Add missing entries to passwd and group.
Updated netperf needs netperf user and group. Updated systemd needs
various systemd users and groups. Dnsmasq also seems to require its
own user/group.
All this is added to prevent systemd-sysusers adding these to
/etc/passwd. And systemd-sysusers adds these, because the updated
user/group eclass in portage-stable now drops configuration files into
/usr/lib/sysusers.d. Maybe at some point we will switch over to
(patched?) systemd-sysusers, so this catch-up game won't be necessary,
but we are not there yet.
This includes the `auditd` binary and systemd unit as part of the
distro. While journald is also able to handle logs from the linux audit
subsystem, auditd provides audit-specific capabilities that are
necessary in deployments subject to regulatory compliance.
For one, an administrator is able to configure audit log writing policy
to ensure that logs land on disk and nothing is missed (`flush`). We
wouldn't want such policy through journald as it woudl sync and ensure
all logs which might be undesirable and too resource intensive. In
short, this allows us to configure different management policies for
audit logs compared to general logs.
It allows us to explicitly configure the node's reaction to errors such
as the disk beign full, the disk having other issues or space constraints.
While Flatcar is not Common Criteria certified which would require the
system to shut down if audit logs present issues (not written or
collected), some FedRAMP environments do require actions such as
notifications (which could be achieved via syslog). This can be
explicitly done with auditd as well.
Co-authored-by: Kai Lüke <pothos@users.noreply.github.com>
- Consolidate them (so enabling selinux and disabling hybrid cgroups
was moved).
- Remove outdated masks (arm64 does not mask any use flags any more)
and use flags (ssl was replaced in favor of +openssl and gnutls,
introspection is gone).
- Add gnuefi (for bootctl, earlier it was built if we requested
general efi support, now it's built when support also for gnu-efi is
requested).
Fix build issues when building firmware 20220209 by bumping the cxbg4
firmware version to 1.26.6.0. Without that, build fails like:
```
* Scanning for files required by 5.15.22-flatcar
* Missing firmware: cxgb4/t6fw.bin (cxgb4.ko.xz)
* Missing firmware: cxgb4/t5fw.bin (cxgb4.ko.xz)
* Missing firmware: cxgb4/t4fw.bin (cxgb4.ko.xz)
```
As gcc 10 or newer defaults to `-fno-common`, we need to define only
once in a *.c file, instead of *.h that can be imported multiple times
by *.c files.
See also https://github.com/vmware/open-vmdk/pull/13.
- Add the tmpfiles configuration for populating /var
- Add service compatibility symlinks (maybe time to drop them)
- Drop moving a binary from /usr/sbin to /sbin
- Drop populating /etc and /var
- Drop pkg_postinst
Based on commit c232e24562cfecd53cb281330e2900fcc30006f7.
Update net-fs/nfs-utils to 2.5.4-r3, as needed by gcc 10.
Without that update, build fails like:
```
/usr/libexec/gcc/x86_64-cros-linux-gnu/ld:
../../support/export/libexport.a(xtab.o):.../support/export/xtab.c:32:
multiple definition of `v4root_needed';
mountd-v4root.o:.../utils/mountd/v4root.c:31: first defined here
```
Waagent ejects the provisioning dvd, but this causes the /dev/sr0 drive
to be in a state where util-linux probing it causes the kernel to spam
"unaligned transfer" messages. This is fixed in util-linux main branch,
but it will be a while until this is released.
Create a symlink from 'eject' to '/bin/true' and modify the unit's PATH
environment variable so that this symlink is found before the eject
binary.
Additionally I added the oem python directory to PATH, so that waagent
can be start directly. This should be enough so that messages from
waagent in the journal are prefixed with 'waagent' and not 'python'.
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
This new downstream patch disables the ManageForeignRoutes and
ManageForeignRoutingPolicyRules systemd-netword settings by default to
ensure that CNIs don't get their routes or routing policy rules
discarded on network reconfiguration events.
https://github.com/flatcar-linux/Flatcar/issues/620
