[gentoo-commits] proj/releng:master commit in: tools-musl/, tools-musl/portage.amd64.hardened-stage4/package.use/, ...

[gentoo-commits] proj/releng:master commit in: tools-musl/, tools-musl/portage.amd64.hardened-stage4/package.use/, ...

[Matt Thode]

commit:     274837a3d1885f840e1f7c8ed08271135b7537dc
Author:     Your Name <you <AT> example <DOT> com>
AuthorDate: Mon Jan  2 03:35:11 2017 +0000
Commit:     Matt Thode <prometheanfire <AT> gentoo <DOT> org>
CommitDate: Mon Jan  2 03:37:52 2017 +0000
URL:        https://gitweb.gentoo.org/proj/releng.git/commit/?id=274837a3

add stage4 musl config

 .../package.keywords/stage4                        |  4 +
 .../package.mask/stage4                            |  1 +
 .../package.use/stage4                             |  1 +
 tools-musl/run-stage4.sh                           |  5 ++
 tools-musl/stage4-fsscript.sh                      | 81 ++++++++++++++++++++
 tools-musl/stage4-hardened-amd64-configured.spec   | 86 ++++++++++++++++++++++
 tools-musl/stage4-hardened-amd64.spec              | 86 ++++++++++++++++++++++
 7 files changed, 264 insertions(+)

diff --git a/tools-musl/portage.amd64.hardened-stage4/package.keywords/stage4 b/tools-musl/portage.amd64.hardened-stage4/package.keywords/stage4
new file mode 100644
index 0000000..a21cf48
--- /dev/null
+++ b/tools-musl/portage.amd64.hardened-stage4/package.keywords/stage4
@@ -0,0 +1,4 @@
+=sys-apps/portage-2.3.1 ~amd64
+=net-analyzer/macchanger-1.7.0-r1 ~amd64
+<sys-kernel/hardened-sources-4.5.0 ~amd64
+=sys-apps/busybox-1.26.0::musl

diff --git a/tools-musl/portage.amd64.hardened-stage4/package.mask/stage4 b/tools-musl/portage.amd64.hardened-stage4/package.mask/stage4
new file mode 100644
index 0000000..38a688c
--- /dev/null
+++ b/tools-musl/portage.amd64.hardened-stage4/package.mask/stage4
@@ -0,0 +1 @@
+>sys-kernel/hardened-sources-4.5.0

diff --git a/tools-musl/portage.amd64.hardened-stage4/package.use/stage4 b/tools-musl/portage.amd64.hardened-stage4/package.use/stage4
new file mode 100644
index 0000000..4b84ae6
--- /dev/null
+++ b/tools-musl/portage.amd64.hardened-stage4/package.use/stage4
@@ -0,0 +1 @@
+sys-boot/grub grub_platforms_pc

diff --git a/tools-musl/run-stage4.sh b/tools-musl/run-stage4.sh
new file mode 100755
index 0000000..e79acc7
--- /dev/null
+++ b/tools-musl/run-stage4.sh
@@ -0,0 +1,5 @@
+MUSL_DIR="$( cd "$( dirname ${BASH_SOURCE[0]} )" && pwd )"
+cp "${MUSL_DIR}"/stage4-hardened-amd64.spec "${MUSL_DIR}"/stage4-hardened-amd64-configured.spec
+sed -i "s|@REPO_DIR@|${MUSL_DIR}|g" "${MUSL_DIR}"/stage4-hardened-amd64-configured.spec
+
+catalyst -f "${MUSL_DIR}"/stage4-hardened-amd64-configured.spec | tee -a "${MUSL_DIR}"/zzz.log

diff --git a/tools-musl/stage4-fsscript.sh b/tools-musl/stage4-fsscript.sh
new file mode 100755
index 0000000..f222b1f
--- /dev/null
+++ b/tools-musl/stage4-fsscript.sh
@@ -0,0 +1,81 @@
+#!/bin/bash
+
+# Set timezone
+echo 'UTC' > /etc/timezone
+
+# Some rootfs stuff
+grep -v rootfs /proc/mounts > /etc/mtab
+
+# This is set in rackspaces prep, might help us
+echo 'net.ipv4.conf.eth0.arp_notify = 1' >> /etc/sysctl.conf
+echo 'vm.swappiness = 0' >> /etc/sysctl.conf
+
+# Let's configure our grub
+# Access on both regular tty and serial console
+mkdir /boot/grub
+cat >>/etc/default/grub <<EOF
+GRUB_TERMINAL='serial console'
+GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200n8"
+GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"
+EOF
+grub-mkconfig -o /boot/grub/grub.cfg
+sed -r -i 's/loop[0-9]+p1/LABEL\=cloudimg-rootfs/g' /boot/grub/grub.cfg
+sed -i 's/root=.*\ ro/root=LABEL\=cloudimg-rootfs\ ro/' /boot/grub/grub.cfg
+
+# And the fstab
+echo 'LABEL=cloudimg-rootfs / ext4 defaults 0 0' > /etc/fstab
+
+# allow the console log
+sed -i 's/#s0/s0/g' /etc/inittab
+
+# let ipv6 use normal slaac
+sed -i 's/slaac/#slaac/g' /etc/dhcpcd.conf
+# don't let dhcpcd set domain name or hostname
+sed -i 's/domain_name\,\ domain_search\,\ host_name/domain_search/g' /etc/dhcpcd.conf
+
+# need to do this here because it clobbers an openrc owned file
+cat > /etc/conf.d/hostname << "EOL"
+# Set to the hostname of this machine
+if [ -f /etc/hostname ];then
+  hostname=$(cat /etc/hostname 2> /dev/null | cut -d"." -f1 2> /dev/null)
+else
+  hostname="localhost"
+fi
+EOL
+chmod 0644 /etc/conf.d/hostname
+chown root:root /etc/conf.d/hostname
+
+# set a nice default for /etc/resolv.conf
+cat > /etc/resolv.conf << EOL
+nameserver 8.8.8.8
+nameserver 2001:4860:4860::8888
+EOL
+
+# let's upgrade (security fixes and otherwise)
+USE="-build" emerge -uDNv --with-bdeps=y --buildpkg=y --jobs=2 @world
+USE="-build" emerge --verbose=n --depclean
+USE="-build" emerge -v --usepkg=n --buildpkg=y @preserved-rebuild
+etc-update --automode -5
+
+# Clean up portage
+emerge --verbose=n --depclean
+if [[ -a /usr/bin/eix ]]; then
+  eix-update
+fi
+emaint all -f
+eselect news read all
+eclean-dist --destructive
+sed -i '/^USE=\"\${USE}\ \ build\"$/d' /etc/portage/make.conf
+
+# clean up system
+passwd -d root
+passwd -l root
+for i in $(find /var/log -type f); do truncate -s 0 $i; done
+# remove foreign manpages
+find /usr/share/man/ -mindepth 1  -maxdepth 1 -path "/usr/share/man/man*" -prune -o -exec rm -rf {} \;
+
+# fine if this fails, aka non-hardened
+if [[ -x /usr/sbin/migrate-pax ]]; then
+  echo 'migraging pax'
+  /usr/sbin/migrate-pax -m
+fi

diff --git a/tools-musl/stage4-hardened-amd64-configured.spec b/tools-musl/stage4-hardened-amd64-configured.spec
new file mode 100644
index 0000000..ccbdc4f
--- /dev/null
+++ b/tools-musl/stage4-hardened-amd64-configured.spec
@@ -0,0 +1,86 @@
+subarch: amd64
+target: stage4
+version_stamp: cloud-latest
+rel_type: default
+profile: hardened/linux/musl/amd64
+snapshot: current
+source_subpath: musl/hardened/amd64/stage3-amd64-musl-hardened
+portage_confdir: /root/releng/tools-musl/portage.amd64.hardened-stage4
+portage_overlay: /opt/overlays/musl
+
+stage4/use:
+	bash-completion
+	bindist
+	bzip2
+	idm
+	ipv6
+	mmx
+	sse
+	sse2
+	urandom
+
+stage4/packages:
+	app-admin/logrotate
+	app-admin/sudo
+	app-admin/syslog-ng
+	app-editors/vim
+	app-portage/eix
+	app-portage/gentoolkit
+	net-misc/dhcpcd
+	net-misc/iputils
+	sys-boot/grub
+	sys-apps/dmidecode
+	sys-apps/gptfdisk
+	sys-apps/iproute2
+	sys-apps/lsb-release
+	sys-apps/pciutils
+	sys-block/parted
+	sys-devel/bc
+	sys-power/acpid
+	sys-process/cronie
+stage4/fsscript: /root/releng/tools-musl/tools-musl/stage4-fsscript.sh
+stage4/rcadd:
+	acpid|default
+	cronie|default
+	dhcpcd|default
+	net.lo|default
+	netmount|default
+	sshd|default
+	syslog-ng|default
+
+boot/kernel: gentoo
+boot/kernel/gentoo/sources: hardened-sources
+boot/kernel/gentoo/config: /root/releng/tools-musl/../releases/weekly/kconfig/amd64/admincd-4.4.8-r1.config
+boot/kernel/gentoo/extraversion: openstack
+boot/kernel/gentoo/gk_kernargs: --all-ramdisk-modules --makeopts=-j4
+
+# all of the cleanup...
+stage4/unmerge:
+	sys-kernel/genkernel
+	sys-kernel/hardened-sources
+
+stage4/empty:
+	/root/.ccache
+	/tmp
+	/usr/portage/distfiles
+	/usr/src
+	/var/cache/edb/dep
+	/var/cache/genkernel
+	/var/cache/portage/distfiles
+	/var/empty
+	/var/run
+	/var/state
+	/var/tmp
+
+stage4/rm:
+	/etc/*-
+	/etc/*.old
+	/etc/ssh/ssh_host_*
+	/root/.*history
+	/root/.lesshst
+	/root/.ssh/known_hosts
+	/root/.viminfo
+	# Remove any generated stuff by genkernel
+	/usr/share/genkernel
+	# This is 3MB of crap for each copy
+	/usr/lib64/python*/site-packages/gentoolkit/test/eclean/testdistfiles.tar.gz

diff --git a/tools-musl/stage4-hardened-amd64.spec b/tools-musl/stage4-hardened-amd64.spec
new file mode 100644
index 0000000..e8b30e9
--- /dev/null
+++ b/tools-musl/stage4-hardened-amd64.spec
@@ -0,0 +1,86 @@
+subarch: amd64
+target: stage4
+version_stamp: cloud-latest
+rel_type: default
+profile: hardened/linux/musl/amd64
+snapshot: current
+source_subpath: musl/hardened/amd64/stage3-amd64-musl-hardened
+portage_confdir: @REPO_DIR@/portage.amd64.hardened-stage4
+portage_overlay: /opt/overlays/musl
+
+stage4/use:
+	bash-completion
+	bindist
+	bzip2
+	idm
+	ipv6
+	mmx
+	sse
+	sse2
+	urandom
+
+stage4/packages:
+	app-admin/logrotate
+	app-admin/sudo
+	app-admin/syslog-ng
+	app-editors/vim
+	app-portage/eix
+	app-portage/gentoolkit
+	net-misc/dhcpcd
+	net-misc/iputils
+	sys-boot/grub
+	sys-apps/dmidecode
+	sys-apps/gptfdisk
+	sys-apps/iproute2
+	sys-apps/lsb-release
+	sys-apps/pciutils
+	sys-block/parted
+	sys-devel/bc
+	sys-power/acpid
+	sys-process/cronie
+stage4/fsscript: /root/releng/tools-musl/tools-musl/stage4-fsscript.sh
+stage4/rcadd:
+	acpid|default
+	cronie|default
+	dhcpcd|default
+	net.lo|default
+	netmount|default
+	sshd|default
+	syslog-ng|default
+
+boot/kernel: gentoo
+boot/kernel/gentoo/sources: hardened-sources
+boot/kernel/gentoo/config: @REPO_DIR@/../releases/weekly/kconfig/amd64/admincd-4.4.8-r1.config
+boot/kernel/gentoo/extraversion: openstack
+boot/kernel/gentoo/gk_kernargs: --all-ramdisk-modules --makeopts=-j4
+
+# all of the cleanup...
+stage4/unmerge:
+	sys-kernel/genkernel
+	sys-kernel/hardened-sources
+
+stage4/empty:
+	/root/.ccache
+	/tmp
+	/usr/portage/distfiles
+	/usr/src
+	/var/cache/edb/dep
+	/var/cache/genkernel
+	/var/cache/portage/distfiles
+	/var/empty
+	/var/run
+	/var/state
+	/var/tmp
+
+stage4/rm:
+	/etc/*-
+	/etc/*.old
+	/etc/ssh/ssh_host_*
+	/root/.*history
+	/root/.lesshst
+	/root/.ssh/known_hosts
+	/root/.viminfo
+	# Remove any generated stuff by genkernel
+	/usr/share/genkernel
+	# This is 3MB of crap for each copy
+	/usr/lib64/python*/site-packages/gentoolkit/test/eclean/testdistfiles.tar.gz