Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

📖 Add byoi fedora/rockylinux-fips example #1591

Merged
merged 2 commits into from
Jul 7, 2023
Merged

Conversation

mudler
Copy link
Member

@mudler mudler commented Jul 6, 2023

Fixes #362

Adds fips e2e example for:

  • fedora
  • rockylinux

Draft as needs to validate with the latest images

Renames also the ubuntu-20-lts-fips framework image to fips-systemd as works as well for rocky and fedora.

Signed-off-by: mudler <mudler@kairos.io>
@mudler mudler marked this pull request as draft July 6, 2023 18:56
@mudler
Copy link
Member Author

mudler commented Jul 7, 2023

As I feared, generic framework images for fips just don't work:

         Starting immucore.service - immucore...                                                                                                                                                                     
[   15.879932] immucore[1408]: fatal error: unexpected signal during runtime execution                                                                                                                               
[   15.882202] immucore[1408]: [signal SIGSEGV: segmentation violation code=0x1 addr=0xc3 pc=0x7fdbecb58895]            
[   15.882767] immucore[1408]: runtime stack:                                                                                                                                                                        
[   15.883013] immucore[1408]: runtime.throw({0xfa15b2?, 0x0?})                                                                                                                                                      
[   15.883343] immucore[1408]:  /usr/local/go/src/runtime/panic.go:1047 +0x5d fp=0x7ffe480dc2c0 sp=0x7ffe480dc290 pc=0x4388fd                                                                                        
[   15.883953] immucore[1408]: runtime.sigpanic()
[   15.884229] immucore[1408]:  /usr/local/go/src/runtime/signal_unix.go:823 +0x369 fp=0x7ffe480dc310 sp=0x7ffe480dc2c0 pc=0x44eba9
[   15.884860] immucore[1408]: goroutine 1 [syscall, locked to thread]:
[   15.885252] immucore[1408]: runtime.cgocall(0xbc5380, 0xc00020af58)
[   15.885632] immucore[1408]:  /usr/local/go/src/runtime/cgocall.go:158 +0x5c fp=0xc00020af30 sp=0xc00020aef8 pc=0x406bfc
[   15.886266] immucore[1408]: os/user._Cfunc_mygetpwuid_r(0x0, 0xc0002964b0, 0x1750db0, 0x400, 0xc000014d78)
[   15.886928] immucore[1408]:  _cgo_gotypes.go:176 +0x4c fp=0xc00020af58 sp=0xc00020af30 pc=0x7726cc
[   15.887413] immucore[1408]: os/user.lookupUnixUid.func1.1(0x0, 0x164c240?, 0xc00020aff0?, 0x410827?)
[   15.887898] immucore[1408]:  /usr/local/go/src/os/user/cgo_lookup_unix.go:102 +0xa6 fp=0xc00020afb8 sp=0xc00020af58 pc=0x7733a6
[   15.888505] immucore[1408]: os/user.lookupUnixUid.func1()
[   15.888800] immucore[1408]:  /usr/local/go/src/os/user/cgo_lookup_unix.go:102 +0x29 fp=0xc00020afe8 sp=0xc00020afb8 pc=0x7732e9
[   15.889451] immucore[1408]: os/user.retryWithBuffer(0xc00023d310, 0xc00020b0c8)
[   15.889858] immucore[1408]:  /usr/local/go/src/os/user/cgo_lookup_unix.go:244 +0x39 fp=0xc00020b030 sp=0xc00020afe8 pc=0x7744d9
[   15.890485] immucore[1408]: os/user.lookupUnixUid(0x0)
[   15.890801] immucore[1408]:  /usr/local/go/src/os/user/cgo_lookup_unix.go:95 +0x10f fp=0xc00020b108 sp=0xc00020b030 pc=0x7730ef
[   15.891465] immucore[1408]: os/user.current()
[   15.891725] immucore[1408]:  /usr/local/go/src/os/user/cgo_lookup_unix.go:48 +0x47 fp=0xc00020b148 sp=0xc00020b108 pc=0x772a07
[   15.892349] immucore[1408]: os/user.Current.func1()
[   15.892621] immucore[1408]:  /usr/local/go/src/os/user/lookup.go:15 +0x17 fp=0xc00020b158 sp=0xc00020b148 pc=0x771df7
[   15.893217] immucore[1408]: sync.(*Once).doSlow(0xc00020b1d8?, 0x4e4054?)

@kairos-io/maintainers I'll go ahead and rename the ubuntu flavor to something more meaningful and generic, I don't see any way around creating generic fips images for now

Signed-off-by: mudler <mudler@kairos.io>
@mudler mudler marked this pull request as ready for review July 7, 2023 12:36
@mudler mudler requested a review from a team July 7, 2023 12:37
@mudler
Copy link
Member Author

mudler commented Jul 7, 2023

I've validated that the ubuntu framework image works also with fedora and rockylinux, renaming it to fips-systemd. For specific issues we will tackle them separately

ln -sf "initrd-${kernel}" /boot/initrd && depmod -a "${kernel}"

# Symlink kernel HMAC
RUN kernel=$(ls /boot/vmlinuz-* | head -n1) && ln -sf ."${kernel#/boot/}".hmac /boot/.vmlinuz.hmac
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the "main" difference with standard examples

# Copy the os-release file to identify the OS
COPY --from=osbuilder /workspace/os-release /etc/os-release

COPY --from=quay.io/kairos/framework:master_fips-systemd / /
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: the framework image is fips

@mudler mudler merged commit dfb34d9 into master Jul 7, 2023
32 checks passed
@mudler mudler deleted the dev/fips_examples branch July 7, 2023 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

📖 Create FIPS e2e examples for BYOI
2 participants