Image Builder의 보안 모범 사례

Image Builder 파이프라인은 최종 이미지가 보안 모범 사례를 따르는지 확인하고 스냅샷으로 전달해서는 안 되는 빌드 아티팩트 또는 설정을 제거하는 데 도움이 되는 정리 스크립트를 실행합니다. 하지만 스크립트의 일부 섹션을 건너뛰거나 사용자 데이터를 완전히 오버라이드할 수 있습니다. 따라서 Image Builder 파이프라인에서 생성된 이미지가 특정 규제 기준을 반드시 준수하는 것은 아닙니다.

파이프라인이 빌드 및 테스트 단계를 완료하면 Image Builder는 출력 이미지를 생성하기 직전에 다음 정리 스크립트를 자동으로 실행합니다.

파일 정리가 완료되면 Image Builder는 Systems Manager 에이전트를 제거하고 cronie 패키지를 제거하는 단계를 스크립트에 추가합니다. Image Builder는 /tmp/imagebuilder_service 서비스 작업 디렉터리의 빌드 중에 설치한 내용을 추적합니다. Image Builder는 이러한 마커를 사용하여 제거할 대상을 결정합니다.

#!/bin/bash
if [[ ! -f {{workingDirectory}}/perform_cleanup ]]; then
    echo "Skipping cleanup"
    exit 0
else
    sudo rm -f {{workingDirectory}}/perform_cleanup
fi

function cleanup() {
    FILES=("$@")
    for FILE in "${FILES[@]}"; do
        if [[ -f "$FILE" ]]; then
            echo "Deleting $FILE";
            sudo shred -zuf $FILE;
        fi;
        if [[ -f $FILE ]]; then
            echo "Failed to delete '$FILE'. Failing."
            exit 1
        fi;
    done
};


# Clean up for cloud-init files
CLOUD_INIT_FILES=(
    "/etc/sudoers.d/90-cloud-init-users"
    "/etc/locale.conf"
    "/var/log/cloud-init.log"
    "/var/log/cloud-init-output.log"
)
if [[ -f {{workingDirectory}}/skip_cleanup_cloudinit_files ]]; then
    echo "Skipping cleanup of cloud init files"
else
    echo "Cleaning up cloud init files"
    cleanup "${CLOUD_INIT_FILES[@]}"
    if [[ -d "/var/lib/cloud" ]]; then
        if [[ $( sudo find /var/lib/cloud -type f | sudo wc -l ) -gt 0 ]]; then
            echo "Deleting files within /var/lib/cloud/*"
            sudo find /var/lib/cloud -type f -exec shred -zuf {} \;
        fi;

        if [[ $( sudo ls /var/lib/cloud | sudo wc -l ) -gt 0 ]]; then
            echo "Deleting /var/lib/cloud/*"
            sudo rm -rf /var/lib/cloud/* || true
        fi;
    fi;
fi;


# Clean up for temporary instance files
INSTANCE_FILES=(
    "/etc/.updated"
    "/etc/aliases.db"
    "/etc/hostname"
    "/var/lib/misc/postfix.aliasesdb-stamp"
    "/var/lib/postfix/master.lock"
    "/var/spool/postfix/pid/master.pid"
    "/var/.updated"
    "/var/cache/yum/x86_64/2/.gpgkeyschecked.yum"
)
if [[ -f {{workingDirectory}}/skip_cleanup_instance_files ]]; then
    echo "Skipping cleanup of instance files"
else
    echo "Cleaning up instance files"
    cleanup "${INSTANCE_FILES[@]}"
fi;


# Clean up for ssh files
SSH_FILES=(
    "/etc/ssh/ssh_host_rsa_key"
    "/etc/ssh/ssh_host_rsa_key.pub"
    "/etc/ssh/ssh_host_ecdsa_key"
    "/etc/ssh/ssh_host_ecdsa_key.pub"
    "/etc/ssh/ssh_host_ed25519_key"
    "/etc/ssh/ssh_host_ed25519_key.pub"
    "/root/.ssh/authorized_keys"
)
if [[ -f {{workingDirectory}}/skip_cleanup_ssh_files ]]; then
    echo "Skipping cleanup of ssh files"
else
    echo "Cleaning up ssh files"
    cleanup "${SSH_FILES[@]}"
    USERS=$(ls /home/)
    for user in $USERS; do
        echo Deleting /home/"$user"/.ssh/authorized_keys;
        sudo find /home/"$user"/.ssh/authorized_keys -type f -exec shred -zuf {} \;
    done
    for user in $USERS; do
        if [[ -f /home/"$user"/.ssh/authorized_keys ]]; then
            echo Failed to delete /home/"$user"/.ssh/authorized_keys;
            exit 1
        fi;
    done;
fi;


# Clean up for instance log files
INSTANCE_LOG_FILES=(
    "/var/log/audit/audit.log"
    "/var/log/boot.log"
    "/var/log/dmesg"
    "/var/log/cron"
)
if [[ -f {{workingDirectory}}/skip_cleanup_instance_log_files ]]; then
    echo "Skipping cleanup of instance log files"
else
    echo "Cleaning up instance log files"
    cleanup "${INSTANCE_LOG_FILES[@]}"
fi;

# Clean up for TOE files
if [[ -f {{workingDirectory}}/skip_cleanup_toe_files ]]; then
    echo "Skipping cleanup of TOE files"
else
    echo "Cleaning TOE files"
    shopt -s nullglob
    TOE_MATCHES=({{workingDirectory}}/TOE_*)
    shopt -u nullglob
    if [[ ${#TOE_MATCHES[@]} -gt 0 ]]; then
        if [[ $( sudo find "${TOE_MATCHES[@]}" -type f | sudo wc -l) -gt 0 ]]; then
            echo "Deleting files within {{workingDirectory}}/TOE_*"
            sudo find "${TOE_MATCHES[@]}" -type f -exec shred -zuf {} \;
        fi
        shopt -s nullglob
        TOE_REMAINING=({{workingDirectory}}/TOE_*)
        shopt -u nullglob
        if [[ ${#TOE_REMAINING[@]} -gt 0 ]]; then
            if [[ $( sudo find "${TOE_REMAINING[@]}" -type f | sudo wc -l) -gt 0 ]]; then
                echo "Failed to delete {{workingDirectory}}/TOE_*"
                exit 1
            fi
            echo "Deleting {{workingDirectory}}/TOE_*"
            sudo rm -rf "${TOE_REMAINING[@]}"
        fi
        shopt -s nullglob
        TOE_FINAL=({{workingDirectory}}/TOE_*)
        shopt -u nullglob
        if [[ ${#TOE_FINAL[@]} -gt 0 ]]; then
            echo "Failed to delete {{workingDirectory}}/TOE_*"
            exit 1
        fi
    fi
fi

# Clean up for ssm log files
if [[ -f {{workingDirectory}}/skip_cleanup_ssm_log_files ]]; then
    echo "Skipping cleanup of ssm log files"
else
    echo "Cleaning up ssm log files"
    if [[ -d "/var/log/amazon/ssm" ]]; then
        if [[ $( sudo find /var/log/amazon/ssm -type f | sudo wc -l) -gt 0 ]]; then
            echo "Deleting files within /var/log/amazon/ssm/*"
            sudo find /var/log/amazon/ssm -type f -exec shred -zuf {} \;
        fi
        if [[ $( sudo find /var/log/amazon/ssm -type f | sudo wc -l) -gt 0 ]]; then
            echo "Failed to delete /var/log/amazon/ssm"
            exit 1
        fi
        echo "Deleting /var/log/amazon/ssm/*"
        sudo rm -rf /var/log/amazon/ssm
        if [[ -d "/var/log/amazon/ssm" ]]; then
            echo "Failed to delete /var/log/amazon/ssm"
            exit 1
        fi
    fi
fi


shopt -s nullglob
SA_MATCHES=(/var/log/sa/sa*)
shopt -u nullglob
if [[ ${#SA_MATCHES[@]} -gt 0 ]]; then
    echo "Deleting /var/log/sa/sa*"
    sudo shred -zuf "${SA_MATCHES[@]}"
    shopt -s nullglob
    SA_REMAINING=(/var/log/sa/sa*)
    shopt -u nullglob
    if [[ ${#SA_REMAINING[@]} -gt 0 ]]; then
        echo "Failed to delete /var/log/sa/sa*"
        exit 1
    fi
fi

shopt -s nullglob
DHCLIENT_MATCHES=(/var/lib/dhclient/dhclient*.lease)
shopt -u nullglob
if [[ ${#DHCLIENT_MATCHES[@]} -gt 0 ]]; then
    echo "Deleting /var/lib/dhclient/dhclient*.lease"
    sudo shred -zuf "${DHCLIENT_MATCHES[@]}"
    shopt -s nullglob
    DHCLIENT_REMAINING=(/var/lib/dhclient/dhclient*.lease)
    shopt -u nullglob
    if [[ ${#DHCLIENT_REMAINING[@]} -gt 0 ]]; then
        echo "Failed to delete /var/lib/dhclient/dhclient*.lease"
        exit 1
    fi
fi

if [[ $( sudo find /var/tmp -type f | sudo wc -l) -gt 0 ]]; then
    echo "Deleting files within /var/tmp/*"
    sudo find /var/tmp -type f -exec shred -zuf {} \;
fi
if [[ $( sudo find /var/tmp -type f | sudo wc -l) -gt 0 ]]; then
    echo "Failed to delete /var/tmp"
    exit 1
fi
if [[ $( sudo ls /var/tmp | sudo wc -l ) -gt 0 ]]; then
    echo "Deleting /var/tmp/*"
    sudo rm -rf /var/tmp/*
fi

if [[ -f "/var/lib/systemd/random-seed" ]]; then
    echo "Deleting /var/lib/systemd/random-seed"
    sudo shred -zuf /var/lib/systemd/random-seed
    sudo rm -f /var/lib/systemd/random-seed
fi

# Shredding is not guaranteed to work well on rolling logs

if [[ -f "/var/lib/rsyslog/imjournal.state" ]]; then
    echo "Deleting /var/lib/rsyslog/imjournal.state"
    sudo shred -zuf /var/lib/rsyslog/imjournal.state
    sudo rm -f /var/lib/rsyslog/imjournal.state
fi

if [[ -d "/var/log/journal" ]] && [[ $( sudo ls /var/log/journal/ | sudo wc -l ) -gt 0 ]]; then
    echo "Deleting /var/log/journal/*"
    sudo find /var/log/journal/ -type f -exec shred -zuf {} \;
    sudo rm -rf /var/log/journal/*
fi

if [[ -f "/etc/machine-id" ]]; then
    echo "Truncating /etc/machine-id"
    sudo truncate -s 0 /etc/machine-id
fi

if [[ -f "/var/lib/dbus/machine-id" ]]; then
    echo "Truncating /var/lib/dbus/machine-id"
    sudo truncate -s 0 /var/lib/dbus/machine-id
fi

sudo touch /etc/machine-id

# Flush all pending writes to disk before instance shutdown and snapshot
sync

echo "Sanitize OK"


###############################################################################
# Image Builder appends the following steps to the clean up script to uninstall
# the Systems Manager (SSM) agent and, on Amazon Linux 1, Amazon Linux 2, and
# Amazon Linux 2023, to remove the cronie package when Image Builder installed a
# crontab during the build. Image Builder uses the /tmp/imagebuilder_service
# working directory to track what it installed.
###############################################################################

SERVICE_ROOT_WORKING_DIR="/tmp/imagebuilder_service"

# SSM_UNINSTALL_CONDITION reflects the systemsManagerAgent.uninstallAfterBuild
# recipe setting and how the SSM agent was installed:
#   SSM_INSTALLED_BY_CUSTOMER      - always uninstall the SSM agent
#   SSM_INSTALLED_BY_IMAGE_BUILDER - uninstall only if Image Builder installed it
#   (any other value)              - leave the SSM agent in the final image
SSM_UNINSTALL_CONDITION="<uninstallAfterBuild condition>"

function error_exit {
  echo "$1" 1>&2
  exit 1
}

function ssm_exists() {
  eval "$1"  > /dev/null 2>&1
  echo $?
}

function cleanup_image() {
  rm -rf "${SERVICE_ROOT_WORKING_DIR}"
}

function uninstall_ssm_agent() {

  uninstall_package="$1"
  uninstall_all=""
  uninstall_success="false"

  if [ "${uninstall_package}" == "" ]; then
    uninstall_all="true"
  fi

  yum="sudo yum search amazon-ssm-agent | grep amazon-ssm-agent"
  snap="sudo snap list amazon-ssm-agent"
  rpm="sudo rpm -qa amazon-ssm-agent | grep amazon-ssm-agent"
  dpkg="sudo dpkg --get-selections | grep amazon-ssm-agent"
  pkg="su -m root -c \"pkg info -l amazon-ssm-agent | grep amazon-ssm-agent\""


  if [[ ("${uninstall_all}" == "true" || "${uninstall_package}" == "snap") && $(ssm_exists "${snap}") -eq 0 ]]; then
    echo "Package found in Snap.... Uninstalling"
    (sleep 30 ; sudo snap remove amazon-ssm-agent) &>/dev/null &
    uninstall_success="true"
  fi

  if [[ ("${uninstall_all}" == "true" || "${uninstall_package}" == "yum") && $(ssm_exists "${yum}") -eq 0 ]]; then
    echo "Package found in Yum.... Uninstalling"
    (sleep 30 ; sudo yum remove -y amazon-ssm-agent) &>/dev/null &
    uninstall_success="true"
  fi

  if [[ ("${uninstall_all}" == "true" || "${uninstall_package}" == "rpm") && $(ssm_exists "${rpm}") -eq 0 ]]; then
    echo "Package found in Rpm.... Uninstalling"
    (sleep 30 ; sudo rpm -e amazon-ssm-agent) &>/dev/null &
    uninstall_success="true"
  fi

  if [[ ("${uninstall_all}" == "true" || "${uninstall_package}" == "dpkg") && $(ssm_exists "${dpkg}") -eq 0 ]]; then
    echo "Package found in Dpkg.... Uninstalling"
    (sleep 30 ; sudo dpkg -r --force-all amazon-ssm-agent) &>/dev/null &
    uninstall_success="true"
  fi

  if [[ ("${uninstall_all}" == "true" || "${uninstall_package}" == "pkg") && $(ssm_exists "${pkg}") -eq 0 ]]; then
    echo "Package found in FreeBSD.... Uninstalling"
    (sleep 30 ; su -m root -c "pkg remove -y amazon-ssm-agent") &> /dev/null &
    uninstall_success="true"
  fi

  if [ "${uninstall_success}" == "false" ] ; then
    error_exit "Unable to uninstall an SSM agent"
  fi
}

# Amazon Linux releases where Image Builder installs cronie to provide a crontab:
# Amazon Linux AMI (AL1), AL2, and AL2023.
function is_cronie_supported_amazon_linux() {
    if [ "$(get_os_type)" != "amzn" ]; then
        return 1
    fi
    case "$(get_os_version)" in
        2|2023) return 0 ;;
        # AL1 releases use date-based versions from 2010 through 2018.
        201[0-8].[0-9][0-9]) return 0 ;;
        *) return 1 ;;
    esac
}

function uninstall_crontab() {
    if is_cronie_supported_amazon_linux ; then
        echo "Uninstalling cronie package"
        sudo yum remove -y cronie
    fi
}

function get_os_type() {
    FILE=/etc/os-release
    if [ -e $FILE ]; then
        . $FILE
        echo $ID
    else
        echo ""
    fi
}

function get_os_version() {
    FILE=/etc/os-release
    if [ -e $FILE ]; then
        . $FILE
        echo $VERSION_ID
    else
        echo ""
    fi
}

if [ "${SSM_UNINSTALL_CONDITION}" == "SSM_INSTALLED_BY_CUSTOMER" ] ; then
  echo "Uninstall after build set to true. Uninstalling SSM agent."
  uninstall_ssm_agent

elif [ "${SSM_UNINSTALL_CONDITION}" == "SSM_INSTALLED_BY_IMAGE_BUILDER" ] ; then
  echo "Checking if the SSM agent was installed by Image Builder"
  if [[ -f ${SERVICE_ROOT_WORKING_DIR}/ssm_installed ]] ; then
    package_manager="$(cat ${SERVICE_ROOT_WORKING_DIR}/ssm_installed)"
    echo "Uninstalling the SSM agent installed by Image Builder using ${package_manager}"
    uninstall_ssm_agent "${package_manager}"
  fi
else
  echo "Uninstall after build set to false. Skipping SSM agent uninstall."
fi

# When Image Builder installs a crontab during the build (on Amazon Linux 1,
# Amazon Linux 2, or Amazon Linux 2023), it records a crontab_installed marker
# and removes the cronie package here. To keep cronie in your final image,
# delete the marker before clean up runs:
#   rm -f /tmp/imagebuilder_service/crontab_installed
if [[ -f ${SERVICE_ROOT_WORKING_DIR}/crontab_installed ]] ; then
  echo "Uninstalling crontab installed by Image Builder"
  uninstall_crontab
fi

cleanup_image

Image Builder 파이프라인은 Windows 이미지를 사용자 지정한 후 Microsoft Sysprep 유틸리티를 실행합니다. 이러한 작업은 AWS 이미지 강화 및 정리 모범 사례를 따릅니다.

Image Builder 파이프라인은 최종 이미지가 보안 모범 사례를 따르는지 확인하고 스냅샷으로 전달해서는 안 되는 빌드 아티팩트 또는 설정을 제거하는 데 도움이 되는 정리 스크립트를 실행합니다. 하지만 스크립트의 일부 섹션을 건너뛰거나 사용자 데이터를 완전히 오버라이드할 수 있습니다. 따라서 Image Builder 파이프라인에서 생성된 이미지가 특정 규제 기준을 반드시 준수하는 것은 아닙니다.

파이프라인이 빌드 및 테스트 단계를 완료하면 Image Builder는 출력 이미지를 생성하기 직전에 다음 정리 스크립트를 자동으로 실행합니다.

#!/bin/bash
if [[ ! -f {{workingDirectory}}/perform_cleanup ]]; then
  echo "Skipping cleanup"
  exit 0
else
  sudo rm -f {{workingDirectory}}/perform_cleanup
fi

function cleanup() {
  FILES=("$@")
  for FILE in "${FILES[@]}"; do
      if [[ -f "$FILE" ]]; then
          echo "Deleting $FILE";
          sudo rm -f $FILE;
      fi;
      if [[ -f $FILE ]]; then
          echo "Failed to delete '$FILE'. Failing."
          exit 1
      fi;
  done
};

# Reset EC2 macOS Init instance history so the image behaves as a first boot
if [[ -f {{workingDirectory}}/skip_cleanup_ec2_macos_init_files ]]; then
  echo "Skipping cleanup of ec2-macos-init instance history"
else
  echo "Cleaning up ec2-macos-init instance history"
  if [[ -x /usr/local/bin/ec2-macos-init ]]; then
      sudo /usr/local/bin/ec2-macos-init clean -all
  fi
fi

# Clean up for temporary instance files
INSTANCE_FILES=(
  "/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist"
)
if [[ -f {{workingDirectory}}/skip_cleanup_instance_files ]]; then
  echo "Skipping cleanup of instance files"
else
  echo "Cleaning up instance files"
  cleanup "${INSTANCE_FILES[@]}"
fi;


# Clean up for ssh files
SSH_FILES=(
  "/etc/ssh/ssh_host_rsa_key"
  "/etc/ssh/ssh_host_rsa_key.pub"
  "/etc/ssh/ssh_host_ecdsa_key"
  "/etc/ssh/ssh_host_ecdsa_key.pub"
  "/etc/ssh/ssh_host_ed25519_key"
  "/etc/ssh/ssh_host_ed25519_key.pub"
  "/var/root/.ssh/authorized_keys"
)
if [[ -f {{workingDirectory}}/skip_cleanup_ssh_files ]]; then
  echo "Skipping cleanup of ssh files"
else
  echo "Cleaning up ssh files"
  cleanup "${SSH_FILES[@]}"
  USERS=$(ls /Users/)
  for user in $USERS; do
      if [[ -f /Users/"$user"/.ssh/authorized_keys ]]; then
          echo Deleting /Users/"$user"/.ssh/authorized_keys;
          sudo rm -f /Users/"$user"/.ssh/authorized_keys;
      fi;
  done
  for user in $USERS; do
      if [[ -f /Users/"$user"/.ssh/authorized_keys ]]; then
          echo Failed to delete /Users/"$user"/.ssh/authorized_keys;
          exit 1
      fi;
  done;
fi;


# Clean up for instance log files
INSTANCE_LOG_FILES=(
  "/var/log/amazon/ec2/ec2-macos-init.log"
  "/var/log/amazon/ec2/ena-ethernet.log"
  "/var/log/amazon/ec2/system-monitoring.log"
)
if [[ -f {{workingDirectory}}/skip_cleanup_instance_log_files ]]; then
  echo "Skipping cleanup of instance log files"
else
  echo "Cleaning up instance log files"
  cleanup "${INSTANCE_LOG_FILES[@]}"
fi;

# Clean up for TOE files
if [[ -f {{workingDirectory}}/skip_cleanup_toe_files ]]; then
  echo "Skipping cleanup of TOE files"
else
  echo "Cleaning TOE files"
  shopt -s nullglob
  TOE_MATCHES=({{workingDirectory}}/TOE_*)
  shopt -u nullglob
  if [[ ${#TOE_MATCHES[@]} -gt 0 ]]; then
      if [[ $( sudo find "${TOE_MATCHES[@]}" -type f | sudo wc -l) -gt 0 ]]; then
          echo "Deleting files within {{workingDirectory}}/TOE_*"
          sudo find "${TOE_MATCHES[@]}" -type f -exec rm -f {} \;
      fi
      shopt -s nullglob
      TOE_REMAINING=({{workingDirectory}}/TOE_*)
      shopt -u nullglob
      if [[ ${#TOE_REMAINING[@]} -gt 0 ]]; then
          if [[ $( sudo find "${TOE_REMAINING[@]}" -type f | sudo wc -l) -gt 0 ]]; then
              echo "Failed to delete {{workingDirectory}}/TOE_*"
              exit 1
          fi
          echo "Deleting {{workingDirectory}}/TOE_*"
          sudo rm -rf "${TOE_REMAINING[@]}"
      fi
      shopt -s nullglob
      TOE_FINAL=({{workingDirectory}}/TOE_*)
      shopt -u nullglob
      if [[ ${#TOE_FINAL[@]} -gt 0 ]]; then
          echo "Failed to delete {{workingDirectory}}/TOE_*"
          exit 1
      fi
  fi
fi

# Clean up for ssm log files
if [[ -f {{workingDirectory}}/skip_cleanup_ssm_log_files ]]; then
  echo "Skipping cleanup of ssm log files"
else
  echo "Cleaning up ssm log files"
  if [[ -d "/var/log/amazon/ssm" ]]; then
      if [[ $( sudo find /var/log/amazon/ssm -type f | sudo wc -l) -gt 0 ]]; then
          echo "Deleting files within /var/log/amazon/ssm/*"
          sudo find /var/log/amazon/ssm -type f -exec rm -f {} \;
      fi
      if [[ $( sudo find /var/log/amazon/ssm -type f | sudo wc -l) -gt 0 ]]; then
          echo "Failed to delete /var/log/amazon/ssm"
          exit 1
      fi
      echo "Deleting /var/log/amazon/ssm/*"
      sudo rm -rf /var/log/amazon/ssm
      if [[ -d "/var/log/amazon/ssm" ]]; then
          echo "Failed to delete /var/log/amazon/ssm"
          exit 1
      fi
  fi
fi


# Clean up for DHCP lease files
shopt -s nullglob
DHCP_LEASE_MATCHES=(/var/db/dhcpclient/leases/*)
shopt -u nullglob
if [[ ${#DHCP_LEASE_MATCHES[@]} -gt 0 ]]; then
  echo "Deleting /var/db/dhcpclient/leases/*"
  sudo rm -f "${DHCP_LEASE_MATCHES[@]}"
  shopt -s nullglob
  DHCP_LEASE_REMAINING=(/var/db/dhcpclient/leases/*)
  shopt -u nullglob
  if [[ ${#DHCP_LEASE_REMAINING[@]} -gt 0 ]]; then
      echo "Failed to delete /var/db/dhcpclient/leases/*"
      exit 1
  fi
fi

if [[ $( sudo find /var/tmp -type f | sudo wc -l) -gt 0 ]]; then
      echo "Deleting files within /var/tmp/*"
      sudo find /var/tmp -type f -exec rm -f {} \;
fi
if [[ $( sudo find /var/tmp -type f | sudo wc -l) -gt 0 ]]; then
      echo "Failed to delete /var/tmp"
      exit 1
fi
if [[ $( sudo ls /var/tmp | sudo wc -l ) -gt 0 ]]; then
      echo "Deleting /var/tmp/*"
      sudo rm -rf /var/tmp/*
fi

# Flush all pending writes to disk before instance shutdown and snapshot
sync