2 echo "Starting Kickstart Post"
3 PATH=/sbin:/usr/sbin:/bin:/usr/bin
6 # Import SELinux Modules
7 echo "Enabling selinux modules"
8 SEMODULES="base automount avahi consolekit cyrus dhcp dnsmasq guest hal ipsec \
9 iscsi kerberos kerneloops ldap lockdev logadm mozilla ntp ovirt-node-selinux \
10 polkit portmap qemu rpcbind sasl snmp stunnel sysstat tcpd unprivuser \
11 unconfined usbmodules userhelper virt"
13 lokkit -v --selinuxtype=minimum
16 for semodule in $SEMODULES; do
18 pp_file=/usr/share/selinux/minimum/$semodule.pp
19 if [ -f $pp_file.bz2 ]; then
20 bzip2 -dc $pp_file.bz2 > "$tmpdir/$semodule.pp"
23 elif [ -f $pp_file ]; then
27 # Don't put "base.pp" on the list.
28 test $semodule = base \
31 && modules="$modules $semodule.pp"
34 if test -n "$modules"; then
37 && semodule -v -b base.pp -i $modules \
42 echo "Running ovirt-install-node-stateless"
43 ovirt-install-node-stateless
45 echo "Creating shadow files"
46 # because we aren't installing authconfig, we aren't setting up shadow
47 # and gshadow properly. Do it by hand here
51 echo "Forcing C locale"
52 # force logins (via ssh, etc) to use C locale, since we remove locales
53 cat >> /etc/profile << \EOF
54 # oVirt: force our locale to C since we don't have locale stuff'
55 export LC_ALL=C LANG=C
58 echo "Configuring IPTables"
59 # here, we need to punch the appropriate holes in the firewall
60 cat > /etc/sysconfig/iptables << \EOF
61 # oVirt automatically generated firewall configuration
66 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
67 -A INPUT -p icmp -j ACCEPT
68 -A INPUT -i lo -j ACCEPT
70 -A INPUT -p tcp --dport 16509 -j ACCEPT
72 -A INPUT -p tcp --dport 22 -j ACCEPT
74 -A INPUT -p tcp --dport 81 -j ACCEPT
76 -A INPUT -p tcp -m multiport --dports 5800:6000 -j ACCEPT
78 -A INPUT -p tcp -m multiport --dports 49152:49216 -j ACCEPT
79 -A INPUT -j REJECT --reject-with icmp-host-prohibited
80 -A FORWARD -m physdev ! --physdev-is-bridged -j REJECT --reject-with icmp-host-prohibited
83 # configure IPv6 firewall, default is all ACCEPT
84 cat > /etc/sysconfig/ip6tables << \EOF
85 # oVirt automatically generated firewall configuration
90 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
91 -A INPUT -p ipv6-icmp -j ACCEPT
92 -A INPUT -i lo -j ACCEPT
94 -A INPUT -p tcp --dport 16509 -j ACCEPT
96 -A INPUT -p tcp --dport 22 -j ACCEPT
98 -A INPUT -p tcp --dport 81 -j ACCEPT
100 -A INPUT -p tcp -m multiport --dports 5800:6000 -j ACCEPT
102 -A INPUT -p tcp -m multiport --dports 49152:49216 -j ACCEPT
103 -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
104 -A FORWARD -m physdev ! --physdev-is-bridged -j REJECT --reject-with icmp6-adm-prohibited
108 # remove errors from /sbin/dhclient-script
109 DHSCRIPT=/sbin/dhclient-script
110 sed -i 's/mv /cp -p /g' $DHSCRIPT
111 sed -i '/rm -f.*${interface}/d' $DHSCRIPT
112 sed -i '/rm -f \/etc\/localtime/d' $DHSCRIPT
113 sed -i '/rm -f \/etc\/ntp.conf/d' $DHSCRIPT
114 sed -i '/rm -f \/etc\/yp.conf/d' $DHSCRIPT
116 if rpm -q --qf '%{release}' ovirt-node | grep -q "^0\." ; then
117 echo "Building in developer mode, leaving root account unlocked"
119 set /files/etc/ssh/sshd_config/PermitEmptyPasswords yes
123 echo "Building in production mode, locking root account"
127 # directories required in the image with the correct perms
128 # config persistance currently handles only regular files
132 # fix iSCSI/LVM startup issue
133 sed -i 's/node\.session\.initial_login_retry_max.*/node.session.initial_login_retry_max = 60/' /etc/iscsi/iscsid.conf
135 # root's bash profile
136 cat >> /root/.bashrc <<EOF
137 # aliases used for the temporary
143 alias ping='ping -c 3'
147 cp /usr/share/ovirt-node/grub-splash.xpm.gz /boot/grub/splash.xpm.gz
148 cp /usr/share/ovirt-node/syslinux-vesa-splash.jpg usr/lib/anaconda-runtime/syslinux-vesa-splash.jpg
150 # Remove the default logrotate daily cron job
151 # since we run it every 10 minutes instead.
152 rm -f /etc/cron.daily/logrotate
154 # comment out /etc/* entries in rwtab to prevent overlapping mounts
155 touch /var/lib/random-seed
158 sed -i '/^files \/etc*/ s/^/#/' /etc/rwtab
159 cat > /etc/rwtab.d/ovirt <<EOF
160 dirs /var/lib/multipath
162 files /var/cache/libvirt
163 files /var/cache/hald
164 files /var/empty/sshd/etc/localtime
166 files /var/lib/libvirt