From 834d00bf450fd21131165ee7be7f024d45ae108d Mon Sep 17 00:00:00 2001
From: Marcio Donadio <marcio@slac.stanford.edu>
Date: Tue, 30 Sep 2025 08:02:42 -0700
Subject: [PATCH] All NICs that are disconnected from the network must be
 disabled on boot

---
 custom_files/disable_disconnected_nics.service | 10 ++++++++++
 custom_files/disable_disconnected_nics.sh      | 11 +++++++++++
 scripts/generate-image.sh                      | 10 ++++++----
 3 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 custom_files/disable_disconnected_nics.service
 create mode 100755 custom_files/disable_disconnected_nics.sh

diff --git a/custom_files/disable_disconnected_nics.service b/custom_files/disable_disconnected_nics.service
new file mode 100644
index 0000000..f7ffeb4
--- /dev/null
+++ b/custom_files/disable_disconnected_nics.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Disable disconnected network interfaces on boot
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/root/scripts/disable_disconnected_nics.sh
+
+[Install]
+WantedBy=multi-user.target
diff --git a/custom_files/disable_disconnected_nics.sh b/custom_files/disable_disconnected_nics.sh
new file mode 100755
index 0000000..745df23
--- /dev/null
+++ b/custom_files/disable_disconnected_nics.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# Get a list of all network interfaces (excluding loopback)
+interfaces=$(ls /sys/class/net | grep -v lo)
+
+for iface in $interfaces; do
+        # Check if the interface is disconnected (carrier detected)
+        if [[ -f "/sys/class/net/$iface/carrier" ]] && [[ "$(cat /sys/class/net/$iface/carrier)" == "0" ]]; then
+            ip link set dev $iface down
+        fi
+done
diff --git a/scripts/generate-image.sh b/scripts/generate-image.sh
index 7881fcd..52a6a10 100755
--- a/scripts/generate-image.sh
+++ b/scripts/generate-image.sh
@@ -123,6 +123,8 @@ fi
 cp -r /custom_files/run_bootfile_dev.sh root/scripts
 cp -r /custom_files/run_bootfile_prod.sh root/scripts
 cp -r /custom_files/create-users.sh root/scripts
+cp -r /custom_files/disable_disconnected_nics.sh root/scripts
+cp -r /custom_files/disable_disconnected_nics.service usr/lib/systemd/system/
 if [ -n "$prod_flag" ]; then
   cp -r /custom_files/run_bootfile_prod.service usr/lib/systemd/system/run_bootfile.service
 else
@@ -155,7 +157,6 @@ else
     mkdir -p afs/slac.stanford.edu
   fi
   if [ -d "afs/slac.stanford.edu" ]; then
-#    echo "172.23.66.102:/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab
     echo "s3dflclsdevnfs001:/sdf/group/ad/transition/afs/slac.stanford.edu /afs/slac.stanford.edu nfs _netdev,auto,x-systemd.automount,x-systemd.mount-timeout=5min,x-systemd.after=sys-subsystem-net-devices-enp7s0.device,retry=10,timeo=14 0 0" > etc/fstab
   fi
 fi
@@ -170,17 +171,18 @@ sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/system
 sed -i "s/#DefaultLimitMEMLOCK=/DefaultLimitMEMLOCK=infinity/g" etc/systemd/user.conf
 sed -i "s/#DefaultLimitRTPRIO=/DefaultLimitRTPRIO=infinity/g" etc/systemd/user.conf
 
-
 # chroot, set a blank password to root, and create the laci account. laci
 # account must have UID 8412 and be part of an lcls group with GID 2211.
 # The IDs are important for accessing NFS directories.
+# Deactivate all NICs that are disconnected from a network.
 # Activate NTP, generate required locales
 chroot . \
     bash -c '\
         /root/scripts/create-users.sh && \
         systemctl enable /usr/lib/systemd/system/run_bootfile.service && \
-	systemctl enable ntpd && \
-	localedef -i en_US -f UTF-8 en_US.utf8 && \
+        systemctl enable ntpd && \
+        systemctl enable disable_disconnected_nics.service && \
+        localedef -i en_US -f UTF-8 en_US.utf8 && \
         exit \
     '