matthew/sonic-buildimage
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
ea078e7823
sonic-buildimage/build_debian.sh

456 lines
21 KiB
Bash
Raw Normal View History

New release v1.0.0
2016-03-08 13:42:20 -06:00
#!/bin/bash
## This script is to automate the preparation for a debian file system, which will be used for
## an ONIE installer image.
##
## USAGE:
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
## USERNAME=username PASSWORD=password ./build_debian
## ENVIRONMENT:
New release v1.0.0
2016-03-08 13:42:20 -06:00
## USERNAME
## The name of the default admin user
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
## PASSWORD
## The password, expected by chpasswd command
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Default user
[ -n "$USERNAME" ] || {
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
echo "Error: no or empty USERNAME"
New release v1.0.0
2016-03-08 13:42:20 -06:00
exit 1
}
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
## Password for the default user
[ -n "$PASSWORD" ] || {
echo "Error: no or empty PASSWORD"
New release v1.0.0
2016-03-08 13:42:20 -06:00
exit 1
}
## Include common functions
. functions.sh
## Enable debug output for script
set -x -e
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## docker engine version (with platform)
[docker] Update docker package version for CVE-2019-5736 fix (#2663)
2019-03-18 20:50:05 -05:00
DOCKER_VERSION=5:18.09.2~3-0~debian-stretch
[kernel]: update sonic kernel to 4.9.0-8-2 (#2468) * [kernel]: update sonic kernel to 4.9.0-8-2 * 3b2114d 2019-01-20 | [sonic-linux-kernel] add udp_l3mdev_accept kernel upstream patch (#70) (HEAD, azure/master) [Harish Venkatraman] * 37734aa 2019-01-10 | L3mdev cgroup (#73) [lguohan] * d631eeb 2018-12-15 | yet another uart race condition fix (#75) [lguohan] Signed-off-by: Guohan Lu <gulv@microsoft.com> * Update Mellanox SDK Signed-off-by: Guohan Lu <gulv@microsoft.com> * Update arista platform driver to match 4.9.0-8-2 kernel Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-01-25 02:46:09 -06:00
LINUX_KERNEL_VERSION=4.9.0-8-2
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Working directory to prepare the file system
FILESYSTEM_ROOT=./fsroot
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
PLATFORM_DIR=platform
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Hostname for the linux image
Rename hostname (#6)
2016-09-15 17:22:29 -05:00
HOSTNAME=sonic
New release v1.0.0
2016-03-08 13:42:20 -06:00
DEFAULT_USERINFO="Default admin user,,,"
## Read ONIE image related config file
. ./onie-image.conf
[ -n "$ONIE_IMAGE_PART_SIZE" ] || {
echo "Error: Invalid ONIE_IMAGE_PART_SIZE in onie image config file"
exit 1
}
[ -n "$ONIE_INSTALLER_PAYLOAD" ] || {
echo "Error: Invalid ONIE_INSTALLER_PAYLOAD in onie image config file"
exit 1
}
[ -n "$FILESYSTEM_SQUASHFS" ] || {
echo "Error: Invalid FILESYSTEM_SQUASHFS in onie image config file"
exit 1
}
## Prepare the file system directory
if [[ -d $FILESYSTEM_ROOT ]]; then
[build_debian]: install deps in rootfs instead of just extracting the packages (#280) packages contains post-install that needs to be performed
2017-02-10 09:39:05 -06:00
sudo rm -rf $FILESYSTEM_ROOT || die "Failed to clean chroot directory"
New release v1.0.0
2016-03-08 13:42:20 -06:00
fi
mkdir -p $FILESYSTEM_ROOT
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
mkdir -p $FILESYSTEM_ROOT/$PLATFORM_DIR
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
mkdir -p $FILESYSTEM_ROOT/$PLATFORM_DIR/x86_64-grub
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
touch $FILESYSTEM_ROOT/$PLATFORM_DIR/firsttime
New release v1.0.0
2016-03-08 13:42:20 -06:00
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
## make / as a mountpoint in chroot env, needed by dockerd
pushd $FILESYSTEM_ROOT
sudo mount --bind . .
popd
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Build a basic Debian system by debootstrap
echo '[INFO] Debootstrap...'
[baseimage]: update base image from jessie to stretch
2017-09-05 04:07:05 -05:00
sudo http_proxy=$http_proxy debootstrap --variant=minbase --arch amd64 stretch $FILESYSTEM_ROOT http://debian-archive.trafficmanager.net/debian
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Config hostname and hosts, otherwise 'sudo ...' will complain 'sudo: unable to resolve host ...'
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '$HOSTNAME' > /etc/hostname"
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '127.0.0.1 $HOSTNAME' >> /etc/hosts"
Add support for cavium SAI (#5)
2016-09-25 23:48:25 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c "echo '127.0.0.1 localhost' >> /etc/hosts"
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Config basic fstab
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'echo "proc /proc proc defaults 0 0" >> /etc/fstab'
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'echo "sysfs /sys sysfs defaults 0 0" >> /etc/fstab'
[build]: allow to use http(s) proxy in the build (#1265) * allow to use http(s) proxy in the build To enable this, use following command http_proxy=[your_proxy] https_proxy=[your_proxy] make
2017-12-24 01:34:15 -06:00
## Setup proxy
[ -n "$http_proxy" ] && sudo /bin/bash -c "echo 'Acquire::http::Proxy \"$http_proxy\";' > $FILESYSTEM_ROOT/etc/apt/apt.conf.d/01proxy"
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Note: mounting is necessary to makedev and install linux image
echo '[INFO] Mount all'
## Output all the mounted device for troubleshooting
mount
trap_push 'sudo umount $FILESYSTEM_ROOT/proc || true'
sudo LANG=C chroot $FILESYSTEM_ROOT mount proc /proc -t proc
## Pointing apt to public apt mirrors and getting latest packages, needed for latest security updates
use seperate sources.list for debian base image build (#61)
2016-11-08 05:04:52 -06:00
sudo cp files/apt/sources.list $FILESYSTEM_ROOT/etc/apt/
Config apt inside docker images to save disk space: auto clean, gz, no trans (#69)
2016-11-16 14:46:15 -06:00
sudo cp files/apt/apt.conf.d/{81norecommends,apt-{clean,gzip-indexes,no-languages}} $FILESYSTEM_ROOT/etc/apt/apt.conf.d/
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c 'apt-mark auto `apt-mark showmanual`'
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Note: set lang to prevent locale warnings in your chroot
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y update
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y upgrade
echo '[INFO] Install packages for building image'
[baseimage]: install systemd-sysv in the base image
2017-09-02 17:29:21 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install makedev psmisc systemd-sysv
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Create device files
echo '[INFO] MAKEDEV'
sudo LANG=C chroot $FILESYSTEM_ROOT /bin/bash -c 'cd /dev && MAKEDEV generic'
## Install initramfs-tools and linux kernel
## Note: initramfs-tools recommends depending on busybox, and we really want busybox for
## 1. commands such as touch
## 2. mount supports squashfs
## However, 'dpkg -i' plus 'apt-get install -f' will ignore the recommended dependency. So
## we install busybox explicitly
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install busybox
Changed ACS references to SONiC in image, added timestamp to base image volume label
2016-09-06 15:15:10 -05:00
echo '[INFO] Install SONiC linux kernel image'
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Note: duplicate apt-get command to ensure every line return zero
[build]: put stretch debian packages under target/debs/stretch/ (#2519) * [build]: put stretch debian packages under target/debs/stretch/ * in stretch build phase, all debian packages built in that stage are placed under target/debs/stretch directory. * for python-based debian packages, since they are really the same for jessie and stretch, they are placed under target/python-debs directory. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-05 00:06:37 -06:00
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/initramfs-tools-core_*.deb || \
[baseimage]: upgrade initramfs to 0.130
2017-09-01 03:53:21 -05:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
[build]: put stretch debian packages under target/debs/stretch/ (#2519) * [build]: put stretch debian packages under target/debs/stretch/ * in stretch build phase, all debian packages built in that stage are placed under target/debs/stretch directory. * for python-based debian packages, since they are really the same for jessie and stretch, they are placed under target/python-debs directory. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-05 00:06:37 -06:00
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/initramfs-tools_*.deb || \
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
[build]: put stretch debian packages under target/debs/stretch/ (#2519) * [build]: put stretch debian packages under target/debs/stretch/ * in stretch build phase, all debian packages built in that stage are placed under target/debs/stretch directory. * for python-based debian packages, since they are really the same for jessie and stretch, they are placed under target/python-debs directory. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-05 00:06:37 -06:00
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/linux-image-${LINUX_KERNEL_VERSION}-amd64_*.deb || \
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
[baseimage]: install acl package
2017-12-11 11:00:41 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install acl
[baseimage] install dmidecode (#2540) Signed-off-by: Mykola Faryma <mykolaf@mellanox.com>
2019-02-08 13:52:12 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install dmidecode
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
[baseimage]: build root filesystem via overlay fs instead of aufs
2017-09-02 17:32:31 -05:00
## Update initramfs for booting with squashfs+overlay
New release v1.0.0
2016-03-08 13:42:20 -06:00
cat files/initramfs-tools/modules | sudo tee -a $FILESYSTEM_ROOT/etc/initramfs-tools/modules > /dev/null
[Arista]: Add support to convert vfat file system to ext4 (#201) This commit will convert the existing file system of flash drive on Arista switches from VFAT to EXT4 in the booting of SONiC. It will take the whole flash and therefore remove the recovery partition. There is a check in the script making sure that the conversion operation will not happen on a non-Arista switch or if the existing file system is not VFAT.
2017-01-24 00:25:47 -06:00
## Hook into initramfs: change fs type from vfat to ext4 on arista switches
sudo mkdir -p $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/
sudo cp files/initramfs-tools/arista-convertfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-convertfs
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-convertfs
Add initramfs hook for Arista devices (#2595) We are going to use initramfs hook for firmware upgrades To install Arista hook: - create folder /mnt/flash/<image dir>/platform/hooks/boot1/ from Aboot or /host/<image dir>/platform/hooks/boot1/ from Sonic - add executable script to created folder
2019-02-27 12:28:04 -06:00
sudo cp files/initramfs-tools/arista-hook $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-hook
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-hook
[Arista]: Add support to convert vfat file system to ext4 (#201) This commit will convert the existing file system of flash drive on Arista switches from VFAT to EXT4 in the booting of SONiC. It will take the whole flash and therefore remove the recovery partition. There is a check in the script making sure that the conversion operation will not happen on a non-Arista switch or if the existing file system is not VFAT.
2017-01-24 00:25:47 -06:00
sudo cp files/initramfs-tools/mke2fs $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/mke2fs
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/mke2fs
[aboot]: Add setfacl in the initramfs (#1185) Arista platforms need the filesystem ACLs to be removed on boot to prevent invalid permission to be set for new files.
2017-11-24 19:30:11 -06:00
sudo cp files/initramfs-tools/setfacl $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/setfacl
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/setfacl
[Arista]: Add support to convert vfat file system to ext4 (#201) This commit will convert the existing file system of flash drive on Arista switches from VFAT to EXT4 in the booting of SONiC. It will take the whole flash and therefore remove the recovery partition. There is a check in the script making sure that the conversion operation will not happen on a non-Arista switch or if the existing file system is not VFAT.
2017-01-24 00:25:47 -06:00
Add arista-net initramfs hook (#899)
2017-08-19 23:32:10 -05:00
# Hook into initramfs: rename the management interfaces on arista switches
sudo cp files/initramfs-tools/arista-net $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-net
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/arista-net
Reduce SONiC migration partition from 8G to 1G. (#1343) * Reduce SONiC migration partition from 8G to 1G. * Changes to create 1G partition with ability to resize post migration. * Remove redundant changes in varlog * Use findfs to interpret root. Move resize in case cmdline params are reordered
2018-02-07 08:07:01 -06:00
# Hook into initramfs: resize root partition after migration from another NOS to SONiC on Dell switches
sudo cp files/initramfs-tools/resize-rootfs $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/resize-rootfs
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-premount/resize-rootfs
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Hook into initramfs: after partition mount and loop file mount
## 1. Prepare layered file system
## 2. Bind-mount docker working directory (docker aufs cannot work over aufs rootfs)
sudo cp files/initramfs-tools/union-mount $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/union-mount
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/union-mount
[baseimage]: allocate varlog disk in the initramfs stage (#936) moving to initramfs unifies disk allocate on different platforms. use fallocate instead of dd to speed up the disk allocation. By default, mkfs.ext4 has -E discard option which discards the blocks at the mkfs time, also speed up the initialization time.
2017-09-06 22:07:32 -05:00
sudo cp files/initramfs-tools/varlog $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/varlog
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/varlog
[fast-reboot]: Support OS9 -> SONiC fast-reboot migration (#1414) * Support OS9 -> SONiC fast-reboot migration * Address review comments. Update NOS mac in EEPROM and net.rules for eth0 * Address review comments. Update sonic-platform-modules-dell to fac81d... * Fix script for POSIX compliance
2018-03-08 18:42:41 -06:00
# Management interface (eth0) dhcp can be optionally turned off (during a migration from another NOS to SONiC)
removing dhcp- turn- off option from initrd (#2555) * removing dhcp changes from initrd * removing mgmt-intf-dhcp file
2019-04-02 17:48:04 -05:00
#sudo cp files/initramfs-tools/mgmt-intf-dhcp $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/mgmt-intf-dhcp
#sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/scripts/init-bottom/mgmt-intf-dhcp
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo cp files/initramfs-tools/union-fsck $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/union-fsck
sudo chmod +x $FILESYSTEM_ROOT/etc/initramfs-tools/hooks/union-fsck
[baseimage]: build root filesystem via overlay fs instead of aufs
2017-09-02 17:32:31 -05:00
pushd $FILESYSTEM_ROOT/usr/share/initramfs-tools/scripts/init-bottom && sudo patch -p1 < $OLDPWD/files/initramfs-tools/udev.patch; popd
New release v1.0.0
2016-03-08 13:42:20 -06:00
[Platform] Add Ingrasys S9130-32X and S9230-64X with Nephos Switch ASIC (#1245) * Add switch ASIC vendor and platforms for Nephos - What I did Add switch ASIC vendor: Nephos Add Nephos platforms: Ingrasys S9130-32X, Ingrasys S9230-64X - How I did it Add platform/nephos files Add platform/nephos/sonic-platform-modules-ingrasys submodule Add device/ingrasys/x86_64-ingrasys_s9130_32x-r0 files Add device/ingrasys/x86_64-ingrasys_s9230_64x-r0 files Add SONiC to support Nephos platform - How to verify it To build SONiC installer image and docker images, run the following commands: make configure PLATFORM=nephos make target/sonic-nephos.bin Check system and network feature is worked as well - Description for the changelog Add switch ASIC vendor and platforms for Nephos - A picture of a cute animal (not mandatory but encouraged) Signed-off-by: Sam Yang <yang.kaiyu@gmail.com> * Advance sonic-sairedis submodule to include #271 (Add Nephos ASIC)
2017-12-22 12:04:29 -06:00
## Install latest intel ixgbe driver
[build]: put stretch debian packages under target/debs/stretch/ (#2519) * [build]: put stretch debian packages under target/debs/stretch/ * in stretch build phase, all debian packages built in that stage are placed under target/debs/stretch directory. * for python-based debian packages, since they are really the same for jessie and stretch, they are placed under target/python-debs directory. Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-02-05 00:06:37 -06:00
sudo cp target/files/stretch/ixgbe.ko $FILESYSTEM_ROOT/lib/modules/${LINUX_KERNEL_VERSION}-amd64/kernel/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
[Platform] Add Ingrasys S9130-32X and S9230-64X with Nephos Switch ASIC (#1245) * Add switch ASIC vendor and platforms for Nephos - What I did Add switch ASIC vendor: Nephos Add Nephos platforms: Ingrasys S9130-32X, Ingrasys S9230-64X - How I did it Add platform/nephos files Add platform/nephos/sonic-platform-modules-ingrasys submodule Add device/ingrasys/x86_64-ingrasys_s9130_32x-r0 files Add device/ingrasys/x86_64-ingrasys_s9230_64x-r0 files Add SONiC to support Nephos platform - How to verify it To build SONiC installer image and docker images, run the following commands: make configure PLATFORM=nephos make target/sonic-nephos.bin Check system and network feature is worked as well - Description for the changelog Add switch ASIC vendor and platforms for Nephos - A picture of a cute animal (not mandatory but encouraged) Signed-off-by: Sam Yang <yang.kaiyu@gmail.com> * Advance sonic-sairedis submodule to include #271 (Add Nephos ASIC)
2017-12-22 12:04:29 -06:00
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Install docker
echo '[INFO] Install docker'
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Install apparmor utils since they're missing and apparmor is enabled in the kernel
## Otherwise Docker will fail to start
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apparmor
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install apt-transport-https \
ca-certificates \
curl \
gnupg2 \
software-properties-common
[build]: apply proxy setting to curl. (#2544)
2019-02-09 00:01:29 -06:00
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT curl -o /tmp/docker.gpg -fsSL https://download.docker.com/linux/debian/gpg
[docker-engine]: upgrade docker engine to 18.09 (#2417) * [docker-engine]: upgrade docker engine to 18.09
2019-01-04 22:47:43 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-key add /tmp/docker.gpg
sudo LANG=C chroot $FILESYSTEM_ROOT rm /tmp/docker.gpg
sudo LANG=C chroot $FILESYSTEM_ROOT add-apt-repository \
"deb [arch=amd64] https://download.docker.com/linux/debian stretch stable"
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get update
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install docker-ce=${DOCKER_VERSION}
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y remove software-properties-common gnupg2
Simplify script to install docker (#1925) Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>
2018-08-13 20:30:00 -05:00
Squash merge master (11de390)
2016-08-04 12:39:33 -05:00
## Add docker config drop-in to select aufs, otherwise it may select other storage driver
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo mkdir -p $FILESYSTEM_ROOT/etc/systemd/system/docker.service.d/
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Note: $_ means last argument of last command
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo cp files/docker/docker.service.conf $_
[docker-engine] fix systemd shutdown hang (#2451) When rebooting without the platform_reboot plugin, systemd takes a few minutes to properly shutdown. It's blocking on some docker cleanup operation. As described by https://github.com/docker/for-linux/issues/421 there is a race between docker.service and containerd.service. docker needs containerd to properly stop the containers.
2019-01-16 03:54:14 -06:00
## Fix systemd race between docker and containerd
sudo sed -i '/After=/s/$/ containerd.service/' $FILESYSTEM_ROOT/lib/systemd/system/docker.service
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Create default user
## Note: user should be in the group with the same name, and also in sudo/docker group
sudo LANG=C chroot $FILESYSTEM_ROOT useradd -G sudo,docker $USERNAME -c "$DEFAULT_USERINFO" -m -s /bin/bash
## Create password for the default user
[baseimage]: Improve password hashing for default user account (#1748) * [slave.mk]: Fix displaying username and password in build summary We display contents of DEFAULT_USERNAME and DEFAULT_PASSWORD, while image can be build with USERNAME and/or PASSWORD given on make(1) command line. For example: $ make USERNAME=adm PASSWORD=mypass target/sonic-broadcom.bin Fix by displaying USERNAME and PASSWORD variables in build summary. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co> * [baseimage]: Improve default user account handling There are couple of issues with current implementation of default user account management in baseimage: 1) It uses DES to encrypt accounts password. Furthermore this effectively limits password length to 8 symbols, even if more provided with PASSWORD or DEFAULT_PASSWORD from rules/config. 2) Salt value for password is same on all builds even with different password increasing attack surface. 3) During the build process password passed as command line parameter either as plain text (if given to make(1) as "make PASSWORD=...") or DES encrypted (if given to build_debian.sh) can be seen by non-build users using /proc/<pid>/cmdline file that has group and world readable permissions. Both 1) and 2) come from: perl -e 'print crypt("$(PASSWORD)", "salt"),"\n"')" that by defalt uses DES if salt does not have format $<id>$<salt>$, where <id> is hashing function id. See crypt(3) for more details on valid <id> values. To address issues above we propose following changes: 1) Do not create password by hands (e.g. using perl snippet above): put this job to chpasswd(8) which is aware about system wide password hashing policy specified in /etc/login.defs with ENCRYPT_METHOD (by default it is SHA512 for Debian 8). 2) Now chpasswd(8) will take care about proper salt value. 3) This has two steps: 3.1) For compatibility reasons accept USERNAME and PASSWORD as make(1) parameters, but warn user that this is unsafe. 3.2) Use process environment to pass USERNAME and PASSWORD variables from Makefile to build_debian.sh as more secure alternative to passing via command line parameters: /proc/<pid>/environ readable only by user running process or privileged users like root. Before change: -------------- hash1 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSs", "salt"),"\n"')" ^^^^^^^^ 8 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Note the hash (DES encrypted password) hash2 ----- # u='admin' # p="$(LANG=C perl -e 'print crypt("YourPaSsWoRd", "salt"),"\n"')" ^^^^^^^^^^^^ 12 symbols # echo "$u:$p" | chpasswd -e # getent shadow admin admin:sazQDkwgZPfSk:17680:0:99999:7::: ^^^^^^^^^^^^^ Hash is the same as for "YourPaSs" After change: ------------- hash1 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$1Nho1jHC$T8YwK58FYToXMFuetQta7/XouAAN2q1IzWC3bdIg86woAs6WuTg\ ^^^^^^^^ Note salt here ksLO3oyQInax/wNVq.N4de6dyWZDsCAvsZ1:17681:0:99999:7::: hash2 ----- # echo "admin:YourPaSs" | chpasswd # getent shadow admin admin:$6$yKU5g7BO$kdT02Z1wHXhr1VCniKkZbLaMPZXK0WSSVGhSLGrNhsrsVxCJ.D9\ ^^^^^^^^ Here salt completely different from case above plFpd8ksGNpw/Vb92hvgYyCL2i5cfI8QEY/:17681:0:99999:7::: Since salt is different hashes for same password different too. hash1 ----- # LANG=C perl -e 'print crypt("YourPaSs", "\$6\$salt\$"),"\n"' ^^^^^ We want SHA512 hash $6$salt$qkwPvXqUeGpexO1vatnIQFAreOTXs6rnDX.OI.Sz2rcy51JrO8dFc9aGv82bB\ yd2ELrIMJ.FQLNjgSD0nNha7/ hash2 ----- # LANG=C perl -e 'print crypt("YourPaSsWoRd", "\$6\$salt\$"),"\n"' $6$salt$1JVndGzyy/dj7PaXo6hNcttlQoZe23ob8GWYWxVGEiGOlh6sofbaIvwl6Ho7N\ kYDI8zwRumRwga/A29nHm4mZ1 Now with same "salt" and $<id>$, and same 8 symbol prefix in password, but different password length we have different hashes. Signed-off-by: Sergey Popovich <sergey.popovich@ordnance.co>
2018-06-09 13:29:16 -05:00
echo "$USERNAME:$PASSWORD" | sudo LANG=C chroot $FILESYSTEM_ROOT chpasswd
New release v1.0.0
2016-03-08 13:42:20 -06:00
Build Arista Aboot image
2016-03-16 01:38:26 -05:00
## Pre-install hardware drivers
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y install \
firmware-linux-nonfree
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Pre-install the fundamental packages
## Note: gdisk is needed for sgdisk in install.sh
## Note: parted is needed for partprobe in install.sh
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Note: ca-certificates is needed for easy_install
Keep pip in the debian image (#356)
2017-03-02 18:04:18 -06:00
## Note: don't install python-apt by pip, older than Debian repo one
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
file \
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
ifupdown2 \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
iproute2 \
[interfaces]: Remove bridge-utils from swss docker and add it to base image (#417) The reason is that /etc/network/interfaces file is in base image. After booting, docker-swss is not ready and thus the empty VLAN interfaces cannot be created when the brctl is pointing to the binary inside the swss docker. Add the bridge-utils into the base image and add bridge_ports none to the /etc/network/interfaces file so that after boot-up the empty VLAN interfaces will be created to let the members to join later. Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-03-20 23:39:09 -05:00
bridge-utils \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
isc-dhcp-client \
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo \
vim \
tcpdump \
[build_debian]: Add dbus package to update timezone (#702) Signed-off-by: Hiayang Zheng haiyang.z@alibaba.inc
2017-06-15 12:31:13 -05:00
dbus \
New release v1.0.0
2016-03-08 13:42:20 -06:00
ntp \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
ntpstat \
New release v1.0.0
2016-03-08 13:42:20 -06:00
openssh-server \
python \
python-setuptools \
Add monit for disk>85% into pmon docker (#582) * Add monit for disk>85% into pmon docker * Revert "Add monit for disk>85% into pmon docker" This reverts commit 9cbbf591c08bce4b52a0f68cbbddae102d7fc614. * Install monit in base image
2017-05-18 12:57:19 -05:00
monit \
New release v1.0.0
2016-03-08 13:42:20 -06:00
python-apt \
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
traceroute \
iputils-ping \
net-tools \
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
bsdmainutils \
ca-certificates \
i2c-tools \
Automatic fw upgrade for mlnx platform (#31) * Automatic fw upgrade for mlnx platform Implement script for firmware upgrade to required version Add firmware binary and script to ops-syncd-mlnx container Add pciutils and usbutils to sonic-generic.bin * Update firmware installation message It is possible to do both upgrade and downgrade Change "Upgrading" to "Installing compatible version" Signed-off-by: marian-pritsak <marianp@mellanox.com>
2016-10-18 13:22:29 -05:00
efibootmgr \
usbutils \
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
pciutils \
iptables-persistent \
Add get_graph service to fetch minigraph automatically (#288) - Add a functionality to get SNMP community from DHCP (option 224) - Add a functionality to get minigraph from http service instead of using default minigraph - The url for graph service is passed through DHCP option 225 - This feature is by default disabled. Modify rule/config to enable it on build time, or modify /etc/sonic/graph_service_url on run time. - Fix a bug that getting hostname from DHCP is not working correctly
2017-02-17 15:47:01 -06:00
logrotate \
[baseimage]: Add kexec-tools package into the baseimage (#397) * Include kexec-tools package which could be used for fast reboot * Use sudo for sed
2017-03-15 20:38:55 -05:00
curl \
[image]: SONiC-to-SONiC update (#464)
2017-04-21 19:23:36 -05:00
kexec-tools \
[docker-base]: Add less, strace, and configuration for vim (#591) * Add less in docker-base. Add strace in docker_base_dbg. * Make link vim to vim.tiny and have vim config file
2017-05-11 20:46:11 -05:00
less \
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
unzip \
[build_debian]: Install grub-common in the base image (#1014)
2017-10-05 23:43:25 -05:00
gdisk \
[baseimage]: Install sysfsutils package into SONiC host system (#1290)
2018-01-10 05:04:32 -06:00
sysfsutils \
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
squashfs-tools \
[fast-reboot]: Support OS9 -> SONiC fast-reboot migration (#1414) * Support OS9 -> SONiC fast-reboot migration * Address review comments. Update NOS mac in EEPROM and net.rules for eth0 * Address review comments. Update sonic-platform-modules-dell to fac81d... * Fix script for POSIX compliance
2018-03-08 18:42:41 -06:00
grub2-common \
[baseimage]: use rsyslog in baseimage from stretch repo Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-08-11 12:58:30 -05:00
rsyslog \
[baseimage]: add screen package (#1644)
2018-04-26 15:53:54 -05:00
ethtool \
[baseimage]: add commonly used network tools (#1832) * [baseimage]: add commonly used network tools
2018-07-01 11:46:25 -05:00
screen \
hping3 \
python-scapy \
tcptraceroute \
[baseimage] set default locale en_US.UTF-8 (#1988) * [baseimage] set default locale en_US.UTF-8 Signed-off-by: chenhu <chenhu@didichuxing.com> * [baseimage]set default locale to en_US.UTF-8, clean all other unused * [baseimage] update-locale after locale-gen * correct update-locale command line Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-09-11 05:15:19 -05:00
mtr-tiny \
[baseimage]: install cgroup-tools and set udp_l3mdev_accept=1 (#2485) cgroup-tools is required to bind a process to l3mdev master Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-01-25 13:47:09 -06:00
locales \
cgroup-tools
[baseimage] set default locale en_US.UTF-8 (#1988) * [baseimage] set default locale en_US.UTF-8 Signed-off-by: chenhu <chenhu@didichuxing.com> * [baseimage]set default locale to en_US.UTF-8, clean all other unused * [baseimage] update-locale after locale-gen * correct update-locale command line Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-09-11 05:15:19 -05:00
#Adds a locale to a debian system in non-interactive mode
sudo sed -i '/^#.* en_US.* /s/^#//' $FILESYSTEM_ROOT/etc/locale.gen && \
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT locale-gen "en_US.UTF-8"
sudo LANG=en_US.UTF-8 DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT update-locale "LANG=en_US.UTF-8"
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c "find /usr/share/i18n/locales/ ! -name 'en_US' -type f -exec rm -f {} +"
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
[baseimage]: Download picocom version 3.1-2 from stretch-backports; No longer build from source (#1946)
2018-08-17 19:38:20 -05:00
# Install certain fundamental packages from stretch-backports in order to get
# more up-to-date (but potentially less stable) versions
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y -t stretch-backports install \
picocom
[build/onie installer] Install grub for SONiC post migration from another NOS (#949) * Install grub for SONiC post migration from another NOS * Install grub from bundled debian package instead of using ONIE's. Address review comments
2017-09-17 13:41:30 -05:00
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y download \
grub-pc-bin
sudo mv $FILESYSTEM_ROOT/grub-pc-bin*.deb $FILESYSTEM_ROOT/$PLATFORM_DIR/x86_64-grub
[baseimage]: Add kexec-tools package into the baseimage (#397) * Include kexec-tools package which could be used for fast reboot * Use sudo for sed
2017-03-15 20:38:55 -05:00
## Disable kexec supported reboot which was installed by default
sudo sed -i 's/LOAD_KEXEC=true/LOAD_KEXEC=false/' $FILESYSTEM_ROOT/etc/default/kexec
New release v1.0.0
2016-03-08 13:42:20 -06:00
[ntp] disable ntp time jump (#2589) - removing -g to disable jump when time difference is greater than 1000s - add -x to disable initial jump
2019-02-20 10:04:12 -06:00
## Modifty ntp default configuration: disable initial jump (add -x), and disable
## jump when time difference is greater than 1000 seconds (remove -g).
sudo sed -i "s/NTPD_OPTS='-g'/NTPD_OPTS='-x'/" $FILESYSTEM_ROOT/etc/default/ntp
[baseimage] Adding setuid permissions to ping binaries, so sudo is no longer needed (#1765)
2018-06-04 23:01:53 -05:00
## Fix ping tools permission so non root user can directly use them
## Note: this is a workaround since aufs doesn't support extended attributes
## Ref: https://github.com/moby/moby/issues/5650#issuecomment-303499489
## TODO: remove workaround when the overlay filesystem support extended attributes
sudo chmod u+s $FILESYSTEM_ROOT/bin/ping{,6}
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Remove sshd host keys, and will regenerate on first sshd start
sudo rm -f $FILESYSTEM_ROOT/etc/ssh/ssh_host_*_key*
sudo cp files/sshd/host-ssh-keygen.sh $FILESYSTEM_ROOT/usr/local/bin/
sudo cp -f files/sshd/sshd.service $FILESYSTEM_ROOT/lib/systemd/system/ssh.service
## Config sshd
sudo augtool --autosave "set /files/etc/ssh/sshd_config/UseDNS no" -r $FILESYSTEM_ROOT
Add caclmgrd and related files to translate and install control plane ACL rules (#1240)
2018-01-09 19:55:10 -06:00
sudo sed -i 's/^ListenAddress ::/#ListenAddress ::/' $FILESYSTEM_ROOT/etc/ssh/sshd_config
sudo sed -i 's/^#ListenAddress 0.0.0.0/ListenAddress 0.0.0.0/' $FILESYSTEM_ROOT/etc/ssh/sshd_config
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
Add monit for disk>85% into pmon docker (#582) * Add monit for disk>85% into pmon docker * Revert "Add monit for disk>85% into pmon docker" This reverts commit 9cbbf591c08bce4b52a0f68cbbddae102d7fc614. * Install monit in base image
2017-05-18 12:57:19 -05:00
## Config monit
sudo sed -i '
s/^# set logfile syslog/set logfile syslog/;
s/^\s*set logfile \/var/# set logfile \/var/;
s/^# set httpd port/set httpd port/;
s/^# use address localhost/ use address localhost/;
s/^# allow localhost/ allow localhost/;
s/^# allow admin:monit/ allow admin:monit/;
s/^# allow @monit/ allow @monit/;
s/^# allow @users readonly/ allow @users readonly/
' $FILESYSTEM_ROOT/etc/monit/monitrc
sudo tee -a $FILESYSTEM_ROOT/etc/monit/monitrc > /dev/null <<'EOF'
[baseimage]: build root filesystem via overlay fs instead of aufs
2017-09-02 17:32:31 -05:00
check filesystem root-overlay with path /
Add monit for disk>85% into pmon docker (#582) * Add monit for disk>85% into pmon docker * Revert "Add monit for disk>85% into pmon docker" This reverts commit 9cbbf591c08bce4b52a0f68cbbddae102d7fc614. * Install monit in base image
2017-05-18 12:57:19 -05:00
if space usage > 90% for 5 times within 10 cycles then alert
Add monit for /var/log disk usage (#1836) Signed-off-by: Qi Luo <qiluo-msft@users.noreply.github.com>
2018-07-03 19:00:31 -05:00
check filesystem var-log with path /var/log
if space usage > 90% for 5 times within 10 cycles then alert
Add monit for disk>85% into pmon docker (#582) * Add monit for disk>85% into pmon docker * Revert "Add monit for disk>85% into pmon docker" This reverts commit 9cbbf591c08bce4b52a0f68cbbddae102d7fc614. * Install monit in base image
2017-05-18 12:57:19 -05:00
check system $HOST
if memory usage > 90% for 5 times within 10 cycles then alert
if cpu usage (user) > 90% for 5 times within 10 cycles then alert
if cpu usage (system) > 90% for 5 times within 10 cycles then alert
EOF
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
## Config sysctl
sudo mkdir -p $FILESYSTEM_ROOT/var/core
sudo augtool --autosave "
[quagga] enable core dump for bgpd and zebra (#927) * [core dump] pass unix time to coredump-compress script Currently we only have program name (e.g. bgpd) and PID in the core file name. PID could collide especially after docker restart or recreate. Passing the unix time to coredump-compress so it could also add time to the core file name. * [utilities] include the change to coredump_compress script * [quagga] enable core dump for bgpd and zebra bgpd and zebra downgrade their privilege shortly after started. For that sysctrl kernel.suid_dumpable needs to be set to 2, so that they can dump core. Note that fs.suid_dumpable SHOULD NOT be set to 1. Which will bypass all system security.
2017-08-30 11:41:47 -05:00
set /files/etc/sysctl.conf/kernel.core_pattern '|/usr/bin/coredump-compress %e %t %p'
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
[debian]: Add kernel configuration to reboot on kernel soft lockup (#594)
2017-05-11 20:57:00 -05:00
set /files/etc/sysctl.conf/kernel.softlockup_panic 1
set /files/etc/sysctl.conf/kernel.panic 10
[quagga] enable core dump for bgpd and zebra (#927) * [core dump] pass unix time to coredump-compress script Currently we only have program name (e.g. bgpd) and PID in the core file name. PID could collide especially after docker restart or recreate. Passing the unix time to coredump-compress so it could also add time to the core file name. * [utilities] include the change to coredump_compress script * [quagga] enable core dump for bgpd and zebra bgpd and zebra downgrade their privilege shortly after started. For that sysctrl kernel.suid_dumpable needs to be set to 2, so that they can dump core. Note that fs.suid_dumpable SHOULD NOT be set to 1. Which will bypass all system security.
2017-08-30 11:41:47 -05:00
set /files/etc/sysctl.conf/fs.suid_dumpable 2
[debian]: Add kernel configuration to reboot on kernel soft lockup (#594)
2017-05-11 20:57:00 -05:00
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
set /files/etc/sysctl.conf/net.ipv4.conf.default.forwarding 1
set /files/etc/sysctl.conf/net.ipv4.conf.all.forwarding 1
set /files/etc/sysctl.conf/net.ipv4.conf.eth0.forwarding 0
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_accept 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_announce 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_filter 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_notify 0
set /files/etc/sysctl.conf/net.ipv4.conf.default.arp_ignore 0
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_accept 0
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_announce 1
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_filter 0
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_notify 1
set /files/etc/sysctl.conf/net.ipv4.conf.all.arp_ignore 2
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
[orchagent]: Add ARP update script to maintain VLAN neighbors (#401) - Extend ARP reachable time to 30min - Add arping to docker-swss - Add arp_update script to routinely probe neighbors Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-05-15 19:06:19 -05:00
set /files/etc/sysctl.conf/net.ipv4.neigh.default.base_reachable_time_ms 1800000
Fix potential blackholing/looping traffic when link-local was used and refresh ipv6 neighbor to avoid CPU hit (#1904) * Fix potential blackholing/looping traffic and refresh ipv6 neighbor to avoid CPU hit In case ipv6 global addresses were configured on L3 interfaces and used for peering, and routing protocol was using link-local addresses on the same interfaces as prefered nexthops, the link-local addresses could be aged out after a while due to no activities towards the link-local addresses themselves. And when we receive new routes with the link-local nexthops, SONiC won't insert them to the HW, and thus cause looping or blackholing traffic. Global ipv6 addresses on L3 interfaces between switches are refreshed by BGP keeplive and other messages. On server facing side, traffic may hit fowarding plane only, and no refresh for the ipv6 neighbor entries regularly. This could age-out the linux kernel ipv6 neighbor entries, and HW neighbor table entries could be removed, and thus traffic going to those neighbors would hit CPU, and cause traffic drop and temperary CPU high load. Also, if link-local addresses were not learned, we may not get them at all later. It is intended to fix all above issues. Changes: Add ndisc6 package in swss docker and use it for ipv6 ndp ping to update the neighbors' state on Vlan interfaces Change the default ipv6 neighbor reachable timer to 30mins Add periodical ipv6 multicast ping to ff02::11 to get/refresh link-local neighbor info. * Fix review comments: Add PORTCHANNEL_INTERFACE interface for ipv6 multicast ping format issue * Combine regular L3 interface and portchannel interface for looping * Add ndisc6 package to vs docker
2018-08-12 05:14:55 -05:00
set /files/etc/sysctl.conf/net.ipv6.neigh.default.base_reachable_time_ms 1800000
[orchagent]: Add ARP update script to maintain VLAN neighbors (#401) - Extend ARP reachable time to 30min - Add arping to docker-swss - Add arp_update script to routinely probe neighbors Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-05-15 19:06:19 -05:00
build_debian: Enable IPv6 forwarding (#60) Router behavior is assumed. 1. IsRouter flag is set in Neighbor Advertisements 2. Router Solicitations are not sent. 3. Router Advertisements are ignored. 4. Redirects are ignored. ref: http://mirrors.deepspace6.net/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html
2016-11-04 21:47:36 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.default.forwarding 1
set /files/etc/sysctl.conf/net.ipv6.conf.all.forwarding 1
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.forwarding 0
set /files/etc/sysctl.conf/net.ipv6.conf.default.accept_dad 0
build_debian: Disable IPv6 DAD (#56) This change disables DAD (IPv6's Duplicate Address Detection). DAD protects against IP address conflicts. The way it works is that after an address is added to an interface, the operating system uses the Neighbor Discovery Protocol to check if any other host on the network has the same address. If it finds a neighbor with the same address, the address is removed from the interface. The problem here is that the time waiting for DAD to be done is fairly long and because that we set the host interface operating status to be down at first, the port cannot exchange the Neighbor Discovery Protocol and DAD will time out. The host interface is only brought up after we have received the port admin status up notification from the kernel, which happens only after the DAD is done or times out. This makes the whole host interfaces bringing up procedure very slow. This the DAD is disabled. When it is disabled, addresses are immediately usable. Without DAD, we need to make sure that the IPv6 addresses don't have conflicts. For now, we have two IPv6 addresses. One is assigned manually, which prevents conflicts at first. Another one is the IPv6 link-local address. It is derived from the MAC address and thus all the link-local addresses are the same on one box. Because link-local addresses are not used, it will not trigger issues even if they are the same.
2016-11-03 14:15:00 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.all.accept_dad 0
[baseimage]: Disable DAD for eth0 explicitly (#1701)
2018-05-12 03:31:17 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.accept_dad 0
[debian]: Disable receiving default routes for ipv6 on mgmt interface (#588) * Disable net.ipv6.conf.eth0.accept_ra_defrtr. It will remain IPv6 working on mgmt interface, but it will disable receiving default routes
2017-05-10 19:39:51 -05:00
[debian]: Enable keep_addr_on_down to keep IPv6 addresses (#1992) Starting from kernel 4.6, this new attribute keep_addr_on_down is introduced (https://kernelnewbies.org/Linux_4.6). If set, static global addresses with no expiration time are not flushed. Ref: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Signed-off-by: Shu0T1an ChenG <shuche@microsoft.com>
2018-08-28 16:40:01 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.default.keep_addr_on_down 1
set /files/etc/sysctl.conf/net.ipv6.conf.all.keep_addr_on_down 1
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.keep_addr_on_down 1
[debian]: Disable receiving default routes for ipv6 on mgmt interface (#588) * Disable net.ipv6.conf.eth0.accept_ra_defrtr. It will remain IPv6 working on mgmt interface, but it will disable receiving default routes
2017-05-10 19:39:51 -05:00
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.accept_ra_defrtr 0
Disable IPv6 ra for eth0 interface (#2493) * Disable IPv6 ra for eth0 interface
2019-01-29 11:03:23 -06:00
set /files/etc/sysctl.conf/net.ipv6.conf.eth0.accept_ra 0
[baseimage]: Increase net.core.rmem_max to 2097152 (#767) * Increase net.core.rmem_max to 2097152
2017-06-29 03:40:22 -05:00
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
set /files/etc/sysctl.conf/net.ipv4.tcp_l3mdev_accept 1
[baseimage]: install cgroup-tools and set udp_l3mdev_accept=1 (#2485) cgroup-tools is required to bind a process to l3mdev master Signed-off-by: Guohan Lu <gulv@microsoft.com>
2019-01-25 13:47:09 -06:00
set /files/etc/sysctl.conf/net.ipv4.udp_l3mdev_accept 1
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
[baseimage]: Increase net.core.rmem_max to 2097152 (#767) * Increase net.core.rmem_max to 2097152
2017-06-29 03:40:22 -05:00
set /files/etc/sysctl.conf/net.core.rmem_max 2097152
[baseimage] Added net.core.wmem_max value required by Copp test (#1489)
2018-03-14 11:20:47 -05:00
set /files/etc/sysctl.conf/net.core.wmem_max 2097152
Squash merge latest code to github branch
2016-07-26 14:01:58 -05:00
" -r $FILESYSTEM_ROOT
New release v1.0.0
2016-03-08 13:42:20 -06:00
## docker-py is needed by Ansible docker module
[build]: allow to use http(s) proxy in the build (#1265) * allow to use http(s) proxy in the build To enable this, use following command http_proxy=[your_proxy] https_proxy=[your_proxy] make
2017-12-24 01:34:15 -06:00
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT easy_install pip
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip install 'docker-py==1.6.0'
Keep pip in the debian image (#356)
2017-03-02 18:04:18 -06:00
## Note: keep pip installed for maintainance purpose
New release v1.0.0
2016-03-08 13:42:20 -06:00
[baseimage]: Install netifaces package in sonic-slave docker and sonic image (#1353)
2018-12-15 13:52:36 -06:00
## Get gcc and python dev pkgs
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install gcc libpython2.7-dev
sudo https_proxy=$https_proxy LANG=C chroot $FILESYSTEM_ROOT pip install 'netifaces==0.10.7'
[database]: Mount /var/run/redis/ folder from host for all dockers (#418) - Create /var/run/redis/ folder on the host - Install Python client for Redis on the host - Mount /var/run/redis/ as read/write from host for all dockers - Enable accessing the database everywhere including on the host and from remote Signed-off-by: Shuotian Cheng <shuche@microsoft.com>
2017-03-23 14:18:52 -05:00
## Create /var/run/redis folder for docker-database to mount
sudo mkdir -p $FILESYSTEM_ROOT/var/run/redis
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Config DHCP for eth0
sudo tee -a $FILESYSTEM_ROOT/etc/network/interfaces > /dev/null <<EOF
auto eth0
allow-hotplug eth0
iface eth0 inet dhcp
EOF
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo cp files/dhcp/rfc3442-classless-routes $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d
Add DHCP client hook to update hostname. (#235) * Add DHCP client hook to update hostname. * Remove interface checking * Update hostname in /etc/hosts file
2017-02-02 13:19:48 -06:00
sudo cp files/dhcp/sethostname $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
Add get_graph service to fetch minigraph automatically (#288) - Add a functionality to get SNMP community from DHCP (option 224) - Add a functionality to get minigraph from http service instead of using default minigraph - The url for graph service is passed through DHCP option 225 - This feature is by default disabled. Modify rule/config to enable it on build time, or modify /etc/sonic/graph_service_url on run time. - Fix a bug that getting hostname from DHCP is not working correctly
2017-02-17 15:47:01 -06:00
sudo cp files/dhcp/graphserviceurl $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
sudo cp files/dhcp/snmpcommunity $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
[baseimage]: Initial changes for dhcp to support eth0 in a mgmt vrf (#2348) * Initial changes to support eth0 in a mgmt vrf
2019-01-15 20:15:56 -06:00
sudo cp files/dhcp/vrf $FILESYSTEM_ROOT/etc/dhcp/dhclient-exit-hooks.d/
Add get_graph service to fetch minigraph automatically (#288) - Add a functionality to get SNMP community from DHCP (option 224) - Add a functionality to get minigraph from http service instead of using default minigraph - The url for graph service is passed through DHCP option 225 - This feature is by default disabled. Modify rule/config to enable it on build time, or modify /etc/sonic/graph_service_url on run time. - Fix a bug that getting hostname from DHCP is not working correctly
2017-02-17 15:47:01 -06:00
sudo cp files/dhcp/dhclient.conf $FILESYSTEM_ROOT/etc/dhcp/
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
## Version file
sudo mkdir -p $FILESYSTEM_ROOT/etc/sonic
sudo tee $FILESYSTEM_ROOT/etc/sonic/sonic_version.yml > /dev/null <<EOF
[build_debian]: Add quote to specify values as string (#1503)
2018-03-16 03:09:33 -05:00
build_version: '$(sonic_get_version)'
[image]: Explicitly specify kernel_version as string (#1280)
2018-01-03 23:43:06 -06:00
debian_version: '$(cat $FILESYSTEM_ROOT/etc/debian_version)'
[build_debian]: Add quote to specify values as string (#1503)
2018-03-16 03:09:33 -05:00
kernel_version: '$kversion'
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
asic_type: $sonic_asic_platform
[build_debian]: Add quote to specify values as string (#1503)
2018-03-16 03:09:33 -05:00
commit_id: '$(git rev-parse --short HEAD)'
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
build_date: $(date -u)
[build]: add commit id and build number in sonic_version (#508)
2017-04-16 03:17:22 -05:00
build_number: ${BUILD_NUMBER:-0}
[build]: Include SONiC version into installer. (#472) * [build]: Include SONiC version into installer. Signed-off-by: marian-pritsak <marianp@mellanox.com> * Append dirty if contains local changes Signed-off-by: marian-pritsak <marianp@mellanox.com> * Update config * Use correct name for kernel version field * Update sysDescription.j2
2017-04-05 18:14:41 -05:00
built_by: $USER@$BUILD_HOSTNAME
EOF
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
if [ -f sonic_debian_extension.sh ]; then
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
./sonic_debian_extension.sh $FILESYSTEM_ROOT $PLATFORM_DIR
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
fi
Framework to plugin Organization specific scripts during ONIE Image build (#951) * Framework to plugin Organization specific scripts * Framework to plugin Organization specific scripts * Framework to plugin Organization specific scripts * add getopt option to organization script
2017-09-19 18:23:31 -05:00
## Organization specific extensions such as Configuration & Scripts for features like AAA, ZTP...
if [ "${enable_organization_extensions}" = "y" ]; then
if [ -f files/build_templates/organization_extensions.sh ]; then
sudo chmod 755 files/build_templates/organization_extensions.sh
./files/build_templates/organization_extensions.sh -f $FILESYSTEM_ROOT -h $HOSTNAME
fi
fi
[baseimage]: Install netifaces package in sonic-slave docker and sonic image (#1353)
2018-12-15 13:52:36 -06:00
## Remove gcc and python dev pkgs
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y remove gcc libpython2.7-dev
[baseimage]: move update initramfs to later stage some platform drivers install blacklist.conf in /etc/modprobe.d. Those configuration should be proprogated into initramfs to avoid loading those blacklisted driver.
2018-03-05 01:07:40 -06:00
## Update initramfs
sudo chroot $FILESYSTEM_ROOT update-initramfs -u
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Clean up apt
[baseimage]: Install netifaces package in sonic-slave docker and sonic image (#1353)
2018-12-15 13:52:36 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get -y autoremove
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get autoclean
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT apt-get clean
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
sudo LANG=C chroot $FILESYSTEM_ROOT bash -c 'rm -rf /usr/share/doc/* /usr/share/locale/* /var/lib/apt/lists/* /tmp/*'
New release v1.0.0
2016-03-08 13:42:20 -06:00
[build]: allow to use http(s) proxy in the build (#1265) * allow to use http(s) proxy in the build To enable this, use following command http_proxy=[your_proxy] https_proxy=[your_proxy] make
2017-12-24 01:34:15 -06:00
## Clean up proxy
[ -n "$http_proxy" ] && sudo rm -f $FILESYSTEM_ROOT/etc/apt/apt.conf.d/01proxy
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Umount all
echo '[INFO] Umount all'
Ignore return value of umount (#801) * Ignore return value of umount * Refine the umount process, more diagnostic info output
2017-07-12 03:28:36 -05:00
## Display all process details access /proc
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -vm /proc
## Kill the processes
New release v1.0.0
2016-03-08 13:42:20 -06:00
sudo LANG=C chroot $FILESYSTEM_ROOT fuser -km /proc || true
Ignore return value of umount (#801) * Ignore return value of umount * Refine the umount process, more diagnostic info output
2017-07-12 03:28:36 -05:00
## Wait fuser fully kill the processes
sleep 15
sudo umount $FILESYSTEM_ROOT/proc || true
New release v1.0.0
2016-03-08 13:42:20 -06:00
## Prepare empty directory to trigger mount move in initramfs-tools/mount_loop_root, implemented by patching
sudo mkdir $FILESYSTEM_ROOT/host
## Compress most file system into squashfs file
sudo rm -f $ONIE_INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS
Sqush merge latest code to github branch
2016-05-27 15:30:13 -05:00
## Output the file system total size for diag purpose
Ignore return value of umount (#801) * Ignore return value of umount * Refine the umount process, more diagnostic info output
2017-07-12 03:28:36 -05:00
## Note: -x to skip directories on different file systems, such as /proc
sudo du -hsx $FILESYSTEM_ROOT
[build]: create empty /var/lib/docker if needed (#1920) stretch docker-engine in base image is not started by default in the build process. Need to create empty /var/lib/docker Signed-off-by: Guohan Lu <gulv@microsoft.com>
2018-08-13 00:23:43 -05:00
sudo mkdir -p $FILESYSTEM_ROOT/var/lib/docker
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
sudo mksquashfs $FILESYSTEM_ROOT $FILESYSTEM_SQUASHFS -e boot -e var/lib/docker -e $PLATFORM_DIR
New release v1.0.0
2016-03-08 13:42:20 -06:00
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
## Compress docker files
[docker]: change hardcoded value to DOCKERFS_DIR for docker directory on the disk (#269)
2017-02-06 10:17:16 -06:00
pushd $FILESYSTEM_ROOT && sudo tar czf $OLDPWD/$FILESYSTEM_DOCKERFS -C var/lib/docker .; popd
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
[installer]: support platform driver lazy installation (#340) allow one image to support multiple switch devices, install corresponding platform driver during the first boot time.
2017-02-27 15:08:41 -06:00
## Compress together with /boot, /var/lib/docker and $PLATFORM_DIR as an installer payload zip file
pushd $FILESYSTEM_ROOT && sudo zip $OLDPWD/$ONIE_INSTALLER_PAYLOAD -r boot/ $PLATFORM_DIR/; popd
one image implementation (#215) * Single image * Fix review comments * Update syncd service. Add HW mgmt to Mellanox single image. * Add single image template for Broadcom platform. SKU should be provided during configure: make configure PLATFORM=broadcom SKU=Force10-S6000 * Add single image template for Cavium platform. SKU should be provided during configure: make configure PLATFORM=cavium SKU=AS7512 * Add description to sonic_debian_extension.j2 file.
2017-01-29 13:33:33 -06:00
sudo zip -g $ONIE_INSTALLER_PAYLOAD $FILESYSTEM_SQUASHFS $FILESYSTEM_DOCKERFS
Reference in New Issue Copy Permalink