From 4c21a725728de262dd040f75b07d1b135591af73 Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Mon, 20 Mar 2023 15:12:14 -0600 Subject: [PATCH 1/2] Restrict access to /warewulf/config from overlays The wwinit overlay populates /warewulf/config with information about the Warewulf configuration. This includes the IPMI password, which should not be visible to regular users. This changes the installed permissions of the file to be readable by root only. Closes #728 Signed-off-by: Jonathon Anderson --- CHANGELOG.md | 1 + Makefile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5245f88..688036a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - The correct header is now displayed when `-al` flags are specified to overlay list. +- Restrict access to `/warewulf/config` to root only. (#728, #742) ### Changed diff --git a/Makefile b/Makefile index 2772c723..61e470bc 100644 --- a/Makefile +++ b/Makefile @@ -188,7 +188,7 @@ files: all chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh* chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/NetworkManager/system-connections/ww4-managed.ww chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww - chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww + chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host install -m 0755 wwctl $(DESTDIR)$(BINDIR) install -m 0755 wwapic $(DESTDIR)$(BINDIR) From 6073354d24353b1b71cd039880094849268524fe Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Mon, 20 Mar 2023 16:07:15 -0600 Subject: [PATCH 2/2] Update documentation to reference ghcr rather than DockerHub Warewulf sample node images are now built automatically with GitHub CI/CD, targeting ghcr.io. This updates the documentation to reference that location rather than DockerHub. Addresses #732 Signed-off-by: Jonathon Anderson --- internal/app/api/wwapird_curls/curls.sh | 4 ++-- internal/app/wwctl/container/imprt/root.go | 2 +- userdocs/contents/containers.rst | 2 +- userdocs/contributing/development-environment-kvm.rst | 2 +- userdocs/contributing/development-environment-vbox.rst | 2 +- userdocs/quickstart/el7.rst | 2 +- userdocs/quickstart/el8.rst | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/internal/app/api/wwapird_curls/curls.sh b/internal/app/api/wwapird_curls/curls.sh index a9f95d54..e4f6ac01 100644 --- a/internal/app/api/wwapird_curls/curls.sh +++ b/internal/app/api/wwapird_curls/curls.sh @@ -15,7 +15,7 @@ curl --cacert /usr/local/etc/warewulf/keys/cacert.pem \ curl http://localhost:9871/v1/container # container import -curl -d '{"source": "docker://warewulf/rocky:8", "name": "rocky-8", "update": true, "default": true}' -H "Content-Type: application/json" -X POST http://localhost:9871/v1/container +curl -d '{"source": "docker://ghcr.io/hpcng/warewulf-rockylinux:8", "name": "rocky-8", "update": true, "default": true}' -H "Content-Type: application/json" -X POST http://localhost:9871/v1/container # container delete curl -X DELETE http://localhost:9871/v1/container?containerNames=rocky-8 @@ -54,4 +54,4 @@ curl http://localhost:9871/v1/nodestatus?nodeNames=testApiNode0 # node delete single node curl -X DELETE http://localhost:9871/v1/node?nodeNames=testApiNode0 -curl -X DELETE http://localhost:9871/v1/node?nodeNames=testApiNode1 \ No newline at end of file +curl -X DELETE http://localhost:9871/v1/node?nodeNames=testApiNode1 diff --git a/internal/app/wwctl/container/imprt/root.go b/internal/app/wwctl/container/imprt/root.go index bd3a563b..edafc127 100644 --- a/internal/app/wwctl/container/imprt/root.go +++ b/internal/app/wwctl/container/imprt/root.go @@ -16,7 +16,7 @@ are: * /path/to/archive/tar/ball * /path/to/chroot/ Imported containers are used to create bootable VNFS images.`, - Example: "wwctl container import docker://warewulf/centos-8 my_container", + Example: "wwctl container import docker://ghcr.io/hpcng/warewulf-rockylinux:8 rockylinux-8", RunE: CobraRunE, Args: cobra.MinimumNArgs(1), } diff --git a/userdocs/contents/containers.rst b/userdocs/contents/containers.rst index c8b0a5d3..641d023b 100644 --- a/userdocs/contents/containers.rst +++ b/userdocs/contents/containers.rst @@ -48,7 +48,7 @@ Here is an example of importing from Docker Hub. .. code-block:: console - # wwctl container import docker://warewulf/rocky rocky-8 + # wwctl container import docker://ghcr.io/hpcng/warewulf-rockylinux:8 rocky-8 Getting image source signatures Copying blob d7f16ed6f451 done Copying config da2ca70704 done diff --git a/userdocs/contributing/development-environment-kvm.rst b/userdocs/contributing/development-environment-kvm.rst index 023b3eb9..83149f9f 100644 --- a/userdocs/contributing/development-environment-kvm.rst +++ b/userdocs/contributing/development-environment-kvm.rst @@ -102,7 +102,7 @@ Build and install Warewulf on wwdev sudo wwctl configure ssh # Build the basic ssh keys to be included by the default system overlay # Pull and build the VNFS container and kernel - sudo wwctl container import docker://warewulf/centos-8 centos-8 --setdefault + sudo wwctl container import docker://ghcr.io/hpcng/warewulf-centos:7 centos-7 --setdefault sudo wwctl kernel import build $(uname -r) --setdefault # Set up the default node profile diff --git a/userdocs/contributing/development-environment-vbox.rst b/userdocs/contributing/development-environment-vbox.rst index 8d504aa5..e432466c 100644 --- a/userdocs/contributing/development-environment-vbox.rst +++ b/userdocs/contributing/development-environment-vbox.rst @@ -117,7 +117,7 @@ I have VirtualBox running on my desktop. sudo wwctl configure ssh --persist # Build the basic ssh keys to be included by the default system overlay # Pull and build the VNFS container and kernel - sudo wwctl container import docker://warewulf/centos-7 centos-7 --setdefault + sudo wwctl container import docker://ghcr.io/hpcng/warewulf-centos:7 centos-7 --setdefault sudo wwctl kernel import build $(uname -r) --setdefault # Set up the default node profile diff --git a/userdocs/quickstart/el7.rst b/userdocs/quickstart/el7.rst index a82445cd..c5859d56 100644 --- a/userdocs/quickstart/el7.rst +++ b/userdocs/quickstart/el7.rst @@ -103,7 +103,7 @@ default running kernel from the controller node and set both in the .. code-block:: bash - sudo wwctl container import docker://warewulf/centos-7 centos-7 --setdefault + sudo wwctl container import docker://ghcr.io/hpcng/warewulf-centos:7 centos-7 --setdefault sudo wwctl kernel import $(uname -r) --setdefault Set up the default node profile diff --git a/userdocs/quickstart/el8.rst b/userdocs/quickstart/el8.rst index 215b0037..4c812914 100644 --- a/userdocs/quickstart/el8.rst +++ b/userdocs/quickstart/el8.rst @@ -105,7 +105,7 @@ default running kernel from the controller node and set both in the .. code-block:: bash - sudo wwctl container import docker://warewulf/rocky:8 rocky-8 + sudo wwctl container import docker://ghcr.io/hpcng/warewulf-rockylinux:8 rocky-8 Set up the default node profile