common.yaml

# We inherit from Fedora CoreOS' base configuration
include:
  - fedora-coreos-config/manifests/ignition-and-ostree.yaml
  - fedora-coreos-config/manifests/file-transfer.yaml
  - fedora-coreos-config/manifests/networking-tools.yaml
  - fedora-coreos-config/manifests/system-configuration.yaml
  - fedora-coreos-config/manifests/user-experience.yaml
  - fedora-coreos-config/manifests/shared-workarounds.yaml
  # RHCOS owned packages
  - rhcos-packages.yaml

# Layers common to all versions of RHCOS and SCOS
ostree-layers:
  - overlay/01fcos
  - overlay/02fcos-nouveau
  - overlay/05rhcos
  - overlay/06gcp-routes
  - overlay/15rhcos-networkmanager-dispatcher
  - overlay/15rhcos-tuned-bits
  - overlay/20platform-chrony
  - overlay/21dhcp-chrony
  - overlay/25azure-udev-rules

arch-include:
  x86_64:
    - fedora-coreos-config/manifests/grub2-removals.yaml
    - fedora-coreos-config/manifests/bootupd.yaml
  ppc64le: fedora-coreos-config/manifests/grub2-removals.yaml
  aarch64:
    - fedora-coreos-config/manifests/grub2-removals.yaml
    - fedora-coreos-config/manifests/bootupd.yaml

documentation: false
initramfs-args:
  - "--no-hostonly"
  - "--omit-drivers"
  - "nouveau"
  - "--omit"
  # we don't need root-on-NFS
  # see upstream: https://github.com/coreos/fedora-coreos-config/pull/60
  - "nfs"
  - "--add"
  - "iscsi"
  - "ignition"
  - "--add"
  - "ifcfg"
  - "--add"
  - "fips"
  # The current default in RHEL8 is network-legacy
 ## XXX: This does not work for now: https://github.com/dracutdevs/dracut/issues/798
 ## XXX: Temporarily use overlay.d/05rhcos/usr/lib/dracut/modules.d/29rhcos-need-network-manager/module-setup.sh
 #- "--add"
 #- "network-manager"
  - "--omit"
  - "network-legacy"

postprocess:
  - |
     #!/usr/bin/env bash
     set -xeo pipefail

     # Disable PasswordAuthentication in SSH
     sed -i "s|^PasswordAuthentication yes$|PasswordAuthentication no|g" /etc/ssh/sshd_config
     # Disable root login because don't do that.
     sed -i "s|^PermitRootLogin yes$|PermitRootLogin no|g" /etc/ssh/sshd_config
     # Enable ClientAliveInterval and set to 180 per https://bugzilla.redhat.com/show_bug.cgi?id=1701050
     sed -i "s|^#ClientAliveInterval 0$|ClientAliveInterval 180|g" /etc/ssh/sshd_config

     # TEMPORARY: Create /etc/vmware-tools/tools.conf to ensure RHCOS shows up properly in VMWare
     # See https://jira.coreos.com/browse/RHCOS-258
     if [ "$(uname -m)" == "x86_64" ]; then
     cat > /etc/vmware-tools/tools.conf <<'EOF'
     [guestosinfo]
     short-name = rhel8-64
     EOF
     fi

     # TEMPORARY: Fix file permission for cpictl until fix is backported to RHEL 8.6
     # See https://bugzilla.redhat.com/show_bug.cgi?id=2024102
     if [ "$(uname -m)" == "s390x" ]; then
     [ "$(stat -c '%a' /usr/lib/s390-tools/cpictl)" == "755" ] && echo "Permission for /usr/lib/s390-tools/cpictl is fixed, remove temporary hack"
     chmod 755 /usr/lib/s390-tools/cpictl
     fi

     # Nuke network.service from orbit
     # https://github.com/openshift/os/issues/117
     rm -rf /etc/rc.d/init.d/network /etc/rc.d/rc*.d/*network

     # We're not using resolved yet
     rm -f /usr/lib/systemd/system/systemd-resolved.service
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # manually modify SELinux booleans that are needed for OCP use cases
    semanage boolean --modify --on container_use_cephfs      # RHBZ#1694045
    semanage boolean --modify --on virt_use_samba            # RHBZ#1754825

  # https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/812
  # https://bugzilla.redhat.com/show_bug.cgi?id=1796537
  - |
    #!/usr/bin/bash
    mkdir -p /usr/share/containers/oci/hooks.d

  # This is part of e.g. fedora-repos in Fedora; we now want to include it by default
  # so that the MCO can use it by default and not trip over SELinux issues trying
  # to create it.
  - |
    #!/usr/bin/bash
    mkdir -p /etc/yum.repos.d

  # These enable librhsm which enables host subscriptions to work in containers
  # https://github.com/rpm-software-management/librhsm/blob/fcd972cbe7c8a3907ba9f091cd082b1090231492/rhsm/rhsm-context.c#L30
  - |
    #!/usr/bin/bash
    ln -sr /run/secrets/etc-pki-entitlement /etc/pki/entitlement-host
    ln -sr /run/secrets/rhsm /etc/rhsm-host

  # This updates the PAM configuration to reference all of the SSSD modules.
  # Removes the `authselect` binary afterwards since `authselect` does not play well with `nss-altfiles`
  # (https://github.com/pbrezina/authselect/issues/48).
  # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
  # NOTE: This is a temporary hack which should be updated after switching to systemd-sysusers
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # use `authselect test` since `authselect select` wants to copy to `/var` too
    authselect test sssd --nsswitch | tail -n +2 > /etc/nsswitch.conf
    for pam_file in system-auth password-auth smartcard-auth fingerprint-auth postlogin; do
      authselect test sssd --${pam_file} | tail -n +2 > /etc/pam.d/${pam_file}
    done
    rm -f $(which authselect)

  # Make sure that we do not ship broken symlinks:
  # https://github.com/openshift/os/issues/1003
  # Remove known broken symlinks that point to non-existing files or directories
  - |
    #!/usr/bin/env bash
    set -euo pipefail

    list_broken_symlinks_folders=(
      '/etc/alternatives/'
      '/usr/lib/.build-id/'
    )

    # It is not possible to remove files from usr after first boot so that is
    # why we are removing them in the postprocess scripts here.

    list_known_removed_folders=(
      '/usr/bin/systemd-firstboot'
      '/usr/lib/systemd/system-generators/systemd-gpt-auto-generator'
      '/usr/share/doc/'
      '/usr/share/info/'
      '/usr/share/man/'
      )
    for folder in "${list_broken_symlinks_folders[@]}"; do
        find "${folder}" -type l | while read -r file_name; do
            real_path=$(realpath -m "${file_name}");
            if [[ -e "${real_path}" ]]; then
              continue
            fi
            for element in "${list_known_removed_folders[@]}"; do
              if [[ "${real_path}" == "${element}"* ]]; then
                  rm -r "${file_name}"
              fi
            done
        done
    done

remove-files:
  # We don't ship man(1) or info(1)
  - usr/share/info
  - usr/share/man
  # Drop text docs too
  - usr/share/doc

etc-group-members:
  - wheel
  - sudo
  - systemd-journal
  - adm
ignore-removed-users:
  - root
ignore-removed-groups:
  - root
check-passwd:
  type: "file"
  filename: "passwd"
check-groups:
  type: "file"
  filename: "group"

exclude-packages:
  # https://bugzilla.redhat.com/show_bug.cgi?id=1798278
  - subscription-manager
  # And this one shouldn't come in
  - dnf
  # https://github.com/coreos/rpm-ostree/pull/1789/files/a0cd999a8acd5b40ec1024a794a642916fbc8ff8#diff-fc2076dc46933204a7a798f544ce3734
  # People need to use `rpm-ostree kargs` instead.
  - grubby
  # udisks2 is a fwupd recommends only need for encrypted swap checks
  - udisks2
  # dhcp-client is recommended by chrony for handling NTP servers given out via
  # DHCP, but we have a NM dispatcher script that is doing that
  # See: https://bugzilla.redhat.com/show_bug.cgi?id=1930468
  # See: https://bugzilla.redhat.com/show_bug.cgi?id=1800901
  - dhcp-client

# Try to maintain this list ordering by "in RHEL, then not in RHEL".
# To verify, disable all repos except the ootpa ones and then comment
# out the bottom and run `coreos-assembler build`.
# A lof of packages are inherited by the manifests included at the top.
packages:
 # Contains SCTP (https://bugzilla.redhat.com/show_bug.cgi?id=1718049)
 # and it's not really going to be worth playing the "where's my kernel module"
 # game long term.  If we ship it we support it, etc.
 - kernel-modules-extra
 # Audit
 - audit
 # Containers
 - containernetworking-plugins
 # Pinned due to cosa on Fedora not honoring RHEL 8 modules as expected
 - container-selinux
 # Needed for newer rpm-ostree
 - "'skopeo >= 2:1.7.0'"
 - cri-o cri-tools
 # Not yet in RHEL, dev preview in Openshift
 - conmon-rs
 # Networking
 - nfs-utils
 - dnsmasq
 - NetworkManager-ovs
 # needed for rpm-ostree today
 - polkit
 # Extra runtime
 - sssd
 # Common tools used by scripts and admins interactively
 - rsync tmux
 - nmap-ncat strace
 # Editors
 - nano
 # Red Hat CA certs
 - subscription-manager-rhsm-certificates
 # Used on the bootstrap node
 - systemd-journal-remote
 # Extras
 - systemd-journal-gateway
 # Used to update PAM configuration to work with SSSD
 # https://bugzilla.redhat.com/show_bug.cgi?id=1774154
 - authselect
 # https://bugzilla.redhat.com/show_bug.cgi?id=1900759
 - qemu-guest-agent
 # BELOW HERE ARE PACKAGES NOT IN RHEL
 # OpenShift OKD
 #- origin-node origin-hyperkube origin-clients
 # OpenShift
 - openshift-hyperkube openshift-clients
 # Gluster - Used for Openshift e2e gluster testcases
 # Reverts https://gitlab.cee.redhat.com/coreos/redhat-coreos/merge_requests/367 and add it for all arches
 - glusterfs-fuse
 # Needed for kernel-devel extension: https://bugzilla.redhat.com/show_bug.cgi?id=1885408
 # x86_64 and s390x have these packages installed as dependencies of other packages, ppc64le does not
 # FIXME: once the below BZs have been resolved to remove perl dependencies, this can be done in the extensions script
 # https://bugzilla.redhat.com/show_bug.cgi?id=1877905
 # https://bugzilla.redhat.com/show_bug.cgi?id=1886201
 - perl-interpreter
 # https://github.com/coreos/fedora-coreos-tracker/issues/404
 # https://bugzilla.redhat.com/show_bug.cgi?id=1925698
 # https://github.com/openshift/machine-config-operator/pull/2421
 - conntrack-tools
 # Upstream PR https://github.com/coreos/fedora-coreos-config/pull/786
 - WALinuxAgent-udev
 # Provide fips-mode-setup which is needed by rhcos-fips.sh
 - crypto-policies-scripts

packages-x86_64:
  # Temporary add of open-vm-tools. Should be removed when containerized
  - open-vm-tools
  - irqbalance
  # Until we sort out 4.2 -> 4.3 upgrades, we need to carry this.
  # See also https://github.com/ostreedev/ostree/pull/1929
  - ostree-grub2
  # rdma-core cleanly covers some key bare metal use cases
  - rdma-core

packages-ppc64le:
  - irqbalance
  - librtas
  - powerpc-utils-core
  - ppc64-diag-rtas
  - rdma-core

packages-s390x:
  # Required for IBM Secure Execution. Now is part of s390utils-base.rpm
  # https://github.com/coreos/fedora-coreos-tracker/issues/1217
  - /usr/bin/genprotimg

remove-from-packages:
  - - filesystem
    - "/usr/share/backgrounds"
  # https://bugzilla.redhat.com/show_bug.cgi?id=1762509
  # https://bugzilla.redhat.com/show_bug.cgi?id=1727058
  - - initscripts
    - "/"
  # Remove the systemd unit; we only want the binary to be used
  # by MCD or kubelet.  See above.
  - - conntrack-tools
    - /usr/lib/systemd/system