Also see https://bugs.launchpad.net/cloud-images/+bug/2106729.
Since Oracular[1]:
Ubuntu’s systemd-networkd no longer sets UseDomains=true for managed
network interfaces. In effect, this means that search domains
configured in DHCP leases will not be reflected in /etc/resolv.conf
by default. This change aligns Ubuntu’s default behavior with that
of upstream. System administrators may choose to override this
default on a global, or per-interface basis. See systemd.network 4
for details.
The default in systemd is UseDomains=false. From systemd.network(5)[2]:
DHCP=
Furthermore, note that by default the domain name specified
through DHCP is not used for name resolution. See option
UseDomains= below.
UseDomains=
It is recommended to enable this option only on trusted
networks, as setting this affects resolution of all hostnames,
in particular of single-label names. It is generally safer to
use the supplied domain only as routing domain, rather than as
search domain, in order to not have it affect local resolution
of single-label names.
It has been reported to us by few clouds that this breaks local name
resolution. For instance, in Google Cloud Compute, users can no longer
reach instances in the same zone[3] nor Google Cloud services[4] by
their names.
Arguably, the security concerns for having this option disabled are not
valid in cloud environments. As one of our partners said:
IIUC, the motivation to disable UseDomains by default is that a
laptop might be used on an untrusted network where the domains
provided by DHCP can be a security issue, directing users to places
they don't intend.
But it's not possible for a cloud instance to be connected to an
untrusted network (barring a breached account).
The way I'm looking at this is that DHCP option 119 exists for the
express purpose of allowing a network administrator to configure the
DNS search path for computers on that network. I understand there's
a security concern if that network isn't a datacenter. But in the
cloud there's no concern (in some clouds, it's not even possible for
DHCP response packets to come from anywhere but the cloud's own
DHCP).
We should restore this setting in cloud images.
[1] https://discourse.ubuntu.com/t/oracular-oriole-release-notes/44878
[2] https://manpages.ubuntu.com/manpages/plucky/en/man5/systemd.network.5.html
[3] https://cloud.google.com/compute/docs/internal-dns
[4] https://cloud.google.com/compute/docs/metadata/overview
This model intentionally uses pc-kernel from a branch, for components
testing purposes. We'll have to update this again before release when
the desired pc-kernel is on a stable channel.
* Again in ubuntu-server builds, configure LAYERFS_PATH in the kernel layer
and ensure the initrd is freshly regenerated in that layer. LAYERFS_PATH
was being set to the layer below the kernel layer, which meant that the
live session did not get access to all the modules in the case that the
kernel had not been installed in the base layer, which in turn means that
installs fail. (LP: #2100148)
* While we're at it, delete any initrd from any other layer than a kernel
layer, as they just waste space on the ISO.
patch create_manifest to produce an sbom when called by an ubuntu-cpc
project. Patch all the ubuntu-cpc hooks and series files to include the
newly generated manifests, filelists, and sboms. Generates a number of
new artifacts in the builds. the snap utilized, cpc-sbom, is an open
source repo and a provided via a hidden snap. there is no intention of
publisizing the snap or how we generate sboms, however partners require
the ability to audit if required.
defensively checks if the snap is already installed, in the case of
multiple hooks being called in a single build (thus sharing a build
host), and only if called in an ubuntu-cpc project.
(cherry picked from commit 7c7b7df89dc96169db1f255d6bba901ebb63a43c)
Plucky is currently on kernel 6.12 so preseeding fails with a apparmor
feature mismatch given that the live-build/apparmor/generic tree is
used. Adding a 6.12 tree (which is identical with the 6.11 tree)
solves this.
U-Boot with distroboot has:
efi_dtb_prefixes=/ /dtb/ /dtb/current/
So we should install the device-trees into dtb/ and not dtbs/ on the EFI
system partition.
Fixes: 365435ad2dbe ("riscv: copy device trees to the ESP")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Commit f9c5020200ce ("riscv: directly copy device trees to /boot/dtbs")
incorrectly copied devicetrees into /boot/dtbs/$kvers instead of /boot/efi/dtbs,
inside the ESP and where U-boot expects them. This commit fixes this path.
Fixes: f9c5020200ce ("riscv: directly copy device trees to /boot/dtbs")
Signed-off-by: Adriano Cordova <adriano.cordova@canonical.com>
We are removing our different variants of wsl rootfs with the new
Microsoft format. We only keep one following the distribution policy:
- lts to lts
- intermediate release to next one
Co-authored-by: Carlos Nihelton <carlos.santanadeoliveira@canonical.com>
The previous Tegra kernel metapackage implementation (linux-nvidia-tegra-igx)
was initially planned to apply both for Jetson devices and IGX systems. It turned
out recently (LP: #2069179) that we now need to reserve the metapackage name
linux-nvidia-tegra-igx for IGX systems, and use the new linux-nvidia-tegra-jetson
metapackage for Jetson devices. For the sake of clarity, the image name, model,
sub-arch, variant should align with the kernel metapackage name.
LP:2083240
starting in noble, adduser no longer creates a homedir for system users.
The buildd user then does not have a home directory, causing snaps to be
unable to run, as well as possibly other issues from a missing assumed
homedir. Explicitly create /home/buildd
Version 1 of install-sources.yaml is a top-level list of the sources to
be offered.
Version 2 extends this by placing the list under a top-level key
`sources`, adding a `version` field, and adding a `kernel` field which
supplants the current kernel-meta-package file. `kernel.default` is
read to know which kernel to use - unless we need to fallback to the
bridge kernel.
