ITS: Replacement of words as suggested by its-scanner
chkconfig: Added Vendor, distribution tag also fixed for bogus date Change-Id: I57f47894485ed092c0f0b75e80ba6acc0df33413 Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/13784 Tested-by: gerrit-photon <photon-checkins@vmware.com> Reviewed-by: Tapas Kundu <tkundu@vmware.com>
This commit is contained in:
Nitesh Kumar
Tapas Kundu
parent
6cbb308b36
commit
ec822047cc
|
|
@ -88,10 +88,10 @@ This package contains development headers and static library for libgomp
|
|||
%setup -q
|
||||
%patch0 -p1
|
||||
|
||||
# disable FORTIFY_SOURCE=2 from hardening
|
||||
# deactivate FORTIFY_SOURCE=2 from hardening
|
||||
sed -i '/*cpp:/s/^/# /' `dirname $(gcc --print-libgcc-file-name)`/../specs
|
||||
sed -i '/Ofast:-D_FORTIFY_SOURCE=2/s/^/# /' `dirname $(gcc --print-libgcc-file-name)`/../specs
|
||||
# disable no-pie for gcc binaries
|
||||
# deactivate no-pie for gcc binaries
|
||||
sed -i '/^NO_PIE_CFLAGS = /s/@NO_PIE_CFLAGS@//' gcc/Makefile.in
|
||||
|
||||
install -vdm 755 ../gcc-build
|
||||
|
|
@ -131,9 +131,9 @@ popd
|
|||
|
||||
%check
|
||||
ulimit -s 32768
|
||||
# disable PCH tests is ASLR is on (due to bug in pch)
|
||||
# deactivate PCH tests is ASLR is on (due to bug in pch)
|
||||
test `cat /proc/sys/kernel/randomize_va_space` -ne 0 && rm gcc/testsuite/gcc.dg/pch/pch.exp
|
||||
# disable security hardening for tests
|
||||
# deactivate security hardening for tests
|
||||
rm -f $(dirname $(gcc -print-libgcc-file-name))/../specs
|
||||
# run only gcc tests
|
||||
cd ../gcc-build/gcc
|
||||
|
|
|
|||
|
|
@ -144,7 +144,7 @@ rm -rf %{buildroot}/*
|
|||
* Tue Oct 10 2017 Anish Swaminathan <anishs@vmware.com> 8.5.23-1
|
||||
- Upgraded to version 8.5.23
|
||||
* Wed Sep 27 2017 Alexey Makhalov <amakhalov@vmware.com> 8.5.20-3
|
||||
- Offline build, disable javadoc target
|
||||
- Offline build, deactivate javadoc target
|
||||
* Wed Sep 13 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 8.5.20-2
|
||||
- Updated the permissions on directories packaged
|
||||
* Tue Aug 15 2017 Anish Swaminathan <anishs@vmware.com> 8.5.20-1
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ readonly BASH_COMPLETION_COMPAT_DIR
|
|||
|
||||
# Blacklisted completions, causing problems with our code.
|
||||
#
|
||||
_blacklist_glob='@(acroread.sh)'
|
||||
_denylist_glob='@(acroread.sh)'
|
||||
|
||||
# Turn on extended globbing and programmable completion
|
||||
shopt -s extglob progcomp
|
||||
|
|
@ -1550,7 +1550,7 @@ _known_hosts_real()
|
|||
-S "$suffix" -W "$hosts" -- "$cur" ) )
|
||||
fi
|
||||
|
||||
# This feature is disabled because it does not scale to
|
||||
# This feature is deactivated because it does not scale to
|
||||
# larger networks. See:
|
||||
# https://bugs.launchpad.net/ubuntu/+source/bash-completion/+bug/510591
|
||||
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574950
|
||||
|
|
@ -1977,11 +1977,11 @@ if [[ -d $BASH_COMPLETION_COMPAT_DIR && -r $BASH_COMPLETION_COMPAT_DIR && \
|
|||
-x $BASH_COMPLETION_COMPAT_DIR ]]; then
|
||||
for i in $(LC_ALL=C command ls "$BASH_COMPLETION_COMPAT_DIR"); do
|
||||
i=$BASH_COMPLETION_COMPAT_DIR/$i
|
||||
[[ ${i##*/} != @($_backup_glob|Makefile*|$_blacklist_glob) \
|
||||
[[ ${i##*/} != @($_backup_glob|Makefile*|$_denylist_glob) \
|
||||
&& -f $i && -r $i ]] && . "$i"
|
||||
done
|
||||
fi
|
||||
unset i _blacklist_glob
|
||||
unset i _denylist_glob
|
||||
|
||||
# source user completion file
|
||||
[[ ${BASH_SOURCE[0]} != ~/.bash_completion && -r ~/.bash_completion ]] \
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ sed -i "s@(PREFIX)/man@(PREFIX)/share/man@g" Makefile
|
|||
%build
|
||||
if [ %{_host} != %{_build} ]; then
|
||||
MFLAGS="CC=%{_arch}-unknown-linux-gnu-gcc AR=%{_arch}-unknown-linux-gnu-ar RANLIB=%{_arch}-unknown-linux-gnu-ranlib"
|
||||
# disable buildtime testing
|
||||
# deactivate buildtime testing
|
||||
sed -i 's/all: libbz2.a bzip2 bzip2recover test/all: libbz2.a bzip2 bzip2recover/' Makefile
|
||||
else
|
||||
MFLAGS=
|
||||
|
|
|
|||
|
|
@ -147,7 +147,7 @@ for tempfile in ${TEMPDIR}/certs/*.tmp; do
|
|||
rm -f tempfile.cer "${tempfile}"
|
||||
echo "Created ${keyhash}.pem"
|
||||
done
|
||||
# Remove blacklisted files
|
||||
# Remove denylisted files
|
||||
# MD5 Collision Proof of Concept CA
|
||||
if test -f certs/8f111d69.pem; then
|
||||
echo "Certificate 8f111d69 is not trusted! Removing..."
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
Summary: A system tool for maintaining the /etc/rc*.d hierarchy
|
||||
Name: chkconfig
|
||||
Version: 1.9
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPLv2
|
||||
Vendor: VMware, Inc.
|
||||
Distribution: Photon
|
||||
Group: System Environment/Base
|
||||
URL: https://git.fedorahosted.org/git/chkconfig.git
|
||||
Source: http://fedorahosted.org/releases/c/h/chkconfig/%{name}-%{version}.tar.gz
|
||||
|
|
@ -16,16 +18,16 @@ Requires: libsepol
|
|||
Requires: newt
|
||||
Requires: popt
|
||||
Requires: slang
|
||||
BuildRequires: newt-devel
|
||||
BuildRequires: gettext
|
||||
BuildRequires: popt-devel
|
||||
BuildRequires: newt-devel
|
||||
BuildRequires: gettext
|
||||
BuildRequires: popt-devel
|
||||
BuildRequires: libselinux-devel
|
||||
Conflicts: initscripts <= 5.30-1
|
||||
|
||||
%description
|
||||
Chkconfig is a basic system utility. It updates and queries runlevel
|
||||
information for system services. Chkconfig manipulates the numerous
|
||||
symbolic links in /etc/rc.d, to relieve system administrators of some
|
||||
symbolic links in /etc/rc.d, to relieve system administrators of some
|
||||
of the drudgery of manually editing the symbolic links.
|
||||
|
||||
%package -n ntsysv
|
||||
|
|
@ -93,6 +95,8 @@ rm -rf %{buildroot}
|
|||
%{_mandir}/*/ntsysv.8*
|
||||
|
||||
%changelog
|
||||
* Thu Jun 24 2021 Nitesh Kumar <kunitesh@vmware.com> 1.9-2
|
||||
- Added Vendor, Distribution and fixed bogus date
|
||||
* Fri Apr 07 2017 Anish Swaminathan <anishs@vmware.com> 1.9-1
|
||||
- Upgrade to 1.9
|
||||
* Mon Oct 31 2016 Anish Swaminathan <anishs@vmware.com> 1.5-7
|
||||
|
|
@ -162,7 +166,7 @@ rm -rf %{buildroot}
|
|||
|
||||
* Wed Jan 04 2012 Bill Nottingham <notting@redhat.com> 1.3.57-1
|
||||
- assorted cleanups to LSB dependency support (#693202 fixed properly, #701573)
|
||||
- fix kill values for LSB-only scripts (#696305, <jbastian@redhat.com>)
|
||||
- fix stop values for LSB-only scripts (#696305, <jbastian@redhat.com>)
|
||||
- don't apply start deps for services that aren't starting anywhere (#750446)
|
||||
|
||||
* Tue Oct 11 2011 Bill Nottingham <notting@redhat.com> 1.3.56-1
|
||||
|
|
@ -178,7 +182,7 @@ rm -rf %{buildroot}
|
|||
* Fri Jul 15 2011 Bill Nottingham <notting@redhat.com> 1.3.53-1
|
||||
- ntsysv: change the default to configure runlevels 2/3/4/5 (#709254)
|
||||
- alternatives: check whether the --initscript param is a systemd service, act appropriately (#714830)
|
||||
- forward chkconfig --del to systemctl disable where necessary
|
||||
- forward chkconfig --del to systemctl deactivate where necessary
|
||||
|
||||
* Wed Apr 27 2011 Bill Nottingham <notting@redhat.com> 1.3.52-1
|
||||
- set state before frobbing dependencies (#693202)
|
||||
|
|
@ -195,7 +199,7 @@ rm -rf %{buildroot}
|
|||
- assorted translation updates
|
||||
|
||||
* Tue Nov 9 2010 Bill Nottingham <notting@redhat.com> 1.3.49-1
|
||||
- fix abort on free of uninitialized data. (#649227)
|
||||
- fix stop on free of uninitialized data. (#649227)
|
||||
|
||||
* Wed Oct 27 2010 Bill Nottingham <notting@redhat.com> 1.3.48-1
|
||||
- fix install_initd invocation for services that require $local_fs (#632294)
|
||||
|
|
@ -260,7 +264,7 @@ rm -rf %{buildroot}
|
|||
- translation updates: as, bg, bn_IN, bs, ca, de, fr, hi, hu, id, ja,
|
||||
ka, ml, ms, nb, or, sk, sl
|
||||
- add resetpriorities to the man page (#197399)
|
||||
|
||||
|
||||
* Tue Feb 6 2007 Bill Nottingham <notting@redhat.com> 1.3.33-1
|
||||
- various changes from review - support alternate %%{_sbindir}, fix
|
||||
summaries, add version to requires, assorted other bits
|
||||
|
|
@ -314,7 +318,7 @@ rm -rf %{buildroot}
|
|||
- don't needlessly rewrite xinetd files (#81008)
|
||||
|
||||
* Thu May 5 2005 Bill Nottingham <notting@redhat.com> 1.3.20-1
|
||||
- fix deletion of orphaned slave links (#131496, <mitr@redhat.com>)
|
||||
- fix deletion of orphaned secondary links (#131496, <mitr@redhat.com>)
|
||||
|
||||
* Fri Apr 29 2005 Bill Nottingham <notting@redhat.com> 1.3.19-1
|
||||
- build with updated translations
|
||||
|
|
@ -353,7 +357,7 @@ rm -rf %{buildroot}
|
|||
* Fri Jun 4 2004 Bill Nottingham <notting@redhat.com> 1.3.11-1
|
||||
- fix LSB comment parsing (#85678)
|
||||
|
||||
* Wed May 29 2004 Bill Nottingham <notting@redhat.com> 1.3.10-1
|
||||
* Sat May 29 2004 Bill Nottingham <notting@redhat.com> 1.3.10-1
|
||||
- mark alternatives help output for translation (#110526)
|
||||
|
||||
* Wed Oct 22 2003 Bill Nottingham <notting@redhat.com> 1.3.9-1
|
||||
|
|
@ -407,10 +411,10 @@ rm -rf %{buildroot}
|
|||
- chkconfig/ntsysv (and serviceconf, indirectly): services with
|
||||
*no* links in /etc/rc*.d are no longer displayed with --list, or
|
||||
available for configuration except via chkconfig command-line options
|
||||
- alternatives: fix trying to enable disable a null service
|
||||
- alternatives: fix trying to enable deactivate a null service
|
||||
|
||||
* Tue Mar 5 2002 Bill Nottingham <notting@redhat.com>
|
||||
- alternatives: handle things with different numbers of slave links
|
||||
- alternatives: handle things with different numbers of secondary links
|
||||
|
||||
* Mon Mar 4 2002 Bill Nottingham <notting@redhat.com>
|
||||
- minor alternatives tweaks: don't install the same thing multiple times
|
||||
|
|
@ -423,7 +427,7 @@ rm -rf %{buildroot}
|
|||
* Sun Jan 27 2002 Erik Troan <ewt@redhat.com>
|
||||
- reimplemented update-alternatives as just alternatives
|
||||
|
||||
* Thu Jan 25 2002 Bill Nottingham <notting@redhat.com>
|
||||
* Fri Jan 25 2002 Bill Nottingham <notting@redhat.com>
|
||||
- add in update-alternatives stuff (perl ATM)
|
||||
|
||||
* Mon Aug 27 2001 Trond Eivind Glomsrød <teg@redhat.com>
|
||||
|
|
@ -468,10 +472,10 @@ rm -rf %{buildroot}
|
|||
* Sun Aug 20 2000 Matt Wilson <msw@redhat.com>
|
||||
- new translations
|
||||
|
||||
* Tue Aug 16 2000 Nalin Dahyabhai <nalin@redhat.com>
|
||||
* Wed Aug 16 2000 Nalin Dahyabhai <nalin@redhat.com>
|
||||
- don't worry about extra whitespace on chkconfig: lines (#16150)
|
||||
|
||||
* Wed Aug 10 2000 Trond Eivind Glomsrød <teg@redhat.com>
|
||||
* Thu Aug 10 2000 Trond Eivind Glomsrød <teg@redhat.com>
|
||||
- i18n merge
|
||||
|
||||
* Wed Jul 26 2000 Matt Wilson <msw@redhat.com>
|
||||
|
|
|
|||
|
|
@ -206,7 +206,7 @@ rm -rf %{buildroot}
|
|||
- Updated DataSourceVMwareGuestInfo.patch (till commit 9e69060 from mainline)
|
||||
- Updated dscheck_VMwareGuestInfo and ds-guestinfo-photon.patch
|
||||
* Thu Oct 17 2019 Keerthana K <keerthanak@vmware.com> 19.1-2
|
||||
- Fix to disable custom script by default in DatasourceOVF.
|
||||
- Fix to deactivate custom script by default in DatasourceOVF.
|
||||
- add kubeadm module
|
||||
* Thu Sep 19 2019 Keerthana K <keerthanak@vmware.com> 19.1-1
|
||||
- Update to 19.1
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ Sync {
|
|||
|
||||
#
|
||||
# If the firewall replica goes from primary to backup,
|
||||
# the conntrackd -t command is invoked in the script.
|
||||
# the conntrackd -t command is invoked in the script.
|
||||
# This command schedules a flush of the table in N seconds.
|
||||
# This is useful to purge the connection tracking table of
|
||||
# zombie entries and avoid clashes with old entries if you
|
||||
|
|
@ -50,7 +50,7 @@ Sync {
|
|||
# ACKWindowSize 300
|
||||
|
||||
#
|
||||
# This clause allows you to disable the external cache. Thus,
|
||||
# This clause allows you to deactivate the external cache. Thus,
|
||||
# the state entries are directly injected into the kernel
|
||||
# conntrack table. As a result, you save memory in user-space
|
||||
# but you consume slots in the kernel conntrack table for
|
||||
|
|
@ -74,7 +74,7 @@ Sync {
|
|||
# iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT
|
||||
#
|
||||
Multicast {
|
||||
#
|
||||
#
|
||||
# Multicast address: The address that you use as destination
|
||||
# in the synchronization messages. You do not have to add
|
||||
# this IP to any of your existing interfaces. If any doubt,
|
||||
|
|
@ -125,7 +125,7 @@ Sync {
|
|||
#
|
||||
RcvSocketBuffer 1249280
|
||||
|
||||
#
|
||||
#
|
||||
# Enable/Disable message checksumming. This is a good
|
||||
# property to achieve fault-tolerance. In case of doubt, do
|
||||
# not modify this value.
|
||||
|
|
@ -138,8 +138,8 @@ Sync {
|
|||
# more than one dedicated link does not mean that state-updates will
|
||||
# be sent to all of them. There is only one active dedicated link at
|
||||
# a given moment. The `Default' keyword indicates that this interface
|
||||
# will be selected as the initial dedicated link. You can have
|
||||
# up to 4 redundant dedicated links. Note: Use different multicast
|
||||
# will be selected as the initial dedicated link. You can have
|
||||
# up to 4 redundant dedicated links. Note: Use different multicast
|
||||
# groups for every redundant link.
|
||||
#
|
||||
# Multicast Default {
|
||||
|
|
@ -156,9 +156,9 @@ Sync {
|
|||
# You can use Unicast UDP instead of Multicast to propagate events.
|
||||
# Note that you cannot use unicast UDP and Multicast at the same
|
||||
# time, you can only select one.
|
||||
#
|
||||
#
|
||||
# UDP {
|
||||
#
|
||||
#
|
||||
# UDP address that this firewall uses to listen to events.
|
||||
#
|
||||
# IPv4_address 192.168.2.100
|
||||
|
|
@ -188,7 +188,7 @@ Sync {
|
|||
#
|
||||
# Interface eth2
|
||||
|
||||
#
|
||||
#
|
||||
# The sender socket buffer size
|
||||
#
|
||||
# SndSocketBuffer 1249280
|
||||
|
|
@ -198,18 +198,18 @@ Sync {
|
|||
#
|
||||
# RcvSocketBuffer 1249280
|
||||
|
||||
#
|
||||
# Enable/Disable message checksumming.
|
||||
#
|
||||
# Enable/Disable message checksumming.
|
||||
#
|
||||
# Checksum on
|
||||
# }
|
||||
|
||||
#
|
||||
#
|
||||
# Other unsorted options that are related to the synchronization.
|
||||
#
|
||||
#
|
||||
# Options {
|
||||
#
|
||||
# TCP state-entries have window tracking disabled by default,
|
||||
# TCP state-entries have window tracking deactivated by default,
|
||||
# you can enable it with this option. As said, default is off.
|
||||
# This feature requires a Linux kernel >= 2.6.36.
|
||||
#
|
||||
|
|
@ -256,7 +256,7 @@ General {
|
|||
HashSize 32768
|
||||
|
||||
#
|
||||
# Maximum number of conntracks, it should be double of:
|
||||
# Maximum number of conntracks, it should be double of:
|
||||
# $ cat /proc/sys/net/netfilter/nf_conntrack_max
|
||||
# since the daemon may keep some dead entries cached for possible
|
||||
# retransmission during state synchronization.
|
||||
|
|
@ -277,7 +277,7 @@ General {
|
|||
|
||||
#
|
||||
# Lockfile
|
||||
#
|
||||
#
|
||||
LockFile /var/lock/conntrack.lock
|
||||
|
||||
#
|
||||
|
|
@ -326,7 +326,7 @@ General {
|
|||
#
|
||||
# NetlinkEventsReliable Off
|
||||
|
||||
#
|
||||
#
|
||||
# By default, the daemon receives state updates following an
|
||||
# event-driven model. You can modify this behaviour by switching to
|
||||
# polling mode with the PollSecs clause. This clause tells conntrackd
|
||||
|
|
@ -355,13 +355,13 @@ General {
|
|||
# State. The filter is attached to an action that can be: Accept or
|
||||
# Ignore. Thus, you can define the event filtering policy of the
|
||||
# filter-sets in positive or negative logic depending on your needs.
|
||||
# You can select if conntrackd filters the event messages from
|
||||
# You can select if conntrackd filters the event messages from
|
||||
# user-space or kernel-space. The kernel-space event filtering
|
||||
# saves some CPU cycles by avoiding the copy of the event message
|
||||
# from kernel-space to user-space. The kernel-space event filtering
|
||||
# is prefered, however, you require a Linux kernel >= 2.6.29 to
|
||||
# filter from kernel-space. If you want to select kernel-space
|
||||
# event filtering, use the keyword 'Kernelspace' instead of
|
||||
# filter from kernel-space. If you want to select kernel-space
|
||||
# event filtering, use the keyword 'Kernelspace' instead of
|
||||
# 'Userspace'.
|
||||
#
|
||||
Filter From Userspace {
|
||||
|
|
@ -403,7 +403,7 @@ General {
|
|||
#
|
||||
# Uncomment this line below if you want to filter by flow state.
|
||||
# This option introduces a trade-off in the replication: it
|
||||
# reduces CPU consumption at the cost of having lazy backup
|
||||
# reduces CPU consumption at the cost of having lazy backup
|
||||
# firewall replicas. The existing TCP states are: SYN_SENT,
|
||||
# SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK,
|
||||
# TIME_WAIT, CLOSED, LISTEN.
|
||||
|
|
|
|||
|
|
@ -395,7 +395,7 @@ integrity of the free software distribution system which is
|
|||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
system; it is up to the author/donor to decide if they are willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
|
|
|
|||
|
|
@ -745,7 +745,7 @@ tsrc_file
|
|||
- reenable checks on s390x
|
||||
|
||||
* Sat Jan 11 2003 Karsten Hopp <karsten@redhat.de> 0.72-3
|
||||
- temporarily disable checks on s390x, until someone has
|
||||
- temporarily deactivate checks on s390x, until someone has
|
||||
time to look at it
|
||||
|
||||
* Thu Dec 12 2002 Jakub Jelinek <jakub@redhat.com> 0.72-2
|
||||
|
|
|
|||
|
|
@ -102,7 +102,7 @@ rm -rf %{buildroot}/*
|
|||
* Sun Aug 27 2017 Vinay Kulkarni <kulkarniv@vmware.com> 3.1.5-3
|
||||
- File based configuration for etcd service.
|
||||
* Wed May 31 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 3.1.5-2
|
||||
- Provide preset file to disable service by default
|
||||
- Provide preset file to deactivate service by default
|
||||
* Thu Apr 06 2017 Anish Swaminathan <anishs@vmware.com> 3.1.5-1
|
||||
- Upgraded to version 3.1.5, build from sources
|
||||
* Fri Sep 2 2016 Xiaolin Li <xiaolinl@vmware.com> 3.0.9-1
|
||||
|
|
|
|||
|
|
@ -229,7 +229,7 @@ fi
|
|||
* Mon Jul 24 2017 Anish Swaminathan <anishs@vmware.com> 2.4.27-1
|
||||
- Updated to version 2.4.27 - Fixes CVE-2017-3167
|
||||
* Wed May 31 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 2.4.25-3
|
||||
- Provide preset file to disable service by default.
|
||||
- Provide preset file to deactivate service by default.
|
||||
* Fri Mar 31 2017 Dheeraj Shetty <dheerajs@vmware.com> 2.4.25-2
|
||||
- Fixing httpd.pid file write issue
|
||||
* Fri Mar 31 2017 Dheeraj Shetty <dheerajs@vmware.com> 2.4.25-1
|
||||
|
|
|
|||
|
|
@ -178,7 +178,7 @@ function create_bond {
|
|||
echo configuring $secondary
|
||||
create_eth_cfg_$distro $secondary $bondname
|
||||
|
||||
echo creating: $bondname with primary slave: $primary
|
||||
echo creating: $bondname with primary secondary: $primary
|
||||
create_bond_cfg_$distro $bondname $primary $secondary
|
||||
|
||||
let bondcnt=bondcnt+1
|
||||
|
|
@ -190,4 +190,4 @@ do
|
|||
then
|
||||
create_bond ${list_eth[$i]} ${list_match[$i]}
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
|
|
|||
|
|
@ -10,14 +10,14 @@ modprobe xt_LOG
|
|||
# Enable broadcast echo Protection
|
||||
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
|
||||
|
||||
# Disable Source Routed Packets
|
||||
# deactivate Source Routed Packets
|
||||
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
|
||||
echo 0 > /proc/sys/net/ipv4/conf/default/accept_source_route
|
||||
|
||||
# Enable TCP SYN Cookie Protection
|
||||
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
|
||||
|
||||
# Disable ICMP Redirect Acceptance
|
||||
# deactivate ICMP Redirect Acceptance
|
||||
echo 0 > /proc/sys/net/ipv4/conf/default/accept_redirects
|
||||
|
||||
# Do not send Redirect Messages
|
||||
|
|
@ -36,7 +36,7 @@ echo 1 > /proc/sys/net/ipv4/conf/default/log_martians
|
|||
# be verbose on dynamic ip-addresses (not needed in case of static IP)
|
||||
echo 2 > /proc/sys/net/ipv4/ip_dynaddr
|
||||
|
||||
# disable Explicit Congestion Notification
|
||||
# deactivate Explicit Congestion Notification
|
||||
# too many routers are still ignorant
|
||||
echo 0 > /proc/sys/net/ipv4/tcp_ecn
|
||||
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ install -vDm 644 src/bin/*.{rom,mrom} %{buildroot}/usr/share/ipxe/
|
|||
* Wed Aug 08 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> d2063b7-1
|
||||
- Update version to get it to build with gcc 7.3
|
||||
* Tue Apr 25 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 553f485-2
|
||||
- disable debuginfo gen
|
||||
- deactivate debuginfo gen
|
||||
* Mon Mar 13 2017 Alexey Makhalov <amakhalov@vmware.com> 553f485-1
|
||||
- Version update to build with gcc-6.3
|
||||
- Removed linux/linux-devel build-time dependency
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
#need to disable debuginfo till we bring in x11 deps
|
||||
#need to deactivate debuginfo till we bring in x11 deps
|
||||
%define debug_package %{nil}
|
||||
|
||||
Summary: Java Native Access
|
||||
|
|
@ -109,7 +109,7 @@ ant
|
|||
* Thu May 18 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 4.4.0-4
|
||||
- Renamed openjdk to openjdk8
|
||||
* Tue Apr 25 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 4.4.0-3
|
||||
- disable debuginfo temporarily - wait for x11 deps
|
||||
- deactivate debuginfo temporarily - wait for x11 deps
|
||||
* Tue Apr 04 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 4.4.0-2
|
||||
- use java rpm macros to determine versions
|
||||
* Mon Apr 03 2017 Divya Thaluru <dthaluru@vmware.com> 4.4.0-1
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ install -p -D -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/%{name}.service
|
|||
rm -rf %{buildroot}%{_sysconfdir}/%{name}/samples/*
|
||||
|
||||
%check
|
||||
# A build could silently have LVS support disabled if the kernel includes can't
|
||||
# A build could silently have LVS support deactivated if the kernel includes can't
|
||||
# be properly found, we need to avoid that.
|
||||
if ! grep -q "#define _WITH_LVS_ *1" lib/config.h; then
|
||||
%{__echo} "ERROR: We do not want keepalived lacking LVS support."
|
||||
|
|
|
|||
|
|
@ -143,7 +143,7 @@ rm -rf %{buildroot}/*
|
|||
* Thu Sep 28 2017 Xiaolin Li <xiaolinl@vmware.com> 1.15.2-1
|
||||
- Update to version 1.15.2
|
||||
* Mon Jul 10 2017 Alexey Makhalov <amakhalov@vmware.com> 1.15.1-2
|
||||
- Fix make check: add /etc/hosts entry, disable parallel check
|
||||
- Fix make check: add /etc/hosts entry, deactivate parallel check
|
||||
* Mon Apr 03 2017 Divya Thaluru <dthaluru@vmware.com> 1.15.1-1
|
||||
- Updated to version 1.51.1
|
||||
* Wed Nov 23 2016 Alexey Makhalov <amakhalov@vmware.com> 1.14-6
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ ktap is a new scripting dynamic tracing tool for Linux, it uses a scripting lang
|
|||
|
||||
%build
|
||||
make ktap
|
||||
# ugly hack: disable security hardening to build kernel module
|
||||
# ugly hack: deactivate security hardening to build kernel module
|
||||
# we need to remove sec hard specs file for that.
|
||||
rm -f `dirname $(gcc --print-libgcc-file-name)`/../specs
|
||||
#make KVERSION=%{KERNEL_VERSION}-%{KERNEL_RELEASE} mod
|
||||
|
|
@ -52,7 +52,7 @@ install -vm 755 ktap %{buildroot}%{_bindir}/
|
|||
|
||||
%changelog
|
||||
* Fri Sep 11 2020 Bo Gan <ganb@vmware.com> 0.4-rc1
|
||||
- Temporarily disable kernel module build in preparation for kernel update
|
||||
- Temporarily deactivate kernel module build in preparation for kernel update
|
||||
* Tue Dec 26 2017 Alexey Makhalov <amakhalov@vmware.com> 0.4-8
|
||||
- Update to linux-4.14.y. Added support patch
|
||||
* Fri Jun 09 2017 Chang Lee <changlee@vmware.com> 0.4-7
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ BuildRequires: libmnl-devel
|
|||
BuildRequires: linux-api-headers
|
||||
|
||||
%description
|
||||
libnetfilter_cthelper is the userspace library that provides the programming interface to the user-space helper infrastructure available since Linux kernel 3.6. With this library, you register, configure, enable and disable user-space helpers.
|
||||
libnetfilter_cthelper is the userspace library that provides the programming interface to the user-space helper infrastructure available since Linux kernel 3.6. With this library, you register, configure, enable and deactivate user-space helpers.
|
||||
|
||||
%package devel
|
||||
Summary: Development files for %{name}
|
||||
|
|
|
|||
|
|
@ -85,7 +85,7 @@ make install DESTDIR=%{buildroot}
|
|||
* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.0.1-3
|
||||
- GA - Bump release of all rpms
|
||||
* Mon Feb 08 2016 Anish Swaminathan <anishs@vmware.com> 1.0.1-2
|
||||
- Added patch for bindresvport blacklist
|
||||
- Added patch for bindresvport denylist
|
||||
* Fri Jan 15 2016 Xiaolin Li <xiaolinl@vmware.com> 1.0.1-1
|
||||
- Updated to version 1.0.1
|
||||
* Thu Jul 23 2015 Divya Thaluru <dthaluru@vmware.com> 0.3.2-1
|
||||
|
|
|
|||
|
|
@ -1461,6 +1461,6 @@ mkdir -p %{buildroot}/opt/vmware/share/config
|
|||
* Tue Jun 06 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.2.1-3
|
||||
- fix domainjoin and allow publish of oidc xml
|
||||
* Thu Jun 01 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 1.2.1-2
|
||||
- disable java macros and use java alternatives
|
||||
- deactivate java macros and use java alternatives
|
||||
* Mon May 22 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.2.1-1
|
||||
- Initial - spec modified for Photon from lightwave git repo.
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ make DESTDIR=%{buildroot} install
|
|||
%postun -p /sbin/ldconfig
|
||||
|
||||
%check
|
||||
# disable security hardening for tests
|
||||
# deactivate security hardening for tests
|
||||
rm -f $(dirname $(gcc -print-libgcc-file-name))/../specs
|
||||
cd build
|
||||
make %{?_smp_mflags} check-llvm
|
||||
|
|
|
|||
|
|
@ -133,7 +133,7 @@ fi
|
|||
- Use system installed rpcgen
|
||||
* Fri Sep 21 2018 Alexey Makhalov <amakhalov@vmware.com> 2.3.3-2
|
||||
- Fix compilation issue against glibc-2.28
|
||||
- Use internal rpcgen, disable librpcsecgss dependency.
|
||||
- Use internal rpcgen, deactivate librpcsecgss dependency.
|
||||
* Mon Sep 10 2018 Him Kalyan Bordoloi <bordoloih@vmware.com> 2.3.3-1
|
||||
- Update to 2.3.3
|
||||
* Thu Jun 07 2018 Anish Swaminathan <anishs@vmware.com> 2.3.1-2
|
||||
|
|
|
|||
|
|
@ -76,7 +76,7 @@ find %{buildroot} -name '*.la' -delete
|
|||
|
||||
#%check
|
||||
#make check need BuildRequires per-XML-XPATH and bzip2
|
||||
#no per-XML-XPATH so disable make check
|
||||
#no per-XML-XPATH so deactivate make check
|
||||
#make %{?_smp_mflags} -k check
|
||||
|
||||
%files
|
||||
|
|
@ -121,7 +121,7 @@ find %{buildroot} -name '*.la' -delete
|
|||
* Mon Sep 10 2018 Him Kalyan Bordoloi <bordoloih@vmware.com> 1.2.17-1
|
||||
- Update to 1.2.17
|
||||
* Thu Aug 10 2017 Rongrong Qiu <rqiu@vmware.com> 1.2.14-3
|
||||
- Disable make check which need per-XML-XPATH for bug 1900358
|
||||
- Deactivate make check which need per-XML-XPATH for bug 1900358
|
||||
* Fri May 5 2017 Alexey Makhalov <amakhalov@vmware.com> 1.2.14-2
|
||||
- Remove BuildRequires XML-XPath.
|
||||
* Mon Mar 27 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.2.14-1
|
||||
|
|
|
|||
|
|
@ -24,6 +24,6 @@ popd
|
|||
touch DELETE_ME_TO_DISABLE_CONSOLEHOST_TELEMETRY
|
||||
dotnet publish /property:GenerateFullPaths=true --configuration Linux --framework net5.0 --runtime linux-x64 src/powershell-unix --output bin
|
||||
|
||||
# Even after powershell rpm built, dotnet processes are alive, following to kill them:
|
||||
# Even after powershell rpm built, dotnet processes are alive, following to stop them:
|
||||
killall -15 dotnet
|
||||
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ gem install -V --local --force --install-dir %{buildroot}/%{gemdir} %{SOURCE0}
|
|||
cd %{buildroot}%{gemdir}/gems/backports-%{version}
|
||||
# Removal of alias_method_chain method in Rails 5.1 version creates issue
|
||||
# since the existing testsuite doesn't reflect the change. To avoid rake
|
||||
# to abort and continue the tests following fix is done.
|
||||
# to stop and continue the tests following fix is done.
|
||||
# ref: https://github.com/marcandre/backports/issues/114
|
||||
sed -i "s/^/#/" lib/backports/rails/module.rb
|
||||
rake test
|
||||
|
|
|
|||
|
|
@ -7,11 +7,11 @@ auth optional pam_faildelay.so delay=3000000
|
|||
auth requisite pam_nologin.so
|
||||
|
||||
# Check to make sure that root is allowed to login
|
||||
# Disabled by default. You will need to create /etc/securetty
|
||||
# Deactivated by default. You will need to create /etc/securetty
|
||||
# file for this module to function. See man 5 securetty.
|
||||
#auth required pam_securetty.so
|
||||
|
||||
# Additional group memberships - disabled by default
|
||||
# Additional group memberships - deactivated by default
|
||||
#auth optional pam_group.so
|
||||
|
||||
# include the default auth settings
|
||||
|
|
@ -29,13 +29,13 @@ session required pam_env.so
|
|||
# Set resource limits for the user
|
||||
session required pam_limits.so
|
||||
|
||||
# Display date of last login - Disabled by default
|
||||
# Display date of last login - Deactivated by default
|
||||
#session optional pam_lastlog.so
|
||||
|
||||
# Display the message of the day - Disabled by default
|
||||
# Display the message of the day - Deactivated by default
|
||||
#session optional pam_motd.so
|
||||
|
||||
# Check user's mail - Disabled by default
|
||||
# Check user's mail - Deactivated by default
|
||||
#session optional pam_mail.so standard quiet
|
||||
|
||||
# include the default session and password settings
|
||||
|
|
|
|||
|
|
@ -715,7 +715,7 @@ udevadm hwdb --update &>/dev/null || :
|
|||
* Thu Nov 09 2017 Vinay Kulkarni <kulkarniv@vmware.com> 233-11
|
||||
- Fix CVE-2017-15908 dns packet loop fix.
|
||||
* Tue Nov 07 2017 Vinay Kulkarni <kulkarniv@vmware.com> 233-10
|
||||
- Fix nullptr access during link disable.
|
||||
- Fix nullptr access during link deactivate.
|
||||
* Mon Sep 18 2017 Anish Swaminathan <anishs@vmware.com> 233-9
|
||||
- Backport router solicitation backoff from systemd 234
|
||||
* Fri Sep 15 2017 Anish Swaminathan <anishs@vmware.com> 233-8
|
||||
|
|
@ -765,7 +765,7 @@ udevadm hwdb --update &>/dev/null || :
|
|||
* Fri Jun 17 2016 Vinay Kulkarni <kulkarniv@vmware.com> 228-23
|
||||
- systemd-resolved: Configure initial DNS servers from environment var.
|
||||
* Mon Jun 06 2016 Alexey Makhalov <amakhalov@vmware.com> 228-22
|
||||
- systemd-resolved: disable LLMNR
|
||||
- systemd-resolved: deactivate LLMNR
|
||||
* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 228-21
|
||||
- GA - Bump release of all rpms
|
||||
* Tue May 17 2016 Anish Swaminathan <anishs@vmware.com> 228-20
|
||||
|
|
@ -777,7 +777,7 @@ udevadm hwdb --update &>/dev/null || :
|
|||
* Thu Apr 21 2016 Mahmoud Bassiouny <mbassiouny@vmware.com> 228-17
|
||||
- Set the default.target to the multi-user.target
|
||||
* Tue Apr 12 2016 Vinay Kulkarni <kulkarniv@vmware.com> 228-16
|
||||
- Disable network interface renaming.
|
||||
- Deactivate network interface renaming.
|
||||
* Thu Mar 31 2016 Vinay Kulkarni <kulkarniv@vmware.com> 228-15
|
||||
- Patch to query DHCP DUID, IAID.f
|
||||
* Wed Mar 30 2016 Vinay Kulkarni <kulkarniv@vmware.com> 228-14
|
||||
|
|
|
|||
|
|
@ -141,7 +141,7 @@ make test
|
|||
* Thu Apr 29 2021 Gerrit Photon <photon-checkins@vmware.com> 2.15.0-1
|
||||
- Automatic Version Bump
|
||||
* Fri Oct 09 2020 svasamsetty <svasamsetty@vmware.com> 2.14.0-3
|
||||
- Re-enable tuned as it was disabled due to openssl 1.1.1
|
||||
- Re-enable tuned as it was deactivated due to openssl 1.1.1
|
||||
* Wed Sep 23 2020 Him Kalyan Bordoloi <bordoloih@vmware.com> 2.14.0-2
|
||||
- Bootloader plugin support for Photon
|
||||
- sysctl plugin verify bug fix
|
||||
|
|
|
|||
|
|
@ -106,7 +106,7 @@ fi
|
|||
* Thu Jun 01 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 3.4.10-4
|
||||
- Renamed openjdk to openjdk8.
|
||||
* Wed May 31 2017 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 3.4.10-3
|
||||
- Provide preset to disable service by default
|
||||
- Provide preset to deactivate service by default
|
||||
* Wed May 24 2017 Xiaolin Li <xiaolinl@vmware.com> 3.4.10-2
|
||||
- Used RuntimeDirectory to create folder /var/run/zookeeper.
|
||||
* Wed Apr 05 2017 Xiaolin Li <xiaolinl@vmware.com> 3.4.10-1
|
||||
|
|
|
|||
|
|
@ -75,7 +75,7 @@ zstyle ':completion:*:*:*:*:*' menu select
|
|||
zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#) ([0-9a-z-]#)*=01;34=0=01'
|
||||
zstyle ':completion:*:*:*:*:processes' command "ps -u `whoami` -o pid,user,comm -w -w"
|
||||
|
||||
# disable named-directories autocompletion
|
||||
# deactivate named-directories autocompletion
|
||||
zstyle ':completion:*:cd:*' tag-order local-directories directory-stack path-directories
|
||||
cdpath=(.)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,18 +1,18 @@
|
|||
# Contributing
|
||||
|
||||
The Photon OS project team welcomes contributions from the community.
|
||||
The Photon OS project team welcomes contributions from the community.
|
||||
|
||||
If you wish to contribute code and you have not signed our Contributor License Agreement (CLA), our CLA-bot will take you through the process and update the issue when you open a [Pull Request](https://help.github.com/articles/creating-a-pull-request). If you have questions about the CLA process, see our CLA [FAQ](https://cla.vmware.com/faq) or contact us through the GitHub issue tracker.
|
||||
|
||||
This page presents guidelines for contributing to Photon OS. Following the guidelines helps to make the contribution process easy, collaborative, and productive.
|
||||
This page presents guidelines for contributing to Photon OS. Following the guidelines helps to make the contribution process easy, collaborative, and productive.
|
||||
|
||||
## Submitting Bug Reports and Feature Requests
|
||||
|
||||
Please submit bug reports and feature requests by using our GitHub [Issues](https://github.com/vmware/photon/issues) page.
|
||||
|
||||
Before you submit a bug report about the code in the repository, please check the Issues page to see whether someone has already reported the problem. In the bug report, be as specific as possible about the error and the conditions under which it occurred. On what version and build did it occur? What are the steps to reproduce the bug?
|
||||
Before you submit a bug report about the code in the repository, please check the Issues page to see whether someone has already reported the problem. In the bug report, be as specific as possible about the error and the conditions under which it occurred. On what version and build did it occur? What are the steps to reproduce the bug?
|
||||
|
||||
Feature requests should fall within the scope of the project. Keep in mind that Photon OS is intended to be a minimalist Linux operating system geared toward hosting containerized applications and cloud-native applications.
|
||||
Feature requests should fall within the scope of the project. Keep in mind that Photon OS is intended to be a minimalist Linux operating system geared toward hosting containerized applications and cloud-native applications.
|
||||
|
||||
## Pull Requests
|
||||
|
||||
|
|
@ -22,9 +22,9 @@ Before submitting a pull request, please make sure that you can build Photon OS.
|
|||
|
||||
### Upgrade
|
||||
|
||||
If you have specs with scripts in `%pre`, `%post`, `%preun`, or `%postun`, make sure that you have code that is in appropriate sections for upgrade and install.
|
||||
If you have specs with scripts in `%pre`, `%post`, `%preun`, or `%postun`, make sure that you have code that is in appropriate sections for upgrade and install.
|
||||
|
||||
%pre
|
||||
%pre
|
||||
|
||||
# First argument is 1 => New Installation
|
||||
# First argument is 2 => Upgrade
|
||||
|
|
@ -37,7 +37,7 @@ If you have specs with scripts in `%pre`, `%post`, `%preun`, or `%postun`, make
|
|||
;;
|
||||
esac
|
||||
|
||||
%post
|
||||
%post
|
||||
|
||||
# First argument is 1 => New Installation
|
||||
# First argument is 2 => Upgrade
|
||||
|
|
@ -50,7 +50,7 @@ If you have specs with scripts in `%pre`, `%post`, `%preun`, or `%postun`, make
|
|||
;;
|
||||
esac
|
||||
|
||||
%preun
|
||||
%preun
|
||||
|
||||
# First argument is 0 => Uninstall
|
||||
# First argument is 1 => Upgrade
|
||||
|
|
@ -63,7 +63,7 @@ If you have specs with scripts in `%pre`, `%post`, `%preun`, or `%postun`, make
|
|||
;;
|
||||
esac
|
||||
|
||||
%postun
|
||||
%postun
|
||||
|
||||
# First argument is 0 => Uninstall
|
||||
# First argument is 1 => Upgrade
|
||||
|
|
@ -78,15 +78,15 @@ If you have specs with scripts in `%pre`, `%post`, `%preun`, or `%postun`, make
|
|||
|
||||
### Systemd Macros
|
||||
|
||||
To enable or disable a service in `post`, `preun`, `postun` sections, you can use the following macros.
|
||||
To enable or deactivate a service in `post`, `preun`, `postun` sections, you can use the following macros.
|
||||
|
||||
%post %systemd_post cloud-config.service //enables service
|
||||
%post %systemd_post cloud-config.service //enables service
|
||||
|
||||
%preun %systemd_preun cloud-final.service //disables service
|
||||
%preun %systemd_preun cloud-final.service //deactivates service
|
||||
|
||||
%postun %systemd_postun cloud-init.service //it does not do anything
|
||||
%postun %systemd_postun cloud-init.service //it does not do anything
|
||||
|
||||
Expansion of these macros:
|
||||
Expansion of these macros:
|
||||
|
||||
%systemd_post() \
|
||||
if [ $1 -eq 1 ] ; then \
|
||||
|
|
@ -104,6 +104,6 @@ Expansion of these macros:
|
|||
|
||||
%systemd_postun() %{nil}
|
||||
|
||||
Note: The `systemd_postun` macro does not do anything. The `systemd_preun` macro disables the service, while `systemd_post` macro enables the service.
|
||||
Note: The `systemd_postun` macro does not do anything. The `systemd_preun` macro deactivates the service, while `systemd_post` macro enables the service.
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# Disabling the Photon OS httpd.service
|
||||
# Disabling the Photon OS httpd.service
|
||||
|
||||
If your application or appliance includes its own HTTP server, you must turn off and disable the HTTP server that comes with Photon OS so that it does not conflict with your own HTTP server.
|
||||
If your application or appliance includes its own HTTP server, you must turn off and deactivate the HTTP server that comes with Photon OS so that it does not conflict with your own HTTP server.
|
||||
|
||||
To stop it and deactivate it, run the following commands as root:
|
||||
|
||||
To stop it and disable it, run the following commands as root:
|
||||
|
||||
|
||||
```
|
||||
systemctl stop httpd.service
|
||||
systemctl disable httpd.service
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
# Disabling TLS 1.0 to Improve Transport Layer Security
|
||||
|
||||
Photon OS includes GnuTLS to help secure the transport layer. [GnuTLS](http://www.gnutls.org/) is a library that implements the SSL and TLS protocols to secure communications.
|
||||
Photon OS includes GnuTLS to help secure the transport layer. [GnuTLS](http://www.gnutls.org/) is a library that implements the SSL and TLS protocols to secure communications.
|
||||
|
||||
On Photon OS, SSL 3.0, which contains a known vulnerability, is disabled by default.
|
||||
On Photon OS, SSL 3.0, which contains a known vulnerability, is deactivated by default.
|
||||
|
||||
However, TLS 1.0, which also contains known vulnerabilities, is enabled by default.
|
||||
|
||||
|
|
@ -12,9 +12,9 @@ To turn off TLS 1.0, perform the follwoing steps:
|
|||
1. Create a directory named `/etc/gnutls`.
|
||||
1. In `/etc/gnutls` create a file named `default-priorities`.
|
||||
1. In the `default-priorities` file, specify GnuTLS priority strings that remove TLS 1.0 and SSL 3.0 but retain TLS 1.1 and TLS 1.2.
|
||||
1. After adding a new `default-priorities` file or after modifying it, you must restart all applications, including SSH, with an open TLS session for the changes to take effect.
|
||||
1. After adding a new `default-priorities` file or after modifying it, you must restart all applications, including SSH, with an open TLS session for the changes to take effect.
|
||||
|
||||
The following is an example of a `default-priorities` file that contains GnuTLS priorities to disable TLS 1.0 and SSL 3.0:
|
||||
The following is an example of a `default-priorities` file that contains GnuTLS priorities to deactivate TLS 1.0 and SSL 3.0:
|
||||
|
||||
cat /etc/gnutls/default-priorities
|
||||
SYSTEM=NONE:!VERS-SSL3.0:!VERS-TLS1.0:+VERS-TLS1.1:+VERS-TLS1.2:+AES-128-CBC:+RSA:+SHA1:+COMP-NULL
|
||||
|
|
@ -23,14 +23,14 @@ In this example, the priority string imposes system-specific policies. The `NONE
|
|||
|
||||
On Photon OS, you can verify the system-specific policies in the `default-priorities` file as follows:
|
||||
|
||||
1. Concatenate the `default-priorities` file to check its contents:
|
||||
|
||||
1. Concatenate the `default-priorities` file to check its contents:
|
||||
|
||||
```
|
||||
root@photon-rc [ ~ ]# cat /etc/gnutls/default-priorities
|
||||
SYSTEM=NONE:!VERS-SSL3.0:!VERS-TLS1.0:+VERS-TLS1.1:+VERS-TLS1.2:+AES-128-CBC:+RSA:+SHA1:+COMP-NULL
|
||||
```
|
||||
|
||||
1. Run the following command to check the protocols that are enabled for the system:
|
||||
1. Run the following command to check the protocols that are enabled for the system:
|
||||
|
||||
```
|
||||
root@photon-rc [ /etc/gnutls ]# gnutls-cli --priority @SYSTEM -l
|
||||
|
|
|
|||
|
|
@ -2,14 +2,14 @@
|
|||
|
||||
Before you install Sendmail, you should set the fully qualified domain name (FQDN) of your Photon OS machine.
|
||||
|
||||
By default, Sendmail is not installed with either the minimal or full version of Photon OS. When you install Sendmail, it provides Photon OS with a `systemd` service file that typically enables Sendmail. If the service is not enabled after installation, you must enable it.
|
||||
By default, Sendmail is not installed with either the minimal or full version of Photon OS. When you install Sendmail, it provides Photon OS with a `systemd` service file that typically enables Sendmail. If the service is not enabled after installation, you must enable it.
|
||||
|
||||
Sendmail resides in the Photon extras repository. You can install it with `tdnf` after setting the machine's FQDN.
|
||||
Sendmail resides in the Photon extras repository. You can install it with `tdnf` after setting the machine's FQDN.
|
||||
|
||||
## Procedure
|
||||
|
||||
1. Check whether the FQDN of the machine is set by running the `hostnamectl status` command:
|
||||
|
||||
1. Check whether the FQDN of the machine is set by running the `hostnamectl status` command:
|
||||
|
||||
```
|
||||
hostnamectl status
|
||||
Static hostname: photon-d9ee400e194e
|
||||
|
|
@ -23,16 +23,16 @@ hostnamectl status
|
|||
Architecture: x86-64
|
||||
```
|
||||
|
||||
In the results above, the FQDN is not set. The Photon OS machine only has a short name. If the FQDN were set, the hostname would be in its full form, typically with a domain name.
|
||||
|
||||
1. If the machine does not have an FQDN, set one by running `hostnamectl set-hostname new-name`, replacing `new-name` with the FQDN that you want. For example:
|
||||
|
||||
In the results above, the FQDN is not set. The Photon OS machine only has a short name. If the FQDN were set, the hostname would be in its full form, typically with a domain name.
|
||||
|
||||
1. If the machine does not have an FQDN, set one by running `hostnamectl set-hostname new-name`, replacing `new-name` with the FQDN that you want. For example:
|
||||
|
||||
```
|
||||
hostnamectl set-hostname photon-d9ee400e194e.corp.example.com
|
||||
```
|
||||
|
||||
The `hostnamectl status` command now shows that the machine has an FQDN:
|
||||
|
||||
The `hostnamectl status` command now shows that the machine has an FQDN:
|
||||
|
||||
```
|
||||
root@photon-d9ee400e194e [ ~ ]# hostnamectl status
|
||||
Static hostname: photon-d9ee400e194e.corp.example.com
|
||||
|
|
@ -46,20 +46,20 @@ root@photon-d9ee400e194e [ ~ ]# hostnamectl status
|
|||
Architecture: x86-64
|
||||
```
|
||||
|
||||
1. Install Sendmail:
|
||||
|
||||
1. Install Sendmail:
|
||||
|
||||
```
|
||||
tdnf install sendmail
|
||||
```
|
||||
|
||||
1. Verify if Sendmail is enabled:
|
||||
|
||||
1. Verify if Sendmail is enabled:
|
||||
|
||||
```
|
||||
systemctl status sendmail
|
||||
```
|
||||
|
||||
1. Enable Sendmail if it is disabled and then start it:
|
||||
|
||||
1. Enable Sendmail if it is deactivated and then start it:
|
||||
|
||||
```
|
||||
systemctl enable sendmail
|
||||
systemctl start sendmail
|
||||
|
|
|
|||
|
|
@ -653,8 +653,8 @@ uint32_t
|
|||
**Arguments**
|
||||
|
||||
- ``pszInterfaceName`` - interface name
|
||||
- ``enableDhcp`` - enable (1) or disable (0) DHCP; enabling configures the interface to acquire a DHCP IPv6 address.
|
||||
- ``enableAutoconf`` - enable (1) or disable (0) autoconf; enabling configures the interface to acquire a stateless autoconfiguration IPv6 address.
|
||||
- ``enableDhcp`` - enable (1) or deactivate (0) DHCP; enabling configures the interface to acquire a DHCP IPv6 address.
|
||||
- ``enableAutoconf`` - enable (1) or deactivate (0) autoconf; enabling configures the interface to acquire a stateless autoconfiguration IPv6 address.
|
||||
|
||||
**Returns**
|
||||
|
||||
|
|
@ -679,8 +679,8 @@ Get the mode for the interface.
|
|||
**Arguments**
|
||||
|
||||
- ``pszInterfaceName`` - interface name
|
||||
- ``pDhcpEnabled`` - returns whether IPv6 DHCP is enabled (1) or disabled (0).
|
||||
- ``pAutoconfEnabled`` - returns whether IPv6 stateless autoconfiguration is enabled (1) or disabled (0).
|
||||
- ``pDhcpEnabled`` - returns whether IPv6 DHCP is enabled (1) or deactivated (0).
|
||||
- ``pAutoconfEnabled`` - returns whether IPv6 stateless autoconfiguration is enabled (1) or deactivated (0).
|
||||
|
||||
**Returns**
|
||||
|
||||
|
|
@ -1584,4 +1584,4 @@ Restart the NTP service.
|
|||
**Returns**
|
||||
|
||||
- success: 0
|
||||
- failure: error code
|
||||
- failure: error code
|
||||
|
|
|
|||
|
|
@ -378,7 +378,7 @@ net.get_ipv6_addr(ifname = interface_name)
|
|||
|
||||
### get_ipv6_addr_mode
|
||||
|
||||
Get the address mode for the specified interface to determine whether DHCPv6, autoconf are enabled or disabled.
|
||||
Get the address mode for the specified interface to determine whether DHCPv6, autoconf are enabled or deactivated.
|
||||
|
||||
**Syntax**
|
||||
````
|
||||
|
|
@ -390,7 +390,7 @@ net.get_ipv6_addr_mode(ifname = interface_name)
|
|||
|
||||
**Returns**
|
||||
|
||||
- Status for DHCPv6, autoconf (True=enabled, False=disabled)
|
||||
- Status for DHCPv6, autoconf (True=enabled, False=deactivated)
|
||||
- failure: exception
|
||||
|
||||
### get_ipv6_gateway
|
||||
|
|
@ -441,8 +441,8 @@ net.set_ipv6_addr_mode(ifname = interface_name, enable_dhcp = [True, False], ena
|
|||
**Parameters**
|
||||
|
||||
- ``ifname`` - interface name
|
||||
- ``enable_dhcp`` - True to enable, False to disable
|
||||
- ``enable_autoconf`` - True to enable, False to disable
|
||||
- ``enable_dhcp`` - True to enable, False to deactivate
|
||||
- ``enable_autoconf`` - True to enable, False to deactivate
|
||||
|
||||
**Returns**
|
||||
|
||||
|
|
|
|||
|
|
@ -15,10 +15,10 @@ root@photon [ /home/sus ]# networkctl reconfigure eth0
|
|||
- The options mentioned in the configuration files are case sensitive.
|
||||
- Set `DHCP=yes` to accept IPv4 and IPv6 DHCP requests.
|
||||
- Set `DHCP=ipv4` to accept IPv4 DHCP requests.
|
||||
- Set LinkLocalAddressing=no to disable IPv6. Please do not disable IPv6 via sysctl. When `LinkLocalAddressing=no` in the .network file, the kernel drops addresses starting with **fe80**, for example **fe80::20c:29ff:fe4c:7eca**. If IPv6LL address is not available networkd will not start IPv6 configurations.
|
||||
- Set LinkLocalAddressing=no to deactivate IPv6. Please do not deactivate IPv6 via sysctl. When `LinkLocalAddressing=no` in the .network file, the kernel drops addresses starting with **fe80**, for example **fe80::20c:29ff:fe4c:7eca**. If IPv6LL address is not available networkd will not start IPv6 configurations.
|
||||
|
||||
|
||||
To link network configurations using DHCPv4 (IPv6 disabled), run the following command:
|
||||
To link network configurations using DHCPv4 (IPv6 deactivated), run the following command:
|
||||
```
|
||||
/etc/systemd/network/20-eth0.network
|
||||
[Match]
|
||||
|
|
|
|||
|
|
@ -116,7 +116,7 @@ You can configure Journald using the conf file located at **/etc/systemd/journal
|
|||
#LineMax=48K
|
||||
root@photon-4a0e7f2307d4 [ ~ ]#
|
||||
```
|
||||
By default `rotate` is disable in Photon. Once the changes are made to the conf file, for the changes to take effect you must restart the systemd-journald by running the `systemctl restart systemd-journald` command.
|
||||
By default `rotate` is deactivate in Photon. Once the changes are made to the conf file, for the changes to take effect you must restart the systemd-journald by running the `systemctl restart systemd-journald` command.
|
||||
|
||||
##Cloud-init Logs
|
||||
Cloud-init is the industry standard multi-distribution method for cross-platform cloud instance initialisation.
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ To manage the services run the following commands:
|
|||
- `systemctl status unit` : This command displays the status of a unit.
|
||||
- `systemctl enable unit` : This command enables a unit to run on startup.
|
||||
- `systemctl enable --now unit` : This command enables a unit to run on startup and start immediately.
|
||||
- `systemctl disable unit` : This command disables a unit and removes it from the startup program.
|
||||
- `systemctl disable unit` : This command deactivates a unit and removes it from the startup program.
|
||||
- `systemctl mask unit` : This command masks a unit to make it impossible to start.
|
||||
- `systemctl unmask unit` : This command unmasks a unit.
|
||||
|
||||
|
|
|
|||
|
|
@ -118,7 +118,7 @@ You can configure Journald using the conf file located at **/etc/systemd/journal
|
|||
#LineMax=48K
|
||||
root@photon-4a0e7f2307d4 [ ~ ]#
|
||||
```
|
||||
By default `rotate` is disable in Photon. Once the changes are made to the conf file, for the changes to take effect you must restart the systemd-journald by running the `systemctl restart systemd-journald` command.
|
||||
By default `rotate` is deactivate in Photon. Once the changes are made to the conf file, for the changes to take effect you must restart the systemd-journald by running the `systemctl restart systemd-journald` command.
|
||||
|
||||
##Cloud-init Logs
|
||||
Cloud-init is the industry standard multi-distribution method for cross-platform cloud instance initialisation.
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
set -o errexit # exit if error...insurance ;)
|
||||
set -o nounset # exit if variable not initalized
|
||||
set +h # disable hashall
|
||||
set +h # deactivate hashall
|
||||
SCRIPT_PATH=$(dirname $(realpath -s $0))
|
||||
|
||||
BUILDROOT=$1
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
set -o errexit # exit if error...insurance ;)
|
||||
set -o nounset # exit if variable not initalized
|
||||
set +h # disable hashall
|
||||
set +h # deactivate hashall
|
||||
SCRIPT_PATH=$(dirname $(realpath -s $0))
|
||||
|
||||
BUILDROOT=$1
|
||||
|
|
|
|||
|
|
@ -50,7 +50,7 @@ class DependencyGraphNode(object):
|
|||
|
||||
# Internal data-structure used to perform controlled
|
||||
# traversals of the dependency graph, as well as certain
|
||||
# sanity checks.
|
||||
# confidence checks.
|
||||
self.numVisits = 0
|
||||
|
||||
# Internal flag to check if the package is built
|
||||
|
|
|
|||
|
|
@ -87,7 +87,7 @@ The contain utility is invoked as
|
|||
|
||||
with options
|
||||
|
||||
-c disable console emulation in the container
|
||||
-c deactivate console emulation in the container
|
||||
-g MAP set the container-to-host GID map
|
||||
-i CMD run a helper child inside the new namespaces
|
||||
-n share the host network unprivileged in the container
|
||||
|
|
@ -113,7 +113,7 @@ can be used to override the defaults.
|
|||
The container console is a host pseudo-terminal bound at /dev/console in the
|
||||
new /dev filesystem: stdin and stdout are copied to/from this, and it serves
|
||||
as stdin, stdout and stderr for the container init process. This console
|
||||
emulation can be disabled using the -c option: if -c is used, init is run
|
||||
emulation can be deactivated using the -c option: if -c is used, init is run
|
||||
directly with the stdin, stdout and stderr of the contain command.
|
||||
|
||||
Containers are usually isolated in their own network namespace, with a
|
||||
|
|
@ -264,13 +264,13 @@ support for creating and updating these files in this format; they are
|
|||
likely to become a standard way to delegate sub-users and sub-groups.
|
||||
|
||||
Linux 3.19 and later do not allow unprivileged processes to write a GID map
|
||||
unless the setgroups() call has been permanently disabled by writing "deny"
|
||||
unless the setgroups() call has been permanently deactivated by writing "deny"
|
||||
to /proc/PID/setgroups. This is a fix for CVE-2014-8989 which applied to
|
||||
strangely-configured systems where group membership implies more restricted
|
||||
permissions rather than supplementary permissions.
|
||||
|
||||
As a result, when run non-setuid by an unprivileged user, contain and pseudo
|
||||
must disable setgroups() in the container. Conversely, when installed setuid
|
||||
must deactivate setgroups() in the container. Conversely, when installed setuid
|
||||
root, they will use their privilege to bypass this kernel restriction,
|
||||
resulting in fully-functional containers which still support setgroups().
|
||||
However, this also means that they can be used to bypass restrictions
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ within the container to start a graceful shut down. For example
|
|||
|
||||
inject PID /bin/halt
|
||||
|
||||
To immediately kill a container and all its processes, it is sufficient to
|
||||
To immediately stop a container and all its processes, it is sufficient to
|
||||
send the init process a SIGKILL from the host using
|
||||
|
||||
pkill -KILL -P PID
|
||||
|
|
@ -86,8 +86,8 @@ if binfmt_misc is mounted on /proc/sys/fs/binfmt_misc in the host
|
|||
filesystem. This was fixed in Linux 3.13.
|
||||
|
||||
Linux 3.19 introduced restrictions on writing a user namespace GID map as an
|
||||
unprivileged user unless setgroups() has been permanently disabled, which
|
||||
unprivileged user unless setgroups() has been permanently deactivated, which
|
||||
broke older versions of contain. Run non-setuid and unprivileged, contain
|
||||
and pseudo must now disable setgroups() to create containers, but if they
|
||||
and pseudo must now deactivate setgroups() to create containers, but if they
|
||||
are installed setuid, they will bypass this kernel restriction and leave
|
||||
setgroups() enabled in the resulting containers.
|
||||
|
|
|
|||
|
|
@ -18,13 +18,13 @@
|
|||
static struct termios saved;
|
||||
|
||||
int getconsole(void) {
|
||||
int master;
|
||||
int primary;
|
||||
|
||||
if ((master = posix_openpt(O_RDWR | O_NOCTTY)) < 0)
|
||||
if ((primary = posix_openpt(O_RDWR | O_NOCTTY)) < 0)
|
||||
error(1, 0, "Failed to allocate a console pseudo-terminal");
|
||||
grantpt(master);
|
||||
unlockpt(master);
|
||||
return master;
|
||||
grantpt(primary);
|
||||
unlockpt(primary);
|
||||
return primary;
|
||||
}
|
||||
|
||||
static void rawmode() {
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ void usage(char *progname) {
|
|||
Usage: %s [OPTIONS] DIR [CMD [ARG]...]\n\
|
||||
Options:\n\
|
||||
-b BND bind host path into container\n\
|
||||
-c disable console emulation in the container\n\
|
||||
-c deactivate console emulation in the container\n\
|
||||
-g MAP set the container-to-host GID map\n\
|
||||
-i CMD run a helper child inside the new namespaces\n\
|
||||
-n share the host network unprivileged in the container\n\
|
||||
|
|
@ -34,7 +34,7 @@ GID and UID maps are specified as START:LOWER:COUNT[,START:LOWER:COUNT]...\n\
|
|||
int main(int argc, char **argv) {
|
||||
char *gidmap = NULL, *inside = NULL, *outside = NULL, *uidmap = NULL;
|
||||
char *bind = NULL;
|
||||
int hostnet = 0, master, option, stdio = 0;
|
||||
int hostnet = 0, primary, option, stdio = 0;
|
||||
pid_t child, parent;
|
||||
|
||||
while ((option = getopt(argc, argv, "+:b:cg:i:no:u:")) > 0)
|
||||
|
|
@ -114,8 +114,8 @@ int main(int argc, char **argv) {
|
|||
error(1, errno, "setuid");
|
||||
}
|
||||
|
||||
master = stdio ? -1 : getconsole();
|
||||
createroot(argv[optind], master, inside, bind);
|
||||
primary = stdio ? -1 : getconsole();
|
||||
createroot(argv[optind], primary, inside, bind);
|
||||
|
||||
unshare(CLONE_NEWPID);
|
||||
switch (child = fork()) {
|
||||
|
|
@ -128,8 +128,8 @@ int main(int argc, char **argv) {
|
|||
mountsys();
|
||||
enterroot();
|
||||
|
||||
if (master >= 0) {
|
||||
close(master);
|
||||
if (primary >= 0) {
|
||||
close(primary);
|
||||
setconsole("/dev/console");
|
||||
}
|
||||
|
||||
|
|
@ -143,5 +143,5 @@ int main(int argc, char **argv) {
|
|||
error(1, errno, "exec");
|
||||
}
|
||||
|
||||
return supervise(child, master);
|
||||
return supervise(child, primary);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,9 +17,9 @@ void denysetgroups(pid_t pid) {
|
|||
|
||||
path = string("/proc/%d/setgroups", pid);
|
||||
if ((fd = open(path, O_WRONLY)) < 0)
|
||||
error(1, 0, "Failed to disable setgroups() in container");
|
||||
error(1, 0, "Failed to deactivate setgroups() in container");
|
||||
else if (write(fd, text, strlen(text)) != (ssize_t) strlen(text))
|
||||
error(1, 0, "Failed to disable setgroups() in container");
|
||||
error(1, 0, "Failed to deactivate setgroups() in container");
|
||||
close(fd);
|
||||
free(path);
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue