Skip to content

Instantly share code, notes, and snippets.

@bcressey
bcressey / admin.template
Created February 14, 2025 22:13
EKS hybrid nodes for Bottlerocket (via IAM-RA)
{
"user": "${SSH_USER}",
"ssh": {
"authorized-keys": [
"${SSH_AUTHORIZED_KEY}"
]
}
}
@bcressey
bcressey / admin.template
Created February 14, 2025 22:13
EKS hybrid nodes for Bottlerocket (via SSM)
{
"user": "${SSH_USER}",
"ssh": {
"authorized-keys": [
"${SSH_AUTHORIZED_KEY}"
]
}
}
@bcressey
bcressey / oh-containers.sh
Created June 4, 2024 17:27
where to put modprobe
#!/bin/bash
for c in \
alpine:latest \
debian:stretch \
debian:buster \
debian:bullseye \
debian:bookworm \
fedora:32 \
fedora:33 \
@bcressey
bcressey / diff-report
Created May 1, 2024 03:06
kernel-6.1 invariant changes
==> configs/config-aarch64-aws-dev-diff <==
CRC8 n -> m
FM10K n -> m
FW_LOADER_COMPRESS n -> y
I40E n -> m
ICE n -> m
IGBVF n -> m
IXGB n -> m
IXGBE n -> m
KEYBOARD_ATKBD n -> m
From d1e4a7bacc3725852b25c1c23ceef474d4a0468f Mon Sep 17 00:00:00 2001
From: Ben Cressey <bcressey@amazon.com>
Date: Sat, 30 Mar 2024 15:25:47 +0000
Subject: [PATCH] libsepol/cil: check common perms for "all" verification
Otherwise, the verifier will reject the "all" operator when used for
a class whose only permissions come through "classcommon".
Signed-off-by: Ben Cressey <bcressey@amazon.com>
---
@bcressey
bcressey / config-bottlerocket-aarch64-kernel-5.10
Last active July 6, 2022 22:13
disable uncommon filesystem and network protocols
-ATM_BR2684 m
-ATM_BR2684_IPFILTER n
-ATM_CLIP m
-ATM_CLIP_NO_ICMP n
-ATM_DRIVERS n
-ATM_LANE m
-ATM_MPOA n
-CAN_8DEV_USB n
-CAN_BCM m
-CAN_CALC_BITTIMING y