Skip to content

Commit a1c49b1

Browse files
chewichewi
committed
app-admin/google-guest-configs: New package for udev rules and scripts
We already have GCE disk rules in coreos-init, but a user has pointed out that the newer NVMe rules are missing. Let's take the rules directly from upstream instead. This is loosely based on the ChromiumOS package of the same name. Signed-off-by: James Le Cuirot <[email protected]>
1 parent 04cd5a7 commit a1c49b1

File tree

9 files changed

+170
-43
lines changed

9 files changed

+170
-43
lines changed

‎changelog/bugfixes/2025-12-29-gce-udev.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- Updated the GCE udev disk rules to include NVMe disks.

‎sdk_container/src/third_party/coreos-overlay/app-admin/google-guest-configs/Manifest‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
DIST google-guest-configs-20260112.00.tar.gz 50187 BLAKE2B 467b16fff8bfec7c54ee5daa1921bf51a3da4087d35b4598811fe8f219bc3c5c3b638615cc11a0a9ebe39c42a0ed567e19c03693b85df5cf13a2933b1b1c99a8 SHA512 633d2c5bd840876dbaec211be13b1af20c08c4eb4d3013827968d2c388b93b82f79dbb7eb3946ff3b68f4b27cb5eaf13cb715e091116fd49660e589b5a69c850

‎sdk_container/src/third_party/coreos-overlay/app-admin/google-guest-configs/files/google-guest-configs-20211116.00-sysctl.patch‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
diff --git a/src/etc/sysctl.d/60-gce-network-security.conf b/src/etc/sysctl.d/60-gce-network-security.conf
2+
index b40085b..d89d87d 100644
3+
--- a/src/etc/sysctl.d/60-gce-network-security.conf
4+
+++ b/src/etc/sysctl.d/60-gce-network-security.conf
5+
@@ -14,45 +14,6 @@
6+
#
7+
# Google-recommended kernel parameters
8+
9+
-# Turn on SYN-flood protections. Starting with 2.6.26, there is no loss
10+
-# of TCP functionality/features under normal conditions. When flood
11+
-# protections kick in under high unanswered-SYN load, the system
12+
-# should remain more stable, with a trade off of some loss of TCP
13+
-# functionality/features (e.g. TCP Window scaling).
14+
-net.ipv4.tcp_syncookies=1
15+
-
16+
-# Ignore source-routed packets
17+
-net.ipv4.conf.all.accept_source_route=0
18+
-net.ipv4.conf.default.accept_source_route=0
19+
-
20+
-# Ignore ICMP redirects from non-GW hosts
21+
-net.ipv4.conf.all.accept_redirects=0
22+
-net.ipv4.conf.default.accept_redirects=0
23+
-net.ipv4.conf.all.secure_redirects=1
24+
-net.ipv4.conf.default.secure_redirects=1
25+
-
26+
-# Don't pass traffic between networks or act as a router
27+
-net.ipv4.ip_forward=0
28+
-net.ipv4.conf.all.send_redirects=0
29+
-net.ipv4.conf.default.send_redirects=0
30+
-
31+
-# Turn on Source Address Verification in all interfaces to
32+
-# prevent some spoofing attacks.
33+
-net.ipv4.conf.all.rp_filter=1
34+
-net.ipv4.conf.default.rp_filter=1
35+
-
36+
-# Ignore ICMP broadcasts to avoid participating in Smurf attacks
37+
-net.ipv4.icmp_echo_ignore_broadcasts=1
38+
-
39+
-# Ignore bad ICMP errors
40+
-net.ipv4.icmp_ignore_bogus_error_responses=1
41+
-
42+
# Log spoofed, source-routed, and redirect packets
43+
net.ipv4.conf.all.log_martians=1
44+
net.ipv4.conf.default.log_martians=1
45+
-
46+
-# Addresses of mmap base, heap, stack and VDSO page are randomized
47+
-kernel.randomize_va_space=2
48+
-
49+
-# Reboot the machine soon after a kernel panic.
50+
-kernel.panic=10

‎sdk_container/src/third_party/coreos-overlay/app-admin/google-guest-configs/google-guest-configs-20260112.00.ebuild‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Copyright 2026 The Flatcar Container Linux Maintainers
2+
# Distributed under the terms of the Apache License 2.0
3+
4+
# IMPORTANT! When bumping, ensure that the Dracut modules do not install files
5+
# that would make runtime changes to systems to other than GCE VMs because the
6+
# initrd is shared between image types. The udev disk rules are currently safe.
7+
8+
EAPI=8
9+
10+
inherit udev
11+
12+
DESCRIPTION="Configuration and scripts to support the Google Compute Engine guest environment"
13+
HOMEPAGE="http://github.com/GoogleCloudPlatform/guest-configs"
14+
SRC_URI="https://github.com/GoogleCloudPlatform/guest-configs/archive/${PV}.tar.gz -> ${P}.tar.gz"
15+
S="${WORKDIR}/guest-configs-${PV}"
16+
17+
LICENSE="Apache-2.0 BSD ZLIB"
18+
SLOT="0"
19+
KEYWORDS="amd64"
20+
21+
RDEPEND="
22+
net-misc/curl
23+
sys-apps/ethtool
24+
sys-apps/iproute2
25+
sys-apps/nvme-cli
26+
!<app-emulation/google-compute-engine-20190124-r3
27+
"
28+
29+
PATCHES=(
30+
"${FILESDIR}"/${PN}-20211116.00-sysctl.patch
31+
)
32+
33+
src_install() {
34+
exeinto "$(get_udevdir)"
35+
doexe src/lib/udev/google_nvme_id
36+
37+
udev_dorules src/lib/udev/rules.d/65-gce-disk-naming.rules
38+
udev_dorules src/lib/udev/rules.d/75-gce-network.rules
39+
40+
insinto /usr/lib/sysctl.d
41+
doins src/etc/sysctl.d/60-gce-network-security.conf
42+
43+
dobin src/usr/bin/google_set_multiqueue
44+
dobin src/usr/bin/google_optimize_local_ssd
45+
dobin src/usr/bin/gce-nic-naming
46+
47+
insinto /usr/lib/dracut/modules.d
48+
doins -r src/lib/dracut/modules.d/*
49+
50+
# Don't put any sysctl config into the shared initrd. It will still get
51+
# applied after switching root anyway.
52+
local sysctl=( "${ED}"/usr/lib/sysctl.d/* )
53+
insinto /usr/lib/dracut/dracut.conf.d
54+
newins - ${PN}.conf <<-EOF
55+
remove_items+=" ${sysctl[@]#${ED}} "
56+
EOF
57+
}
58+
59+
pkg_postinst() {
60+
udev_reload
61+
}
62+
63+
pkg_postrm() {
64+
udev_reload
65+
}

‎sdk_container/src/third_party/coreos-overlay/app-admin/google-guest-configs/metadata.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
3+
<pkgmetadata>
4+
<upstream>
5+
<remote-id type="github">GoogleCloudPlatform/guest-configs</remote-id>
6+
</upstream>
7+
</pkgmetadata>

sdk_container/src/third_party/coreos-overlay/app-emulation/google-compute-engine/google-compute-engine-20190124-r2.ebuild renamed to sdk_container/src/third_party/coreos-overlay/app-emulation/google-compute-engine/google-compute-engine-20190124-r3.ebuild

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,10 @@ RDEPEND="
2828
sys-apps/iproute2
2929
sys-apps/shadow
3030
"
31+
32+
src_install() {
33+
distutils-r1_src_install
34+
35+
# Newer versions are installed by app-admin/google-guest-configs.
36+
rm -v "${ED}"/usr/bin/google_{optimize_local_ssd,set_multiqueue} || die
37+
}

‎sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/oem-gce-20180823-r7.ebuild‎

Lines changed: 0 additions & 42 deletions
This file was deleted.

‎sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/oem-gce-20260102.ebuild‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Copyright (c) 2013 CoreOS, Inc.. All rights reserved.
2+
# Distributed under the terms of the GNU General Public License v2
3+
# Copyright (c) 2020 Kinvolk GmbH. All rights reserved.
4+
# Distributed under the terms of the GNU General Public License v2
5+
6+
EAPI=8
7+
8+
inherit systemd
9+
10+
DESCRIPTION="OEM suite for Google Compute Engine images"
11+
HOMEPAGE="https://cloud.google.com/products/compute-engine/"
12+
S="${WORKDIR}"
13+
14+
LICENSE="Apache-2.0"
15+
SLOT="0"
16+
KEYWORDS="amd64"
17+
18+
RDEPEND="
19+
app-admin/google-guest-configs
20+
app-emulation/google-compute-engine
21+
"
22+
23+
OEM_NAME="Google Compute Engine"
24+
25+
src_install() {
26+
systemd_dounit "${FILESDIR}"/units/{oem-gce,oem-gce-enable-oslogin,setup-oem}.service
27+
systemd_install_dropin multi-user.target "${FILESDIR}"/units/10-oem-gce.conf
28+
systemd_enable_service multi-user.target ntpd.service
29+
30+
dobin "${FILESDIR}"/bin/{enable-oslogin,init.sh}
31+
32+
# These files will be symlinked to /etc via 'setup-oem.service'
33+
insinto /usr/share/gce
34+
doins "${FILESDIR}"/files/{google-cloud-sdk.sh,hosts}
35+
}

‎sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-kernel/coreos-kernel-6.12.65.ebuild‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,10 @@ DEPEND="
5656
>=sys-kernel/coreos-firmware-20180103-r1:=
5757
sys-process/procps
5858
virtual/udev
59-
amd64? ( sys-firmware/intel-microcode:= )
59+
amd64? (
60+
app-admin/google-guest-configs
61+
sys-firmware/intel-microcode:=
62+
)
6063
"
6164

6265
src_prepare() {

0 commit comments

Comments
 (0)