From b33dfc51ccafb9172c0a29c0e4376f0db8b9e3f1 2016-03-25 20:58:11 From: Jan Wagner Date: 2016-03-25 20:58:11 Subject: [PATCH] Added: ENABLE_CRYPTFS - encrypted rootfs, use-latest-bootloader, cp-cleanup --- diff --git a/.gitignore b/.gitignore index 6ba2fb7..239ef3c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ images custom.d *.swp +*.bak *.log diff --git a/README.md b/README.md index 853730b..1f91c88 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ ENABLE_MINBASE=true ./rpi2-gen-image.sh BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi2-gen-image.sh BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi2-gen-image.sh ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi2-gen-image.sh +ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi2-gen-image.sh ``` #### APT settings: @@ -31,7 +32,7 @@ Set Debian packages server address. Choose a server from the list of Debian worl Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. ##### `APT_INCLUDES`="" -A comma seperated list of additional packages to be installed during bootstrapping. +A comma separated list of additional packages to be installed during bootstrapping. #### General system settings: ##### `HOSTNAME`="rpi2-jessie" @@ -65,13 +66,13 @@ Set the supported variant(s) of the keyboard layout(s). Set extra xkb configuration options. #### Networking settings (DHCP): -This setting is used to set up networking auto configuration in `/etc/systemd/network/eth.network`. +This parameter is used to set up networking auto configuration in `/etc/systemd/network/eth.network`. #####`ENABLE_DHCP`=true Set the system to use DHCP. This requires an DHCP server. #### Networking settings (static): -These settings are used to set up a static networking configuration in /etc/systemd/network/eth.network. The following static networking settings are only supported if `ENABLE_DHCP` was set to `false`. +These parameters are used to set up a static networking configuration in /etc/systemd/network/eth.network. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. #####`NET_ADDRESS`="" Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24". @@ -131,7 +132,7 @@ Install a user defined window manager for the X Window System. To make sure all Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB. ##### `ENABLE_REDUCE`=false -Reduce the disk usage by deleting packages and files. See `REDUCE_*` parameters for detailed information. +Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information. ##### `ENABLE_UBOOT`=false Replace default RPi2 second stage bootloader (bootcode.bin) with U-Boot bootloader. U-Boot can boot images via the network using the BOOTP/TFTP protocol. @@ -159,11 +160,14 @@ Enable IPv4/IPv6 network stack hardening settings. Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`. ##### `CHROOT_SCRIPTS`="" -Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this direcory is run in lexicographical order. +Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order. + +##### `ENABLE_INITRAMFS`=false +Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false. #### Kernel compilation: ##### `BUILD_KERNEL`=false -Build and install the latest RPi2 Linux kernel. Currently only the default RPi2 kernel configuration is used. Detailed configuration parameters for customizing the kernel and minor bug fixes still need to get implemented. feel free to help. +Build and install the latest RPi2 Linux kernel. Currently only the default RPi2 kernel configuration is used. ##### `KERNEL_REDUCE`=false Reduce the size of the generated kernel by removing unwanted device, network and filesystem drivers (experimental). @@ -184,10 +188,10 @@ Remove all kernel sources from the generated OS image after it was built and ins Path to a directory of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot. ##### `KERNELSRC_CLEAN`=false -Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This setting will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true. +Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true. ##### `KERNELSRC_CONFIG`=true -Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This setting is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This settings is ignored if `KERNELSRC_PREBUILT`=true. +Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true. ##### `KERNELSRC_PREBUILT`=false With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed. @@ -204,7 +208,7 @@ Remove all doc files (harsh). Configure APT to not include doc files on future ` ##### `REDUCE_MAN`=true Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations. -##### `REDUCE_VIM`=true +##### `REDUCE_VIM`=false Replace `vim-tiny` package by `levee` a tiny vim clone. ##### `REDUCE_BASH`=false @@ -214,11 +218,28 @@ Remove `bash` package and switch to `dash` shell (experimental). Remove PCI related hwdb files (experimental). ##### `REDUCE_SSHD`=true -Replace `openssh-server` with dropbear. +Replace `openssh-server` with `dropbear`. ##### `REDUCE_LOCALE`=true Remove all `locale` translation files. +#### Encrypted root partition: + +##### `ENABLE_CRYPTFS`=false +Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. `ENABLE_UBOOT`, `ENABLE_SPLITFS`, `EXPANDROOT` and SSH-to-initramfs are currently not supported but will be soon - feel free to help. + +##### `CRYPTFS_PASSWORD`="" +Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true. + +##### `CRYPTFS_MAPPING`="secure" +Set name of dm-crypt managed device-mapper mapping. + +##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512" +Set cipher specification string. `aes-xts*` ciphers are strongly recommended. + +##### `CRYPTFS_XTSKEYSIZE`=512 +Sets key size in bits. The argument has to be a multiple of 8. + ## Understanding the script The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order: @@ -235,11 +256,13 @@ The functions of this script that are required for the different stages of the b | `41-uboot.sh` | Build and Setup U-Boot | | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver | | `50-firstboot.sh` | First boot actions | +| `99-reduce.sh` | Reduce the disk space usage | All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually. | Directory | Description | | --- | --- | +| `apt` | APT management configuration files | | `boot` | Boot and RPi2 configuration files | | `dpkg` | Package Manager configuration | | `firstboot` | Scripts that get executed on first boot | diff --git a/bootstrap.d/10-bootstrap.sh b/bootstrap.d/10-bootstrap.sh index 7b4a04d..f55c3e3 100644 --- a/bootstrap.d/10-bootstrap.sh +++ b/bootstrap.d/10-bootstrap.sh @@ -13,11 +13,11 @@ else fi # Copy qemu emulator binary to chroot -cp "${QEMU_BINARY}" "$R/usr/bin" +install_exec "${QEMU_BINARY}" "${R}${QEMU_BINARY}" # Copy debian-archive-keyring.pgp mkdir -p "$R/usr/share/keyrings" -cp /usr/share/keyrings/debian-archive-keyring.gpg "$R/usr/share/keyrings/debian-archive-keyring.gpg" +install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "$R/usr/share/keyrings/debian-archive-keyring.gpg" # Complete the bootstrapping process chroot_exec /debootstrap/debootstrap --second-stage diff --git a/bootstrap.d/11-apt.sh b/bootstrap.d/11-apt.sh index 9610832..554aaf5 100644 --- a/bootstrap.d/11-apt.sh +++ b/bootstrap.d/11-apt.sh @@ -11,18 +11,25 @@ if [ -z "$APT_PROXY" ] ; then sed -i "s/\"\"/\"${APT_PROXY}\"/" "$R/etc/apt/apt.conf.d/10proxy" fi -# Install APT pinning configuration for flash-kernel package -install_readonly files/apt/flash-kernel "$R/etc/apt/preferences.d/flash-kernel" +if [ "$BUILD_KERNEL" = false ] ; then + # Install APT pinning configuration for flash-kernel package + install_readonly files/apt/flash-kernel "$R/etc/apt/preferences.d/flash-kernel" -# Upgrade collabora package index and install collabora keyring -echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" > "$R/etc/apt/sources.list" -chroot_exec apt-get -qq -y update -chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring + # Install APT sources.list + install_readonly files/apt/sources.list "$R/etc/apt/sources.list" + echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >> "$R/etc/apt/sources.list" + + # Upgrade collabora package index and install collabora keyring + chroot_exec apt-get -qq -y update + chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring +else # BUILD_KERNEL=true + # Install APT sources.list + install_readonly files/apt/sources.list "$R/etc/apt/sources.list" -# Install APT sources.list -install_readonly files/apt/sources.list "$R/etc/apt/sources.list" -sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "$R/etc/apt/sources.list" -sed -i "s/ jessie/ ${RELEASE}/" "$R/etc/apt/sources.list" + # Use specified APT server and release + sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "$R/etc/apt/sources.list" + sed -i "s/ jessie/ ${RELEASE}/" "$R/etc/apt/sources.list" +fi # Upgrade package index and update all installed packages and changed dependencies chroot_exec apt-get -qq -y update diff --git a/bootstrap.d/13-kernel.sh b/bootstrap.d/13-kernel.sh index 671025d..ec6b59f 100644 --- a/bootstrap.d/13-kernel.sh +++ b/bootstrap.d/13-kernel.sh @@ -110,24 +110,31 @@ if [ "$BUILD_KERNEL" = true ] ; then KERNEL_VERSION=`cat "$R/usr/src/linux/include/config/kernel.release"` # Copy kernel configuration file to the boot directory - cp "$R/usr/src/linux/.config" "$R/boot/config-${KERNEL_VERSION}" + install_readonly "$R/usr/src/linux/.config" "$R/boot/config-${KERNEL_VERSION}" # Copy dts and dtb device tree sources and binaries mkdir "$R/boot/firmware/overlays/" - cp "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/"*.dtb "$R/boot/firmware/" - cp "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb* "$R/boot/firmware/overlays/" - cp "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "$R/boot/firmware/overlays/" + install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/"*.dtb "$R/boot/firmware/" + install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb* "$R/boot/firmware/overlays/" + install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "$R/boot/firmware/overlays/README" - # Convert kernel zImage and copy it to the boot directory - "$R/usr/src/linux/scripts/mkknlimg" "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/zImage" "$R/boot/firmware/kernel7.img" + # Copy zImage kernel to the boot directory + install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/zImage" "$R/boot/firmware/kernel7.img" # Remove kernel sources if [ "$KERNEL_REMOVESRC" = true ] ; then rm -fr "$R/usr/src/linux" fi - # Install raspberry bootloader and flash-kernel packages - chroot_exec apt-get -qq -y --no-install-recommends install raspberrypi-bootloader-nokernel + # Install latest boot binaries from raspberry/firmware github + wget -q -O "$R/boot/firmware/bootcode.bin" https://github.com/raspberrypi/firmware/raw/master/boot/bootcode.bin + wget -q -O "$R/boot/firmware/fixup_cd.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_cd.dat + wget -q -O "$R/boot/firmware/fixup.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup.dat + wget -q -O "$R/boot/firmware/fixup_x.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_x.dat + wget -q -O "$R/boot/firmware/start_cd.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_cd.elf + wget -q -O "$R/boot/firmware/start.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start.elf + wget -q -O "$R/boot/firmware/start_x.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_x.elf + else # BUILD_KERNEL=false # Kernel installation chroot_exec apt-get -qq -y --no-install-recommends install linux-image-"${COLLABORA_KERNEL}" raspberrypi-bootloader-nokernel @@ -135,9 +142,15 @@ else # BUILD_KERNEL=false # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot chroot_exec apt-get -qq -y install flash-kernel + # Check if kernel installation was successful VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)" - [ -z "$VMLINUZ" ] && exit 1 - cp "$VMLINUZ" "$R/boot/firmware/kernel7.img" + if [ -z "$VMLINUZ" ] ; then + echo "error: kernel installation failed! (/boot/vmlinuz-* not found)" + cleanup + exit 1 + fi + # Copy vmlinuz kernel to the boot directory + install_readonly "$VMLINUZ" "$R/boot/firmware/kernel7.img" fi # Setup firmware boot cmdline @@ -160,6 +173,11 @@ fi # Install firmware boot cmdline echo "${CMDLINE}" > "$R/boot/firmware/cmdline.txt" +# Add encrypted root partition to cmdline.txt +if [ "$ENABLE_CRYPTFS" = true ] ; then + sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/" "$R/boot/firmware/cmdline.txt" +fi + # Install firmware config install_readonly files/boot/config.txt "$R/boot/firmware/config.txt" @@ -168,6 +186,11 @@ if [ "$ENABLE_MINGPU" = true ] ; then echo "gpu_mem=16" >> "$R/boot/firmware/config.txt" fi +# Setup boot with initramfs +if [ "$ENABLE_INITRAMFS" = true ] ; then + echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "$R/boot/firmware/config.txt" +fi + # Create firmware configuration and cmdline symlinks ln -sf firmware/config.txt "$R/boot/config.txt" ln -sf firmware/cmdline.txt "$R/boot/cmdline.txt" @@ -192,8 +215,37 @@ install_readonly files/modules/raspi-blacklist.conf "$R/etc/modprobe.d/raspi-bla # Install and setup fstab install_readonly files/mount/fstab "$R/etc/fstab" + +# Add usb/sda disk root partition to fstab if [ "$ENABLE_SPLITFS" = true ] ; then - sed -i 's/mmcblk0p2/sda1/' "$R/etc/fstab" + sed -i "s/mmcblk0p2/sda1/" "$R/etc/fstab" +fi + +# Add encrypted root partition to fstab and crypttab +if [ "$ENABLE_CRYPTFS" = true ] ; then + # Replace fstab root partition with encrypted partition mapping + sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "$R/etc/fstab" + + # Add encrypted partition to crypttab and fstab + install_readonly files/mount/crypttab "$R/etc/crypttab" + echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks" >> "$R/etc/crypttab" +fi + +# Generate initramfs file +if [ "$ENABLE_INITRAMFS" = true ] ; then + if [ "$ENABLE_CRYPTFS" = true ] ; then + # Dummy mapping required by mkinitramfs + echo "0 1 crypt $(echo ${CRYPTFS_CIPHER} | cut -d ':' -f 1) ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}" + + # Generate initramfs with encrypted root partition support + chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}" + + # Remove dummy mapping + chroot_exec cryptsetup close "${CRYPTFS_MAPPING}" + else + # Generate initramfs without encrypted root partition support + chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}" + fi fi # Install sysctl.d configuration files diff --git a/bootstrap.d/41-uboot.sh b/bootstrap.d/41-uboot.sh index d3f13b9..8f59f26 100644 --- a/bootstrap.d/41-uboot.sh +++ b/bootstrap.d/41-uboot.sh @@ -19,7 +19,7 @@ if [ "$ENABLE_UBOOT" = true ] ; then chroot_exec make -C /tmp/u-boot/ rpi_2_defconfig all # Copy compiled bootloader binary and set config.txt to load it - cp "$R/tmp/u-boot/u-boot.bin" "$R/boot/firmware/" + install_readonly "$R/tmp/u-boot/u-boot.bin" "$R/boot/firmware/u-boot.bin" printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "$R/boot/firmware/config.txt" # Install and setup U-Boot command file diff --git a/bootstrap.d/50-firstboot.sh b/bootstrap.d/50-firstboot.sh index 0c93d11..2ec9404 100644 --- a/bootstrap.d/50-firstboot.sh +++ b/bootstrap.d/50-firstboot.sh @@ -9,9 +9,8 @@ cat files/firstboot/10-begin.sh > "$R/etc/rc.firstboot" # Ensure openssh server host keys are regenerated on first boot -if [ "$ENABLE_SSHD" = true ] && [ "$ENABLE_REDUCE" = false ]; then +if [ "$ENABLE_SSHD" = true ] ; then cat files/firstboot/21-generate-ssh-keys.sh >> "$R/etc/rc.firstboot" - rm -f "$R/etc/ssh/ssh_host_*" fi # Prepare filesystem auto expand diff --git a/bootstrap.d/99-reduce.sh b/bootstrap.d/99-reduce.sh index f3b2848..99fbc9b 100644 --- a/bootstrap.d/99-reduce.sh +++ b/bootstrap.d/99-reduce.sh @@ -66,6 +66,12 @@ if [ "$ENABLE_REDUCE" = true ] ; then rm -f "$R/boot/firmware/fixup_x.dat" fi + # Remove kernel and initrd from /boot (already in /boot/firmware) + if [ "$BUILD_KERNEL" = false ] ; then + rm -r "$R/boot/vmlinuz--*" + rm -r "$R/boot/initrd.img-*" + fi + # Clean APT list of repositories rm -fr "$R/var/lib/apt/lists/*" chroot_exec apt-get -qq -y update diff --git a/files/apt/sources.list b/files/apt/sources.list index 36472fc..ffc2c9b 100644 --- a/files/apt/sources.list +++ b/files/apt/sources.list @@ -6,5 +6,3 @@ deb http://ftp.debian.org/debian/ jessie-updates main contrib deb http://security.debian.org/ jessie/updates main contrib #deb-src http://security.debian.org/ jessie/updates main contrib - -deb https://repositories.collabora.co.uk/debian jessie rpi2 diff --git a/files/firstboot/21-generate-ssh-keys.sh b/files/firstboot/21-generate-ssh-keys.sh index a6c567c..928ee2e 100644 --- a/files/firstboot/21-generate-ssh-keys.sh +++ b/files/firstboot/21-generate-ssh-keys.sh @@ -1,8 +1,20 @@ logger -t "rc.firstboot" "Generating SSH host keys" -rm -f /etc/ssh/ssh_host_* -ssh-keygen -q -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key -ssh-keygen -q -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key -ssh-keygen -q -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key -ssh-keygen -q -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key -systemctl restart sshd +if [ -d "/etc/ssh/" ] ; then + rm -f /etc/ssh/ssh_host_* + systemctl stop sshd + ssh-keygen -q -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key + ssh-keygen -q -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key + ssh-keygen -q -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key + ssh-keygen -q -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key + systemctl start sshd +fi + +if [ -d "/etc/dropbear/" ] ; then + rm -f /etc/dropbear/dropbear_* + systemctl stop dropbear + dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key + dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key + dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key + systemctl start dropbear +fi diff --git a/files/firstboot/22-expandroot.sh b/files/firstboot/22-expandroot.sh index 00b94af..03ec50d 100644 --- a/files/firstboot/22-expandroot.sh +++ b/files/firstboot/22-expandroot.sh @@ -5,14 +5,14 @@ case "${ROOT_PART}" in mmcblk0*) ROOT_DEV=mmcblk0 ;; sda*) ROOT_DEV=sda ;; esac -if [ "$PART_NUM" = "$ROOT_PART" ]; then +if [ "$PART_NUM" = "$ROOT_PART" ] ; then logger -t "rc.firstboot" "$ROOT_PART is not an SD card. Don't know how to expand" return 0 fi # NOTE: the NOOBS partition layout confuses parted. For now, let's only # agree to work with a sufficiently simple partition layout -if [ "$PART_NUM" -gt 2 ]; then +if [ "$PART_NUM" -gt 2 ] ; then logger -t "rc.firstboot" "Your partition layout is not currently supported by this tool." return 0 fi @@ -24,14 +24,18 @@ fi # Get the starting offset of the root partition PART_START=$(parted /dev/${ROOT_DEV} -ms unit s p | grep "^${PART_NUM}" | cut -f 2 -d: | sed 's/[^0-9]//g') -[ "$PART_START" ] || return 1 +if [ -z "$PART_START" ] ; then + logger -t "rc.firstboot" "${ROOT_DEV} unable to get starting sector of the partition" + return 1 +fi # Get the possible last sector for the root partition PART_LAST=$(fdisk -l /dev/${ROOT_DEV} | grep '^Disk.*sectors' | awk '{ print $7 - 1 }') -[ "$PART_LAST" ] || return 1 +if [ -z "$PART_LAST" ] ; then + logger -t "rc.firstboot" "${ROOT_DEV} unable to get last sector of the partition" + return 1 +fi -# Return value will likely be error for fdisk as it fails to reload the -# partition table because the root fs is mounted ### Since rc.local is run with "sh -e", let's add "|| true" to prevent premature exit fdisk /dev/${ROOT_DEV} < diff --git a/functions.sh b/functions.sh index 36f6bc3..cbd5bad 100644 --- a/functions.sh +++ b/functions.sh @@ -6,17 +6,18 @@ cleanup (){ # Identify and kill all processes still using files echo "killing processes using mount point ..." - fuser -k $R + fuser -k "$R" sleep 3 - fuser -9 -k -v $R + fuser -9 -k -v "$R" # Clean up all temporary mount points echo "removing temporary mount points ..." - umount -l $R/proc 2> /dev/null - umount -l $R/sys 2> /dev/null - umount -l $R/dev/pts 2> /dev/null + umount -l "$R/proc" 2> /dev/null + umount -l "$R/sys" 2> /dev/null + umount -l "$R/dev/pts" 2> /dev/null umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null umount "$BUILDDIR/mount" 2> /dev/null + cryptsetup close "${CRYPTFS_MAPPING}" 2> /dev/null losetup -d "$ROOT_LOOP" 2> /dev/null losetup -d "$FRMW_LOOP" 2> /dev/null trap - 0 1 2 3 6 diff --git a/rpi2-gen-image.sh b/rpi2-gen-image.sh index dcaef9c..d25bdb6 100755 --- a/rpi2-gen-image.sh +++ b/rpi2-gen-image.sh @@ -23,7 +23,7 @@ fi # Check if ./functions.sh script exists if [ ! -r "./functions.sh" ] ; then - echo "error: './functions.sh' required script not found. please reinstall the latest script version!" + echo "error: './functions.sh' required script not found!" exit 1 fi @@ -45,9 +45,9 @@ KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig} QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static} # Build directories -BASEDIR=$(pwd)/images/${RELEASE} -BUILDDIR=${BASEDIR}/build -R=${BUILDDIR}/chroot +BASEDIR="$(pwd)/images/${RELEASE}" +BUILDDIR="${BASEDIR}/build" +R="${BUILDDIR}/chroot" # General settings HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}} @@ -101,6 +101,7 @@ ENABLE_FBTURBO=${ENABLE_FBTURBO:=false} ENABLE_HARDNET=${ENABLE_HARDNET:=false} ENABLE_IPTABLES=${ENABLE_IPTABLES:=false} ENABLE_SPLITFS=${ENABLE_SPLITFS:=false} +ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false} # Kernel compilation settings BUILD_KERNEL=${BUILD_KERNEL:=false} @@ -120,12 +121,22 @@ KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false} REDUCE_APT=${REDUCE_APT:=true} REDUCE_DOC=${REDUCE_DOC:=true} REDUCE_MAN=${REDUCE_MAN:=true} -REDUCE_VIM=${REDUCE_VIM:=true} +REDUCE_VIM=${REDUCE_VIM:=false} REDUCE_BASH=${REDUCE_BASH:=false} REDUCE_HWDB=${REDUCE_HWDB:=true} REDUCE_SSHD=${REDUCE_SSHD:=true} REDUCE_LOCALE=${REDUCE_LOCALE:=true} +# Encrypted filesystem settings +ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false} +CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""} +CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"} +CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"} +CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512} + +# Stop the Crypto Wars +DISABLE_FBI=${DISABLE_FBI:=false} + # Chroot scripts directory CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""} @@ -149,6 +160,28 @@ if [ "$KERNEL_MENUCONFIG" = true ] ; then REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses5-dev" fi +# Stop the Crypto Wars +if [ "$DISABLE_FBI" = true ] ; then + ENABLE_CRYPTFS=true +fi + +# Add cryptsetup package to enable filesystem encryption +if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then + REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup" + APT_INCLUDES="${APT_INCLUDES},cryptsetup" + + if [ -z "$CRYPTFS_PASSWORD" ] ; then + echo "error: no password defined (CRYPTFS_PASSWORD)!" + exit 1 + fi + ENABLE_INITRAMFS=true +fi + +# Add initramfs generation tools +if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then + APT_INCLUDES="${APT_INCLUDES},initramfs-tools" +fi + # Check if all required packages are installed on the build system for package in $REQUIRED_PACKAGES ; do if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then @@ -193,6 +226,12 @@ if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then exit 1 fi +# Check if specified device mapping already exists (will be used by cryptsetup) +if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then + echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding" + exit 1 +fi + # Don't clobber an old build if [ -e "$BUILDDIR" ] ; then echo "error: directory ${BUILDDIR} already exists, not proceeding" @@ -215,7 +254,7 @@ trap cleanup 0 1 2 3 6 # Add required packages for the minbase installation if [ "$ENABLE_MINBASE" = true ] ; then - APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools" + APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown" else APT_INCLUDES="${APT_INCLUDES},locales,keyboard-configuration,console-setup" fi @@ -321,6 +360,11 @@ fi # Remove apt-utils chroot_exec apt-get purge -qq -y --force-yes apt-utils +# Generate required machine-id +MACHINE_ID=$(dbus-uuidgen) +echo -n "${MACHINE_ID}" > "$R/var/lib/dbus/machine-id" +echo -n "${MACHINE_ID}" > "$R/etc/machine-id" + # APT Cleanup chroot_exec apt-get -y clean chroot_exec apt-get -y autoclean @@ -331,19 +375,21 @@ umount -l "$R/proc" umount -l "$R/sys" # Clean up directories -rm -rf "$R/run" +rm -rf "$R/run/*" rm -rf "$R/tmp/*" # Clean up files +rm -f "$R/etc/ssh/ssh_host_*" +rm -f "$R/etc/dropbear/dropbear_*" rm -f "$R/etc/apt/sources.list.save" rm -f "$R/etc/resolvconf/resolv.conf.d/original" rm -f "$R/etc/*-" rm -f "$R/root/.bash_history" rm -f "$R/var/lib/urandom/random-seed" -rm -f "$R/var/lib/dbus/machine-id" -rm -f "$R/etc/machine-id" rm -f "$R/etc/apt/apt.conf.d/10proxy" rm -f "$R/etc/resolv.conf" +rm -f "$R/initrd.img" +rm -f "$R/vmlinuz" rm -f "${R}${QEMU_BINARY}" # Calculate size of the chroot directory in KB @@ -371,43 +417,58 @@ if [ "$ENABLE_SPLITFS" = true ] ; then dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img" bs=512 count=0 seek=${FRMW_SECTORS} dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}-root.img" bs=512 count=${TABLE_SECTORS} dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}-root.img" bs=512 count=0 seek=${ROOT_SECTORS} - # Write partition tables - sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img" < /dev/null < /dev/null < /dev/null < .password + + # Initialize encrypted partition + echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password + + # Open encrypted partition and setup mapping + cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}" + + # Secure delete password keyfile + shred -zu .password + + # Update temporary loop device + ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}" + + # Wipe encrypted partition (encryption cipher is used for randomness) + dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count=$(blockdev --getsz "${ROOT_LOOP}") +fi + # Build filesystems mkfs.vfat "$FRMW_LOOP" mkfs.ext4 "$ROOT_LOOP"