Raspi2-3_GenImage Commit - r66:061173da65b0 · Collaboration Tremplin des Sciences

Added ENABLE_SPLITFS option to produce distinct /boot/firmware and root images

Vincent Knecht -

r66:061173da65b0

parent child

Context file:

r66:061173da65b0

Collapse all files

.gitignore created 644 +3 0

@@ -0,0 +1,3
	1	images
	2	custom.d
	3	*.swp

bootstrap.d/10-bootstrap.sh created 644 +27 0

@@ -0,0 +1,27
	1	#
	2	# Debootstrap basic system
	3	#
	4
	5	. ./functions.sh
	6
	7	# Base debootstrap (unpack only)
	8	if [ "$ENABLE_MINBASE" = true ] ; then
	9	http_proxy=${APT_PROXY} debootstrap --arch=armhf --variant=minbase --foreign --include=${APT_INCLUDES} $RELEASE $R http://${APT_SERVER}/debian
	10	else
	11	http_proxy=${APT_PROXY} debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R http://${APT_SERVER}/debian
	12	fi
	13
	14	# Copy qemu emulator binary to chroot
	15	cp /usr/bin/qemu-arm-static $R/usr/bin
	16
	17	# Copy debian-archive-keyring.pgp
	18	mkdir -p $R/usr/share/keyrings
	19	cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
	20
	21	# Complete the bootstrapping process
	22	chroot_exec /debootstrap/debootstrap --second-stage
	23
	24	# Mount required filesystems
	25	mount -t proc none $R/proc
	26	mount -t sysfs none $R/sys
	27	mount --bind /dev/pts $R/dev/pts

bootstrap.d/11-apt.sh created 644 +40 0

@@ -0,0 +1,40
	1	#
	2	# Setup APT repositories
	3	#
	4
	5	. ./functions.sh
	6
	7	# Use proxy inside chroot
	8	if [ -z "$APT_PROXY" ] ; then
	9	echo "Acquire::http::Proxy \"$APT_PROXY\";" >> $R/etc/apt/apt.conf.d/10proxy
	10	fi
	11
	12	# Pin package flash-kernel to repositories.collabora.co.uk
	13	cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
	14	Package: flash-kernel
	15	Pin: origin repositories.collabora.co.uk
	16	Pin-Priority: 1000
	17	EOM
	18
	19	# Upgrade collabora package index and install collabora keyring
	20	echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
	21	chroot_exec apt-get -qq -y update
	22	chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring
	23
	24	# Set up initial sources.list
	25	cat <<EOM >$R/etc/apt/sources.list
	26	deb http://${APT_SERVER}/debian ${RELEASE} main contrib
	27	#deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
	28
	29	deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
	30	#deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
	31
	32	deb http://security.debian.org/ ${RELEASE}/updates main contrib
	33	#deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
	34
	35	deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
	36	EOM
	37
	38	# Upgrade package index and update all installed packages and changed dependencies
	39	chroot_exec apt-get -qq -y update
	40	chroot_exec apt-get -qq -y -u dist-upgrade

bootstrap.d/12-locale.sh created 644 +52 0

@@ -0,0 +1,52
	1	#
	2	# Setup locales and keyboard settings
	3	#
	4
	5	. ./functions.sh
	6
	7	# Set up timezone
	8	echo ${TIMEZONE} >$R/etc/timezone
	9	chroot_exec dpkg-reconfigure -f noninteractive tzdata
	10
	11	# Set up default locale and keyboard configuration
	12	if [ "$ENABLE_MINBASE" = false ] ; then
	13	# Set locale choice in debconf db, even though dpkg-reconfigure ignores and overwrites them due to some bug
	14	# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685957
	15	# ... so we have to set locales manually
	16	if [ "$DEFLOCAL" = "en_US.UTF-8" ] ; then
	17	chroot_exec echo "locales locales/locales_to_be_generated multiselect ${DEFLOCAL} UTF-8" \| debconf-set-selections
	18	else
	19	# en_US.UTF-8 should be available anyway : https://www.debian.org/doc/manuals/debian-reference/ch08.en.html#_the_reconfiguration_of_the_locale
	20	chroot_exec echo "locales locales/locales_to_be_generated multiselect en_US.UTF-8 UTF-8, ${DEFLOCAL} UTF-8" \| debconf-set-selections
	21	chroot_exec sed -i "/en_US.UTF-8/s/^#//" /etc/locale.gen
	22	fi
	23	chroot_exec sed -i "/${DEFLOCAL}/s/^#//" /etc/locale.gen
	24	chroot_exec echo "locales locales/default_environment_locale select ${DEFLOCAL}" \| debconf-set-selections
	25	chroot_exec locale-gen
	26	chroot_exec update-locale LANG=${DEFLOCAL}
	27
	28	# Keyboard configuration, if requested
	29	if [ "$XKBMODEL" != "" ] ; then
	30	chroot_exec sed -i "s/^XKBMODEL.*/XKBMODEL=\"${XKBMODEL}\"/" /etc/default/keyboard
	31	fi
	32	if [ "$XKBLAYOUT" != "" ] ; then
	33	chroot_exec sed -i "s/^XKBLAYOUT.*/XKBLAYOUT=\"${XKBLAYOUT}\"/" /etc/default/keyboard
	34	fi
	35	if [ "$XKBVARIANT" != "" ] ; then
	36	chroot_exec sed -i "s/^XKBVARIANT.*/XKBVARIANT=\"${XKBVARIANT}\"/" /etc/default/keyboard
	37	fi
	38	if [ "$XKBOPTIONS" != "" ] ; then
	39	chroot_exec sed -i "s/^XKBOPTIONS.*/XKBOPTIONS=\"${XKBOPTIONS}\"/" /etc/default/keyboard
	40	fi
	41	chroot_exec dpkg-reconfigure -f noninteractive keyboard-configuration
	42	# Set up font console
	43	case "${DEFLOCAL}" in
	44	*UTF-8)
	45	chroot_exec sed -i 's/^CHARMAP.*/CHARMAP="UTF-8"/' /etc/default/console-setup
	46	;;
	47	*)
	48	chroot_exec sed -i 's/^CHARMAP.*/CHARMAP="guess"/' /etc/default/console-setup
	49	;;
	50	esac
	51	chroot_exec dpkg-reconfigure -f noninteractive console-setup
	52	fi

bootstrap.d/13-kernel.sh created 644 +109 0

@@ -0,0 +1,109
	1	#
	2	# Kernel installation
	3	#
	4
	5	. ./functions.sh
	6
	7	# Fetch and build latest raspberry kernel
	8	if [ "$BUILD_KERNEL" = true ] ; then
	9	# Fetch current raspberrypi kernel sources
	10	git -C $R/usr/local/src clone --depth=1 https://github.com/raspberrypi/linux
	11
	12	# Load default raspberry kernel configuration
	13	make -C $R/usr/local/src/linux ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- bcm2709_defconfig
	14
	15	# Cross compile kernel and modules
	16	make -C $R/usr/local/src/linux -j$(grep -c processor /proc/cpuinfo) ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- zImage modules dtbs
	17
	18	# Install kernel modules
	19	make -C $R/usr/local/src/linux ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- INSTALL_MOD_PATH=../.. modules_install
	20
	21	# Install kernel headers
	22	if [ "$KERNEL_HEADERS" = true ]; then
	23	make -C $R/usr/local/src/linux ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- INSTALL_HDR_PATH=../../usr headers_install
	24	fi
	25
	26	# Copy and rename compiled kernel to boot directory
	27	mkdir $R/boot/firmware/
	28	$R/usr/local/src/linux/scripts/mkknlimg $R/usr/local/src/linux/arch/arm/boot/zImage $R/boot/firmware/kernel7.img
	29
	30	# Copy dts and dtb device definitions
	31	mkdir $R/boot/firmware/overlays/
	32	cp $R/usr/local/src/linux/arch/arm/boot/dts/*.dtb $R/boot/firmware/
	33	cp $R/usr/local/src/linux/arch/arm/boot/dts/overlays/.dtb $R/boot/firmware/overlays/
	34	cp $R/usr/local/src/linux/arch/arm/boot/dts/overlays/README $R/boot/firmware/overlays/
	35
	36	# Install raspberry bootloader and flash-kernel
	37	chroot_exec apt-get -qq -y --no-install-recommends install raspberrypi-bootloader-nokernel
	38	else
	39	# Kernel installation
	40	chroot_exec apt-get -qq -y --no-install-recommends install linux-image-${KERNEL} raspberrypi-bootloader-nokernel
	41
	42	# Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
	43	chroot_exec apt-get -qq -y install flash-kernel
	44
	45	VMLINUZ="$(ls -1 $R/boot/vmlinuz-* \| sort \| tail -n 1)"
	46	[ -z "$VMLINUZ" ] && exit 1
	47	cp $VMLINUZ $R/boot/firmware/kernel7.img
	48	fi
	49
	50	# Set up firmware boot cmdline
	51	if [ "$ENABLE_SPLITFS" = true ] ; then
	52	CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1 ${CMDLINE}"
	53	else
	54	CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1 ${CMDLINE}"
	55	fi
	56
	57	# Set up serial console support (if requested)
	58	if [ "$ENABLE_CONSOLE" = true ] ; then
	59	CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
	60	fi
	61
	62	# Set up IPv6 networking support
	63	if [ "$ENABLE_IPV6" = false ] ; then
	64	CMDLINE="${CMDLINE} ipv6.disable=1"
	65	fi
	66
	67	echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
	68
	69	# Set up firmware config
	70	install -o root -g root -m 644 files/config.txt $R/boot/firmware/config.txt
	71
	72	# Load snd_bcm2835 kernel module at boot time
	73	if [ "$ENABLE_SOUND" = true ] ; then
	74	echo "snd_bcm2835" >>$R/etc/modules
	75	fi
	76
	77	# Set smallest possible GPU memory allocation size: 16MB (no X)
	78	if [ "$ENABLE_MINGPU" = true ] ; then
	79	echo "gpu_mem=16" >>$R/boot/firmware/config.txt
	80	fi
	81
	82	# Create symlinks
	83	ln -sf firmware/config.txt $R/boot/config.txt
	84	ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
	85
	86	# Prepare modules-load.d directory
	87	mkdir -p $R/lib/modules-load.d/
	88
	89	# Load random module on boot
	90	if [ "$ENABLE_HWRANDOM" = true ] ; then
	91	cat <<EOM >$R/lib/modules-load.d/rpi2.conf
	92	bcm2708_rng
	93	EOM
	94	fi
	95
	96	# Prepare modprobe.d directory
	97	mkdir -p $R/etc/modprobe.d/
	98
	99	# Blacklist sound modules
	100	install -o root -g root -m 644 files/modprobe.d/raspi-blacklist.conf $R/etc/modprobe.d/raspi-blacklist.conf
	101
	102	# Create default fstab
	103	install -o root -g root -m 644 files/fstab $R/etc/fstab
	104	if [ "$ENABLE_SPLITFS" = true ] ; then
	105	sed -i 's/mmcblk0p2/sda1/' $R/etc/fstab
	106	fi
	107
	108	# Avoid swapping and increase cache sizes
	109	install -o root -g root -m 644 files/sysctl.d/81-rpi-vm.conf $R/etc/sysctl.d/81-rpi-vm.conf

bootstrap.d/20-networking.sh created 644 +78 0

@@ -0,0 +1,78
	1	#
	2	# Setup networking
	3	#
	4
	5	. ./functions.sh
	6
	7	# Set up IPv4 hosts
	8	echo ${HOSTNAME} >$R/etc/hostname
	9	cat <<EOM >$R/etc/hosts
	10	127.0.0.1 localhost
	11	127.0.1.1 ${HOSTNAME}
	12	EOM
	13
	14	if [ "$NET_ADDRESS" != "" ] ; then
	15	NET_IP=$(echo ${NET_ADDRESS} \| cut -f 1 -d'/')
	16	sed -i "s/^127.0.1.1/${NET_IP}/" $R/etc/hosts
	17	fi
	18
	19	# Set up IPv6 hosts
	20	if [ "$ENABLE_IPV6" = true ] ; then
	21	cat <<EOM >>$R/etc/hosts
	22
	23	::1 localhost ip6-localhost ip6-loopback
	24	ff02::1 ip6-allnodes
	25	ff02::2 ip6-allrouters
	26	EOM
	27	fi
	28
	29	# Place hint about network configuration
	30	cat <<EOM >$R/etc/network/interfaces
	31	# Debian switched to systemd-networkd configuration files.
	32	# please configure your networks in '/etc/systemd/network/'
	33	source /etc/interfaces.d/*.conf
	34	EOM
	35
	36	if [ "$ENABLE_DHCP" = true ] ; then
	37	# Enable systemd-networkd DHCP configuration for interface eth0
	38	cat <<EOM >$R/etc/systemd/network/eth.network
	39	[Match]
	40	Name=eth0
	41
	42	[Network]
	43	DHCP=yes
	44	EOM
	45
	46	# Set DHCP configuration to IPv4 only
	47	if [ "$ENABLE_IPV6" = false ] ; then
	48	sed -i "s/^DHCP=yes/DHCP=v4/" $R/etc/systemd/network/eth.network
	49	fi
	50	else # ENABLE_DHCP=false
	51	cat <<EOM >$R/etc/systemd/network/eth.network
	52	[Match]
	53	Name=eth0
	54
	55	[Network]
	56	DHCP=no
	57	Address=${NET_ADDRESS}
	58	Gateway=${NET_GATEWAY}
	59	DNS=${NET_DNS_1}
	60	DNS=${NET_DNS_2}
	61	Domains=${NET_DNS_DOMAINS}
	62	NTP=${NET_NTP_1}
	63	NTP=${NET_NTP_2}
	64	EOM
	65	fi
	66
	67	# Enable systemd-networkd service
	68	chroot_exec systemctl enable systemd-networkd
	69
	70	# Enable network stack hardening
	71	if [ "$ENABLE_HARDNET" = true ] ; then
	72	install -o root -g root -m 644 files/sysctl.d/82-rpi-net-hardening.conf $R/etc/sysctl.d/82-rpi-net-hardening.conf
	73
	74	# Enable resolver warnings about spoofed addresses
	75	cat <<EOM >>$R/etc/host.conf
	76	spoof warn
	77	EOM
	78	fi

bootstrap.d/21-firewall.sh created 644 +43 0

@@ -0,0 +1,43
	1	#
	2	# Enable firewall based on iptables started by systemd service
	3	#
	4
	5	. ./functions.sh
	6
	7	if [ "$ENABLE_IPTABLES" = true ] ; then
	8	# Create iptables configuration directory
	9	mkdir -p "$R/etc/iptables"
	10
	11	# Create iptables systemd service
	12	install -o root -g root -m 644 files/iptables/iptables.service $R/etc/systemd/system/iptables.service
	13
	14	# Create flush-table script called by iptables service
	15	install -o root -g root -m 755 files/iptables/flush-iptables.sh $R/etc/iptables/flush-iptables.sh
	16
	17	# Create iptables rule file
	18	install -o root -g root -m 644 files/iptables/iptables.rules $R/etc/iptables/iptables.rules
	19
	20	# Reload systemd configuration and enable iptables service
	21	chroot_exec systemctl daemon-reload
	22	chroot_exec systemctl enable iptables.service
	23
	24	if [ "$ENABLE_IPV6" = true ] ; then
	25	# Create ip6tables systemd service
	26	install -o root -g root -m 644 files/iptables/ip6tables.service $R/etc/systemd/system/ip6tables.service
	27
	28	# Create ip6tables file
	29	install -o root -g root -m 755 files/iptables/flush-ip6tables.sh $R/etc/iptables/flush-ip6tables.sh
	30
	31	install -o root -g root -m 644 files/iptables/ip6tables.rules $R/etc/iptables/ip6tables.rules
	32
	33	# Reload systemd configuration and enable iptables service
	34	chroot_exec systemctl daemon-reload
	35	chroot_exec systemctl enable ip6tables.service
	36	fi
	37	fi
	38
	39	# Remove SSHD related iptables rules
	40	if [ "$ENABLE_SSHD" = false ] ; then
	41	sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/iptables.rules 2> /dev/null
	42	sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/ip6tables.rules 2> /dev/null
	43	fi

bootstrap.d/30-security.sh created 644 +30 0

@@ -0,0 +1,30
	1	#
	2	# Setup users and security settings
	3	#
	4
	5	. ./functions.sh
	6
	7	# Generate crypt(3) password string
	8	ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
	9
	10	# Set up default user
	11	if [ "$ENABLE_USER" = true ] ; then
	12	chroot_exec adduser --gecos pi --add_extra_groups --disabled-password pi
	13	chroot_exec usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
	14	fi
	15
	16	# Set up root password or not
	17	if [ "$ENABLE_ROOT" = true ]; then
	18	chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
	19
	20	if [ "$ENABLE_ROOT_SSH" = true ]; then
	21	sed -i 's\|[#]PermitRootLogin.\|PermitRootLogin yes\|g' $R/etc/ssh/sshd_config
	22	fi
	23	else
	24	chroot_exec usermod -p \'!\' root
	25	fi
	26
	27	# Enable serial console systemd style
	28	if [ "$ENABLE_CONSOLE" = true ] ; then
	29	chroot_exec systemctl enable serial-getty\@ttyAMA0.service
	30	fi

bootstrap.d/31-logging.sh created 644 +12 0

@@ -0,0 +1,12
	1	#
	2	# Setup logging
	3	#
	4
	5	. ./functions.sh
	6
	7	# Disable rsyslog
	8	if [ "$ENABLE_RSYSLOG" = false ]; then
	9	sed -i 's\|[#]*ForwardToSyslog=yes\|ForwardToSyslog=no\|g' $R/etc/systemd/journald.conf
	10	chroot_exec systemctl disable rsyslog
	11	chroot_exec apt-get purge -q -y --force-yes rsyslog
	12	fi

bootstrap.d/41-uboot.sh created 644 +44 0

@@ -0,0 +1,44
	1	#
	2	# Setup Uboot
	3	#
	4
	5	. ./functions.sh
	6
	7	# Install gcc/c++ build environment inside the chroot
	8	if [ "$ENABLE_UBOOT" = true ] \|\| [ "$ENABLE_FBTURBO" = true ]; then
	9	chroot_exec apt-get install -q -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
	10	fi
	11
	12	# Fetch and build U-Boot bootloader
	13	if [ "$ENABLE_UBOOT" = true ] ; then
	14	# Fetch U-Boot bootloader sources
	15	git -C $R/tmp clone git://git.denx.de/u-boot.git
	16
	17	# Build and install U-Boot inside chroot
	18	chroot_exec make -C /tmp/u-boot/ rpi_2_defconfig all
	19
	20	# Copy compiled bootloader binary and set config.txt to load it
	21	cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
	22	printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
	23
	24	# Set U-Boot command file
	25	cat <<EOM >$R/boot/firmware/uboot.mkimage
	26	# Tell Linux that it is booting on a Raspberry Pi2
	27	setenv machid 0x00000c42
	28
	29	# Set the kernel boot command line
	30	setenv bootargs "earlyprintk ${CMDLINE}"
	31
	32	# Save these changes to u-boot's environment
	33	saveenv
	34
	35	# Load the existing Linux kernel into RAM
	36	fatload mmc 0:1 \${kernel_addr_r} kernel7.img
	37
	38	# Boot the kernel we have just loaded
	39	bootz \${kernel_addr_r}
	40	EOM
	41
	42	# Generate U-Boot image from command file
	43	chroot_exec mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
	44	fi

bootstrap.d/42-fbturbo.sh created 644 +34 0

@@ -0,0 +1,34
	1	#
	2	# Fetch and build fbturbo Xorg driver
	3	#
	4
	5	. ./functions.sh
	6
	7	if [ "$ENABLE_FBTURBO" = true ] ; then
	8	# Fetch fbturbo driver sources
	9	git -C $R/tmp clone https://github.com/ssvb/xf86-video-fbturbo.git
	10
	11	# Install Xorg build dependencies
	12	chroot_exec apt-get install -q -y --no-install-recommends xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
	13
	14	# Build and install fbturbo driver inside chroot
	15	chroot_exec /bin/bash -c "cd /tmp/xf86-video-fbturbo; autoreconf -vi; ./configure --prefix=/usr; make; make install"
	16
	17	# Add fbturbo driver to Xorg configuration
	18	cat <<EOM >$R/usr/share/X11/xorg.conf.d/99-fbturbo.conf
	19	Section "Device"
	20	Identifier "Allwinner A10/A13 FBDEV"
	21	Driver "fbturbo"
	22	Option "fbdev" "/dev/fb0"
	23	Option "SwapbuffersWait" "true"
	24	EndSection
	25	EOM
	26
	27	# Remove Xorg build dependencies
	28	chroot_exec apt-get -q -y purge --auto-remove xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
	29	fi
	30
	31	# Remove gcc/c++ build environment from the chroot
	32	if [ "$ENABLE_UBOOT" = true ] \|\| [ "$ENABLE_FBTURBO" = true ]; then
	33	chroot_exec apt-get -y -q purge --auto-remove bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
	34	fi

bootstrap.d/50-firstboot.sh created 644 +24 0

@@ -0,0 +1,24
	1	#
	2	# First boot actions
	3	#
	4
	5	. ./functions.sh
	6
	7	cat files/firstboot/10-begin.sh > $R/etc/rc.firstboot
	8
	9	# Ensure openssh server host keys are regenerated on first boot
	10	if [ "$ENABLE_SSHD" = true ] ; then
	11	cat files/firstboot/21-generate-ssh-keys.sh >> $R/etc/rc.firstboot
	12	rm -f $R/etc/ssh/ssh_host_*
	13	fi
	14
	15	if [ "$EXPANDROOT" = true ] ; then
	16	cat files/firstboot/22-expandroot.sh >> $R/etc/rc.firstboot
	17	fi
	18
	19	cat files/firstboot/99-finish.sh >> $R/etc/rc.firstboot
	20	chmod +x $R/etc/rc.firstboot
	21
	22	sed -i '/exit 0/d' $R/etc/rc.local
	23	echo /etc/rc.firstboot >> $R/etc/rc.local
	24	echo exit 0 >> $R/etc/rc.local

functions.sh created 644 +23 0

@@ -0,0 +1,23
	1	cleanup (){
	2	# Clean up all temporary mount points
	3	set +x
	4	set +e
	5	echo "killing processes using mount point ..."
	6	fuser -k $R
	7	sleep 3
	8	fuser -9 -k -v $R
	9	echo "removing temporary mount points ..."
	10	umount -l $R/proc 2> /dev/null
	11	umount -l $R/sys 2> /dev/null
	12	umount -l $R/dev/pts 2> /dev/null
	13	umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
	14	umount "$BUILDDIR/mount" 2> /dev/null
	15	losetup -d "$ROOT_LOOP" 2> /dev/null
	16	losetup -d "$FRMW_LOOP" 2> /dev/null
	17	trap - 0 1 2 3 6
	18	}
	19
	20	chroot_exec() {
	21	# Exec command in chroot
	22	LANG=C LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot $R $*
	23	}

README.md +38 -1

@@ -123,7 +123,7 Install Xorg open-source X Window System.
123	##### `ENABLE_WM`=""	123	##### `ENABLE_WM`=""
124	Install a user defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi2-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.	124	Install a user defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi2-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
125		125
126	#### Advanced sytem features:	126	#### Advanced system features:
127	##### `ENABLE_MINBASE`=false	127	##### `ENABLE_MINBASE`=false
128	Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.	128	Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
129		129
@@ -155,6 +155,43 Enable having root partition on an USB drive by creating two image files: one fo
155	##### `CHROOT_SCRIPTS`=""	155	##### `CHROOT_SCRIPTS`=""
156	Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this direcory is run in lexicographical order.	156	Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this direcory is run in lexicographical order.
157		157
		158	#### Kernel compilation:
		159	##### `BUILD_KERNEL`=false
		160	Build and install the latest RPi2 linux kernel. Currently only the default RPi2 kernel configuration is used. Detailed configuration parameters for customizing the kernel and minor bug fixes still need to get implemented. feel free to help.
		161
		162	##### `KERNEL_HEADERS`=true
		163	If true, also install kernel headers with built kernel.
		164
		165	## Understanding the script
		166	The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
		167
		168	\| Script \| Description \|
		169	\| --- \| --- \|
		170	\| `10-bootstrap.sh` \| Debootstrap basic system \|
		171	\| `11-apt.sh` \| Setup APT repositories \|
		172	\| `12-locale.sh` \| Setup Locales and keyboard settings \|
		173	\| `13-kernel.sh` \| Build and install RPi2 Kernel \|
		174	\| `20-networking.sh` \| Setup Networking \|
		175	\| `21-firewall.sh` \| Setup iptables Firewall \|
		176	\| `30-security.sh` \| Setup users and security settings \|
		177	\| `31-logging.sh` \| Setup logging \|
		178	\| `41-uboot.sh` \| Build and Setup Uboot \|
		179	\| `42-fbturbo.sh` \| Buld and Setup fbturbo Xorg driver \|
		180	\| `50-firstboot.sh` \| First boot actions \|
		181
		182	All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
		183
		184	\| Directory \| Description \|
		185	\| --- \| --- \|
		186	\| `boot` \| Boot and RPi2 configuration files \|
		187	\| `firstboot` \| Scripts that get executed on first boot \|
		188	\| `iptables` \| Firewall configuration files \|
		189	\| `modprobe.d` \| Kernel Module Blacklist configuration \|
		190	\| `mount` \| Fstab configuration \|
		191	\| `network` \| Networking configuration files \|
		192	\| `sysctl.d` \| Swapping and Network Hardening configuration \|
		193	\| `xorg` \| fbturbo Xorg driver configuration \|
		194
158	## Logging of the bootstrapping process	195	## Logging of the bootstrapping process
159	All information related to the bootstrapping process and the commands executed by the `rpi2-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:	196	All information related to the bootstrapping process and the commands executed by the `rpi2-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
160		197

rpi2-gen-image.sh +32 -432

@@ -15,25 +15,7
15	# Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>	15	# Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
16	########################################################################	16	########################################################################
17		17
18	# Clean up all temporary mount points	18	source ./functions.sh
19	cleanup (){
20	set +x
21	set +e
22	echo "removing temporary mount points ..."
23	umount -l $R/proc 2> /dev/null
24	umount -l $R/sys 2> /dev/null
25	umount -l $R/dev/pts 2> /dev/null
26	umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
27	umount "$BUILDDIR/mount" 2> /dev/null
28	losetup -d "$ROOT_LOOP" 2> /dev/null
29	losetup -d "$FRMW_LOOP" 2> /dev/null
30	trap - 0 1 2 3 6
31	}
32
33	# Exec command in chroot
34	chroot_exec() {
35	LANG=C LC_ALL=C chroot $R $*
36	}
37		19
38	set -e	20	set -e
39	set -x	21	set -x
@@ -43,7 +25,7 RELEASE=${RELEASE:=jessie}
43	KERNEL=${KERNEL:=3.18.0-trunk-rpi2}	25	KERNEL=${KERNEL:=3.18.0-trunk-rpi2}
44		26
45	# Build settings	27	# Build settings
46	BASEDIR=./images/${RELEASE}	28	BASEDIR=$(pwd)/images/${RELEASE}
47	BUILDDIR=${BASEDIR}/build	29	BUILDDIR=${BASEDIR}/build
48		30
49	# General settings	31	# General settings
@@ -96,6 +78,10 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
96	ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}	78	ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
97	ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}	79	ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
98		80
		81	# Kernel compilation settings
		82	BUILD_KERNEL=${BUILD_KERNEL:=false}
		83	KERNEL_HEADERS=${KERNEL_HEADERS:=true}
		84
99	# Image chroot path	85	# Image chroot path
100	R=${BUILDDIR}/chroot	86	R=${BUILDDIR}/chroot
101	CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}	87	CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
@@ -118,6 +104,11 if [ "$(id -u)" -ne "0" ] ; then
118	exit 1	104	exit 1
119	fi	105	fi
120		106
		107	# Add packages required for kernel cross compilation
		108	if [ "$BUILD_KERNEL" = true ] ; then
		109	REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
		110	fi
		111
121	# Check if all required packages are installed	112	# Check if all required packages are installed
122	for package in $REQUIRED_PACKAGES ; do	113	for package in $REQUIRED_PACKAGES ; do
123	if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then	114	if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
@@ -214,416 +205,18 if [ "$ENABLE_XORG" = true ] ; then
214	APT_INCLUDES="${APT_INCLUDES},xorg"	205	APT_INCLUDES="${APT_INCLUDES},xorg"
215	fi	206	fi
216		207
217	# Base debootstrap (unpack only)	208	## Main bootstrap
218	if [ "$ENABLE_MINBASE" = true ] ; then	209	for i in bootstrap.d/*.sh; do
219	http_proxy=${APT_PROXY} debootstrap --arch=armhf --variant=minbase --foreign --include=${APT_INCLUDES} $RELEASE $R http://${APT_SERVER}/debian	210	. $i
220	else	211	done
221	http_proxy=${APT_PROXY} debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R http://${APT_SERVER}/debian
222	fi
223
224	# Copy qemu emulator binary to chroot
225	cp /usr/bin/qemu-arm-static $R/usr/bin
226
227	# Copy debian-archive-keyring.pgp
228	chroot $R mkdir -p /usr/share/keyrings
229	cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
230
231	# Complete the bootstrapping process
232	chroot $R /debootstrap/debootstrap --second-stage
233
234	# Mount required filesystems
235	mount -t proc none $R/proc
236	mount -t sysfs none $R/sys
237	mount --bind /dev/pts $R/dev/pts
238
239	# Use proxy inside chroot
240	if [ -z "$APT_PROXY" ] ; then
241	echo "Acquire::http::Proxy \"$APT_PROXY\";" >> $R/etc/apt/apt.conf.d/10proxy
242	fi
243
244	# Pin package flash-kernel to repositories.collabora.co.uk
245	cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
246	Package: flash-kernel
247	Pin: origin repositories.collabora.co.uk
248	Pin-Priority: 1000
249	EOM
250
251	# Set up timezone
252	echo ${TIMEZONE} >$R/etc/timezone
253	chroot_exec dpkg-reconfigure -f noninteractive tzdata
254
255	# Upgrade collabora package index and install collabora keyring
256	echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
257	chroot_exec apt-get -qq -y update
258	chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring
259
260	# Set up initial sources.list
261	cat <<EOM >$R/etc/apt/sources.list
262	deb http://${APT_SERVER}/debian ${RELEASE} main contrib
263	#deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
264
265	deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
266	#deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
267
268	deb http://security.debian.org/ ${RELEASE}/updates main contrib
269	#deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
270
271	deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
272	EOM
273
274	# Upgrade package index and update all installed packages and changed dependencies
275	chroot_exec apt-get -qq -y update
276	chroot_exec apt-get -qq -y -u dist-upgrade
277
278	# Set up default locale and keyboard configuration
279	if [ "$ENABLE_MINBASE" = false ] ; then
280	# Set locale choice in debconf db, even though dpkg-reconfigure ignores and overwrites them due to some bug
281	# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685957
282	# ... so we have to set locales manually
283	if [ "$DEFLOCAL" = "en_US.UTF-8" ] ; then
284	chroot_exec echo "locales locales/locales_to_be_generated multiselect ${DEFLOCAL} UTF-8" \| debconf-set-selections
285	else
286	# en_US.UTF-8 should be available anyway : https://www.debian.org/doc/manuals/debian-reference/ch08.en.html#_the_reconfiguration_of_the_locale
287	chroot_exec echo "locales locales/locales_to_be_generated multiselect en_US.UTF-8 UTF-8, ${DEFLOCAL} UTF-8" \| debconf-set-selections
288	chroot_exec sed -i "/en_US.UTF-8/s/^#//" /etc/locale.gen
289	fi
290	chroot_exec sed -i "/${DEFLOCAL}/s/^#//" /etc/locale.gen
291	chroot_exec echo "locales locales/default_environment_locale select ${DEFLOCAL}" \| debconf-set-selections
292	chroot_exec locale-gen
293	chroot_exec update-locale LANG=${DEFLOCAL}
294
295	# Keyboard configuration, if requested
296	if [ "$XKBMODEL" != "" ] ; then
297	chroot_exec sed -i "s/^XKBMODEL.*/XKBMODEL=\"${XKBMODEL}\"/" /etc/default/keyboard
298	fi
299	if [ "$XKBLAYOUT" != "" ] ; then
300	chroot_exec sed -i "s/^XKBLAYOUT.*/XKBLAYOUT=\"${XKBLAYOUT}\"/" /etc/default/keyboard
301	fi
302	if [ "$XKBVARIANT" != "" ] ; then
303	chroot_exec sed -i "s/^XKBVARIANT.*/XKBVARIANT=\"${XKBVARIANT}\"/" /etc/default/keyboard
304	fi
305	if [ "$XKBOPTIONS" != "" ] ; then
306	chroot_exec sed -i "s/^XKBOPTIONS.*/XKBOPTIONS=\"${XKBOPTIONS}\"/" /etc/default/keyboard
307	fi
308	chroot_exec dpkg-reconfigure -f noninteractive keyboard-configuration
309	# Set up font console
310	case "${DEFLOCAL}" in
311	*UTF-8)
312	chroot_exec sed -i 's/^CHARMAP.*/CHARMAP="UTF-8"/' /etc/default/console-setup
313	;;
314	*)
315	chroot_exec sed -i 's/^CHARMAP.*/CHARMAP="guess"/' /etc/default/console-setup
316	;;
317	esac
318	chroot_exec dpkg-reconfigure -f noninteractive console-setup
319	fi
320
321	# Kernel installation
322	# Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
323	chroot_exec apt-get -qq -y --no-install-recommends install linux-image-${KERNEL} raspberrypi-bootloader-nokernel
324	chroot_exec apt-get -qq -y install flash-kernel
325
326	VMLINUZ="$(ls -1 $R/boot/vmlinuz-* \| sort \| tail -n 1)"
327	[ -z "$VMLINUZ" ] && exit 1
328	cp $VMLINUZ $R/boot/firmware/kernel7.img
329
330	# Set up IPv4 hosts
331	echo ${HOSTNAME} >$R/etc/hostname
332	cat <<EOM >$R/etc/hosts
333	127.0.0.1 localhost
334	127.0.1.1 ${HOSTNAME}
335	EOM
336	if [ "$NET_ADDRESS" != "" ] ; then
337	NET_IP=$(echo ${NET_ADDRESS} \| cut -f 1 -d'/')
338	sed -i "s/^127.0.1.1/${NET_IP}/" $R/etc/hosts
339	fi
340
341	# Set up IPv6 hosts
342	if [ "$ENABLE_IPV6" = true ] ; then
343	cat <<EOM >>$R/etc/hosts
344
345	::1 localhost ip6-localhost ip6-loopback
346	ff02::1 ip6-allnodes
347	ff02::2 ip6-allrouters
348	EOM
349	fi
350
351	# Place hint about network configuration
352	cat <<EOM >$R/etc/network/interfaces
353	# Debian switched to systemd-networkd configuration files.
354	# please configure your networks in '/etc/systemd/network/'
355	EOM
356
357	if [ "$ENABLE_DHCP" = true ] ; then
358	# Enable systemd-networkd DHCP configuration for interface eth0
359	cat <<EOM >$R/etc/systemd/network/eth.network
360	[Match]
361	Name=eth0
362
363	[Network]
364	DHCP=yes
365	EOM
366
367	# Set DHCP configuration to IPv4 only
368	if [ "$ENABLE_IPV6" = false ] ; then
369	sed -i "s/^DHCP=yes/DHCP=v4/" $R/etc/systemd/network/eth.network
370	fi
371	else # ENABLE_DHCP=false
372	cat <<EOM >$R/etc/systemd/network/eth.network
373	[Match]
374	Name=eth0
375
376	[Network]
377	DHCP=no
378	Address=${NET_ADDRESS}
379	Gateway=${NET_GATEWAY}
380	DNS=${NET_DNS_1}
381	DNS=${NET_DNS_2}
382	Domains=${NET_DNS_DOMAINS}
383	NTP=${NET_NTP_1}
384	NTP=${NET_NTP_2}
385	EOM
386	fi
387
388	# Enable systemd-networkd service
389	chroot_exec systemctl enable systemd-networkd
390
391	# Generate crypt(3) password string
392	ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
393
394	# Set up default user
395	if [ "$ENABLE_USER" = true ] ; then
396	chroot_exec adduser --gecos pi --add_extra_groups --disabled-password pi
397	chroot_exec usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
398	fi
399
400	# Set up root password or not
401	if [ "$ENABLE_ROOT" = true ]; then
402	chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
403
404	if [ "$ENABLE_ROOT_SSH" = true ]; then
405	sed -i 's\|[#]PermitRootLogin.\|PermitRootLogin yes\|g' $R/etc/ssh/sshd_config
406	fi
407	else
408	chroot_exec usermod -p \'!\' root
409	fi
410
411	# Set up firmware boot cmdline
412	if [ "$ENABLE_SPLITFS" = true ] ; then
413	CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
414	else
415	CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
416	fi
417
418	# Set up serial console support (if requested)
419	if [ "$ENABLE_CONSOLE" = true ] ; then
420	CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
421	fi
422
423	# Set up IPv6 networking support
424	if [ "$ENABLE_IPV6" = false ] ; then
425	CMDLINE="${CMDLINE} ipv6.disable=1"
426	fi
427
428	echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
429
430	# Set up firmware config
431	install -o root -g root -m 644 files/config.txt $R/boot/firmware/config.txt
432
433	# Load snd_bcm2835 kernel module at boot time
434	if [ "$ENABLE_SOUND" = true ] ; then
435	echo "snd_bcm2835" >>$R/etc/modules
436	fi
437
438	# Set smallest possible GPU memory allocation size: 16MB (no X)
439	if [ "$ENABLE_MINGPU" = true ] ; then
440	echo "gpu_mem=16" >>$R/boot/firmware/config.txt
441	fi
442
443	# Create symlinks
444	ln -sf firmware/config.txt $R/boot/config.txt
445	ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
446
447	# Prepare modules-load.d directory
448	mkdir -p $R/lib/modules-load.d/
449
450	# Load random module on boot
451	if [ "$ENABLE_HWRANDOM" = true ] ; then
452	cat <<EOM >$R/lib/modules-load.d/rpi2.conf
453	bcm2708_rng
454	EOM
455	fi
456
457	# Prepare modprobe.d directory
458	mkdir -p $R/etc/modprobe.d/
459
460	# Blacklist sound modules
461	install -o root -g root -m 644 files/modprobe.d/raspi-blacklist.conf $R/etc/modprobe.d/raspi-blacklist.conf
462
463	# Create default fstab
464	install -o root -g root -m 644 files/fstab $R/etc/fstab
465	if [ "$ENABLE_SPLITFS" = true ] ; then
466	sed -i '/mmcblk0p2/sda1/' $R/etc/fstab
467	fi
468
469	# Avoid swapping and increase cache sizes
470	install -o root -g root -m 644 files/sysctl.d/81-rpi-vm.conf $R/etc/sysctl.d/81-rpi-vm.conf
471
472	# Enable network stack hardening
473	if [ "$ENABLE_HARDNET" = true ] ; then
474	install -o root -g root -m 644 files/sysctl.d/81-rpi-net-hardening.conf $R/etc/sysctl.d/81-rpi-net-hardening.conf
475
476	# Enable resolver warnings about spoofed addresses
477	cat <<EOM >>$R/etc/host.conf
478	spoof warn
479	EOM
480	fi
481
482	# First boot actions
483	cat files/firstboot/10-begin.sh > $R/etc/rc.firstboot
484
485	# Ensure openssh server host keys are regenerated on first boot
486	if [ "$ENABLE_SSHD" = true ] ; then
487	cat files/firstboot/21-generate-ssh-keys.sh >> $R/etc/rc.firstboot
488	rm -f $R/etc/ssh/ssh_host_*
489	fi
490
491	if [ "$EXPANDROOT" = true ] ; then
492	cat files/firstboot/22-expandroot.sh >> $R/etc/rc.firstboot
493	fi
494
495	cat files/firstboot/99-finish.sh >> $R/etc/rc.firstboot
496	chmod +x $R/etc/rc.firstboot
497
498	sed -i '/exit 0/d' $R/etc/rc.local
499	echo /etc/rc.firstboot >> $R/etc/rc.local
500	echo exit 0 >> $R/etc/rc.local
501
502	# Disable rsyslog
503	if [ "$ENABLE_RSYSLOG" = false ]; then
504	sed -i 's\|[#]*ForwardToSyslog=yes\|ForwardToSyslog=no\|g' $R/etc/systemd/journald.conf
505	chroot_exec systemctl disable rsyslog
506	chroot_exec apt-get purge -q -y --force-yes rsyslog
507	fi
508
509	# Enable serial console systemd style
510	if [ "$ENABLE_CONSOLE" = true ] ; then
511	chroot_exec systemctl enable serial-getty\@ttyAMA0.service
512	fi
513
514	# Enable firewall based on iptables started by systemd service
515	if [ "$ENABLE_IPTABLES" = true ] ; then
516	# Create iptables configuration directory
517	mkdir -p "$R/etc/iptables"
518
519	# Create iptables systemd service
520	install -o root -g root -m 644 files/iptables/iptables.service $R/etc/systemd/system/iptables.service
521
522	# Create flush-table script called by iptables service
523	install -o root -g root -m 755 files/iptables/flush-iptables.sh $R/etc/iptables/flush-iptables.sh
524
525	# Create iptables rule file
526	install -o root -g root -m 644 files/iptables/iptables.rules $R/etc/iptables/iptables.rules
527
528	# Reload systemd configuration and enable iptables service
529	chroot_exec systemctl daemon-reload
530	chroot_exec systemctl enable iptables.service
531
532	if [ "$ENABLE_IPV6" = true ] ; then
533	# Create ip6tables systemd service
534	install -o root -g root -m 644 files/iptables/ip6tables.service $R/etc/systemd/system/ip6tables.service
535
536	# Create ip6tables file
537	install -o root -g root -m 755 files/iptables/flush-ip6tables.sh $R/etc/iptables/flush-ip6tables.sh
538
539	install -o root -g root -m 644 files/iptables/ip6tables.rules $R/etc/iptables/ip6tables.rules
540
541	# Reload systemd configuration and enable iptables service
542	chroot_exec systemctl daemon-reload
543	chroot_exec systemctl enable ip6tables.service
544	fi
545	fi
546
547	# Remove SSHD related iptables rules
548	if [ "$ENABLE_SSHD" = false ] ; then
549	sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/iptables.rules 2> /dev/null
550	sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/ip6tables.rules 2> /dev/null
551	fi
552
553	# Install gcc/c++ build environment inside the chroot
554	if [ "$ENABLE_UBOOT" = true ] \|\| [ "$ENABLE_FBTURBO" = true ]; then
555	chroot_exec apt-get install -q -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
556	fi
557
558	# Fetch and build U-Boot bootloader
559	if [ "$ENABLE_UBOOT" = true ] ; then
560	# Fetch U-Boot bootloader sources
561	git -C $R/tmp clone git://git.denx.de/u-boot.git
562
563	# Build and install U-Boot inside chroot
564	chroot_exec make -C /tmp/u-boot/ rpi_2_defconfig all
565
566	# Copy compiled bootloader binary and set config.txt to load it
567	cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
568	printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
569
570	# Set U-Boot command file
571	cat <<EOM >$R/boot/firmware/uboot.mkimage
572	# Tell Linux that it is booting on a Raspberry Pi2
573	setenv machid 0x00000c42
574
575	# Set the kernel boot command line
576	setenv bootargs "earlyprintk ${CMDLINE}"
577
578	# Save these changes to u-boot's environment
579	saveenv
580
581	# Load the existing Linux kernel into RAM
582	fatload mmc 0:1 \${kernel_addr_r} kernel7.img
583
584	# Boot the kernel we have just loaded
585	bootz \${kernel_addr_r}
586	EOM
587
588	# Generate U-Boot image from command file
589	chroot_exec mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
590	fi
591
592	# Fetch and build fbturbo Xorg driver
593	if [ "$ENABLE_FBTURBO" = true ] ; then
594	# Fetch fbturbo driver sources
595	git -C $R/tmp clone https://github.com/ssvb/xf86-video-fbturbo.git
596
597	# Install Xorg build dependencies
598	chroot_exec apt-get install -q -y --no-install-recommends xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
599
600	# Build and install fbturbo driver inside chroot
601	chroot_exec /bin/bash -c "cd /tmp/xf86-video-fbturbo; autoreconf -vi; ./configure --prefix=/usr; make; make install"
602
603	# Add fbturbo driver to Xorg configuration
604	cat <<EOM >$R/usr/share/X11/xorg.conf.d/99-fbturbo.conf
605	Section "Device"
606	Identifier "Allwinner A10/A13 FBDEV"
607	Driver "fbturbo"
608	Option "fbdev" "/dev/fb0"
609	Option "SwapbuffersWait" "true"
610	EndSection
611	EOM
612
613	# Remove Xorg build dependencies
614	chroot_exec apt-get -q -y purge --auto-remove xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
615	fi
616		212
617	# Remove gcc/c++ build environment from the chroot	213	## Custom bootstrap scripts
618	if [ "$ENABLE_UBOOT" = true ] \|\| [ "$ENABLE_FBTURBO" = true ]; then	214	if [ -d "custom.d" ]; then
619	chroot_exec apt-get -y -q purge --auto-remove bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make	215	for i in custom.d/*.sh; do
		216	. $i
		217	done
620	fi	218	fi
621		219
622	# Clean cached downloads
623	chroot_exec apt-get -y clean
624	chroot_exec apt-get -y autoclean
625	chroot_exec apt-get -y autoremove
626
627	# Invoke custom scripts	220	# Invoke custom scripts
628	if [ -n "${CHROOT_SCRIPTS}" ]; then	221	if [ -n "${CHROOT_SCRIPTS}" ]; then
629	cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"	222	cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
@@ -631,6 +224,11 if [ -n "${CHROOT_SCRIPTS}" ]; then
631	rm -rf "${R}/chroot_scripts"	224	rm -rf "${R}/chroot_scripts"
632	fi	225	fi
633		226
		227	## Cleanup
		228	chroot_exec apt-get -y clean
		229	chroot_exec apt-get -y autoclean
		230	chroot_exec apt-get -y autoremove
		231
634	# Unmount mounted filesystems	232	# Unmount mounted filesystems
635	umount -l $R/proc	233	umount -l $R/proc
636	umount -l $R/sys	234	umount -l $R/sys
@@ -647,6 +245,7 rm -f $R/var/lib/urandom/random-seed
647	[ -L $R/var/lib/dbus/machine-id ] \|\| rm -f $R/var/lib/dbus/machine-id	245	[ -L $R/var/lib/dbus/machine-id ] \|\| rm -f $R/var/lib/dbus/machine-id
648	rm -f $R/etc/machine-id	246	rm -f $R/etc/machine-id
649	rm -fr $R/etc/apt/apt.conf.d/10proxy	247	rm -fr $R/etc/apt/apt.conf.d/10proxy
		248	rm -f $R/etc/resolv.conf
650		249
651	# Calculate size of the chroot directory in KB	250	# Calculate size of the chroot directory in KB
652	CHROOT_SIZE=$(expr `du -s $R \| awk '{ print $1 }'`)	251	CHROOT_SIZE=$(expr `du -s $R \| awk '{ print $1 }'`)
@@ -690,7 +289,7 unit: sectors
690	3 : start= 0, size= 0, Id= 0	289	3 : start= 0, size= 0, Id= 0
691	4 : start= 0, size= 0, Id= 0	290	4 : start= 0, size= 0, Id= 0
692	EOM	291	EOM
693	# Set up temporary loop devices ~~and build filesystems~~	292	# Set up temporary loop devices
694	FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}-frmw.img)"	293	FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}-frmw.img)"
695	ROOT_LOOP="$(losetup -o 1M -f --show $BASEDIR/${DATE}-debian-${RELEASE}-root.img)"	294	ROOT_LOOP="$(losetup -o 1M -f --show $BASEDIR/${DATE}-debian-${RELEASE}-root.img)"
696	else	295	else
@@ -705,11 +304,12 unit: sectors
705	3 : start= 0, size= 0, Id= 0	304	3 : start= 0, size= 0, Id= 0
706	4 : start= 0, size= 0, Id= 0	305	4 : start= 0, size= 0, Id= 0
707	EOM	306	EOM
708	# Set up temporary loop devices ~~and build filesystems~~	307	# Set up temporary loop devices
709	FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"	308	FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
710	ROOT_LOOP="$(losetup -o 65M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"	309	ROOT_LOOP="$(losetup -o 65M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
711	fi	310	fi
712		311
		312	# Build filesystems
713	mkfs.vfat "$FRMW_LOOP"	313	mkfs.vfat "$FRMW_LOOP"
714	mkfs.ext4 "$ROOT_LOOP"	314	mkfs.ext4 "$ROOT_LOOP"
715		315
@@ -732,12 +332,12 if [ "$ENABLE_SPLITFS" = true ] ; then
732	bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}-root.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}-root.img"	332	bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}-root.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}-root.img"
733		333
734	# Image was successfully created	334	# Image was successfully created
735	echo "$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img ($(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} \* 512 \/ 1024)M)" ": successfully created"	335	echo "$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img ($(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
736	echo "$BASEDIR/${DATE}-debian-${RELEASE}-root.img ($(expr ${TABLE_SECTORS} + ${ROOT_SECTORS} \* 512 \/ 1024)M)" ": successfully created"	336	echo "$BASEDIR/${DATE}-debian-${RELEASE}-root.img ($(expr ${TABLE_SECTORS} + ${ROOT_SECTORS} \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
737	else	337	else
738	# (optional) create block map file for "bmaptool"	338	# (optional) create block map file for "bmaptool"
739	bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"	339	bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
740		340
741	# Image was successfully created	341	# Image was successfully created
742	echo "$BASEDIR/${DATE}-debian-${RELEASE}.img ($(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS} \* 512 \/ 1024)M)" ": successfully created"	342	echo "$BASEDIR/${DATE}-debian-${RELEASE}.img ($(expr ${TABLE_SECTORS} + ${FRMW_SECTORS} + ${ROOT_SECTORS} \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
743	fi	343	fi

General Comments 0

Écrire
Preview

Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages