From 2eabfd77ffbce2b8f4a4c2c5689e783deb9f5766 Mon Sep 17 00:00:00 2001 From: Dmitry Tantsur Date: Fri, 21 Aug 2020 18:48:15 +0200 Subject: [PATCH] Make the iPXE and PXE boot files world-readable Change-Id: I8ac09e69149d7855cc754e15bd379170f822ee01 --- .../tasks/create_tftpboot.yml | 20 +++++++++++++++++++ .../notes/pxe-acl-26f3be809caa0c88.yaml | 4 ++++ 2 files changed, 24 insertions(+) create mode 100644 releasenotes/notes/pxe-acl-26f3be809caa0c88.yaml diff --git a/playbooks/roles/bifrost-ironic-install/tasks/create_tftpboot.yml b/playbooks/roles/bifrost-ironic-install/tasks/create_tftpboot.yml index 2018cd089..3ef022186 100644 --- a/playbooks/roles/bifrost-ironic-install/tasks/create_tftpboot.yml +++ b/playbooks/roles/bifrost-ironic-install/tasks/create_tftpboot.yml @@ -49,6 +49,16 @@ - name: "Copy full iPXE image into /tftpboot" copy: src={{ ipxe_dir }}/{{ ipxe_full_binary }} dest=/tftpboot/ remote_src=true +- name: Make boot files owned by ironic and world-readable + file: + path: "{{ item }}" + mode: 0644 + owner: ironic + group: ironic + loop: + - /tftpboot/undionly.kpxe + - "/tftpboot/{{ ipxe_full_binary }}" + - name: "Set up iPXE for EFI booting" block: - name: "Check if the iPXE EFI image is present" @@ -72,6 +82,16 @@ - name: "Copy iPXE EFI image into /tftpboot" copy: src={{ ipxe_dir }}/{{ ipxe_efi_binary }} dest=/tftpboot/ remote_src=true + + - name: Make UEFI boot files owned by ironic and world-readable + file: + path: "{{ item }}" + mode: 0644 + owner: ironic + group: ironic + loop: + - "/tftpboot/{{ ipxe_efi_binary }}" + - "{{ http_boot_folder }}/{{ ipxe_efi_binary }}" when: enable_uefi_ipxe | bool == true # Similar logic to below can be utilized to retrieve files diff --git a/releasenotes/notes/pxe-acl-26f3be809caa0c88.yaml b/releasenotes/notes/pxe-acl-26f3be809caa0c88.yaml new file mode 100644 index 000000000..a9136be93 --- /dev/null +++ b/releasenotes/notes/pxe-acl-26f3be809caa0c88.yaml @@ -0,0 +1,4 @@ +--- +fixes: + - | + Fixes ACL of PXE and iPXE boot files to make sure they are world-readable.