From 3ceec9ba65f8d972008465239ce796bc3aa61dcd Mon Sep 17 00:00:00 2001 From: David Mendez Date: Fri, 9 Oct 2026 12:59:49 -0700 Subject: [PATCH 1/3] Gate nfs-server.service on /etc/nfs_disable Add a ConditionPathExists=!/etc/nfs_disable constraint to the nfs-server.service drop-in configuration. When the /etc/nfs_disable marker file exists, systemd will not start this service, even if explicitly requested via 'systemctl start'. This gating mechanism allows administrators to close port 2049 (NFS) by default on most appliance variants. Multiple Condition*= keys are ANDed together, preserving the existing container virtualization check. --- .../lib/systemd/system/nfs-server.service.d/override.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/files/common/lib/systemd/system/nfs-server.service.d/override.conf b/files/common/lib/systemd/system/nfs-server.service.d/override.conf index ba4723e3a..35729e2df 100644 --- a/files/common/lib/systemd/system/nfs-server.service.d/override.conf +++ b/files/common/lib/systemd/system/nfs-server.service.d/override.conf @@ -14,3 +14,11 @@ ExecStartPost=-/bin/sh -c "echo 65536 > /proc/fs/nfsd/max_connections" # running when inside of the container. # ConditionVirtualization=!container +# +# Administrators can close port 2049 by default on most appliance variants +# (see the Disable-NFS-Access design). While /etc/nfs_disable exists, +# systemd will not start this service -- even a manual "systemctl start" +# is a no-op. Multiple Condition*= keys are ANDed together, so this does +# not weaken the container check above. +# +ConditionPathExists=!/etc/nfs_disable From f5a29d7faaa2aa48bdbcd4876f29486735ee4417 Mon Sep 17 00:00:00 2001 From: David Mendez Date: Fri, 9 Oct 2026 13:02:47 -0700 Subject: [PATCH 2/3] Default nfs-server to disabled on image build, except leave-alone variants Co-Authored-By: Claude Haiku 4.5 --- .../roles/delphix-platform/tasks/main.yml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml index 0f20ed717..dc0f628a5 100644 --- a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml +++ b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml @@ -199,6 +199,30 @@ # - command: systemctl mask nfs-blkmap.service +# +# Close port 2049 by default on every appliance variant except the ones +# listed below (internal engineering/test/infra images, left untouched). +# A "delphix engine" variant (internal-dev, internal-qa, external-standard) +# re-enables this at setup time if VIRTUALIZATION is chosen -- see +# ProductServiceImpl#setEngineType(). DCT/Hyperscale/UCF variants never +# re-enable it; it is a permanent fact about those variants. +# +# ansible_is_chroot restricts this to image-build time ONLY. Without it, +# this task re-runs on every real engine's first boot after every upgrade +# of the delphix-platform package (debian/prerm deletes ansible-done on +# every upgrade), which would recreate /etc/nfs_disable on a live +# VIRTUALIZATION/BOTH engine and silently undo NfsServerAccess.enable(). +# Existing engines are retrofitted by UpgradeManagerImpl#postUpgradeCleanup +# instead -- keep the leave-alone list below in sync with that Java logic. +# +- file: + path: /etc/nfs_disable + state: touch + when: + - ansible_is_chroot + - variant not in ['internal-minimal', 'internal-unittest', 'internal-dcenter', + 'internal-buildserver', 'internal-package-mirror', 'internal-claude'] + # # By default, the ulimit for core files is set to 0, and the default # filename and location for a core file is 'core' in the cwd. Update From 812d616ee0a577267ef7ab61806d79f40a5c151a Mon Sep 17 00:00:00 2001 From: David Mendez Date: Mon, 19 Oct 2026 09:15:27 -0700 Subject: [PATCH 3/3] CP-13821 Fix final-review wording: mention BOTH, remove non-existent admin-control framing PR URL: https://www.github.com/delphix/delphix-platform/pull/581 Co-Authored-By: Claude Sonnet 5 --- .../systemd/system/nfs-server.service.d/override.conf | 10 +++++----- .../roles/delphix-platform/tasks/main.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/files/common/lib/systemd/system/nfs-server.service.d/override.conf b/files/common/lib/systemd/system/nfs-server.service.d/override.conf index 35729e2df..ebed4958a 100644 --- a/files/common/lib/systemd/system/nfs-server.service.d/override.conf +++ b/files/common/lib/systemd/system/nfs-server.service.d/override.conf @@ -15,10 +15,10 @@ ExecStartPost=-/bin/sh -c "echo 65536 > /proc/fs/nfsd/max_connections" # ConditionVirtualization=!container # -# Administrators can close port 2049 by default on most appliance variants -# (see the Disable-NFS-Access design). While /etc/nfs_disable exists, -# systemd will not start this service -- even a manual "systemctl start" -# is a no-op. Multiple Condition*= keys are ANDed together, so this does -# not weaken the container check above. +# Port 2049 (NFS) is closed by default on most appliance variants: image +# build creates /etc/nfs_disable, and while it exists systemd will not +# start this service -- even a manual "systemctl start" is a no-op. Multiple +# Condition*= keys are ANDed together, so this does not weaken the container +# check above. # ConditionPathExists=!/etc/nfs_disable diff --git a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml index dc0f628a5..dd0ad5b33 100644 --- a/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml +++ b/files/common/var/lib/delphix-platform/ansible/10-delphix-platform/roles/delphix-platform/tasks/main.yml @@ -203,7 +203,7 @@ # Close port 2049 by default on every appliance variant except the ones # listed below (internal engineering/test/infra images, left untouched). # A "delphix engine" variant (internal-dev, internal-qa, external-standard) -# re-enables this at setup time if VIRTUALIZATION is chosen -- see +# re-enables this at setup time if VIRTUALIZATION or BOTH is chosen -- see # ProductServiceImpl#setEngineType(). DCT/Hyperscale/UCF variants never # re-enable it; it is a permanent fact about those variants. #