openstack/diskimage-builder
Code Issues Proposed changes
9ba196394c
diskimage-builder/elements/iso
History
Shivanand Tendulker f0315b4ed4 Fix to load only signed kernel in UEFI secure boot 
This fix prevents loading of unsigned ubuntu kernel in UEFI secure
boot environment when image is created using 'iso' element.

'iso' element uses 'linux' and 'initrd' modules of grub2 to load
kernel and initrd respectively. The grub2 implementation of Ubuntu
can load unsigned kernel when these modules are used.

Ubuntu has Grub2 modules 'linuxefi' and 'initrdefi' which exits
boot process if unsigned kernel is used in UEFI secure boot mode.
The 'iso' element should use these modules in grub.cfg to prevent
loading of unsigned kernel when node is booted in the UEFI secure
boot environment.

'linuxefi' and 'initrdefi' works seamlessly when node is booted in
normal UEFI boot mode (non-secure).

Fedora do not have this issue. This fix has been tested in Fedora
environment. It works fine.

Closes-Bug: 1443114
Change-Id: If256ba1f7d7c149482d0f37fabcdfa8ed22e3f91
2015-04-13 13:20:12 +00:00
..
cleanup.d Fix to load only signed kernel in UEFI secure boot 2015-04-13 13:20:12 +00:00
post-install.d UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
element-deps UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
package-installs.yaml UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
pkg-map UEFI secure boot support for iso element. 2015-03-10 00:39:14 -07:00
README.rst Create docs site containing element READMEs 2015-02-10 11:45:35 -08:00

README.rst

iso

Generates a bootable ISO image from the kernel/ramdisk generated by the elements baremetal or ramdisk. It uses isolinux to boot on BIOS machines and grub to boot on EFI machines.

This element has been tested on the following distro(s): * ubuntu * fedora

NOTE: For other distros, please make sure the isolinux.bin file exists at /usr/lib/syslinux/isolinux.bin.

baremetal element

When used with baremetal element, this generates a bootable ISO image named <image-name>-boot.iso booting the generated kernel and ramdisk. It also automatically appends kernel command-line argument 'root=UUID=<uuid-of-the-root-partition>'. Any more kernel command-line arguments required may be provided by specifying them in DIB_BOOT_ISO_KERNEL_CMDLINE_ARGS.

NOTE: It uses pre-built efiboot.img by default to work for UEFI machines. This is because of a bug in latest version of grub[1]. The user may choose to avoid using pre-built binary and build efiboot.img on their own machine by setting the environment variable DIB_UEFI_ISO_BUILD_EFIBOOT to 1 (this might work only on certain versions of grub). The current efiboot.img was generated by the method build_efiboot_img() in 100-build-iso on Ubuntu 13.10 with grub 2.00-19ubuntu2.1.

ramdisk element

When used with ramdisk element, this generates a bootable ISO image named <image-name>.iso booting the generated kernel and ramdisk. It also automatically appends kernel command-line argument 'boot_method=vmedia' which is required for Ironic drivers iscsi_ilo.

REFERENCES

[1] https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1378658