; then
## Pre-install hardware drivers
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install \
firmware-linux-nonfree
fi
Build Arista Aboot image
2016-03-16 01:38:26 -05:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Pre-install the fundamental packages
## Note: gdisk is needed for sgdisk in install.sh
## Note: parted is needed for partprobe in install.sh
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Note: ca-certificates is needed for easy_install
Keep pip in the debian image (#356)
2017-03-02 18:04:18 -06:00
## Note: don't install python-apt by pip, older than Debian repo one
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
file \
[baseimage] management VRF support via l3mdev (#2585) This commit adds support for New feature management VRF using L3mdev. Added commands to enable/disable management VRF. Config vrf add mgmt will enable management VRF, enslave the eth0 device to the master device mgmt and restart interfaces-configs in mgmt-vrf context. management interface (eth0) can be configured using config interface eth0 ip add command and removed using config interface eth0 ip remove command. Requirement and design are covered in mgmt vrf design document. Currently show command displays linux command output; will update show command display in next PR after concluding what would be the output for the show commands. Added metric for default routes in dhcp and static, any changes for metric will be addressed subsequently after discussing. Signed-off-by: Harish Venkatraman <harish_venkatraman@dell.com>
2019-07-24 18:18:40 -05:00
ifmetric \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
iproute2 \
[interfaces]: Remove bridge-utils from swss docker and add it to base image (#417) The reason is that /etc/network/interfaces file is in base image. After booting, docker-swss is not ready and thus the empty VLAN interfaces cannot be created when the brctl is pointing to the binary inside the swss docker. Add the bridge-utils into the base image and add bridge_ports none to the /etc/network/interfaces file so that after boot-up the empty VLAN interfaces will be created to let the members to join later. Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-03-20 23:39:09 -05:00
bridge-utils \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
isc-dhcp-client \
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo \
vim \
tcpdump \
[build_debian]: Add dbus package to update timezone (#702) Signed-off-by: Hiayang Zheng haiyang.z@alibaba.inc
2017-06-15 12:31:13 -05:00
dbus \
New release v1.0.0
2016-03-08 13:42:20 -06:00
ntp \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
ntpstat \
New release v1.0.0
2016-03-08 13:42:20 -06:00
openssh-server \
python \
python-setuptools \
python-apt \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
traceroute \
iputils-ping \
net-tools \
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
bsdmainutils \
ca-certificates \
i2c-tools \
Automatic fw upgrade for mlnx platform (#31) * Automatic fw upgrade for mlnx platform Implement script for firmware upgrade to required version Add firmware binary and script to ops-syncd-mlnx container Add pciutils and usbutils to sonic-generic.bin * Update firmware installation message It is possible to do both upgrade and downgrade Change "Upgrading" to "Installing compatible version" Signed-off-by: marian-pritsak <marianp@mellanox.com>
2016-10-18 13:22:29 -05:00
efibootmgr \
usbutils \
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
pciutils \
iptables-persistent \
[ebtables] install ebtables in base image and install filter rules (#2805) - Add ebtables package, and install some filter rules: 1. ebtables -A FORWARD -d BGA -j DROP 2. ebtables -A FORWARD -p ARP -j DROP Basically, we let the ARP packets in the VLAN being forwarded by the ASIC, kernel gets a copy of these ARP packets and the forwarding from Kenerl gets dropped. So there is always only one copy of ARP/response in the VLAN. Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-05-09 11:44:41 -05:00
ebtables \
Add get_graph service to fetch minigraph automatically (#288) - Add a functionality to get SNMP community from DHCP (option 224) - Add a functionality to get minigraph from http service instead of using default minigraph - The url for graph service is passed through DHCP option 225 - This feature is by default disabled. Modify rule/config to enable it on build time, or modify /etc/sonic/graph_service_url on run time. - Fix a bug that getting hostname from DHCP is not working correctly
2017-02-17 15:47:01 -06:00
logrotate \
[baseimage]: Add kexec-tools package into the baseimage (#397) * Include kexec-tools package which could be used for fast reboot * Use sudo for sed
2017-03-15 20:38:55 -05:00
curl \
[image]: SONiC-to-SONiC update (#464)
2017-04-21 19:23:36 -05:00
kexec-tools \
[docker-base]: Add less, strace, and configuration for vim (#591) * Add less in docker-base. Add strace in docker_base_dbg. * Make link vim to vim.tiny and have vim config file
2017-05-11 20:46:11 -05:00
less \
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
unzip \
[build_debian]: Install grub-common in the base image (#1014)
2017-10-05 23:43:25 -05:00
gdisk \
[baseimage]: Install sysfsutils package into SONiC host system (#1290)
2018-01-10 05:04:32 -06:00
sysfsutils \
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
squashfs-tools \
[fast-reboot]: Support OS9 -> SONiC fast-reboot migration (#1414) * Support OS9 -> SONiC fast-reboot migration * Address review comments. Update NOS mac in EEPROM and net.rules for eth0 * Address review comments. Update sonic-platform-modules-dell to fac81d... * Fix script for POSIX compliance
2018-03-08 18:42:41 -06:00
grub2-common \
[baseimage]: use rsyslog in baseimage from stretch repo Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-08-11 12:58:30 -05:00
rsyslog \
[baseimage]: add screen package (#1644)
2018-04-26 15:53:54 -05:00
ethtool \
[baseimage]: add commonly used network tools (#1832) * [baseimage]: add commonly used network tools
2018-07-01 11:46:25 -05:00
screen \
hping3 \
python-scapy \
tcptraceroute \
[baseimage] set default locale en_US.UTF-8 (#1988) * [baseimage] set default locale en_US.UTF-8 Signed-off-by: chenhu <chenhu@didichuxing.com> * [baseimage]set default locale to en_US.UTF-8, clean all other unused * [baseimage] update-locale after locale-gen * correct update-locale command line Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-09-11 05:15:19 -05:00
mtr-tiny \
[baseimage]: install cgroup-tools and set udp_l3mdev_accept=1 (#2485) cgroup-tools is required to bind a process to l3mdev master Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-01-25 13:47:09 -06:00
locales \
[innovium]: Initial commit (#3243) [build] Add ipmitool [dockers] Add innovium platform in orchagent + ipmitool in snmp [platform/innovium] Add innovium platform [device/celestica] Add x86_64-cel_midstone-r0 device for innovium [device/delta] Add x86_64-delta_et-c032if-r0 device for innovium [sonic-slave-stretch] Add texi2html Signed-off-by: Tony Titus ttitus@innovium.com
2019-08-14 12:40:55 -05:00
cgroup-tools \
[baseimage]: install ndisc6 package (#3344) ndisc6 gathers a few diagnostic tools for IPv6 networks including: - ndisc6, which performs ICMPv6 Neighbor Discovery in userland, - rdisc6, which performs ICMPv6 Router Discovery in userland, - rltraceroute6, a UDP/ICMP IPv6 implementation of traceroute, - tcptraceroute6, a TCP/IPv6-based traceroute implementation, - tcpspray6, a TCP/IP Discard/Echo bandwidth meter, - addrinfo, easy script interface for hostname and address resolution, - dnssort, DNS sorting script. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-08-15 02:32:58 -05:00
ipmitool \
[baseimage]: kdump support (#3722) * In the event of a kernel crash, we need to gather as much information as possible to understand and identify the root cause of the crash. Currently, the kernel does not provide much information, which make kernel crash investigation difficult and time consuming. Fortunately, there is a way in the kernel to provide more information in the case of a kernel crash. kdump is a feature of the Linux kernel that creates crash dumps in the event of a kernel crash. This PR will add kermel kdump support. An extension to the CLI utilities config and show is provided to configure and manage kdump: - enable / disable kdump functionality - configure kdump (how many kernel crash logs can be saved, memory allocated for capture kernel) - view kernel crash logs
2019-11-09 01:08:42 -06:00
ndisc6 \
Changes in sonic-buildimage to support the NAT feature (#3494) * Changes in sonic-buildimage for the NAT feature - Docker for NAT - installing the required tools iptables and conntrack for nat Signed-off-by: kiran.kella@broadcom.com * Add redis-tools dependencies in the docker nat compilation * Addressed review comments * add natsyncd to warm-boot finalizer list * addressed review comments * using swsscommon.DBConnector instead of swsssdk.SonicV2Connector * Enable NAT application in docker-sonic-vs
2020-01-29 19:40:43 -06:00
makedumpfile \
[build_debian.sh]: install python{3,}-pip on sonic base image. (#4380) Signed-off-by: Praveen Chaudhary pchaudhary@linkedin.com
2020-04-07 22:57:54 -05:00
conntrack \
python-pip \
python3-pip
[innovium]: Initial commit (#3243) [build] Add ipmitool [dockers] Add innovium platform in orchagent + ipmitool in snmp [platform/innovium] Add innovium platform [device/celestica] Add x86_64-cel_midstone-r0 device for innovium [device/delta] Add x86_64-delta_et-c032if-r0 device for innovium [sonic-slave-stretch] Add texi2html Signed-off-by: Tony Titus ttitus@innovium.com
2019-08-14 12:40:55 -05:00
[Makefile/slave docker] ARM arch doesn't support few packages (#3273) * [Makefile/slave docker] ARM arch doesn't support few packages iproute2 is missing for ARM sonic-slave docker Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-08-06 23:33:14 -05:00
if [[ $CONFIGURED_ARCH == amd64 ]]; then
## Pre-install the fundamental packages for amd64 (x86)
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
[baseimage]: Flashrom utitily support for BIOS upgrade (#2867)
2019-05-09 02:09:01 -05:00
flashrom \
[baseimage]: Install mcelog package to host OS; log machine check exceptions (MCE) to syslog (#3158) * Install mcelog package to host OS; log machine check exceptions (MCE) to syslog
2019-07-17 11:43:05 -05:00
mcelog
[Makefile/slave docker] ARM arch doesn't support few packages (#3273) * [Makefile/slave docker] ARM arch doesn't support few packages iproute2 is missing for ARM sonic-slave docker Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-08-06 23:33:14 -05:00
fi
[baseimage] set default locale en_US.UTF-8 (#1988) * [baseimage] set default locale en_US.UTF-8 Signed-off-by: chenhu <chenhu@didichuxing.com> * [baseimage]set default locale to en_US.UTF-8, clean all other unused * [baseimage] update-locale after locale-gen * correct update-locale command line Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-09-11 05:15:19 -05:00
[file permission] explicitly set file permission on passwd, group, shadow (#3652) Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-10-22 21:02:08 -05:00
## Set /etc/shadow permissions to -rw-------.
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 600 /etc/shadow
## Set /etc/passwd, /etc/group permissions to -rw-r--r--.
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 644 /etc/passwd
sudo LANG=c chroot $FILESYSTEM_ROOT chmod 644 /etc/group
[baseimage]: kdump support (#3722) * In the event of a kernel crash, we need to gather as much information as possible to understand and identify the root cause of the crash. Currently, the kernel does not provide much information, which make kernel crash investigation difficult and time consuming. Fortunately, there is a way in the kernel to provide more information in the case of a kernel crash. kdump is a feature of the Linux kernel that creates crash dumps in the event of a kernel crash. This PR will add kermel kdump support. An extension to the CLI utilities config and show is provided to configure and manage kdump: - enable / disable kdump functionality - configure kdump (how many kernel crash logs can be saved, memory allocated for capture kernel) - view kernel crash logs
2019-11-09 01:08:42 -06:00
# Needed to install kdump-tools
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "mkdir -p /etc/initramfs-tools/conf.d"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 'MODULES=most' >> /etc/initramfs-tools/conf.d/driver-policy"
[baseimage] set default locale en_US.UTF-8 (#1988) * [baseimage] set default locale en_US.UTF-8 Signed-off-by: chenhu <chenhu@didichuxing.com> * [baseimage]set default locale to en_US.UTF-8, clean all other unused * [baseimage] update-locale after locale-gen * correct update-locale command line Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-09-11 05:15:19 -05:00
#Adds a locale to a debian system in non-interactive mode
sudo sed -i '/^#.* en_US.* /s/^#//' $FILESYSTEM_ROOT/etc/locale.gen && \
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT locale-gen "en_US.UTF-8"
sudo LANG=en_US.UTF-8 DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT update-locale "LANG=en_US.UTF-8"
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c "find /usr/share/i18n/locales/ ! -name 'en_US' -type f -exec rm -f {} +"
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
[baseimage]: Download picocom version 3.1-2 from stretch-backports; No longer build from source (#1946)
2018-08-17 19:38:20 -05:00
# Install certain fundamental packages from stretch-backports in order to get
# more up-to-date (but potentially less stable) versions
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y -t stretch-backports install \
picocom
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
if [[ $CONFIGURED_ARCH == amd64 ]]; then
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y download \
grub-pc-bin
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
sudo mv $FILESYSTEM_ROOT/grub-pc-bin*.deb $FILESYSTEM_ROOT/$PLATFORM_DIR/x86_64-grub
fi
[baseimage]: Add kexec-tools package into the baseimage (#397) * Include kexec-tools package which could be used for fast reboot * Use sudo for sed
2017-03-15 20:38:55 -05:00
## Disable kexec supported reboot which was installed by default
sudo sed -i 's/LOAD_KEXEC=true/LOAD_KEXEC=false/' $FILESYSTEM_ROOT/etc/default/kexec
New release v1.0.0
2016-03-08 13:42:20 -06:00
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Remove sshd host keys, and will regenerate on first sshd start
sudo rm -f $FILESYSTEM_ROOT/etc/ssh/ssh_host_*_key*
sudo cp files/sshd/host-ssh-keygen.sh $FILESYSTEM_ROOT/usr/local/bin/
sudo cp -f files/sshd/sshd.service $FILESYSTEM_ROOT/lib/systemd/system/ssh.service
[sshd] Close all SSH connetions after 15 minutes of inactivity (#3031) - What I did Configure sshd to close all SSH connetions after 15 minutes of inactivity. - How I did it Set ClientAliveInterval to 900 (900 seconds = 15 minutes) and ClientAliveCountMax to 0 in /etc/ssh/sshd_config using augtool in build_debian.sh. In the process, I refactored the existing augtool command for sshd_config so as to add comments and empty lines to file for readability. - How to verify it Log into device via management port. Wait 15 minutes without sending a keystroke -- you should be automatically logged out.
2019-07-07 02:41:14 -05:00
# Config sshd
# 1. Set 'UseDNS' to 'no'
# 2. Configure sshd to close all SSH connetions after 15 minutes of inactivity
sudo augtool -r $FILESYSTEM_ROOT <<'EOF'
touch /files/etc/ssh/sshd_config/EmptyLineHack
rename /files/etc/ssh/sshd_config/EmptyLineHack ""
set /files/etc/ssh/sshd_config/UseDNS no
ins #comment before /files/etc/ssh/sshd_config/UseDNS
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::UseDNS]] "Disable hostname lookups"
rm /files/etc/ssh/sshd_config/ClientAliveInterval
rm /files/etc/ssh/sshd_config/ClientAliveCountMax
touch /files/etc/ssh/sshd_config/EmptyLineHack
rename /files/etc/ssh/sshd_config/EmptyLineHack ""
set /files/etc/ssh/sshd_config/ClientAliveInterval 900
set /files/etc/ssh/sshd_config/ClientAliveCountMax 0
ins #comment before /files/etc/ssh/sshd_config/ClientAliveInterval
set /files/etc/ssh/sshd_config/#comment[following-sibling::*[1][self::ClientAliveInterval]] "Close inactive client sessions after 15 minutes"
save
quit
EOF
# Configure sshd to listen for v4 connections; disable listening for v6 connections
Add caclmgrd and related files to translate and install control plane ACL rules (#1240)
2018-01-09 19:55:10 -06:00
sudo sed -i 's/^ListenAddress ::/#ListenAddress ::/' $FILESYSTEM_ROOT/etc/ssh/sshd_config
sudo sed -i 's/^#ListenAddress 0.0.0.0/ListenAddress 0.0.0.0/' $FILESYSTEM_ROOT/etc/ssh/sshd_config
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Config sysctl
sudo mkdir -p $FILESYSTEM_ROOT/var/core
sudo augtool --autosave "
[quagga] enable core dump for bgpd and zebra (#927) * [core dump] pass unix time to coredump-compress script Currently we only have program name (e.g. bgpd) and PID in the core file name. PID could collide especially after docker restart or recreate. Passing the unix time to coredump-compress so it could also add time to the core file name. * [utilities] include the change to coredump_compress script * [quagga] enable core dump for bgpd and zebra bgpd and zebra downgrade their privilege shortly after started. For that sysctrl kernel.suid_dumpable needs to be set to 2, so that they can dump core. Note that fs.suid_dumpable SHOULD NOT be set to 1. Which will bypass all system security.
2017-08-30 11:41:47 -05:00
set /files/etc/sysctl.conf/kernel.core_pattern '|/usr/bin/coredump-compress %e %t %p'
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
[debian]: Add kernel configuration to reboot on kernel soft lockup (#594)
2017-05-11 20:57:00 -05:00
set /files/etc/sysctl.conf/kernel.softlockup_panic 1
set /files/etc/sysctl.conf/kernel.panic 10
[baseimage] kernel oom-killer to panic when the system is truly out of memory (#2988) - What I did Currently when the system is under memory pressure, the OOM killer kicks in and kills a rogue process. Killing a rogue process can cause the device to be un-healthy leading to blackholing of the traffic. To avoid this, configure the OOM to do a kernel panic which will cause the device to reboot and come back up healthy. - How I did it Added the sysctl variable panic_on_oom and set the value to 2. Setting it to 2 will ensure OOM killer to always do a kernel panic.
2019-06-11 18:19:49 -05:00
set /files/etc/sysctl.conf/vm.panic_on_oom 2
[quagga] enable core dump for bgpd and zebra (#927) * [core dump] pass unix time to coredump-compress script Currently we only have program name (e.g. bgpd) and PID in the core file name. PID could collide especially after docker restart or recreate. Passing the unix time to coredump-compress so it could also add time to the core file name. * [utilities] include the change to coredump_compress script * [quagga] enable core dump for bgpd and zebra bgpd and zebra downgrade their privilege shortly after started. For that sysctrl kernel.suid_dumpable needs to be set to 2, so that they can dump core. Note that fs.suid_dumpable SHOULD NOT be set to 1. Which will bypass all system security.
2017-08-30 11:41:47 -05:00
set /files/etc/sysctl.conf/fs.suid_dumpable 2
[debian]: Add kernel configuration to reboot on kernel soft lockup (#594)
2017-05-11 20:57:00 -05:00
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
set /files/etc/sysctl.conf/net.ipv4.conf.default.forwarding 1
set /files/etc/sysctl.conf/net.ipv4.conf.all.forwarding 1
set /files/etc/sysctl.conf/net.ipv4.conf.eth0.forwarding 0
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_accept 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_announce 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_filter 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_notify 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_ignore 0
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_accept 0
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_announce 1
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_filter 0
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_notify 1
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_ignore 2
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
[orchagent]: Add ARP update script to maintain VLAN neighbors (#401) - Extend ARP reachable time to 30min - Add arping to docker-swss - Add arp_update script to routinely probe neighbors Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-05-15 19:06:19 -05:00
set /files/etc/sysctl.conf/net.ipv4.neigh.default.base_reachable_time_ms 1800000
Fix potential blackholing/looping traffic when link-local was used and refresh ipv6 neighbor to avoid CPU hit (#1904) * Fix potential blackholing/looping traffic and refresh ipv6 neighbor to avoid CPU hit In case ipv6 global addresses were configured on L3 interfaces and used for peering, and routing protocol was using link-local addresses on the same interfaces as prefered nexthops, the link-local addresses could be aged out after a while due to no activities towards the link-local addresses themselves. And when we receive new routes with the link-local nexthops, SONiC won't insert them to the HW, and thus cause looping or blackholing traffic. Global ipv6 addresses on L3 interfaces between switches are refreshed by BGP keeplive and other messages. On server facing side, traffic may hit fowarding plane only, and no refresh for the ipv6 neighbor entries regularly. This could age-out the linux kernel ipv6 neighbor entries, and HW neighbor table entries could be removed, and thus traffic going to those neighbors would hit CPU, and cause traffic drop and temperary CPU high load. Also, if link-local addresses were not learned, we may not get them at all later. It is intended to fix all above issues. Changes: Add ndisc6 package in swss docker and use it for ipv6 ndp ping to update the neighbors' state on Vlan interfaces Change the default ipv6 neighbor reachable timer to 30mins Add periodical ipv6 multicast ping to ff02::11 to get/refresh link-local neighbor info. * Fix review comments: Add PORTCHANNEL_INTERFACE interface for ipv6 multicast ping format issue * Combine regular L3 interface and portchannel interface for looping * Add ndisc6 package to vs docker
2018-08-12 05:14:55 -05:00
set /files/etc/sysctl.conf/net.ipv6.neigh.default.base_reachable_time_ms 1800000
[kernel]: Increasing gc threshold values for kernel neighbors (#4100) Increase gc threashold values as below: Previous: net.ipv6.neigh.default.gc_thresh1=128 net.ipv6.neigh.default.gc_thresh2=512 net.ipv6.neigh.default.gc_thresh3=1024 net.ipv4.neigh.default.gc_thresh1=128 net.ipv4.neigh.default.gc_thresh2=512 net.ipv4.neigh.default.gc_thresh3=1024 New net.ipv6.neigh.default.gc_thresh1=1024 net.ipv6.neigh.default.gc_thresh2=2048 net.ipv6.neigh.default.gc_thresh3=4096 net.ipv4.neigh.default.gc_thresh1=1024 net.ipv4.neigh.default.gc_thresh2=2048 net.ipv4.neigh.default.gc_thresh3=4096
2020-02-04 03:03:16 -06:00
set /files/etc/sysctl.conf/net.ipv4.neigh.default.gc_thresh1 1024
set /files/etc/sysctl.conf/net.ipv6.neigh.default.gc_thresh1 1024
set /files/etc/sysctl.conf/net.ipv4.neigh.default.gc_thresh2 2048
set /files/etc/sysctl.conf/net.ipv6.neigh.default.gc_thresh2 2048
set /files/etc/sysctl.conf/net.ipv4.neigh.default.gc_thresh3 4096
set /files/etc/sysctl.conf/net.ipv6.neigh.default.gc_thresh3 4096
[orchagent]: Add ARP update script to maintain VLAN neighbors (#401) - Extend ARP reachable time to 30min - Add arping to docker-swss - Add arp_update script to routinely probe neighbors Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-05-15 19:06:19 -05:00
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.default.forwarding 1
set /files/etc/sysctl.conf/net.ipv6.conf.all.forwarding 1
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.forwarding 0
set /files/etc/sysctl.conf/net.ipv6.conf.default.accept_dad 0
build_debian: Disable IPv6 DAD (#56) This change disables DAD (IPv6's Duplicate Address Detection). DAD protects against IP address conflicts. The way it works is that after an address is added to an interface, the operating system uses the Neighbor Discovery Protocol to check if any other host on the network has the same address. If it finds a neighbor with the same address, the address is removed from the interface. The problem here is that the time waiting for DAD to be done is fairly long and because that we set the host interface operating status to be down at first, the port cannot exchange the Neighbor Discovery Protocol and DAD will time out. The host interface is only brought up after we have received the port admin status up notification from the kernel, which happens only after the DAD is done or times out. This makes the whole host interfaces bringing up procedure very slow. This the DAD is disabled. When it is disabled, addresses are immediately usable. Without DAD, we need to make sure that the IPv6 addresses don't have conflicts. For now, we have two IPv6 addresses. One is assigned manually, which prevents conflicts at first. Another one is the IPv6 link-local address. It is derived from the MAC address and thus all the link-local addresses are the same on one box. Because link-local addresses are not used, it will not trigger issues even if they are the same.
2016-11-03 14:15:00 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.all.accept_dad 0
[baseimage]: Disable DAD for eth0 explicitly (#1701)
2018-05-12 03:31:17 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.accept_dad 0
[debian]: Disable receiving default routes for ipv6 on mgmt interface (#588) * Disable net.ipv6.conf.eth0.accept_ra_defrtr. It will remain IPv6 working on mgmt interface, but it will disable receiving default routes
2017-05-10 19:39:51 -05:00
[debian]: Enable keep_addr_on_down to keep IPv6 addresses (#1992) Starting from kernel 4.6, this new attribute keep_addr_on_down is introduced (https://kernelnewbies.org/Linux_4.6). If set, static global addresses with no expiration time are not flushed. Ref: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Signed-off-by: Shu0T1an ChenG <shuche@microsoft.com>
2018-08-28 16:40:01 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.default.keep_addr_on_down 1
set /files/etc/sysctl.conf/net.ipv6.conf.all.keep_addr_on_down 1
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.keep_addr_on_down 1
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
set /files/etc/sysctl.conf/net.ipv4.tcp_l3mdev_accept 1
[baseimage]: install cgroup-tools and set udp_l3mdev_accept=1 (#2485) cgroup-tools is required to bind a process to l3mdev master Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-01-25 13:47:09 -06:00
set /files/etc/sysctl.conf/net.ipv4.udp_l3mdev_accept 1
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
[baseimage]: Increase net.core.rmem_max to 2097152 (#767) * Increase net.core.rmem_max to 2097152
2017-06-29 03:40:22 -05:00
set /files/etc/sysctl.conf/net.core.rmem_max 2097152
[baseimage] Added net.core.wmem_max value required by Copp test (#1489)
2018-03-14 11:20:47 -05:00
set /files/etc/sysctl.conf/net.core.wmem_max 2097152
[psud]: Fix for psud crash because of database connection reset (#3647) When database service is down, psud daemon throws an error because of DB connection reset, this because pmon service has no dependency with database service. To resolve this issue, added database service dependency to the pmon service. Also, increased the net.core.somaxconn value to 512 to solve the connection failure on the scaled setup.
2020-01-10 15:26:04 -06:00
set /files/etc/sysctl.conf/net.core.somaxconn 512
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
" -r $FILESYSTEM_ROOT
[Makefile/slave docker] ARM arch doesn't support few packages (#3273) * [Makefile/slave docker] ARM arch doesn't support few packages iproute2 is missing for ARM sonic-slave docker Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-08-06 23:33:14 -05:00
if [[ $CONFIGURED_ARCH == amd64 ]]; then
# Configure mcelog to log machine checks to syslog
sudo sed -i 's/^#syslog = yes/syslog = yes/' $FILESYSTEM_ROOT/etc/mcelog/mcelog.conf
fi
[baseimage]: Install mcelog package to host OS; log machine check exceptions (MCE) to syslog (#3158) * Install mcelog package to host OS; log machine check exceptions (MCE) to syslog
2019-07-17 11:43:05 -05:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## docker-py is needed by Ansible docker module
[build]: allow to use http(s) proxy in the build (#1265) * allow to use http(s) proxy in the build To enable this, use following command http_proxy=[your_proxy] https_proxy=[your_proxy] make
2017-12-24 01:34:15 -06:00
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT easy_install pip
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip install 'docker-py==1.6.0'
Keep pip in the debian image (#356)
2017-03-02 18:04:18 -06:00
## Note: keep pip installed for maintainance purpose
New release v1.0.0
2016-03-08 13:42:20 -06:00
[baseimage]: Install netifaces package in sonic-slave docker and sonic image (#1353)
2018-12-15 13:52:36 -06:00
## Get gcc and python dev pkgs
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install gcc libpython2.7-dev
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip install 'netifaces==0.10.7'
[database]: Mount /var/run/redis/ folder from host for all dockers (#418) - Create /var/run/redis/ folder on the host - Install Python client for Redis on the host - Mount /var/run/redis/ as read/write from host for all dockers - Enable accessing the database everywhere including on the host and from remote Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-03-23 14:18:52 -05:00
## Create /var/run/redis folder for docker-database to mount
sudo mkdir -p $FILESYSTEM_ROOT/var/run/redis
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Config DHCP for eth0
sudo tee -a $FILESYSTEM_ROOT/etc/network/interfaces > /dev/null <<EOF
auto eth0
allow-hotplug eth0
iface eth0 inet dhcp
EOF
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo cp files/dhcp/rfc3442-classless-routes $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d
Add DHCP client hook to update hostname. (#235) * Add DHCP client hook to update hostname. * Remove interface checking * Update hostname in /etc/hosts file
2017-02-02 13:19:48 -06:00
sudo cp files/dhcp/sethostname $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
ZTP infrastructure changes to support DHCP discovery provisioning data (#3298) * ZTP infrastructure changes to support DHCP discovery provisioning data - Dynamically generate DHCP client configuration based on current ZTP state - Added support to request and process hostname when using DHCPv6 - Do not process graphservice url dhcp option if ZTP is enabled, ZTP service will process it - Generate /e/n/i file with all active interfaces seeking address assignment via DHCP. Only interfaces that are created in Linux will be added to /e/n/i. Also DHCP is started only on linked up in-band interfaces. Signed-off-by: Rajendra Dendukuri <rajendra.dendukuri@broadcom.com>
2019-12-10 10:16:56 -06:00
sudo cp files/dhcp/sethostname6 $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
Add get_graph service to fetch minigraph automatically (#288) - Add a functionality to get SNMP community from DHCP (option 224) - Add a functionality to get minigraph from http service instead of using default minigraph - The url for graph service is passed through DHCP option 225 - This feature is by default disabled. Modify rule/config to enable it on build time, or modify /etc/sonic/graph_service_url on run time. - Fix a bug that getting hostname from DHCP is not working correctly
2017-02-17 15:47:01 -06:00
sudo cp files/dhcp/graphserviceurl $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
sudo cp files/dhcp/snmpcommunity $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
sudo cp files/dhcp/vrf $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
[baseimage]: Management vrf ntp support (#3204) This commit adds NTP support for management VRF using L3mdev. Config vrf add mgmt will enable management VRF, enslave the eth0 device to the master device mgmt, stop ntp service in default, restart interfaces-configs and restart ntp service in mgmt-vrf context. Requirement and design are covered in mgmt vrf design document. Signed-off-by: Harish Venkatraman <harish_venkatraman@dell.com>
2019-09-16 12:21:06 -05:00
if [ -f files/image_config/ntp/ntp ]; then
sudo cp ./files/image_config/ntp/ntp $FILESYSTEM_ROOT/etc/init.d/
fi
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
## Version file
sudo mkdir -p $FILESYSTEM_ROOT/etc/sonic
sudo tee $FILESYSTEM_ROOT/etc/sonic/sonic_version.yml > /dev/null <<EOF
[build_debian]: Add quote to specify values as string (#1503)
2018-03-16 03:09:33 -05:00
build_version: '$(sonic_get_version)'
[image]: Explicitly specify kernel_version as string (#1280)
2018-01-03 23:43:06 -06:00
debian_version: '$(cat $FILESYSTEM_ROOT/etc/debian_version)'
[build_debian]: Add quote to specify values as string (#1503)
2018-03-16 03:09:33 -05:00
kernel_version: '$kversion'
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
asic_type: $sonic_asic_platform
[build_debian]: Add quote to specify values as string (#1503)
2018-03-16 03:09:33 -05:00
commit_id: '$(git rev-parse --short HEAD)'
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
build_date: $(date -u)
[build]: add commit id and build number in sonic_version (#508)
2017-04-16 03:17:22 -05:00
build_number: ${BUILD_NUMBER:-0}
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
built_by: $USER@$BUILD_HOSTNAME
EOF
[cron.d] Add cron job to periodically clean-up core files (#3449) * [cron.d] Create cron job to periodically clean-up core files * Create script to scan /var/core and clean-up older core files * Create cron job to run clean-up script Signed-off-by: Danny Allen <daall@microsoft.com> * Update interval for running cron job * Respond to feedback * Change syslog id
2019-09-13 12:50:31 -05:00
## Copy over clean-up script
sudo cp ./files/scripts/core_cleanup.py $FILESYSTEM_ROOT/usr/bin/core_cleanup.py
[build_debian] Include checksum of ASIC config files in SONiC filesystem (#3384) [build_debian] Generate checksum of ASIC config files * Adds script to generate checksums for ASIC config files * Adds step to build_debian that copies ASIC config checksum into SONiC filesystem Signed-off-by: Danny Allen daall@microsoft.com
2019-09-05 21:41:35 -05:00
## Copy ASIC config checksum
python files/build_scripts/generate_asic_config_checksum.py
if [[ ! -f './asic_config_checksum' ]]; then
echo 'asic_config_checksum not found'
exit 1
fi
sudo cp ./asic_config_checksum $FILESYSTEM_ROOT/etc/sonic/asic_config_checksum
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
if [ -f sonic_debian_extension.sh ]; then
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
./sonic_debian_extension.sh $FILESYSTEM_ROOT $PLATFORM_DIR
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
fi
Framework to plugin Organization specific scripts during ONIE Image build (#951) * Framework to plugin Organization specific scripts * Framework to plugin Organization specific scripts * Framework to plugin Organization specific scripts * add getopt option to organization script
2017-09-19 18:23:31 -05:00
## Organization specific extensions such as Configuration & Scripts for features like AAA, ZTP...
if [ "${enable_organization_extensions}" = "y" ]; then
if [ -f files/build_templates/organization_extensions.sh ]; then
[submodule] update sonic-linux-kernel (#2985) * [submodule] update sonic-linux-kernel * update linux kernel version * Fix many version strings * update mellanox components (built with new kernel) * [mlnx] add make files for SDK WJH libs * Update arista driver submodule (#8) Make the debian packaging point to a newer kernel version.
2019-06-18 12:00:16 -05:00
sudo chmod 755 files/build_templates/organization_extensions.sh
Framework to plugin Organization specific scripts during ONIE Image build (#951) * Framework to plugin Organization specific scripts * Framework to plugin Organization specific scripts * Framework to plugin Organization specific scripts * add getopt option to organization script
2017-09-19 18:23:31 -05:00
./files/build_templates/organization_extensions.sh -f $FILESYSTEM_ROOT -h $HOSTNAME
fi
fi
[ebtables] install ebtables in base image and install filter rules (#2805) - Add ebtables package, and install some filter rules: 1. ebtables -A FORWARD -d BGA -j DROP 2. ebtables -A FORWARD -p ARP -j DROP Basically, we let the ARP packets in the VLAN being forwarded by the ASIC, kernel gets a copy of these ARP packets and the forwarding from Kenerl gets dropped. So there is always only one copy of ARP/response in the VLAN. Signed-off-by: Ying Xie <ying.xie@microsoft.com>
2019-05-09 11:44:41 -05:00
## Setup ebtable rules (rule file is in binary format)
sudo sed -i 's/EBTABLES_LOAD_ON_START="no"/EBTABLES_LOAD_ON_START="yes"/g' ${FILESYSTEM_ROOT}/etc/default/ebtables
sudo cp files/image_config/ebtables/ebtables.filter ${FILESYSTEM_ROOT}/etc
[build]: Added debug symbols to many debug dockers. (#3098) * Added debug symbols to many debug dockers. * For debug images *only*: 1) Archive source files into debug image 2) Archived source is copied into /src 3) Created an empty dir /debug 4) Mount both /src as ro & /debug as rw into every docker 5) Login banner will give some details on /src & /debug 6) Devs can copy core file into /debug and view it from inside a container. 7) Dev may create all gdb logs and other data directly into /debug. * Dropped redundant REDIS_TOOLS per review comments. * Added debug symbols to frr package and hence FRR based BGP docker. * 1) Moved dbg_files.sh to scripts/ 2) Src directories to archive are now collected from individual Makefiles. 3) Added few more debug symbols 4) Added few more debug dockers. Here after no more changes except per review comments. To debug: Install required version of debug image in Switch or VM. Copy core file into /debug of host Get into Docker gdb /usr/bin/<daemon> -c /debug/<your core file> set directory /src/... <-- inside gdb to get the source For non-in-depth debugging: Download corresponding debug Docker image (docker-...-dbg.gz) to your VM Load the image Run image with entrypoint as 'bash' with dir containing core mapped in. Run gdb on the core.
2019-07-04 00:13:55 -05:00
## Debug Image specific changes
## Update motd for debug image
if [ "$DEBUG_IMG" == "y" ]
then
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '**************' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 'Running DEBUG image' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '**************' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/src has the sources' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/src is mounted in each docker' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/debug is created for core files or temp files' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo 'Create a subdir under /debug to upload your files' >> /etc/motd"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '/debug is mounted in each docker' >> /etc/motd"
sudo mkdir -p $FILESYSTEM_ROOT/src
Create the src archive in target/ when INSTALL_DEBUG_TOOLS=y (#3323) * Create the src archive in target/ when INSTALL_DEBUG_TOOLS=y * Dropped -v (verbose flag) from tar command
2019-08-28 11:29:48 -05:00
sudo cp $DEBUG_SRC_ARCHIVE_FILE $FILESYSTEM_ROOT/src/
[build]: Added debug symbols to many debug dockers. (#3098) * Added debug symbols to many debug dockers. * For debug images *only*: 1) Archive source files into debug image 2) Archived source is copied into /src 3) Created an empty dir /debug 4) Mount both /src as ro & /debug as rw into every docker 5) Login banner will give some details on /src & /debug 6) Devs can copy core file into /debug and view it from inside a container. 7) Dev may create all gdb logs and other data directly into /debug. * Dropped redundant REDIS_TOOLS per review comments. * Added debug symbols to frr package and hence FRR based BGP docker. * 1) Moved dbg_files.sh to scripts/ 2) Src directories to archive are now collected from individual Makefiles. 3) Added few more debug symbols 4) Added few more debug dockers. Here after no more changes except per review comments. To debug: Install required version of debug image in Switch or VM. Copy core file into /debug of host Get into Docker gdb /usr/bin/<daemon> -c /debug/<your core file> set directory /src/... <-- inside gdb to get the source For non-in-depth debugging: Download corresponding debug Docker image (docker-...-dbg.gz) to your VM Load the image Run image with entrypoint as 'bash' with dir containing core mapped in. Run gdb on the core.
2019-07-04 00:13:55 -05:00
sudo mkdir -p $FILESYSTEM_ROOT/debug
fi
[baseimage]: Install netifaces package in sonic-slave docker and sonic image (#1353)
2018-12-15 13:52:36 -06:00
## Remove gcc and python dev pkgs
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y remove gcc libpython2.7-dev
[initramfs] Updated required tools for initramfs (#3734) * [initramfs] Updated reuired tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Updated required tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [Platform] [Marvell] Platform specific debian package for et6448m device Signed-off-by: Antony Rheneus <arheneus@marvell.com> * Removed auto-generated files Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Marvell arm modules update and platform config update Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [iniramfs] add initramfs uboot-utils hook script only for ARM Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-15 10:25:01 -06:00
## Add mtd and uboot firmware tools package
[Platform] ARM64 support for Marvell ARM platform (#4043) [Makefile] Fix for multi docker issue on 19 version above Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-23 18:50:17 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install u-boot-tools mtd-utils device-tree-compiler
sudo LANG=C chroot $FILESYSTEM_ROOT apt-mark manual u-boot-tools mtd-utils device-tree-compiler
[initramfs] Updated required tools for initramfs (#3734) * [initramfs] Updated reuired tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Updated required tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [Platform] [Marvell] Platform specific debian package for et6448m device Signed-off-by: Antony Rheneus <arheneus@marvell.com> * Removed auto-generated files Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Marvell arm modules update and platform config update Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [iniramfs] add initramfs uboot-utils hook script only for ARM Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-15 10:25:01 -06:00
[baseimage]: move update initramfs to later stage some platform drivers install blacklist.conf in /etc/modprobe.d. Those configuration should be proprogated into initramfs to avoid loading those blacklisted driver.
2018-03-05 01:07:40 -06:00
## Update initramfs
sudo chroot $FILESYSTEM_ROOT update-initramfs -u
[initramfs] Updated required tools for initramfs (#3734) * [initramfs] Updated reuired tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Updated required tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [Platform] [Marvell] Platform specific debian package for et6448m device Signed-off-by: Antony Rheneus <arheneus@marvell.com> * Removed auto-generated files Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Marvell arm modules update and platform config update Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [iniramfs] add initramfs uboot-utils hook script only for ARM Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-15 10:25:01 -06:00
## Convert initrd image to u-boot format
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
INITRD_FILE=initrd.img-${LINUX_KERNEL_VERSION}-${CONFIGURED_ARCH}
if [[ $CONFIGURED_ARCH == armhf ]]; then
INITRD_FILE=initrd.img-${LINUX_KERNEL_VERSION}-armmp
[Platform] ARM64 support for Marvell ARM platform (#4043) [Makefile] Fix for multi docker issue on 19 version above Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-23 18:50:17 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT mkimage -A arm -O linux -T ramdisk -C gzip -d /boot/$INITRD_FILE /boot/u${INITRD_FILE}
## Overwriting the initrd image with uInitrd
sudo LANG=C chroot $FILESYSTEM_ROOT mv /boot/u${INITRD_FILE} /boot/$INITRD_FILE
elif [[ $CONFIGURED_ARCH == arm64 ]]; then
sudo cp -v $PLATFORM_DIR/${sonic_asic_platform}-${CONFIGURED_ARCH}/sonic_fit.its $FILESYSTEM_ROOT/boot/
sudo LANG=C chroot $FILESYSTEM_ROOT mkimage -f /boot/sonic_fit.its /boot/sonic_${CONFIGURED_ARCH}.fit
[initramfs] Updated required tools for initramfs (#3734) * [initramfs] Updated reuired tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Updated required tools for initramfs Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [Platform] [Marvell] Platform specific debian package for et6448m device Signed-off-by: Antony Rheneus <arheneus@marvell.com> * Removed auto-generated files Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Added mtd and uboot firmware tools package required for arm arch Its been enabled to all arch including amd64 Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [initramfs] Marvell arm modules update and platform config update Signed-off-by: Antony Rheneus <arheneus@marvell.com> * [iniramfs] add initramfs uboot-utils hook script only for ARM Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2020-01-15 10:25:01 -06:00
fi
fi
[baseimage]: move update initramfs to later stage some platform drivers install blacklist.conf in /etc/modprobe.d. Those configuration should be proprogated into initramfs to avoid loading those blacklisted driver.
2018-03-05 01:07:40 -06:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Clean up apt
[baseimage]: Install netifaces package in sonic-slave docker and sonic image (#1353)
2018-12-15 13:52:36 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y autoremove
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get autoclean
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get clean
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c 'rm -rf /usr/share/doc/* /usr/share/locale/* /var/lib/apt/lists/* /tmp/*'
New release v1.0.0
2016-03-08 13:42:20 -06:00
[build]: allow to use http(s) proxy in the build (#1265) * allow to use http(s) proxy in the build To enable this, use following command http_proxy=[your_proxy] https_proxy=[your_proxy] make
2017-12-24 01:34:15 -06:00
## Clean up proxy
[ -n "$http_proxy" ] && sudo rm -f $FILESYSTEM_ROOT/etc/apt/apt.conf.d/01proxy
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Umount all
echo '[INFO] Umount all'
Ignore return value of umount (#801) * Ignore return value of umount * Refine the umount process, more diagnostic info output
2017-07-12 03:28:36 -05:00
## Display all process details access /proc
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -vm /proc
## Kill the processes
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -km /proc || true
Ignore return value of umount (#801) * Ignore return value of umount * Refine the umount process, more diagnostic info output
2017-07-12 03:28:36 -05:00
## Wait fuser fully kill the processes
sleep 15
sudo umount $FILESYSTEM_ROOT/proc || true
New release v1.0.0
2016-03-08 13:42:20 -06:00
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
if [[ $CONFIGURED_ARCH == armhf || $CONFIGURED_ARCH == arm64 ]]; then
# Remove qemu arm bin executable used for cross-building
sudo rm -f $FILESYSTEM_ROOT/usr/bin/qemu*static || true
DOCKERFS_PATH=../dockerfs/
fi
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Prepare empty directory to trigger mount move in initramfs-tools/mount_loop_root, implemented by patching
sudo mkdir $FILESYSTEM_ROOT/host
## Compress most file system into squashfs file
sudo rm -f $ONIE_INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
## Output the file system total size for diag purpose
Ignore return value of umount (#801) * Ignore return value of umount * Refine the umount process, more diagnostic info output
2017-07-12 03:28:36 -05:00
## Note: -x to skip directories on different file systems, such as /proc
sudo du -hsx $FILESYSTEM_ROOT
[build]: create empty /var/lib/docker if needed (#1920) stretch docker-engine in base image is not started by default in the build process. Need to create empty /var/lib/docker Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-08-13 00:23:43 -05:00
sudo mkdir -p $FILESYSTEM_ROOT/var/lib/docker
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
sudo mksquashfs $FILESYSTEM_ROOT $FILESYSTEM_SQUASHFS -e boot -e var/lib/docker -e $PLATFORM_DIR
New release v1.0.0
2016-03-08 13:42:20 -06:00
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
## Compress docker files
[build]: SONiC buildimage ARM arch support (#2980) ARM Architecture support in SONIC make configure platform=[ASIC_VENDOR_ARCH] PLATFORM_ARCH=[ARM_ARCH] SONIC_ARCH: default amd64 armhf - arm32bit arm64 - arm64bit Signed-off-by: Antony Rheneus <arheneus@marvell.com>
2019-07-26 00:06:41 -05:00
pushd $FILESYSTEM_ROOT && sudo tar czf $OLDPWD/$FILESYSTEM_DOCKERFS -C ${DOCKERFS_PATH}var/lib/docker .; popd
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
## Compress together with /boot, /var/lib/docker and $PLATFORM_DIR as an installer payload zip file
pushd $FILESYSTEM_ROOT && sudo zip $OLDPWD/$ONIE_INSTALLER_PAYLOAD -r boot/ $PLATFORM_DIR/; popd
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
sudo zip -g $ONIE_INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS $FILESYSTEM_DOCKERFS
Reference in New Issue Copy Permalink