* grub-signed: Commonize on one spec
Use macros to swap spec contents based on build architecture. We will
still create an SRPM per arch, each with a unique name, so there is no
risk of SRPM name collision.
* grub-signed: Define new grub2-efi-binary subpackage
New subpackage will contain the signed grubx64.efi/grubaa64.efi binary.
This package name is identical to the unsigned version and we will
prefer to use this signed version if built.
* grub-signed: rename files
* grub2: bump spec version to match signed version
* Update github action checks
CG manifest, license file, and spec entanglement checks are failing
due to the grub-efi-binary-signed naming change. Update the checks to
account for the new name.
* grub2-signed: rename source0 to match subpackage
Source0 previous pointed to grub2-efi-unsigned rpm which technically
can work but it would be better to use the grub2-efi-binary package
instead because grub2-efi-binary package is ultimately the package we
will be replacing. We can also perform checks to make sure the output
rpm matches the inputs, modulo the signed binary.
Signed-off-by: Chris Co <chrco@microsoft.com>
* shim: Introduce shim package
Shim package contains a signed shim bootloader which is signed with the
Microsoft UEFI CA cert to allow it to load on many different platforms
that support UEFI Secure boot. If UEFI Secure Boot is enabled, this shim
binary will verify that next stage bootloaders (i.e., grub and kernel)
are signed with the CBL-Mariner secure boot key.
* shim: add extra versioning info to source0
Renamed Source0 tarball naming to prevent future tarball naming
collisions.
* CI: ignore shim during cgmanifest check
shim package's Source0 is a signed binary created by us.
* licenses-map: Add shim to table
* shim: prefer install over cp
* licenses: Add shim to data file
Fixes error thrown by spec license checker
* shim: Add comment explaining why only x86_64 shim
Signed-off-by: Chris Co <chrco@microsoft.com>
* kernel-signed: define a new kernel subpackage
This spec purpose is to take an input kernel rpm and input secure-boot-signed
kernel binary from the same build and generate a new "kernel" rpm with the
signed kernel binary + all of the other original kernel files, triggers,
scriptlets, requires, provides, etc.
We need to ensure the kernel modules and kernel binary used are from the exact
same build because at build time the kernel modules are signed with an
ephemeral key that the kernel enrolls in its keyring. We enforce kernel
module signature checking when we enable security features like kernel
lockdown so our kernel can only load those specific kernel modules at runtime.
Additionally, to complete the UEFI Secure Boot chain, we must PE-sign the
kernel binary. Ideally we would enable secure-boot signing tools like pesign
or sbsign to be callable from inside the rpmbuild environment, that way we can
secure-boot sign the kernel binary during the kernel's rpmbuild. It is best
practice to sign as soon as possible. However there are issues getting that
secure boot signing infrastructure in place today. Hence we sign the
resulting kernel binary and "repackage" the kernel RPM (something rpm itself
actively tries to make sure you never do...generally for good reasons).
To achive this repackaging, this spec creates a new subpackage named
"kernel". To retain all of the initial kernel package behaviors, we make sure
the subpackage has the same requires, provides, triggers, post steps, and
files as the original kernel package.
This specific repackaging implementation leaves room for us to enable the
more ideal secure-boot signing flow in the future without introducing any
sort of breaking change or new packaging. Users still install a "kernel"
package like they normally would.
Maintenance Notes:
- This spec's "version" and "release" must reflect the unsigned version that
was signed. An important consequence is that when making a change to this
spec or the normal kernel spec, the other spec's version version/release must
be increased to keep the two versions consistent.
- Make sure the kernel subpackage's Requires, Provides, triggers, post/postun
scriptlets, and files match the normal kernel spec's. The kernel subpackage
should contain the same content as the input kernel package but replace the
kernel binary with our signed kernel binary. Since all the requires, provides,
etc are the same, this new kernel package can be a direct replacement for the
normal kernel package and RPM will resolve packages with kernel dependencies
correctly.
To populate the input sources:
1. Build the unsigned packages as normal
2. Sign the desired binary
3. Place the unsigned package and signed binary in this spec's folder
4. Build this spec
* kernel-signed: refactor into one common spec file
The only differences between kernel-signed-x86_64 and
kernel-signed-aarch64 spec files were primarily the architecture
type in the spec name and input Source0 rpm. We can use a macro to set
these and reduce down to one spec file
* Update checks to consider kernel-signed
* kernel-hyperv: match release number
Ideally we keep kernel-headers version/release in sync with kernel and
kernel-hyperv package version/release. This allows the user to install
kernel-headers on any Mariner system by using
dnf install kernel-headers-$(uname -r)
Signed-off-by: Chris Co <chrco@microsoft.com>
Add a custom installkernel script to easily install the Linux kernel
onto a running Mariner system. This script will get called automatically
by the Linux kernel's "make install" command.
Signed-off-by: Chris Co <chrco@microsoft.com>
* diskutils: Add partprobe after partition creation
There can be a timing issue where partition creation finishes but the
devtmpfs files are not populated in time for partition initialization.
So to deal with this, we call partprobe here to query and flush the
partition table information, which should enforce that the devtmpfs
files are created when partprobe returns control.
* diskutils: invoke partprobe with flock
Added flock because "partprobe -s" apparently doesn't always block.
flock is part of the util-linux package and helps to synchronize access
with other cooperating processes. The important part is it will block
if the fd is busy, and then execute the command. Adding a 5 second timeout
to prevent us from possibly waiting forever.
* diskutils: Update timeout variable name
* diskutils: clarify debug log message
* Add parted to documentation and quickstart runner
Signed-off-by: Chris Co <chrco@microsoft.com>
* Update trademark section of the readme
Signed-off-by: Jim Perrin <Jim.Perrin@microsoft.com>
* Update building.md (#104)
* add wants=sshd-keygen.service to sshd (#58)
* add wants=sshd-keygen.service to sshd
Signed-off-by: Jim Perrin <Jim.Perrin@microsoft.com>
* modify signatures.json and bump release for pr
Signed-off-by: Jim Perrin <Jim.Perrin@microsoft.com>
* Fix libffi normal package build (#116)
* Fix libffi normal package build
* Add comment explaining the purpose of the sed call
* Upgrade golang to 1.13.15 (#93)
* Adding a small build tip to the quick start instructions. (#123)
* Add cloud-init-vmware-guestinfo package (#124)
* Add cloud-init-vmware-guestinfo package
* Updating 'ca-certificates' nssckbi.h header and unifying changelog entries with package version (#125)
* Updating changelog to be consistent with package version.
* Fixing missed update to 'nssckbi.h'.
* Updating manifests.
* Updating signatures.
* Markdown lint-induced clean-up of doc files. (#122)
* Makrdownlint-induced clean-up.
* Removing redundant lines.
* Removing redundant lines 2.
* Add IMA feature to the kernel, add config for it (#135)
* Add IMA feature to the kernel, add config for it
- Add IMA measurement configs to the x86_64, and aarch64 kernel configs (IMA_APPRAISE currently disabled).
- Add KernelCommandLine config field to control IMA, and allow additional configs to be passed.
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
Co-authored-by: Christopher Co <christopher.co@microsoft.com>
* Update tpm2 tools to 4.2, tss to 2.4.0 (#134)
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Enable Mellanox kernel configs
* Update tpm2-abrmd to 2.3.3 (#144)
* Update tpm2-abrmd to 2.3.3
* Create quickstart.yml (#119)
This patch adds a GitHub Action to verify our Quickstart instructions
* Nopatch httpd CVE-1999-0236, CVE-1999-1412 (#148)
* Nopatch httpd CVE-1999-0236, CVE-1999-1412
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Nopatch groff CVE-2000-0803 (#149)
* Nopatch groff CVE-2000-0803
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Nopatch apparmor CVE-2016-1585 (#150)
* Nopatch apparmor CVE-2016-1585
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Nopatch qemu CVE-2016-7161 (#152)
* Nopatch qemu CVE-2016-7161
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Nopatch lua CVE-2020-15889 (#153)
* nopatch lua CVE-2020-15889
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Nopatch unzip CVE-2008-0888 (#154)
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* full: Always install the default kernel (#132)
Currently, when installing CBL-Mariner via ISO, the ISO will
install the standard kernel package or the kernel-hyperv package
depending on if installing on HyperV VM or not.
The HyperV kernel is still under evaluation so use the standard kernel
package across the board.
* Support downloading preview SRPMs (#160)
Replace SRPM_URL* with SRPM_URL_LIST
* Patch CVE-2020-14342 in cifs-utils
* Replace mariner-repos's %post script as %posttrans
- After looking at here, it shows that %post script for a new version runs before the %preun script for an old version. Which means, after an upgrade, the keys would be removed by the older version: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#ordering
* Update pkggen_core_aarch64.txt
* Update pkggen_core_x86_64.txt
* Update toolchain_aarch64.txt
* Update toolchain_x86_64.txt
* Add a more verbose changelog
* Remove chrony-wait as a boot service dependency (#166)
* Remove chrony-wait as a boot service dependency
* Add cgmanifest entry for chrony
* Address changelog and prep section comments
* initramfs: Regenerate initrd using host-only mode on file-based trigger (#170)
* initramfs: Always use host-only mode
kdump currently uses the host system's initrd when enrolling a crash kernel
and initrd. There is a limitation where the kdump initrd must be generated
with dracut in "host-only" mode.
The -k option forces a host-only initrd build.
The -q option suppresses verbose output
If mkinitrd is called without <image> and <kernel-version> parameters, it will
default to calling dracut in "host-mode" mode on every kernel version it can
find in /boot.
If mkinitrd is called with <image> and <kernel-version> parameters, it will
default to calling dracut in "generic host" mode for rebuilding the specific
initrd. Therefore we need to make sure to add the -k option when invoking
mkinitrd with an explicit <image> and <kernel version>
* Reword comment block
* Fix kernel specs' %postun scripts (#164)
* Fix `kernel.spec`'s `%postun` script
* Fix `kernel-signed-aarch64`'s `%postun` script
* Fix kernel-signed-x64.spec's %postun script
* Fix kernel-hyperv.spec's %postun script
* Adding new 'preview' repository. (#146)
* Adding new 'preview' repository.
* Addressing comments.
* Fix kernel aarch64 package build break due to missing CONFIG_IMA_KEXEC (#171)
* Fix kernel aarch64 package build break due to missing CONFIG_IMA_KEXEC (#171)
* Update fontconfig to 2.13.91 (#175)
* Extending 'strongswan' test timeout. (#173)
* Fix CVE-2020-14342 patch to not depend on PATH
* installutils: Supply blank /etc/machine-id file (#147)
From https://www.freedesktop.org/software/systemd/man/machine-id.html:
For operating system images which are created once and used on multiple
machines, for example for containers or in the cloud, /etc/machine-id
should be an empty file in the generic file system image. An ID will be
generated during boot and saved to this file if possible.
* installutils: Remove root password expiry when no root user is specified in imageconfig file (#161)
* Add SELinux packages to Mariner. (#100)
* Add SELinux packages to Mariner.
This commit add the following packages to Mariner to provide basic
SELinux support:
- checkpolicy
- libsemanage
- mcstrans
- policycoreutils
- secilc
- selinux-policy
- setools
The selinux-policy provided here is a generic base policy, which is not
specifically tuned for Mariner, therefore only permissive mode support
is enabled in this commit. (Although users could load a custom policy
to run in enforcing mode). Future phases have been discussed to add
SELinux enforcing mode support.
This commit does not enable SELinux by default. In order to enable
SELinux support, one must first install necessary packages (libselinux,
policycoreutils, secilc, selinux-policy), and then append "lsm=selinux
selinux=1" to the kernel command line. This will trigger an initial
boot to relabel the system, at which point the system will reboot, and
boot into an SELinux enabled system. SELinux state can be queried with
the "getenforce" command line tool. If SELinux has not been enabled, it
will report "Disabled" (the default). If SELinux support has been
enabled as described in this paragraph, it will report "permissive".
This commit also modifies the following packages to enabled SELinux
functionality in existing packages:
- coreutils
- cronie
- dbus
- openssh
- pam
- rpm
- shadow-utils
- systemd
- util-linux
This enables them to build with SELinux support so that when SELinux is
enabled, they have SELinux related functionality available.
Because coreutils is a basic package and requires building with
libselinux-devel present in order to enable key SELinux functionality,
several dependencies in other packages that rely on coreutils (namely
python2, python3 and systemd-bootstrap) had to be removed in order to
avoid circular dependencies. There does not appear to be a functional
impact from this change based on my testing.
* Remove "::set-env" commands in GitHub Actions (#178)
* Adding a .nopatch for CVE-2007-0086. (#176)
* Updating cert bundle paths. (#181)
* Updating cert bundle paths.
* Updating cgmanifest.json.
* Adding the `gflags` and `rocksdb` packages. (#183)
* Adding the 'rocksdb' package.
* Adding the 'gflags' package.
* Add missing %libsepolver definition in secilc.spec (#192)
* Removing 'TERMINAL_ISO_INSTALLER' from the docs. (#189)
* Add architecture at the end of toolkit archive (#182)
- Also add `version.txt` file in the toolkit archive as an easy way to verify toolkit version.
* Adding a missing '%{?dist}' tag. (#195)
* enable fetching RPMs from pacakges.microsoft.com for Docker based build (#198)
* Update README.md (#180)
* Update README.md (#180)
* Build Break Fix: Rollback selinux checkins. (#204)
* Revert "Add missing %libsepolver definition in secilc.spec (#192)"
This reverts commit 9cff088bec.
* Revert "Add SELinux packages to Mariner. (#100)"
This reverts commit b2d918efac.
* Natively support pulling from the preview repo (#199)
* Fix CVE-2020-26159 in oniguruma (#211)
* Fix CVE-2020-26159
* Increment release, fix autosetup.
* Adding the 'syslog-ng' package. (#205)
* Adding the 'tinyxml2' package. (#206)
* Adding the 'toml11' package. (#207)
* Adding the 'tracelogging' and 'zipper' packages. (#208)
* Add mm-common and libxml++ packages (#215)
* Add liblogging package (#214)
* Add nlohmann-json package (#217)
* Add msgpack package (#216)
* Adding the 'span-lite' and 'telegraf' packages. (#220)
* Remove toolchain-local-wget-list after use (#212)
* Remove toolchain-local-wget-list after use
- toolchain-local-wget-list has been left at the end of a toolchain build. It shows up on `git status` whene toolchain is built locally.
- Another solution would be adding it to `.gitignore`.
* Add temporary toolchain build files to toolkit/.gitignore
* Remove implicit git repository dependency from toolkit (#197)
* Remove implicit git repository dependency
* Remove the new GIT_REV variable
* Add jsonbuilder package (#223)
* update libffi to use https source0 (#227)
* Update libestr (#213)
* Add babeltrace2 and lttng-consume packages (#226)
* Add pugixml package (#222)
* Disable debug package for nlohmann-json (#228)
* Add rapidjson package (#225)
* Upgrade ruby to 2.6.6 to resolve CVE-2019-16255, CVE-2019-16201, CVE-2020-10933, CVE-2020-5247, CVE-2019-15845, CVE-2019-16254 (#224)
* Upgrade ruby to 2.6.6 to resolve CVEs
* Update cgmanifest
* Nopatch qemu CVE-2015-7504 CVE-2017-5931 CVE-2017-14167 (#162)
* Fix CVE-2020-26159 in oniguruma (#211)
* Fix CVE-2020-26159
* Increment release, fix autosetup.
* Enable QAT kernel configs in CBL-Mariner
* Nopatch kernel CVE-2020-10757, CVE-2020-12653, CVE-2020-12657, CVE-2010-3865, CVE-2020-11668, CVE-2020-12654, CVE-2020-24394, CVE-2020-8428 (#193)
* Address CVE-2020-10757, CVE-2020-12653, CVE-2020-12657, CVE-2010-3865, CVE-2020-11668, CVE-2020-12654, CVE-2020-24394, CVE-2020-8428
* Adding the `bond`, `fluent-bit`, and `ivykis` packages. (#234)
* Joslobo/add azure storage (#232)
* Add azure-storage spec file to mariner-core
* Register with legal and update map file
* Fixed #source0 link
* Updated per code review comments
* Fixed URL to use https
* Initial spec lint action commit (#172) (#191)
* Initial spec-cleaner commit for CBL-Mariner
* Add cgmanifest.json file for GitHub workflows folder
* Set continue-on-error to true for a trial period
* patch openssh (#238)
* Update pull_request_template.md (#236)
* Fix check tests for git, make, krb5 and libcap-ng (#241)
* fix check tests
* update toolchain manifests
* fix blank spaces and tabs in make.spec
* Fix CVE-2019-12735 in vim (#230)
* Fix CVE-2019-12735 in vim
* Update the changelog to address only one CVE.
* Switching to correct source for the Microsoft bundle. (#244)
* Fix check tests for brotli, gzip and python-certifi (#245)
* fix check test for brotli, gzip, python-cerifi
* update manifest release version for gzip
* skip check for vim
* Patch unbound CVE-2020-12662 and CVE-2020-12663 (#246)
* Portablectl patches for to support --now --enable and --no-block flags (#139)
* Portablectl patches for to support --now --enable and --no-block flags
* Portablectl patches for to support --now --enable and --no-block flags
* Patch lua CVE-2019-6706, CVE-2020-15888, nopatch CVE-2020-24342 (#169)
* Patch lua CVE-2019-6706, CVE-2020-15888, CVE-2020-15945, nopatch CVE-2020-24342
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Roll back CVE-2020-15945, patch ineffective
Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
* Nopatch ed CVE-2015-2987 (#209)
ed CVE-2015-2987 applies to a different program named ed.
* Patch gnutls CVE-2020-24659 (#247)
Upstream CVE discussion: https://gitlab.com/gnutls/gnutls/-/issues/1071
* update ant verision
* fix changelog comment
* update cgmanifest
* Nopatch sqlite CVE-2015-3717 (#254)
* Added omi package
* Adding the `ccache` and `clamav` packages. (#251)
* Generate ant signatures (#260)
* Add auoms package (#258)
* add auoms package
* add auoms original source url comments
* fix changelog history
* fix auoms signatures
* fix changelog
* use %license
* update licenses-map
* add omi to LICENSES-MAP
* merge latest LICENSES-MAP
* Implement "distroless" containers (#252)
* Create distroless container without bash and surplus dependencies
* Remove RPM database for distroless
* Add busybox and uclibc. Add distroless-packages-debug
* Update cgmanifest
Co-authored-by: Jon Slobodzian <joslobo@microsoft.com>
Co-authored-by: MateuszMalisz <mamalisz@microsoft.com>
* Updated mariner-release package version (#262)
* fix setup (#263)
* fix missed merge file
* Fixed bad file merge
* Fixed poorly merged files
* Merge distroless container revert to 1.0 (#265)
* Revert "Implement "distroless" containers (#252)"
This reverts commit e41efdda19.
* Revert "Implement "distroless" containers (#252)" (#264)
This reverts commit e41efdda19.
* fix package manifest merge issues
* fix issues building input-srpms
* fix package manifest issues
* remove duplicate patch and sed cmd from lua spec
* revert package ignore list and graphoptimizer changes
* remove runc from LICENSES-MAP.md
* Update pkggen merge (#316)
* Clean up lua.spec 1.0 to dev merge (#318)
* update lua.spec and licenses-map.md per feedback
* revert gzip changes
* revert krb5 change
Co-authored-by: Jim Perrin <Jim.Perrin@microsoft.com>
Co-authored-by: Jason Goscinski <jasongos@users.noreply.github.com>
Co-authored-by: Mateusz Malisz <maliszmat@outlook.com>
Co-authored-by: Nicolas Ontiveros <54044510+niontive@users.noreply.github.com>
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
Co-authored-by: Daniel McIlvaney <damcilva@microsoft.com>
Co-authored-by: Christopher Co <christopher.co@microsoft.com>
Co-authored-by: chalamalasetty <chalamalasetty@live.com>
Co-authored-by: chalamalasetty <42326515+chalamalasetty@users.noreply.github.com>
Co-authored-by: Joe Schmitt <1146681+schmittjoseph@users.noreply.github.com>
Co-authored-by: Henry Beberman <henry.beberman@microsoft.com>
Co-authored-by: Emre Girgin <50592283+mrgirgin@users.noreply.github.com>
Co-authored-by: Thomas Crain <thcrain@microsoft.com>
Co-authored-by: Jon Slobodzian <joslobo@microsoft.com>
Co-authored-by: Emre Girgin <mrgirgin@microsoft.com>
Co-authored-by: Daniel Burgener <burgener.daniel@gmail.com>
Co-authored-by: nicolas guibourge <nicogbg@gmail.com>
Co-authored-by: Chirag Shah <chsha@microsoft.com>
Co-authored-by: Henry Li <lihl@microsoft.com>
Co-authored-by: Henry Li <69694695+henryli001@users.noreply.github.com>
Co-authored-by: rychenf1 <rychenf1@gmail.com>
Co-authored-by: Nick Samson <nick.samson@microsoft.com>
Co-authored-by: MateuszMalisz <mamalisz@microsoft.com>
Thomas Crain