[Ovirt-devel] [PATCH] Add additional blacklisting and rpm removal to managed node
Perry N. Myers
pmyers at redhat.com
Tue Jul 1 00:05:45 UTC 2008
Chris Lalancette wrote:
> Perry Myers wrote:
>> A few important notes:
>> 1. /lib/modules was scoured for things that didn't seem necessary, however
>> my notion of not necessary may not be correct. Please review the list
>> of modules that I'm removing and if you see one that we need to add back
>> in, comment.
>> 2. /boot is removed as we don't need an initrd and kernel image inside of
>> the livecd initrd.
>
> Ah yes, good to remove this, since it is superflous.
>
>> 3. The blacklisting method is a hack. What we need is an appliance creator
>> that has black/whitelisting capabilities... (hint, hint to our AOS
>> friends out there)
>>
>> The ISO image RPM is down to 45MB
>> PXE image RPM is at 52MB
>> Running filesystem is 130MB
>
> My question is: so? I don't really see how it's much of an improvement over
> what we already have. Or rather, it's an improvement, but in my opinion the
> cost (breaking RPM, breaking RPM dependencies, etc) is too high.
This patch doesn't break RPM. It does break some dependencies since we're
doing rpm -e --nodeps on a handful of packages. But this is necessary if
we want the embedded hypervisor to live up to its name (i.e. embedded).
As to whether or not living up to the embedded moniker is important,
that's a completely different issue.
>> echo "Removing excess kernel modules"
>> MODULES="/lib/modules/*/kernel"
>> @@ -438,16 +421,60 @@ fs_mods="fs/nls fs/9p fs/affs fs/autofs fs/autofs4 fs/befs fs/bfs fs/cifs \
>> net_mods="net/802 net/8021q net/9p net/appletalk net/atm net/ax25 \
>> net/bluetooth net/dccp net/decnet net/ieee80211 net/ipx net/irda \
>> net/mac80211 net/netrom net/rfkill net/rose net/sched net/tipc \
>> - net/wanrouter net/wireless drivers/auxdisplay drivers/net/appletalk \
>> + net/wanrouter net/wireless"
>> +
>> +driver_mods="drivers/auxdisplay drivers/net/appletalk \
>> drivers/net/hamradio drivers/net/pcmcia drivers/net/tokenring \
>> - drivers/net/wireless drivers/net/irda drivers/atm drivers/usb/atm"
>> + drivers/net/wireless drivers/net/irda drivers/atm drivers/usb/atm \
>> + drivers/acpi drivers/char/drm drivers/char/hw_random drivers/char/mwave \
>
> We probably want to keep hw_random for feeding the random number generator in
> the future, especially because: a) we don't keep our entropy pool across
> reboots, b) we might be running diskless, and c) not all NIC devices contribute
> entropy.
I'll add these back in and resubmit the patch.
>> + drivers/char/ipmp drivers/char/pcmcia drivers/crypto drivers/dca \
>> + drivers/dma drivers/edac drivers/firmware drivers/hwmon
>
> We definitely need to keep drivers/edac around for reporting errors. Same goes
> for drivers/hwmon
Ditto
>> + drivers/memstick drivers/mmc drivers/mfs drivers/parport \
>> + drivers/serial drivers/video drivers/watchdog drivers/net/ppp* \
>> + drivers/usb/serial drivers/usb/misc drivers/usb/class \
>> + drivers/usb/image drivers/rtc"
>
> The serial stuff will be useful for debugging, and some administrators might
> want to use a serial concentrator to see what's going on with their nodes.
Ditto, though we don't provide a way to change the boot options so that
serial console is enabled. Should we do this by default perhaps? I'd be
tempted to put drivers/serial in but not drivers/usb/serial as that's sort
of a fringe case. Most people are going to have real serial ports on
servers, probably not needing USB serial devices.
>>
>> misc_mods="drivers/bluetooth drivers/firewire drivers/i2c drivers/isdn \
>> drivers/media drivers/misc drivers/leds drivers/mtd drivers/w1 sound \
>> - drivers/input drivers/pcmcia drivers/scsi/pcmcia"
>> + drivers/input drivers/pcmcia drivers/scsi/pcmcia arch/x86/oprofile \
>> + crypto lib"
>
> oprofile might be useful in the future, for profiling the nodes, but we haven't
> given any thought to it yet.
It's small anyhow. I'll add it back in.
>>
>> -for mods in $fs_mods $net_mods $misc_mods ; do
>> +for mods in $fs_mods $net_mods $misc_mods $driver_mods ; do
>> $RM $MODULES/$mods
>> done
>>
>> -echo "Finished Kickstart Post"
>> +echo "Removing all timezones except for UTC"
>> +find /usr/share/zoneinfo -regextype egrep -type f \
>> + ! -regex ".*/UTC" -exec $RM {} \;
>> +# XXX anaconda/timezone.py does it, missing in imgcreate/kickstart.py
>> +cp /usr/share/zoneinfo/UTC /etc/localtime
>> +
>> +echo "Removing blacklisted files and directories"
>> +blacklist="/boot /etc/alsa /etc/pki /usr/share/hwdata/MonitorsDB \
>> + /usr/share/hwdata/oui.txt /usr/share/hwdata/videoaliases \
>> + /usr/share/hwdata/videodrivers /usr/share/fedora-release \
>> + /usr/share/tabset /usr/share/libvirt /usr/share/augeas/lenses/tests \
>> + /usr/share/tc /usr/share/emacs /usr/share/info /usr/kerberos \
>> + /usr/src /usr/etc /usr/games /usr/include /usr/local /usr/lib64/python2.5 \
>> + /usr/lib64/tc /usr/lib64/tls /usr/lib64/sse2 /usr/lib64/pkgconfig \
>> + /usr/lib64/nss /usr/lib64/X11 /usr/lib64/games /usr/lib64/alsa-lib \
>> + /usr/lib64/fs/reiserfs /usr/lib64/krb5 /usr/lib64/hal /usr/lib64/gio \
>> + /usr/bin/hal-device /usr/bin/hal-disable-polling \
>> + /usr/bin/hal-find-by-capability /usr/bin/hal-find-by-property \
>> + /usr/bin/hal-is-caller-locked-out /usr/bin/hal-is-caller-privileged \
>> + /usr/bin/hal-lock /usr/bin/hal-set-property /usr/bin/hal-setup-keymap \
>> + /usr/sbin/dell* /lib/terminfo/d /lib/terminfo/v /lib/terminfo/a \
>> + /lib/firmware /lib/security /usr/lib/locale /usr/lib/syslinux \
>> + /usr/lib64/gconv /usr/lib64/pango /usr/lib64/libpango* /etc/pango \
>> + /usr/bin/pango*"
>> +
>> +docs_blacklist="/usr/share/omf /usr/share/gnome /usr/share/doc \
>> + /usr/share/locale /usr/share/libthai /usr/share/man /usr/share/terminfo \
>> + /usr/share/X11 /usr/share/i18n"
>> +
>> +$RM $blacklist $docs_blacklist
>> +
>> +echo "Cleanup empty directory structures in /usr/share"
>> +find /usr/share -type d -exec rmdir {} \; > /dev/null 2>&1
>> +
>> +echo "Finished Kickstart Common Post"
>
> Overall, seems to be breaking a lot of debug and reproducibility functionality
> for very little gain.
I don't see how this break reproducibility. There will be one image, just
stripped down to be smaller. As for breaking debug, I'll add
serial/oprofile mods back in, so with those added back do you feel that
anything else breaks debugging support?
Perry
--
|=- Red Hat, Engineering, Emerging Technologies, Boston -=|
|=- Email: pmyers at redhat.com -=|
|=- Office: +1 412 474 3552 Mobile: +1 703 362 9622 -=|
|=- GnuPG: E65E4F3D 88F9 F1C9 C2F3 1303 01FE 817C C5D2 8B91 E65E 4F3D -=|
More information about the ovirt-devel
mailing list