This also drops the dracut-network package, since there is no (legitimate) reason why an initial ramdisk of a firewall machine should be capable of networking - particularly since there is no firewall engine loaded at this point.
The second version of this patch takes into account that _all_ files in packages of IPFire 3 always go into the respective package. Therefore, if we do not want to have them, deleting the package section is not sufficient - we have to delete them explicitly.
Signed-off-by: Peter Müller peter.mueller@ipfire.org --- dracut/dracut.nm | 49 ++++++++++++++---------------------------------- 1 file changed, 14 insertions(+), 35 deletions(-)
diff --git a/dracut/dracut.nm b/dracut/dracut.nm index 8da9822dd..f2fef35df 100644 --- a/dracut/dracut.nm +++ b/dracut/dracut.nm @@ -4,11 +4,11 @@ ###############################################################################
name = dracut -version = 048 +version = 056 release = 1
groups = System/Boot -url = http://sourceforge.net/apps/trac/dracut/wiki +url = https://sourceforge.net/apps/trac/dracut/wiki license = GPLv2+ summary = Initramfs generator using udev.
@@ -16,7 +16,7 @@ description dracut is a new, event-driven initramfs infrastructure based around udev. end
-source_dl = http://www.kernel.org/pub/linux/utils/boot/dracut/ +source_dl = https://www.kernel.org/pub/linux/utils/boot/dracut/ sources = %{thisapp}.tar.xz
build @@ -49,21 +49,25 @@ build mkdir -pv %{BUILDROOT}/etc/dracut.conf.d cp -vf %{DIR_SOURCE}/ipfire.conf %{BUILDROOT}/etc/dracut.conf.d/ipfire.conf
- # Save package version. - echo "DRACUT_VERSION=%{version}-%{release}" > \ - %{BUILDROOT}/%{dracutlibdir}/dracut/dracut-version.sh - # Remove Gentoo specific module. rm -rvf %{BUILDROOT}%{dracutlibdir}/modules.d/50gensplash
+ # Remove networking modules, since the initial ramdisk + # should not be capable of networking due to security reasons. + rm -rvf \ + %{BUILDROOT}%{dracutlibdir}/modules.d/40network \ + %{BUILDROOT}%{dracutlibdir}/modules.d/45ifcfg \ + %{BUILDROOT}%{dracutlibdir}/modules.d/95fcoe \ + %{BUILDROOT}%{dracutlibdir}/modules.d/95iscsi \ + %{BUILDROOT}%{dracutlibdir}/modules.d/95nbd \ + %{BUILDROOT}%{dracutlibdir}/modules.d/95nfs \ + %{BUILDROOT}%{dracutlibdir}/modules.d/95znet + mkdir -pv %{BUILDROOT}/boot/dracut mkdir -pv %{BUILDROOT}/var/lib/dracut/overlay mkdir -pv %{BUILDROOT}/var/lib/initramfs mkdir -pv %{BUILDROOT}%{localstatedir}/log touch %{BUILDROOT}%{localstatedir}/log/dracut.log - - mkdir -pv %{BUILDROOT}/etc/logrotate.d - install -m 0644 dracut.logrotate %{BUILDROOT}/etc/logrotate.d/dracut_log end end
@@ -92,31 +96,6 @@ packages end end
- package %{name}-network - summary = Network support for the initramdisk. - description - This package requires everything which is needed to build a generic - all purpose initramfs with network support with dracut. - end - - requires - bridge-utils - dhclient - iproute2 - nfs-utils - end - - files - /usr/lib/dracut/modules.d/40network - /usr/lib/dracut/modules.d/95fcoe - /usr/lib/dracut/modules.d/95iscsi - /usr/lib/dracut/modules.d/95nbd - /usr/lib/dracut/modules.d/95nfs - /usr/lib/dracut/modules.d/45ifcfg - /usr/lib/dracut/modules.d/95znet - end - end - package %{name}-utils summary = Command line utils for dracut. description = %{summary}
-
Peter Müller