Added 'scrub-*' commands for securely scrubbing filesystems.

[libguestfs.git] / appliance / make.sh.in

diff --git a/appliance/make.sh.in b/appliance/make.sh.in
index 8f3b212..637bd07 100755 (executable)
--- a/appliance/make.sh.in
+++ b/appliance/make.sh.in
@@ -24,28 +24,6 @@ set -e
 
 cd @top_builddir@
 
-modules="
--i augeas-libs
--i bash
--i binutils
--i coreutils
--i dosfstools
--i file
--i grub
--i iputils
--i kernel
--i lvm2
--i MAKEDEV
--i module-init-tools
--i net-tools
--i ntfs-3g
--i ntfsprogs
--i procps
--i strace
--i util-linux-ng
--i zerofree
-"
-
 # Decide on names for the final output.  These have to match Makefile.am.
 output=appliance/initramfs.@REPO@.@host_cpu@.img
 koutput=appliance/vmlinuz.@REPO@.@host_cpu@
@@ -53,7 +31,14 @@ rm -f $output
 rm -f $koutput
 
 # Create the basic initramfs.
-@FEBOOTSTRAP@ $modules -u @UPDATES@ @REPO@ initramfs @MIRROR@
+exec 5<appliance/packagelist
+packages=
+while read pkg 0<&5; do
+    packages="$packages -i $pkg"
+done
+exec 5<&-
+
+@FEBOOTSTRAP@ $packages -u @UPDATES@ @REPO@ initramfs @MIRROR@
 
 # /sysroot is where the guest root filesystem will be mounted.
 @FEBOOTSTRAP_RUN@ initramfs -- mkdir -p --mode=0777 /sysroot
@@ -80,18 +65,42 @@ rm -f $koutput
 # Don't need any keyboard maps.
 @FEBOOTSTRAP_RUN@ initramfs -- rm -rf /lib/kbd
 
+# Remove anything in home directory.  Because this is potentially
+# liable to monstrous fuck-ups, we don't put a slash before 'home'.
+(cd initramfs && echo home/*) |
+  xargs @FEBOOTSTRAP_RUN@ initramfs -- rm -rf
+
+# Remove /var/lib/yum stuff.
+@FEBOOTSTRAP_RUN@ initramfs -- rm -rf /var/lib/yum
+
+# Remove some unreadable binaries which are incompatible with
+# the supermin appliance.  Since these binaries can't be read
+# from the host filesystem, they generate warnings like:
+#   cpio: ./usr/bin/chfn: Cannot open: Permission denied
+# These binaries are not needed for operation of the appliance.
+@FEBOOTSTRAP_RUN@ initramfs -- rm -f \
+  /usr/bin/chfn \
+  /usr/bin/chsh \
+  /usr/libexec/pt_chown \
+  /usr/sbin/groupdel \
+  /usr/sbin/groupadd \
+  /usr/sbin/useradd \
+  /usr/sbin/tzdata-update \
+  /usr/sbin/userdel \
+  /usr/sbin/usermod \
+  /usr/sbin/groupmod \
+  /usr/sbin/groupmems \
+  /sbin/unix_update \
+  $(cd initramfs && echo usr/sbin/glibc_post_upgrade.*)
+
 # Kernel modules take up nearly half of the image.  Only include ones
 # which are on the whitelist.
-grep -v '^[[:space:]]*$' < appliance/kmod.whitelist |
-  grep -v '^#' > kmod.whitelist.tmp
-exec 5<kmod.whitelist.tmp
+exec 5<appliance/kmod.whitelist
 whitelist=
 while read kmod 0<&5; do
     whitelist="$whitelist -a -not -name $kmod"
 done
 exec 5<&-
-rm kmod.whitelist.tmp
-#echo whitelist=$whitelist
 
 (cd initramfs && \
   find lib/modules/*/kernel -name '*.ko' $whitelist -a -print0 ) |
@@ -124,39 +133,7 @@ echo nameserver 10.0.2.3 > resolv.conf.new
 rm resolv.conf.new
 
 # Create the init script.
-cat > init.new <<'__EOF__'
-#!/bin/sh
-echo Starting /init script ...
-PATH=/sbin:/usr/sbin:$PATH
-mount -t tmpfs none /dev
-mkdir /dev/pts /dev/shm /dev/mapper
-MAKEDEV mem null port zero core full ram tty console fd \
-  hda hdb hdc hdd sda sdb sdc sdd loop sd
-mknod /dev/ptmx c 5 2; chmod 0666 /dev/ptmx
-mknod /dev/random c 1 8;  chmod 0666 /dev/random
-mknod /dev/urandom c 1 9; chmod 0444 /dev/urandom
-mount -t proc /proc /proc
-mount -t sysfs /sys /sys
-mount -t devpts -o gid=5,mode=620 /dev/pts /dev/pts
-ln -sf /proc/self/fd/0 /dev/stdin
-ln -sf /proc/self/fd/1 /dev/stdout
-ln -sf /proc/self/fd/2 /dev/stderr
-modprobe virtio_pci
-modprobe virtio_net
-modprobe dm_mod ||:
-/sbin/ifconfig lo 127.0.0.1
-/sbin/ifconfig eth0 10.0.2.10
-/sbin/route add default gw 10.0.2.2
-lvm vgscan --ignorelockingfailure
-lvm vgchange -ay --ignorelockingfailure
-if grep -sq guestfs_rescue=1 /proc/cmdline; then
-  bash -i
-fi
-exec guestfsd -f
-__EOF__
-
-@FEBOOTSTRAP_INSTALL@ initramfs init.new /init 0755 root.root
-rm init.new
+@FEBOOTSTRAP_INSTALL@ initramfs appliance/init /init 0755 root.root
 
 # Just in case the kernel isn't looking for /init, make /sbin/init
 # be our script, not the real init.