##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

Merge branch 'masterDRT' into masterGV
vidal -
r746:3367d9345003 Fusion
parent child
Show More
Show file before | Show file after | Hide comments
@@ -0,0 +1,14
1 [Match]
2 Name=eth0
3
4 [Network]
5 RouteMetric=10
6 IPv6PrivacyExtensions=true
7 DHCP=no
8 Address=
9 Gateway=
10 DNS=
11 DNS=
12 Domains=
13 NTP=
14 NTP=
Show file before | Show file after | Hide comments
@@ -0,0 +1,14
1 [Match]
2 Name=wlan0
3
4 [Network]
5 RouteMetric=20
6 IPv6PrivacyExtensions=true
7 DHCP=no
8 Address=
9 Gateway=
10 DNS=
11 DNS=
12 Domains=
13 NTP=
14 NTP=
Show file before | Show file after | Hide comments
@@ -0,0 +1,188
1 ############################
2 ########APT settings########
3 ############################
4 APT_SERVER=ftp.debian.org
5 APT_PROXY=
6 KEEP_APT_PROXY=false
7 APT_INCLUDES_LATE=
8 APT_INCLUDES=
9 ############################
10 ##General system settings###
11 ############################
12 SET_ARCH=32
13 RPI_MODEL=3P
14 RELEASE=buster
15 HOSTNAME=
16 DEFLOCAL=en_US.UTF-8
17 TIMEZONE=Europe/Berlin
18 EXPANDROOT=true
19 ############################
20 #######User settings########
21 ############################
22 ENABLE_ROOT=false
23 ROOT_PASSWORD=raspberry
24 ENABLE_USER=true
25 USER_NAME=pi
26 USER_PASSWORD=raspberry
27 ############################
28 ####Keyboard settings#######
29 ############################
30 XKB_MODEL=
31 XKB_LAYOUT=
32 XKB_VARIANT=
33 XKB_OPTIONS=
34 ############################
35 ######Network settings######
36 ############################
37 ENABLE_IPV6=true
38 ENABLE_WIRELESS=false
39 ENABLE_IPTABLES=false
40 ENABLE_HARDNET=false
41 ENABLE_IFNAMES=true
42 ############################
43 # Network settings (DHCP)
44 ENABLE_ETH_DHCP=true
45 ENABLE_WIFI_DHCP=true
46 ############################
47 # Network settings (static)
48 NET_ETH_ADDRESS=
49 NET_ETH_GATEWAY=
50 NET_ETH_DNS_1=
51 NET_ETH_DNS_2=
52 NET_ETH_DNS_DOMAINS=
53 NET_ETH_NTP_1=
54 NET_ETH_NTP_2=
55 ############################
56 NET_WIFI_SSID=
57 NET_WIFI_PSK=
58 ############################
59 # Network settings (static)
60 NET_WIFI_ADDRESS=
61 NET_WIFI_GATEWAY=
62 NET_WIFI_DNS_1=
63 NET_WIFI_DNS_2=
64 NET_WIFI_DNS_DOMAINS=
65 NET_WIFI_NTP_1=
66 NET_WIFI_NTP_2=
67 ############################
68 ###Basic system settings####
69 ############################
70 ENABLE_CONSOLE=false
71 ENABLE_PRINTK=false
72 ENABLE_BLUETOOTH=false
73 ENABLE_MINIUART_OVERLAY=false
74 ENABLE_TURBO=false
75 ENABLE_I2C=true
76 ENABLE_SPI=true
77 ENABLE_NONFREE=false
78 ENABLE_RSYSLOG=false
79 ENABLE_SOUND=false
80 ENABLE_HWRANDOM=true
81 ENABLE_MINGPU=false
82 ENABLE_XORG=false
83 ENABLE_WM=
84 ENABLE_SYSVINIT=false
85 ENABLE_SPLASH=true
86 ENABLE_LOGO=true
87 ENABLE_SILENT_BOOT=false
88 ############################
89 #1=disable overlay,2=turbo+overlay, otherwise leave unset
90 DISABLE_UNDERVOLT_WARNINGS=
91 ############################
92 ##Advanced system settings##
93 ############################
94 ENABLE_DPHYSSWAP=true
95 ENABLE_SYSTEMDSWAP=false
96 ############################
97 ENABLE_QEMU=false
98 QEMU_BINARY=
99 ENABLE_KEYGEN=false
100 ENABLE_MINBASE=false
101 ENABLE_SPLITFS=false
102 ENABLE_INITRAMFS=false
103 ENABLE_DBUS=true
104 ENABLE_USBBOOT=false
105 ############################
106 CHROOT_SCRIPTS=
107 ############################
108 ENABLE_UBOOT=false
109 UBOOTSRC_DIR=
110 ############################
111 ENABLE_FBTURBO=false
112 FBTURBOSRC_DIR=
113 ############################
114 ENABLE_VIDEOCORE=false
115 VIDEOCORESRC_DIR=
116 ############################
117 ENABLE_NEXMON=false
118 NEXMONSRC_DIR=
119 ############################
120 ########SSH settings########
121 ############################
122 SSH_ENABLE=true
123 SSH_ENABLE_ROOT=false
124 SSH_DISABLE_PASSWORD_AUTH=false
125 SSH_LIMIT_USERS=false
126 SSH_ROOT_PUB_KEY=
127 SSH_USER_PUB_KEY=
128 ############################
129 #####Kernel settings########
130 ############################
131 BUILD_KERNEL=true
132 CROSS_COMPILE=
133 KERNEL_ARCH=
134 KERNEL_IMAGE=
135 KERNEL_BRANCH=
136 KERNEL_DEFCONFIG=
137
138 KERNEL_THREADS=1
139 KERNEL_HEADERS=true
140 KERNEL_MENUCONFIG=false
141 KERNEL_OLDDEFCONFIG=false
142 KERNEL_CCACHE=false
143 KERNEL_REMOVESRC=true
144 KERNELSRC_DIR=
145 KERNELSRC_CLEAN=false
146 KERNELSRC_CONFIG=true
147 KERNELSRC_USRCONFIG=
148 KERNELSRC_PREBUILT=false
149 RPI_FIRMWARE_DIR=
150 KERNEL_DEFAULT_GOV=ondemand
151 KERNEL_NF=false
152 KERNEL_VIRT=false
153 KERNEL_ZSWAP=false
154 KERNEL_BPF=true
155 KERNEL_SECURITY=false
156 KERNEL_BTRFS=false
157 KERNEL_POEHAT=false
158 KERNEL_NSPAWN=false
159 KERNEL_DHKEY=true
160 ############################
161 #######Save diskspace#######
162 ############################
163 ENABLE_REDUCE=false
164 REDUCE_APT=true
165 REDUCE_DOC=false
166 REDUCE_MAN=false
167 REDUCE_VIM=false
168 REDUCE_BASH=false
169 REDUCE_HWDB=false
170 REDUCE_SSHD=false
171 REDUCE_LOCALE=false
172 REDUCE_KERNEL=false
173 ############################
174 ######CryptFS Settings######
175 ############################
176 ENABLE_CRYPTFS=false
177 CRYPTFS_PASSWORD=
178 CRYPTFS_MAPPING=secure
179 CRYPTFS_CIPHER=aes-xts-plain64
180 CRYPTFS_HASH=sha256
181 CRYPTFS_XTSKEYSIZE=256
182 CRYPTFS_DROPBEAR=false
183 CRYPTFS_DROPBEAR_PUBKEY=
184 ############################
185 #######Build settings#######
186 ############################
187 BASEDIR=
188 IMAGE_NAME= No newline at end of file
Show file before | Show file after | Hide comments
This diff has been collapsed as it changes many lines, (574 lines changed) Show them Hide them
@@ -1,574 +1,404
1 # rpi23-gen-image
1 # rpi23-gen-image
2 ## Introduction
2 ## Introduction
3
3
4 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for Raspberry Pi 2 (RPi2), Raspberry Pi 3 (RPi3) and Raspberry Pi 4 (RPi4) computers. The script at this time supports the bootstrapping of the Debian (armhf) releases `jessie`, `stretch`, `buster` and 'bullseye'. Raspberry Pi 3 images are generated for 32-bit mode only. Raspberry Pi 3 and Raspberry Pi 4 64-bit images can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.11.y```).
4 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for Raspberry Pi 2 (RPi2), Raspberry Pi 3 (RPi3) and Raspberry Pi 4 (RPi4) computers. The script at this time supports the bootstrapping of the Debian (armhf) releases `jessie`, `stretch`, `buster` and 'bullseye'. Raspberry Pi 3 images are generated for 32-bit mode only. Raspberry Pi 3 and Raspberry Pi 4 64-bit images can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.11.y```).
5
5
6 ## Build dependencies
6 ## Build dependencies
7 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
8
8
9 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
10
10
11 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel/aarch64) cross-compiler toolchain.
11 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel/aarch64) cross-compiler toolchain.
12
12
13 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
14
14
15 ## Command-line parameters
15 ## Command-line parameters
16 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
16 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
17
17
18 ##### Command-line examples:
18 ##### Command-line examples:
19 ```shell
19 ```shell
20 ENABLE_UBOOT=true ./rpi23-gen-image.sh
20 ENABLE_UBOOT=true ./rpi23-gen-image.sh
21 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
21 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
22 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
22 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
23 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
23 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
24 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
24 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
25 ENABLE_MINBASE=true ./rpi23-gen-image.sh
25 ENABLE_MINBASE=true ./rpi23-gen-image.sh
26 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
26 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
27 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
27 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
28 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
30 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
30 RELEASE=buster BUILD_KERNEL=true ./rpi23-gen-image.sh
31 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 RELEASE=buster RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
33 ```
33 ```
34
34
35 ## Configuration template files
35 ## Configuration template files
36 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
36 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
37
37
38 ##### Command-line examples:
38 ##### Command-line examples:
39 ```shell
39 ```shell
40 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
40 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
41 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
41 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
42 ```
42 ```
43
43
44 ## Supported parameters and settings
44 ## Working with the your template:
45 #### APT settings:
45 * **A Pipe ("|") represents a logical OR**
46 ##### `APT_SERVER`="ftp.debian.org"
46 * **A valuetype of boolean represents the options true or false**
47 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
47 * **Values without a default are required if you want do use that feature. It is possible that not every feature has a (working) sanity check.**
48
48 * **If it's not working as expected, search your option in all the files in this repository (With e.g.grep or notepad++).**
49 ##### `APT_PROXY`=""
49 * **Check if your missing a required option while looking at the code**
50 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
51
52 ##### `KEEP_APT_PROXY`=false
53 Keep the APT_PROXY settings used in the bootsrapping process in the generated image.
54
50
55 ##### `APT_INCLUDES`=""
51 ## Supported parameters and settings
56 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
57
58 ##### `APT_INCLUDES_LATE`=""
59 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
60
52
53 #### APT settings:
54 |Option|Value|default value|value format|desciption|
55 |---|---|---|---|---|
56 |APT_SERVER|string|ftp.debian.org|`URL`|Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.|
57 |APT_PROXY|string||`URL`|Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.|
58 |KEEP_APT_PROXY|boolean|false|`true`\|`false`|true=Keep the APT_PROXY settings used in the bootsrapping process in the generated image|
59 |APT_INCLUDES|string list||`packageA`,`packageB`,...|A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.|
60 |APT_INCLUDES_LATE|string list||`packageA`,`packageB`,...|A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.|
61 |APT_EXCLUDES|string list||`packageA`,`packageB`,...|A comma-separated list of packages to exclude. Use carefully|
61 ---
62 ---
62
63
63 #### General system settings:
64 #### General system settings:
64 ##### `SET_ARCH`=32
65 |Option|Value|default value|value format|desciption|
65
66 |---|---|---|---|---|
66 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3/RPI3+/RPI4) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
67 |SET_ARCH|integer|32|`32`\|`64`|Set Architecture to default 32bit. If you want to compile 64-bit (RPI3/RPI3+/RPI4) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.|
67
68 |RPI_MODEL|string|3P|`0`\|`1`\|`1P`\|`2`\|`3`\|`3P`\|`4`|Set Architecture. This option will set most build options accordingly. Specify the target Raspberry Pi hardware model.|
68 ##### `RPI_MODEL`=2
69 |RELEASE|string|buster|`jessie`\|`buster`\|`stretch`<br>\|`bullseye`\|`testing`\|`stable`<br>\|`oldstable`|Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.|
69 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
70 |HOSTNAME|string|RPI_MODEL-RELEASE(e.g. RPI3-buster)|`SomeImageName.img`|Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.|
70 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
71 |DEFLOCAL|string|en_US.UTF-8|`Locale.Charset`|Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.|
71 - `1` = Raspberry Pi 1 model A and B
72 |TIMEZONE|string|Europe/Berlin|`Timezone`|Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.|
72 - `1P` = Raspberry Pi 1 model B+ and A+
73 |EXPANDROOT|boolean|true|`true`\|`false`|true=Expand the root partition and filesystem automatically on first boot|
73 - `2` = Raspberry Pi 2 model B
74 - `3` = Raspberry Pi 3 model B
75 - `3P` = Raspberry Pi 3 model B+
76 - `4` = Raspberry Pi 4 model B
77
78 ##### `RELEASE`="buster"
79 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
80
81 ##### `RELEASE_ARCH`="armhf"
82 Set the desired Debian release architecture.
83
84 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
85 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
86
87 ##### `PASSWORD`="raspberry"
88 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
89
90 ##### `USER_PASSWORD`="raspberry"
91 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
92
74
93 ##### `DEFLOCAL`="en_US.UTF-8"
75 ---
94 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
95
96 ##### `TIMEZONE`="Europe/Berlin"
97 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
98
99 ##### `EXPANDROOT`=true
100 Expand the root partition and filesystem automatically on first boot.
101
102 ##### `ENABLE_DPHYSSWAP`=true
103 Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that.
104
76
105 ##### `ENABLE_QEMU`=false
77 #### User settings:
106 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
78 |Option|Value|default value|desciption|
79 |---|---|---|---|
80 |ENABLE_ROOT|boolean|false|true=root login if ROOT_PASSWORD is set|
81 |ROOT_PASSWORD|string|raspberry|Set password for `root` user. It's **STRONGLY** recommended that you choose a custom password.|
82 |ENABLE_USER|boolean|true|true=Create non-root user with password `USER_PASSWORD` and username `USER_NAME`|
83 |USER_NAME|string|pi|Set username for non-root user, if `ENABLE_USER` is true|
84 |USER_PASSWORD|string|raspberry|Set password for non-root user, if `ENABLE_USER` is true. It's **STRONGLY** recommended that you choose a custom password.|
107
85
108 ---
86 ---
109
87
110 #### Keyboard settings:
88 #### Keyboard settings:
89
111 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
90 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
112
91
113 ##### `XKB_MODEL`=""
92 |Option|Value|default value|value format|desciption|
114 Set the name of the model of your keyboard type.
93 |---|---|---|---|---|
94 |XKB_MODEL|string||`pc104`|Set the name of the model of your keyboard type|
95 |XKB_LAYOUT|string||`us`|Set the supported keyboard layout(s)|
96 |XKB_VARIANT|string||`basic`|Set the supported variant(s) of the keyboard layout(s)|
97 |XKB_OPTIONS|string||`grp:alt_shift_toggle`|Set extra xkb configuration options|
98
99 ---
115
100
116 ##### `XKB_LAYOUT`=""
101 #### Networking settings:
117 Set the supported keyboard layout(s).
102 ethernet setting go to `/etc/systemd/network/eth0.network`.
103 wifi settings go to `/etc/systemd/network/wlan0.network`.
118
104
119 ##### `XKB_VARIANT`=""
105 The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
120 Set the supported variant(s) of the keyboard layout(s).
121
106
122 ##### `XKB_OPTIONS`=""
107 |Option|Value|default value|desciption|
123 Set extra xkb configuration options.
108 |---|---|---|---|
109 |ENABLE_IPV6|boolean|true|true=Enable IPv6 support via systemd-networkd|
110 |ENABLE_WIRELESS|boolean|false|true=Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `0`,`3`,`3P`,`4`|
111 |ENABLE_IPTABLES|boolean|false|true=Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.|
112 |ENABLE_HARDNET|boolean|false|true=Enable IPv4/IPv6 network stack hardening settings|
113 |ENABLE_IFNAMES|boolean|true|true=creates complex and long interface names like e.g. encx8945924. Enable automatic assignment of predictable, stable network interface names for all NICs|
124
114
125 ---
115 ---
126
116
127 #### Networking settings (DHCP):
117 #### Networking settings (DHCP):
128 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
129
118
130 ##### `ENABLE_DHCP`=true
119
131 Set the system to use DHCP. This requires an DHCP server.
120 |Option|Value|default value|desciption|
121 |---|---|---|---|
122 |ENABLE_ETH_DHCP|boolean|true|Set the system to use DHCP on wired interface. This requires an DHCP server|
123 |ENABLE_WIFI_DHCP|boolean|true|Set the system to use DHCP on wifi interface. This requires an DHCP server. Requires ENABLE_WIRELESS|
132
124
133 ---
125 ---
134
126
135 #### Networking settings (static):
127 #### Networking settings (ethernet static):
136 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
128 The following static networking parameters are only supported if `ENABLE_ETH_DHCP` was set to `false`.
137
129
138 ##### `NET_ADDRESS`=""
130 |Option|Value|value format|desciption|
139 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
131 |---|---|---|---|
132 |NET_ETH_ADDRESS|string|`CIDR`|static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24"|
133 |NET_ETH_GATEWAY|string|`IP`|default gateway|
134 |NET_ETH_DNS_1|string|`IP`|first DNS server|
135 |NET_ETH_DNS_2|string|`IP`|second DNS server|
136 |NET_ETH_DNS_DOMAINS|string|`example.local`|default DNS search domains to use for non fully qualified hostnames|
137 |NET_ETH_NTP_1|string|`IP`|first NTP server|
138 |NET_ETH_NTP_2|string|`IP`|second NTP server|
140
139
141 ##### `NET_GATEWAY`=""
140 ---
142 Set the IP address for the default gateway.
143
141
144 ##### `NET_DNS_1`=""
142 #### Networking settings (WIFI):
145 Set the IP address for the first DNS server.
146
143
147 ##### `NET_DNS_2`=""
144 |Option|Value|value format|desciption|
148 Set the IP address for the second DNS server.
145 |---|---|---|---|
146 |NET_WIFI_SSID|string|`yourwifiname`|WIFI SSID|
147 |NET_WIFI_PSK|string|`yourwifikeytojoinnetwork`|WPA/WPA2 PSK|
149
148
150 ##### `NET_DNS_DOMAINS`=""
149 ---
151 Set the default DNS search domains to use for non fully qualified hostnames.
152
150
153 ##### `NET_NTP_1`=""
151 #### Networking settings (WIFI static):
154 Set the IP address for the first NTP server.
152 The following static networking parameters are only supported if `ENABLE_WIFI_DHCP` was set to `false`.
155
153
156 ##### `NET_NTP_2`=""
154 |Option|Value|value format|desciption|
157 Set the IP address for the second NTP server.
155 |---|---|---|---|
156 |NET_WIFI_ADDRESS|string|`CIDR`|static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24"|
157 |NET_WIFI_GATEWAY|string|`IP`|default gateway|
158 |NET_WIFI_DNS_1|string|`IP`|first DNS server|
159 |NET_WIFI_DNS_2|string|`IP`|second DNS server|
160 |NET_WIFI_DNS_DOMAINS|string|`example.local`|default DNS search domains to use for non fully qualified hostnames|
161 |NET_WIFI_NTP_1|string|`IP`|first NTP server|
162 |NET_WIFI_NTP_2|string|`IP`|second NTP server|
158
163
159 ---
164 ---
160
165
161 #### Basic system features:
166 #### Basic system features:
162 ##### `ENABLE_CONSOLE`=true
163 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
164
165 ##### `ENABLE_PRINTK`=false
166 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
167
168 ##### `ENABLE_BLUETOOTH`=false
169 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
170
171 ##### `ENABLE_MINIUART_OVERLAY`=false
172 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
173
174 ##### `ENABLE_TURBO`=false
175 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
176
177 ##### `ENABLE_I2C`=false
178 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
179
167
180 ##### `ENABLE_SPI`=false
168 |Option|Value|default value|value format|desciption|
181 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
169 |---|---|---|---|---|
182
170 |ENABLE_CONSOLE|boolean|false|`true`\|`false`|true=Enable serial console interface.Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.|
183 ##### `ENABLE_IPV6`=true
171 |ENABLE_PRINTK|boolean|false|`true`\|`false`|true=Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian|
184 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
172 |ENABLE_BLUETOOTH|boolean|false|`true`\|`false`|true=Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/)|
185
173 |ENABLE_MINIUART_OVERLAY|boolean|false|`true`\|`false`|true=Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.|
186 ##### `ENABLE_SSHD`=true
174 |ENABLE_TURBO|boolean|false|`true`\|`false`|true=Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI|
187 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
175 |ENABLE_I2C|boolean|true|`true`\|`false`|true=Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins|
188
176 |ENABLE_SPI|boolean|true|`true`\|`false`|true=Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins|
189 ##### `ENABLE_NONFREE`=false
177 |SSH_ENABLE|boolean|true|`true`\|`false`|Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root|
190 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
178 |ENABLE_NONFREE|boolean|false|`true`\|`false`|true=enable non-free\|false=disable non free. Edits /etc/apt/sources.list in your resulting image|
191
179 |ENABLE_RSYSLOG|boolean|false|`true`\|`false`|true=keep rsyslog\|false=remove rsyslog. If rsyslog is removed (false), logs will be available only in journal files)|
192 ##### `ENABLE_WIRELESS`=false
180 |ENABLE_SOUND|boolean|false|`true`\|`false`|true=Enable sound\|false=Disable sound|
193 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
181 |ENABLE_HWRANDOM|boolean|true|`true`\|`false`|true=Enable Hardware Random Number Generator(RNG)\|false=Disable Hardware RNG\|Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled|
194
182 |ENABLE_MINGPU|boolean|false|`true`\|`false`|true=GPU 16MB RAM\|false=64MB RAM\|Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU. Also removes start.elf,fixup.dat,start_x.elf,fixup_x.dat form /boot|
195 ##### `ENABLE_RSYSLOG`=true
183 |ENABLE_XORG|boolean|false|`true`\|`false`|true=Install Xorg X Window System|\false=install no Xorg|
196 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
184 |ENABLE_WM|string||`blackbox`, `openbox`, `fluxbox`,<br> `jwm`, `dwm`, `xfce4`, `awesome`|Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically set true if `ENABLE_WM` is used|
197
185 |ENABLE_SYSVINIT|boolean|false|`true`\|`false`|true=Support for halt,init,poweroff,reboot,runlevel,shutdown,init commands\|false=use systemd commands|
198 ##### `ENABLE_SOUND`=true
186 |ENABLE_SPLASH|boolean|true|`true`\|`false`|true=Enable default Raspberry Pi boot up rainbow splash screen|
199 Enable sound hardware and install Advanced Linux Sound Architecture.
187 |ENABLE_LOGO|boolean|true|`true`\|`false`|true=Enable default Raspberry Pi console logo (image of four raspberries in the top left corner)|
200
188 |ENABLE_SILENT_BOOT|boolean|false|`true`\|`false`|true=Set the verbosity of console messages shown during boot up to a strict minimum|
201 ##### `ENABLE_HWRANDOM`=true
189 |DISABLE_UNDERVOLT_WARNINGS|integer||`1`\|`2`|Unset to keep default behaviour. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present|
202 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
203
204 ##### `ENABLE_MINGPU`=false
205 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
206
207 ##### `ENABLE_DBUS`=true
208 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
209
210 ##### `ENABLE_XORG`=false
211 Install Xorg open-source X Window System.
212
213 ##### `ENABLE_WM`=""
214 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
215
216 ##### `ENABLE_SYSVINIT`=false
217 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
218
190
219 ---
191 ---
220
192
221 #### Advanced system features:
193 #### Advanced system features:
222 ##### `ENABLE_KEYGEN`=false
223 Recover your lost codec license
224
225 ##### `ENABLE_SYSTEMDSWAP`=false
226 Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled.
227
228 ##### `ENABLE_MINBASE`=false
229 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
230
231 ##### `ENABLE_REDUCE`=false
232 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
233
234 ##### `ENABLE_UBOOT`=false
235 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
236 RPI4 needs tbd
237
238 ##### `UBOOTSRC_DIR`=""
239 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
240
241 ##### `ENABLE_FBTURBO`=false
242 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
243
244 ##### `FBTURBOSRC_DIR`=""
245 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
246
247 ##### `ENABLE_VIDEOCORE`=false
248 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
249
250 ##### `VIDEOCORESRC_DIR`=""
251 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
252
253 ##### `ENABLE_NEXMON`=false
254 Install and enable the [Source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git).
255
256 ##### `NEXMONSRC_DIR`=""
257 Path to a directory (`nexmon`) of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
258
259 ##### `ENABLE_IPTABLES`=false
260 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
261
262 ##### `ENABLE_USER`=true
263 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
264
265 ##### `USER_NAME`=pi
266 Non-root user to create. Ignored if `ENABLE_USER`=false
267
268 ##### `ENABLE_ROOT`=false
269 Set root user password so root login will be enabled
270
271 ##### `ENABLE_HARDNET`=false
272 Enable IPv4/IPv6 network stack hardening settings.
273
194
274 ##### `ENABLE_SPLITFS`=false
195 |Option|Value|default value|value format|desciption|
275 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
196 |---|---|---|---|---|
276
197 |ENABLE_DPHYSSWAP|boolean|true|`true`\|`false`|Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that|
277 ##### `CHROOT_SCRIPTS`=""
198 |ENABLE_SYSTEMDSWAP|boolean|false|`true`\|`false`|Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled|
278 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
199 |ENABLE_QEMU|boolean|false|`true`\|`false`|Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file|
279
200 |QEMU_BINARY|string||`FullPathToQemuBinaryFile`|Sets the QEMU enviornment for the Debian archive. **Set by RPI_MODEL**|
280 ##### `ENABLE_INITRAMFS`=false
201 |ENABLE_KEYGEN|boolean|false|`true`\|`false`|Recover your lost codec license|
281 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
202 |ENABLE_MINBASE|boolean|false|`true`\|`false`|Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB|
282
203 |ENABLE_SPLITFS|boolean|false|`true`\|`false`|Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`|
283 ##### `ENABLE_IFNAMES`=true
204 |ENABLE_INITRAMFS|boolean|false|`true`\|`false`|Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false|
284 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
205 |ENABLE_DBUS|boolean|true|`true`\|`false`|Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled|
285
206 |ENABLE_USBBOOT|boolean|false|`true`\|`false`|true=prepare image for usbboot. use with `ENABLE_SPLTFS`=true|
286 ##### `ENABLE_SPLASH`=true
207 |CHROOT_SCRIPTS|string||`FullPathToScriptFolder`|Full path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order|
287 Enable default Raspberry Pi boot up rainbow splash screen.
208 |ENABLE_UBOOT|boolean|false|`true`\|`false`|Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol. RPI4 needs tbd|
288
209 |UBOOTSRC_DIR|string||`FullPathToUBootFolder`|Full path to a directory named `u-boot` of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot|
289 ##### `ENABLE_LOGO`=true
210 |ENABLE_FBTURBO|boolean|false|`true`\|`false`|Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling|
290 Enable default Raspberry Pi console logo (image of four raspberries in the top left corner).
211 |FBTURBOSRC_DIR|string||`FullPathToFbTurboFolder`|Full path to a directory named `xf86-video-fbturbo` of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot|
291
212 |ENABLE_VIDEOCORE|boolean|false|`true`\|`false`|Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling|
292 ##### `ENABLE_SILENT_BOOT`=false
213 |VIDEOCORESRC_DIR|string||`FullPathToVideoSrcFolder`|Full path to a directory named `userland` of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot|
293 Set the verbosity of console messages shown during boot up to a strict minimum.
214 |ENABLE_NEXMON|boolean|false|`true`\|`false`|Install and enable the source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git)|
294
215 |NEXMONSRC_DIR|string||`FullPathToNexmonFolder`|Full path to a directory named `nexmon` of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot|
295 ##### `DISABLE_UNDERVOLT_WARNINGS`=
296 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
297
216
298 ---
217 ---
299
218
300 #### SSH settings:
219 #### SSH settings:
301 ##### `SSH_ENABLE_ROOT`=false
302 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
303
220
304 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
221 |Option|Value|default value|value format|desciption|
305 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
222 |---|---|---|---|---|
306
223 |SSH_ENABLE_ROOT|boolean|false|`true`\|`false`|Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`|
307 ##### `SSH_LIMIT_USERS`=false
224 |SSH_DISABLE_PASSWORD_AUTH|boolean|false|`true`\|`false`|Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported|
308 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
225 |SSH_LIMIT_USERS|boolean|false|`true`\|`false`|Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true)|
309
226 |SSH_ROOT_PUB_KEY|string||`PathToYourROOT`<br>`RSAPublicKeyFile`|Full path to file. Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`|
310 ##### `SSH_ROOT_PUB_KEY`=""
227 |SSH_USER_PUB_KEY|string||`PathToYourUSER`<br>`RSAPublicKeyFile`|Full path to file. Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported|
311 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
312
313 ##### `SSH_USER_PUB_KEY`=""
314 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
315
228
316 ---
229 ---
317
230
318 #### Kernel compilation:
231 #### Kernel settings:
319 ##### `BUILD_KERNEL`=true
232
320 Build and install the latest RPi 0/1/2/3/4 Linux kernel. The default RPi 0/1/2/3/ kernel configuration is used most of the time.
233 |Option|Value|default value|value format|desciption|
321 ENABLE_NEXMON - Changes Kernel Source to [https://github.com/Re4son/](Kali Linux Kernel)
234 |---|---|---|---|---|
322 Precompiled 32bit kernel for RPI0/1/2/3 by [https://github.com/hypriot/](hypriot)
235 |BUILD_KERNEL||true|`true`\|`false`|Build and install the latest RPi 0/1/2/3/4 Linux kernel. The default RPi 0/1/2/3/ kernel configuration is used most of the time. ENABLE_NEXMON - Changes Kernel Source to [https://github.com/Re4son/](Kali Linux Kernel) Precompiled 32bit kernel for RPI0/1/2/3 by [https://github.com/hypriot/](hypriot) Precompiled 64bit kernel for RPI3/4 by [https://github.com/sakaki-/](sakaki)|
323 Precompiled 64bit kernel for RPI3/4 by [https://github.com/sakaki-/](sakaki)
236 |CROSS_COMPILE|string|||This sets the cross-compile environment for the compiler. Set by RPI_MODEL|
324
237 |KERNEL_ARCH|string|||This sets the kernel architecture for the compiler. Set by RPI_MODEL|
325
238 |KERNEL_IMAGE|string|||Name of the image file in the boot partition. Set by RPI_MODEL|
326 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
239 |KERNEL_BRANCH|string|||Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site|
327 This sets the cross-compile environment for the compiler.
240 |KERNEL_DEFCONFIG|string|||Sets the default config for kernel compiling. Set by RPI_MODEL|
328
241 |KERNEL_THREADS|integer|1|`1`\|`2`\|`3`\|...|Number of threads to build the kernel. If not set, the script will automatically determine the maximum number of CPU cores to speed up kernel compilation|
329 ##### `KERNEL_ARCH`="arm"
242 |KERNEL_HEADERS|boolean|true|`true`\|`false`|Install kernel headers with the built kernel|
330 This sets the kernel architecture for the compiler.
243 |KERNEL_MENUCONFIG|boolean|false|`true`\|`false`|Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated|
331
244 |KERNEL_OLDDEFCONFIG|boolean|false|`true`\|`false`|Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values|
332 ##### `KERNEL_IMAGE`="kernel7.img"
245 |KERNEL_CCACHE|boolean|false|`true`\|`false`|Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again|
333 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
246 |KERNEL_REMOVESRC|boolean|true|`true`\|`false`|Remove all kernel sources from the generated OS image after it was built and installed|
334
247 |KERNELSRC_DIR|string||`FullPathToKernelSrcDir`|Full path to a directory named `linux` of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot|
335 ##### `KERNEL_BRANCH`=""
248 |KERNELSRC_CLEAN|boolean|false|`true`\|`false`|Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true|
336 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
249 |KERNELSRC_CONFIG|boolean|true|`true`\|`false`|true=enable custom kernel options. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true|
337
250 |KERNELSRC_USRCONFIG|string||`FullPathToUserKernel.config`|Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy|
338 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
251 |KERNELSRC_PREBUILT|boolean|false|`true`\|`false`|With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed|
339 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
252 |RPI_FIRMWARE_DIR|string||`FullPathToFolder`|Full path to a directory named `firmware`, containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project|
340
253 |KERNEL_DEFAULT_GOV|string|ondemand|`performance`\|`powersave`<br>\|`userspace`\|`ondemand`<br>\|`conservative`\|`schedutil`|Set the default cpu governor at kernel compilation|
341 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
254 |KERNEL_NF|boolean|false|`true`\|`false`|Enable Netfilter modules as kernel modules. You want that for iptables|
342 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
255 |KERNEL_VIRT|boolean|false|`true`\|`false`|Enable Kernel KVM support (/dev/kvm)|
343
256 |KERNEL_ZSWAP|boolean|false|`true`\|`false`|Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases|
344 ##### `KERNEL_REDUCE`=false
257 |KERNEL_BPF|boolean|true|`true`\|`false`|Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd wants it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]|
345 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
258 |KERNEL_SECURITY|boolean|false|`true`\|`false`|Enables Apparmor, integrity subsystem, auditing|
346
259 |KERNEL_BTRFS|boolean|false|`true`\|`false`|enable btrfs kernel support|
347 ##### `KERNEL_THREADS`=1
260 |KERNEL_POEHAT|boolean|false|`true`\|`false`|enable Enable RPI POE HAT fan kernel support|
348 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
261 |KERNEL_NSPAWN|boolean|false|`true`\|`false`|Enable per-interface network priority control - for systemd-nspawn|
349
262 |KERNEL_DHKEY|boolean|true|`true`\|`false`|Diffie-Hellman operations on retained keys - required for >keyutils-1.6|
350 ##### `KERNEL_HEADERS`=true
351 Install kernel headers with the built kernel.
352
353 ##### `KERNEL_MENUCONFIG`=false
354 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
355
356 ##### `KERNEL_OLDDEFCONFIG`=false
357 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
358
359 ##### `KERNEL_CCACHE`=false
360 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
361
362 ##### `KERNEL_REMOVESRC`=true
363 Remove all kernel sources from the generated OS image after it was built and installed.
364
365 ##### `KERNELSRC_DIR`=""
366 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
367
368 ##### `KERNELSRC_CLEAN`=false
369 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
370
371 ##### `KERNELSRC_CONFIG`=true
372 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
373
374 ##### `KERNELSRC_USRCONFIG`=""
375 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
376
377 ##### `KERNELSRC_PREBUILT`=false
378 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
379
380 ##### `RPI_FIRMWARE_DIR`=""
381 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
382
383 ##### `KERNEL_DEFAULT_GOV`="ONDEMAND"
384 Set the default cpu governor at kernel compilation. Supported values are: PERFORMANCE POWERSAVE USERSPACE ONDEMAND CONSERVATIVE SCHEDUTIL
385
386 ##### `KERNEL_NF`=false
387 Enable Netfilter modules as kernel modules
388
389 ##### `KERNEL_VIRT`=false
390 Enable Kernel KVM support (/dev/kvm)
391
392 ##### `KERNEL_ZSWAP`=false
393 Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases
394
395 ##### `KERNEL_BPF`=true
396 Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd compilations about it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]
397
398 ##### `KERNEL_SECURITY`=false
399 Enables Apparmor, integrity subsystem, auditing.
400
401 ##### `KERNEL_BTRFS`="false"
402 enable btrfs kernel support
403
404 ##### `KERNEL_POEHAT`="false"
405 enable Enable RPI POE HAT fan kernel support
406
407 ##### `KERNEL_NSPAWN`="false"
408 Enable per-interface network priority control - for systemd-nspawn
409
410 ##### `KERNEL_DHKEY`="true"
411 Diffie-Hellman operations on retained keys - required for >keyutils-1.6
412
263
413 ---
264 ---
414
265
415 #### Reduce disk usage:
266 #### Reduce disk usage:
416 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
267 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
417
268
418 ##### `REDUCE_APT`=true
269 |Option|Value|default value|value format|desciption|
419 Configure APT to use compressed package repository lists and no package caching files.
270 |---|---|---|---|---|
420
271 |ENABLE_REDUCE|boolean|false|`true`\|`false`|Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information|
421 ##### `REDUCE_DOC`=true
272 |REDUCE_APT|boolean|true|`true`\|`false`|Configure APT to use compressed package repository lists and no package caching files|
422 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
273 |REDUCE_DOC|boolean|false|`true`\|`false`|Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations|
423
274 |REDUCE_MAN|boolean|false|`true`\|`false`|Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations|
424 ##### `REDUCE_MAN`=true
275 |REDUCE_VIM|boolean|false|`true`\|`false`|Replace `vim-tiny` package by `levee` a tiny vim clone|
425 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
276 |REDUCE_BASH|boolean|false|`true`\|`false`|Remove `bash` package and switch to `dash` shell (experimental)|
426
277 |REDUCE_HWDB|boolean|false|`true`\|`false`|Remove PCI related hwdb files (experimental)|
427 ##### `REDUCE_VIM`=false
278 |REDUCE_SSHD|boolean|false|`true`\|`false`|Replace `openssh-server` with `dropbear`|
428 Replace `vim-tiny` package by `levee` a tiny vim clone.
279 |REDUCE_LOCALE|boolean|false|`true`\|`false`|Remove all `locale` translation files|
429
280 |REDUCE_KERNEL|boolean|false|`true`\|`false`|Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental)|
430 ##### `REDUCE_BASH`=false
431 Remove `bash` package and switch to `dash` shell (experimental).
432
433 ##### `REDUCE_HWDB`=true
434 Remove PCI related hwdb files (experimental).
435
436 ##### `REDUCE_SSHD`=true
437 Replace `openssh-server` with `dropbear`.
438
439 ##### `REDUCE_LOCALE`=true
440 Remove all `locale` translation files.
441
442 ---
281 ---
443
282
444 #### Encrypted root partition:
283 #### Encrypted root partition:
445 ##### `ENABLE_CRYPTFS`=false
284 #### On first boot, you will be asked to enter you password several time
446 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
285 #### See cryptsetup options for a more information about opttion values(https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption)
447
286
448 ##### `CRYPTFS_PASSWORD`=""
287 |Option|Value|default value|value format|desciption|
449 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
288 |---|---|---|---|---|
450
289 |ENABLE_CRYPTFS|boolean|false|`true`\|`false`|Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental|
451 ##### `CRYPTFS_MAPPING`="secure"
290 |CRYPTFS_PASSWORD|string||`YourPasswordToUnlockCrypto`|Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true|
452 Set name of dm-crypt managed device-mapper mapping.
291 |CRYPTFS_MAPPING|string|secure|`YourDevMNapperName`|crypsetup device-mapper name|
453
292 |CRYPTFS_CIPHER|string|aes-xts-plain64|`aes-cbc-essiv:sha256`|cryptsetup cipher `aes-xts*` ciphers are strongly recommended|
454 ##### `CRYPTFS_CIPHER`="aes-xts-plain64"
293 |CRYPTFS_HASH|string|sha256|`sha256`\|`sha512`|cryptsetup hash algorithm|
455 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
294 |CRYPTFS_XTSKEYSIZE|integer|256|`256`\|`512`||Sets key size in bits. The argument has to be a multiple of 8|
456
295 |CRYPTFS_DROPBEAR|boolean|false|`true`\|`false`|true=Enable Dropbear Initramfs support\|false=disable dropbear|
457 ##### `CRYPTFS_HASH`=sha512
296 |CRYPTFS_DROPBEAR_PUBKEY|string||`PathToYourPublicDropbearKeyFile`|Full path to dropbear Public RSA-OpenSSH Key|
458 Hash function and size to be used
459
460 ##### `CRYPTFS_XTSKEYSIZE`=512
461 Sets key size in bits. The argument has to be a multiple of 8.
462
463 ##### `CRYPTFS_DROPBEAR`=false
464 Enable Dropbear Initramfs support
465
466 ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
467 Provide path to dropbear Public RSA-OpenSSH Key
468
297
469 ---
298 ---
470
299
471 #### Build settings:
300 #### Build settings:
472 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
301 |Option|Value|default value|value format|desciption|
473 Set a path to a working directory used by the script to generate an image.
302 |---|---|---|---|---|
303 |BASEDIR|string||`FullPathToScriptRootDir`|If unset start from scriptroot or set to Full path to rpi123-gen-image directory|
304 |IMAGE_NAME|string||`YourImageName`|if unset creates a name after this template: rpi`RPI_MODEL`-`RELEASE`-`RELEASE_ARCH`|
474
305
475 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
306 ---
476 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
477
307
478 ## Understanding the script
308 ## Understanding the script
479 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
309 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
480
310
481 | Script | Description |
311 | Script | Description |
482 | --- | --- |
312 | --- | --- |
483 | `10-bootstrap.sh` | Debootstrap basic system |
313 | `10-bootstrap.sh` | Debootstrap basic system |
484 | `11-apt.sh` | Setup APT repositories |
314 | `11-apt.sh` | Setup APT repositories |
485 | `12-locale.sh` | Setup Locales and keyboard settings |
315 | `12-locale.sh` | Setup Locales and keyboard settings |
486 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
316 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
487 | `14-fstab.sh` | Setup fstab and initramfs |
317 | `14-fstab.sh` | Setup fstab and initramfs |
488 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
318 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
489 | `20-networking.sh` | Setup Networking |
319 | `20-networking.sh` | Setup Networking |
490 | `21-firewall.sh` | Setup Firewall |
320 | `21-firewall.sh` | Setup Firewall |
491 | `30-security.sh` | Setup Users and Security settings |
321 | `30-security.sh` | Setup Users and Security settings |
492 | `31-logging.sh` | Setup Logging |
322 | `31-logging.sh` | Setup Logging |
493 | `32-sshd.sh` | Setup SSH and public keys |
323 | `32-sshd.sh` | Setup SSH and public keys |
494 | `41-uboot.sh` | Build and Setup U-Boot |
324 | `41-uboot.sh` | Build and Setup U-Boot |
495 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
325 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
496 | `43-videocore.sh` | Build and Setup videocore libraries |
326 | `43-videocore.sh` | Build and Setup videocore libraries |
497 | `50-firstboot.sh` | First boot actions |
327 | `50-firstboot.sh` | First boot actions |
498 | `99-reduce.sh` | Reduce the disk space usage |
328 | `99-reduce.sh` | Reduce the disk space usage |
499
329
500 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
330 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
501
331
502 | Directory | Description |
332 | Directory | Description |
503 | --- | --- |
333 | --- | --- |
504 | `apt` | APT management configuration files |
334 | `apt` | APT management configuration files |
505 | `boot` | Boot and RPi 0/1/2/3 configuration files |
335 | `boot` | Boot and RPi 0/1/2/3 configuration files |
506 | `dpkg` | Package Manager configuration |
336 | `dpkg` | Package Manager configuration |
507 | `etc` | Configuration files and rc scripts |
337 | `etc` | Configuration files and rc scripts |
508 | `firstboot` | Scripts that get executed on first boot |
338 | `firstboot` | Scripts that get executed on first boot |
509 | `initramfs` | Initramfs scripts |
339 | `initramfs` | Initramfs scripts |
510 | `iptables` | Firewall configuration files |
340 | `iptables` | Firewall configuration files |
511 | `locales` | Locales configuration |
341 | `locales` | Locales configuration |
512 | `modules` | Kernel Modules configuration |
342 | `modules` | Kernel Modules configuration |
513 | `mount` | Fstab configuration |
343 | `mount` | Fstab configuration |
514 | `network` | Networking configuration files |
344 | `network` | Networking configuration files |
515 | `sysctl.d` | Swapping and Network Hardening configuration |
345 | `sysctl.d` | Swapping and Network Hardening configuration |
516 | `xorg` | fbturbo Xorg driver configuration |
346 | `xorg` | fbturbo Xorg driver configuration |
517
347
518 ## Custom packages and scripts
348 ## Custom packages and scripts
519 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
349 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
520
350
521 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
351 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
522
352
523 ## Logging of the bootstrapping process
353 ## Logging of the bootstrapping process
524 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
354 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
525
355
526 ```shell
356 ```shell
527 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
357 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
528 ```
358 ```
529
359
530 ## Flashing the image file
360 ## Flashing the image file
531 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
361 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
532
362
533 ##### Flashing examples:
363 ##### Flashing examples:
534 ```shell
364 ```shell
535 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
365 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
536 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
366 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
537 ```
367 ```
538 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
368 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
539 ```shell
369 ```shell
540 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
370 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
541 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
371 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
542 ```
372 ```
543
373
544 ## QEMU emulation
374 ## QEMU emulation
545 Start QEMU full system emulation:
375 Start QEMU full system emulation:
546 ```shell
376 ```shell
547 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
377 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
548 ```
378 ```
549
379
550 Start QEMU full system emulation and output to console:
380 Start QEMU full system emulation and output to console:
551 ```shell
381 ```shell
552 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
382 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
553 ```
383 ```
554
384
555 Start QEMU full system emulation with SMP and output to console:
385 Start QEMU full system emulation with SMP and output to console:
556 ```shell
386 ```shell
557 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
387 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
558 ```
388 ```
559
389
560 Start QEMU full system emulation with cryptfs, initramfs and output to console:
390 Start QEMU full system emulation with cryptfs, initramfs and output to console:
561 ```shell
391 ```shell
562 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
392 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
563 ```
393 ```
564
394
565 ## External links and references
395 ## External links and references
566 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
396 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
567 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
397 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
568 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
398 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
569 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
399 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
570 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
400 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
571 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
401 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
572 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
402 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
573 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm)
403 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm)
574 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
404 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
Show file before | Show file after | Hide comments
@@ -1,48 +1,49
1 #
1 #
2 # Debootstrap basic system
2 # Debootstrap basic system
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 VARIANT=""
8 VARIANT=""
9 COMPONENTS="main"
9 COMPONENTS="main"
10
10
11 # Use non-free Debian packages if needed
11 # Use non-free Debian packages if needed
12 if [ "$ENABLE_NONFREE" = true ] ; then
12 # One use variable which is only needed by wifi firmware blob => reworked to use non free in /etc/apt/sources.list - we could just use ENABLE_WIRELESS here
13 if [ "$ENABLE_WIRELESS" = true ] ; then
13 COMPONENTS="main,non-free,contrib"
14 COMPONENTS="main,non-free,contrib"
14 fi
15 fi
15
16
16 # Use minbase bootstrap variant which only includes essential packages
17 # Use minbase bootstrap variant which only includes essential packages
17 if [ "$ENABLE_MINBASE" = true ] ; then
18 if [ "$ENABLE_MINBASE" = true ] ; then
18 VARIANT="--variant=minbase"
19 VARIANT="--variant=minbase"
19 fi
20 fi
20
21
21
22
22 # Exclude packages if required by Debian release
23 # Exclude packages if required by Debian release
23 #if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
24 #if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
24 # APT_EXCLUDES="--exclude=init,systemd-sysv"
25 # APT_EXCLUDES="--exclude=init,systemd-sysv"
25 #fi
26 #fi
26
27
27
28
28 # Base debootstrap (unpack only)
29 # Base debootstrap (unpack only)
29 http_proxy=${APT_PROXY} debootstrap ${APT_EXCLUDES} --arch="${RELEASE_ARCH}" --foreign ${VARIANT} --components="${COMPONENTS}" --include="${APT_INCLUDES}" "${RELEASE}" "${R}" "http://${APT_SERVER}/debian"
30 http_proxy=${APT_PROXY} debootstrap ${APT_EXCLUDES} --arch="${RELEASE_ARCH}" --foreign ${VARIANT} --components="${COMPONENTS}" --include="${APT_INCLUDES}" "${RELEASE}" "${R}" "http://${APT_SERVER}/debian"
30
31
31 # Copy qemu emulator binary to chroot
32 # Copy qemu emulator binary to chroot
32 install -m 755 -o root -g root "${QEMU_BINARY}" "${R}${QEMU_BINARY}"
33 install -m 755 -o root -g root "${QEMU_BINARY}" "${R}${QEMU_BINARY}"
33
34
34 # Copy debian-archive-keyring.pgp
35 # Copy debian-archive-keyring.pgp
35 mkdir -p "${R}/usr/share/keyrings"
36 mkdir -p "${R}/usr/share/keyrings"
36 install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "${R}/usr/share/keyrings/debian-archive-keyring.gpg"
37 install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "${R}/usr/share/keyrings/debian-archive-keyring.gpg"
37
38
38 # Complete the bootstrapping process
39 # Complete the bootstrapping process
39 chroot_exec /debootstrap/debootstrap --second-stage
40 chroot_exec /debootstrap/debootstrap --second-stage
40
41
41 # Mount required filesystems
42 # Mount required filesystems
42 mount -t proc none "${R}/proc"
43 mount -t proc none "${R}/proc"
43 mount -t sysfs none "${R}/sys"
44 mount -t sysfs none "${R}/sys"
44
45
45 # Mount pseudo terminal slave if supported by Debian release
46 # Mount pseudo terminal slave if supported by Debian release
46 if [ -d "${R}/dev/pts" ] ; then
47 if [ -d "${R}/dev/pts" ] ; then
47 mount --bind /dev/pts "${R}/dev/pts"
48 mount --bind /dev/pts "${R}/dev/pts"
48 fi
49 fi
Show file before | Show file after | Hide comments
@@ -1,50 +1,54
1 #
1 #
2 # Setup APT repositories
2 # Setup APT repositories
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup APT proxy configuration
8 # Install and setup APT proxy configuration
9 if [ -z "$APT_PROXY" ] ; then
9 if [ -z "$APT_PROXY" ] ; then
10 install_readonly files/apt/10proxy "${ETC_DIR}/apt/apt.conf.d/10proxy"
10 install_readonly files/apt/10proxy "${ETC_DIR}/apt/apt.conf.d/10proxy"
11 sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
11 sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
12 fi
12 fi
13
13
14 # Install APT sources.list
14 # Install APT sources.list
15 install_readonly files/apt/sources.list "${ETC_DIR}/apt/sources.list"
15 install_readonly files/apt/sources.list "${ETC_DIR}/apt/sources.list"
16
16
17 # Use specified APT server and release
17 # Use specified APT server and release
18 sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETC_DIR}/apt/sources.list"
18 sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETC_DIR}/apt/sources.list"
19
19
20 #Fix for changing path for security updates in testing
20 #Fix for changing path for security updates in testing
21 if [ "$RELEASE" = "testing" ] ; then
21 if [ "$RELEASE" = "testing" ] ; then
22 sed -i "s,buster\\/updates,testing-security," "${ETC_DIR}/apt/sources.list"
22 sed -i "s,buster\\/updates,testing-security," "${ETC_DIR}/apt/sources.list"
23 sed -i "s/ buster/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
23 sed -i "s/ buster/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
24 fi
24 fi
25
25
26 if [ "$ENABLE_NONFREE" = "true" ] ; then
27 sed -i "s,main contrib,main contrib non-free," "${ETC_DIR}/apt/sources.list"
28 fi
29
26 if [ -z "$RELEASE" ] ; then
30 if [ -z "$RELEASE" ] ; then
27 # Change release in sources list
31 # Change release in sources list
28 sed -i "s/ buster/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
32 sed -i "s/ buster/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
29 fi
33 fi
30
34
31 # Upgrade package index and update all installed packages and changed dependencies
35 # Upgrade package index and update all installed packages and changed dependencies
32 chroot_exec apt-get -qq -y update
36 chroot_exec apt-get -qq -y update
33 chroot_exec apt-get -qq -y -u dist-upgrade
37 chroot_exec apt-get -qq -y -u dist-upgrade
34
38
35 # Install additional packages
39 # Install additional packages
36 if [ "$APT_INCLUDES_LATE" ] ; then
40 if [ "$APT_INCLUDES_LATE" ] ; then
37 chroot_exec apt-get -qq -y install $(echo "$APT_INCLUDES_LATE" |tr , ' ')
41 chroot_exec apt-get -qq -y install $(echo "$APT_INCLUDES_LATE" |tr , ' ')
38 fi
42 fi
39
43
40 # Install Debian custom packages
44 # Install Debian custom packages
41 if [ -d packages ] ; then
45 if [ -d packages ] ; then
42 for package in packages/*.deb ; do
46 for package in packages/*.deb ; do
43 cp "$package" "${R}"/tmp
47 cp "$package" "${R}"/tmp
44 chroot_exec dpkg --unpack /tmp/"$(basename "$package")"
48 chroot_exec dpkg --unpack /tmp/"$(basename "$package")"
45 done
49 done
46 fi
50 fi
47
51
48 chroot_exec apt-get -qq -y -f install
52 chroot_exec apt-get -qq -y -f install
49
53
50 chroot_exec apt-get -qq -y check
54 chroot_exec apt-get -qq -y check
Show file before | Show file after | Hide comments
@@ -1,889 +1,886
1 #
1 #
2 # Build and Setup RPi2/3/4 Kernel 4.XX 5.XX
2 # Build and Setup RPi2/3/4 Kernel 4.XX 5.XX
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Need to use kali kernel src if nexmon is enabled
8 # Need to use kali kernel src if nexmon is enabled
9 if [ "$ENABLE_NEXMON" = true ] ; then
9 if [ "$ENABLE_NEXMON" = true ] ; then
10 KERNEL_URL="${KALI_KERNEL_URL}"
10 KERNEL_URL="${KALI_KERNEL_URL}"
11 # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel
11 # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel
12 KERNEL_BRANCH=""
12 KERNEL_BRANCH=""
13 KERNELSRC_DIR=""
13 KERNELSRC_DIR=""
14 fi
14 fi
15
15
16 # Fetch and build latest raspberry kernel
16 # Fetch and build latest raspberry kernel
17 if [ "$BUILD_KERNEL" = true ] ; then
17 if [ "$BUILD_KERNEL" = true ] ; then
18 # Setup source directory
18 # Setup source directory
19 mkdir -p "${KERNEL_DIR}"
19 mkdir -p "${KERNEL_DIR}"
20
20
21 # Copy existing kernel sources into chroot directory
21 # Copy existing kernel sources into chroot directory
22 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
22 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
23 # Copy kernel sources and include hidden files
23 # Copy kernel sources and include hidden files
24 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
24 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
25
25
26 # Clean the kernel sources
26 # Clean the kernel sources
27 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
27 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
28 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
28 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
29 fi
29 fi
30 else # KERNELSRC_DIR=""
30 else # KERNELSRC_DIR=""
31 # Create temporary directory for kernel sources
31 # Create temporary directory for kernel sources
32 temp_dir=$(as_nobody mktemp -d)
32 temp_dir=$(as_nobody mktemp -d)
33
33
34 # Fetch current RPi2/3 kernel sources
34 # Fetch current RPi2/3 kernel sources
35 if [ -z "${KERNEL_BRANCH}" ] ; then
35 if [ -z "${KERNEL_BRANCH}" ] ; then
36 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
36 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
37 else
37 else
38 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
38 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
39 fi
39 fi
40
40
41 # Copy downloaded kernel sources
41 # Copy downloaded kernel sources
42 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
42 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
43
43
44 # Remove temporary directory for kernel sources
44 # Remove temporary directory for kernel sources
45 rm -fr "${temp_dir}"
45 rm -fr "${temp_dir}"
46
46
47 # Set permissions of the kernel sources
47 # Set permissions of the kernel sources
48 chown -R root:root "${R}/usr/src"
48 chown -R root:root "${R}/usr/src"
49 fi
49 fi
50
50
51 # Calculate optimal number of kernel building threads
51 # Calculate optimal number of kernel building threads
52 if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then
52 if [ -n "$KERNEL_THREADS" ] && [ -r /proc/cpuinfo ] ; then
53 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
53 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
54 fi
54 fi
55
55
56 # TODO: Check if defined Threadcount is higher than actual cores
57 # if [ "$KERNEL_THREADS" > grep -c processor /proc/cpuinfo] ; then
58 # echo "Defined more Threads than core assigned to this system"
59 # exit 1
60 # fi
61
56 #Copy 32bit config to 64bit
62 #Copy 32bit config to 64bit
57 if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then
63 if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then
58 cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/
64 cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/
59 fi
65 fi
60
66
61 # Configure and build kernel
67 # Configure and build kernel
62 if [ "$KERNELSRC_PREBUILT" = false ] ; then
68 if [ "$KERNELSRC_PREBUILT" = false ] ; then
63 # Remove device, network and filesystem drivers from kernel configuration
69 # Remove device, network and filesystem drivers from kernel configuration
64 if [ "$KERNEL_REDUCE" = true ] ; then
70 if [ "$REDUCE_KERNEL" = true ] ; then
65 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
71 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
66 sed -i\
72 sed -i\
67 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
73 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
68 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
74 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
69 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
75 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
70 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
76 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
71 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
77 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
72 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
78 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
73 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
79 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
74 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
80 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
75 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
81 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
76 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
82 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
77 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
83 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
78 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
84 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
79 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
85 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
80 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
86 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
81 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
87 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
82 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
88 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
83 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
89 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
84 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
90 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
85 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
91 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
86 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
92 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
87 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
93 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
88 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
94 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
89 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
95 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
90 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
96 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
91 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
97 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
92 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
98 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
93 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
99 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
94 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
100 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
95 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
101 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
96 "${KERNEL_DIR}/.config"
102 "${KERNEL_DIR}/.config"
97 fi
103 fi
98
104
99 if [ "$KERNELSRC_CONFIG" = true ] ; then
105 if [ "$KERNELSRC_CONFIG" = true ] ; then
100 # Load default raspberry kernel configuration
106 # Load default raspberry kernel configuration
101 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
107 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
102
108
103 #Switch to KERNELSRC_DIR so we can use set_kernel_config
109 #Switch to KERNELSRC_DIR so we can use set_kernel_config
104 cd "${KERNEL_DIR}" || exit
110 cd "${KERNEL_DIR}" || exit
105
111
106 # Enable RPI POE HAT fan
112 # Enable RPI POE HAT fan
107 if [ "$KERNEL_POEHAT" = true ]; then
113 if [ "$KERNEL_POEHAT" = true ]; then
108 set_kernel_config CONFIG_SENSORS_RPI_POE_FAN m
114 set_kernel_config CONFIG_SENSORS_RPI_POE_FAN m
109 fi
115 fi
110
116
111 # Enable per-interface network priority control
117 # Enable per-interface network priority control
112 # (for systemd-nspawn)
118 # (for systemd-nspawn)
113 if [ "$KERNEL_NSPAN" = true ]; then
119 if [ "$KERNEL_NSPAN" = true ]; then
114 set_kernel_config CONFIG_CGROUP_NET_PRIO y
120 set_kernel_config CONFIG_CGROUP_NET_PRIO y
115 fi
121 fi
116
122
117 # Compile in BTRFS
123 # Compile in BTRFS
118 if [ "$KERNEL_BTRFS" = true ]; then
124 if [ "$KERNEL_BTRFS" = true ]; then
119 set_kernel_config CONFIG_BTRFS_FS y
125 set_kernel_config CONFIG_BTRFS_FS y
120 set_kernel_config CONFIG_BTRFS_FS_POSIX_ACL y
126 set_kernel_config CONFIG_BTRFS_FS_POSIX_ACL y
121 set_kernel_config CONFIG_BTRFS_FS_REF_VERIFY y
127 set_kernel_config CONFIG_BTRFS_FS_REF_VERIFY y
122 fi
128 fi
123
129
124 # Diffie-Hellman operations on retained keys
130 # Diffie-Hellman operations on retained keys
125 # (required for >keyutils-1.6)
131 # (required for >keyutils-1.6)
126 if [ "$KERNEL_DHKEY" = true ]; then
132 if [ "$KERNEL_DHKEY" = true ]; then
127 set_kernel_config CONFIG_KEY_DH_OPERATIONS y
133 set_kernel_config CONFIG_KEY_DH_OPERATIONS y
128 fi
134 fi
129
135
130 if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then
136 if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then
131 # Mask this temporarily during switch to rpi-4.19.y
137 # Mask this temporarily during switch to rpi-4.19.y
132 #Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config
138 #Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config
133 # use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225
139 # use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225
134 #set_kernel_config CONFIG_MMC_BCM2835 n
140 #set_kernel_config CONFIG_MMC_BCM2835 n
135 #set_kernel_config CONFIG_MMC_SDHCI_IPROC n
141 #set_kernel_config CONFIG_MMC_SDHCI_IPROC n
136 #set_kernel_config CONFIG_USB_DWC2 n
142 #set_kernel_config CONFIG_USB_DWC2 n
137 #sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig
143 #sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig
138
144
139 #VLAN got disabled without reason in arm64bit
145 #VLAN got disabled without reason in arm64bit
140 set_kernel_config CONFIG_IPVLAN m
146 set_kernel_config CONFIG_IPVLAN m
141 fi
147 fi
142
148
143 # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
149 # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
144 if [ "$KERNEL_ZSWAP" = true ] ; then
150 if [ "$KERNEL_ZSWAP" = true ] ; then
145 set_kernel_config CONFIG_ZPOOL y
151 set_kernel_config CONFIG_ZPOOL y
146 set_kernel_config CONFIG_ZSWAP y
152 set_kernel_config CONFIG_ZSWAP y
147 set_kernel_config CONFIG_ZBUD y
153 set_kernel_config CONFIG_ZBUD y
148 set_kernel_config CONFIG_Z3FOLD y
154 set_kernel_config CONFIG_Z3FOLD y
149 set_kernel_config CONFIG_ZSMALLOC y
155 set_kernel_config CONFIG_ZSMALLOC y
150 set_kernel_config CONFIG_PGTABLE_MAPPING y
156 set_kernel_config CONFIG_PGTABLE_MAPPING y
151 set_kernel_config CONFIG_LZO_COMPRESS y
157 set_kernel_config CONFIG_LZO_COMPRESS y
152 fi
158 fi
153
159
154 if [ "$RPI_MODEL" = 4 ] ; then
160 if [ "$RPI_MODEL" = 4 ] ; then
155 # Following are set in current 32-bit LPAE kernel
161 # Following are set in current 32-bit LPAE kernel
156 set_kernel_config CONFIG_CGROUP_PIDS y
162 set_kernel_config CONFIG_CGROUP_PIDS y
157 set_kernel_config CONFIG_NET_IPVTI m
163 set_kernel_config CONFIG_NET_IPVTI m
158 set_kernel_config CONFIG_NF_TABLES_SET m
164 set_kernel_config CONFIG_NF_TABLES_SET m
159 set_kernel_config CONFIG_NF_TABLES_INET y
165 set_kernel_config CONFIG_NF_TABLES_INET y
160 set_kernel_config CONFIG_NF_TABLES_NETDEV y
166 set_kernel_config CONFIG_NF_TABLES_NETDEV y
161 set_kernel_config CONFIG_NF_FLOW_TABLE m
167 set_kernel_config CONFIG_NF_FLOW_TABLE m
162 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
168 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
163 set_kernel_config CONFIG_NFT_CONNLIMIT m
169 set_kernel_config CONFIG_NFT_CONNLIMIT m
164 set_kernel_config CONFIG_NFT_TUNNEL m
170 set_kernel_config CONFIG_NFT_TUNNEL m
165 set_kernel_config CONFIG_NFT_OBJREF m
171 set_kernel_config CONFIG_NFT_OBJREF m
166 set_kernel_config CONFIG_NFT_FIB_IPV4 m
172 set_kernel_config CONFIG_NFT_FIB_IPV4 m
167 set_kernel_config CONFIG_NFT_FIB_IPV6 m
173 set_kernel_config CONFIG_NFT_FIB_IPV6 m
168 set_kernel_config CONFIG_NFT_FIB_INET m
174 set_kernel_config CONFIG_NFT_FIB_INET m
169 set_kernel_config CONFIG_NFT_SOCKET m
175 set_kernel_config CONFIG_NFT_SOCKET m
170 set_kernel_config CONFIG_NFT_OSF m
176 set_kernel_config CONFIG_NFT_OSF m
171 set_kernel_config CONFIG_NFT_TPROXY m
177 set_kernel_config CONFIG_NFT_TPROXY m
172 set_kernel_config CONFIG_NF_DUP_NETDEV m
178 set_kernel_config CONFIG_NF_DUP_NETDEV m
173 set_kernel_config CONFIG_NFT_DUP_NETDEV m
179 set_kernel_config CONFIG_NFT_DUP_NETDEV m
174 set_kernel_config CONFIG_NFT_FWD_NETDEV m
180 set_kernel_config CONFIG_NFT_FWD_NETDEV m
175 set_kernel_config CONFIG_NFT_FIB_NETDEV m
181 set_kernel_config CONFIG_NFT_FIB_NETDEV m
176 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
182 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
177 set_kernel_config CONFIG_NF_FLOW_TABLE m
183 set_kernel_config CONFIG_NF_FLOW_TABLE m
178 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
184 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
179 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
185 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
180 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
186 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
181 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
187 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
182 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
188 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
183 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
189 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
184 set_kernel_config CONFIG_NFT_DUP_IPV6 m
190 set_kernel_config CONFIG_NFT_DUP_IPV6 m
185 set_kernel_config CONFIG_NFT_FIB_IPV6 m
191 set_kernel_config CONFIG_NFT_FIB_IPV6 m
186 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 m
192 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 m
187 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
193 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
188 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
194 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
189 set_kernel_config CONFIG_NF_LOG_BRIDGE m
195 set_kernel_config CONFIG_NF_LOG_BRIDGE m
190 set_kernel_config CONFIG_MT76_CORE m
196 set_kernel_config CONFIG_MT76_CORE m
191 set_kernel_config CONFIG_MT76_LEDS m
197 set_kernel_config CONFIG_MT76_LEDS m
192 set_kernel_config CONFIG_MT76_USB m
198 set_kernel_config CONFIG_MT76_USB m
193 set_kernel_config CONFIG_MT76x2_COMMON m
199 set_kernel_config CONFIG_MT76x2_COMMON m
194 set_kernel_config CONFIG_MT76x0U m
200 set_kernel_config CONFIG_MT76x0U m
195 set_kernel_config CONFIG_MT76x2U m
201 set_kernel_config CONFIG_MT76x2U m
196 set_kernel_config CONFIG_TOUCHSCREEN_ILI210X m
202 set_kernel_config CONFIG_TOUCHSCREEN_ILI210X m
197 set_kernel_config CONFIG_BCM_VC_SM m
203 set_kernel_config CONFIG_BCM_VC_SM m
198 set_kernel_config CONFIG_BCM2835_SMI_DEV m
204 set_kernel_config CONFIG_BCM2835_SMI_DEV m
199 set_kernel_config CONFIG_RPIVID_MEM m
205 set_kernel_config CONFIG_RPIVID_MEM m
200 set_kernel_config CONFIG_HW_RANDOM_BCM2835 y
206 set_kernel_config CONFIG_HW_RANDOM_BCM2835 y
201 set_kernel_config CONFIG_TCG_TPM m
207 set_kernel_config CONFIG_TCG_TPM m
202 set_kernel_config CONFIG_HW_RANDOM_TPM y
208 set_kernel_config CONFIG_HW_RANDOM_TPM y
203 set_kernel_config CONFIG_TCG_TIS m
209 set_kernel_config CONFIG_TCG_TIS m
204 set_kernel_config CONFIG_TCG_TIS_SPI m
210 set_kernel_config CONFIG_TCG_TIS_SPI m
205 set_kernel_config CONFIG_I2C_MUX m
211 set_kernel_config CONFIG_I2C_MUX m
206 set_kernel_config CONFIG_I2C_MUX_GPMUX m
212 set_kernel_config CONFIG_I2C_MUX_GPMUX m
207 set_kernel_config CONFIG_I2C_MUX_PCA954x m
213 set_kernel_config CONFIG_I2C_MUX_PCA954x m
208 set_kernel_config CONFIG_SPI_GPIO m
214 set_kernel_config CONFIG_SPI_GPIO m
209 set_kernel_config CONFIG_BATTERY_MAX17040 m
215 set_kernel_config CONFIG_BATTERY_MAX17040 m
210 set_kernel_config CONFIG_SENSORS_GPIO_FAN m
216 set_kernel_config CONFIG_SENSORS_GPIO_FAN m
211 set_kernel_config CONFIG_SENSORS_RASPBERRYPI_HWMON m
217 set_kernel_config CONFIG_SENSORS_RASPBERRYPI_HWMON m
212 set_kernel_config CONFIG_BCM2835_THERMAL y
218 set_kernel_config CONFIG_BCM2835_THERMAL y
213 set_kernel_config CONFIG_RC_CORE y
219 set_kernel_config CONFIG_RC_CORE y
214 set_kernel_config CONFIG_RC_MAP y
220 set_kernel_config CONFIG_RC_MAP y
215 set_kernel_config CONFIG_LIRC y
221 set_kernel_config CONFIG_LIRC y
216 set_kernel_config CONFIG_RC_DECODERS y
222 set_kernel_config CONFIG_RC_DECODERS y
217 set_kernel_config CONFIG_IR_NEC_DECODER m
223 set_kernel_config CONFIG_IR_NEC_DECODER m
218 set_kernel_config CONFIG_IR_RC5_DECODER m
224 set_kernel_config CONFIG_IR_RC5_DECODER m
219 set_kernel_config CONFIG_IR_RC6_DECODER m
225 set_kernel_config CONFIG_IR_RC6_DECODER m
220 set_kernel_config CONFIG_IR_JVC_DECODER m
226 set_kernel_config CONFIG_IR_JVC_DECODER m
221 set_kernel_config CONFIG_IR_SONY_DECODER m
227 set_kernel_config CONFIG_IR_SONY_DECODER m
222 set_kernel_config CONFIG_IR_SANYO_DECODER m
228 set_kernel_config CONFIG_IR_SANYO_DECODER m
223 set_kernel_config CONFIG_IR_SHARP_DECODER m
229 set_kernel_config CONFIG_IR_SHARP_DECODER m
224 set_kernel_config CONFIG_IR_MCE_KBD_DECODER m
230 set_kernel_config CONFIG_IR_MCE_KBD_DECODER m
225 set_kernel_config CONFIG_IR_XMP_DECODER m
231 set_kernel_config CONFIG_IR_XMP_DECODER m
226 set_kernel_config CONFIG_IR_IMON_DECODER m
232 set_kernel_config CONFIG_IR_IMON_DECODER m
227 set_kernel_config CONFIG_RC_DEVICES y
233 set_kernel_config CONFIG_RC_DEVICES y
228 set_kernel_config CONFIG_RC_ATI_REMOTE m
234 set_kernel_config CONFIG_RC_ATI_REMOTE m
229 set_kernel_config CONFIG_IR_IMON m
235 set_kernel_config CONFIG_IR_IMON m
230 set_kernel_config CONFIG_IR_MCEUSB m
236 set_kernel_config CONFIG_IR_MCEUSB m
231 set_kernel_config CONFIG_IR_REDRAT3 m
237 set_kernel_config CONFIG_IR_REDRAT3 m
232 set_kernel_config CONFIG_IR_STREAMZAP m
238 set_kernel_config CONFIG_IR_STREAMZAP m
233 set_kernel_config CONFIG_IR_IGUANA m
239 set_kernel_config CONFIG_IR_IGUANA m
234 set_kernel_config CONFIG_IR_TTUSBIR m
240 set_kernel_config CONFIG_IR_TTUSBIR m
235 set_kernel_config CONFIG_RC_LOOPBACK m
241 set_kernel_config CONFIG_RC_LOOPBACK m
236 set_kernel_config CONFIG_IR_GPIO_CIR m
242 set_kernel_config CONFIG_IR_GPIO_CIR m
237 set_kernel_config CONFIG_IR_GPIO_TX m
243 set_kernel_config CONFIG_IR_GPIO_TX m
238 set_kernel_config CONFIG_IR_PWM_TX m
244 set_kernel_config CONFIG_IR_PWM_TX m
239 set_kernel_config CONFIG_VIDEO_V4L2_SUBDEV_API y
245 set_kernel_config CONFIG_VIDEO_V4L2_SUBDEV_API y
240 set_kernel_config CONFIG_VIDEO_AU0828_RC y
246 set_kernel_config CONFIG_VIDEO_AU0828_RC y
241 set_kernel_config CONFIG_VIDEO_CX231XX m
247 set_kernel_config CONFIG_VIDEO_CX231XX m
242 set_kernel_config CONFIG_VIDEO_CX231XX_RC y
248 set_kernel_config CONFIG_VIDEO_CX231XX_RC y
243 set_kernel_config CONFIG_VIDEO_CX231XX_ALSA m
249 set_kernel_config CONFIG_VIDEO_CX231XX_ALSA m
244 set_kernel_config CONFIG_VIDEO_CX231XX_DVB m
250 set_kernel_config CONFIG_VIDEO_CX231XX_DVB m
245 set_kernel_config CONFIG_VIDEO_TM6000 m
251 set_kernel_config CONFIG_VIDEO_TM6000 m
246 set_kernel_config CONFIG_VIDEO_TM6000_ALSA m
252 set_kernel_config CONFIG_VIDEO_TM6000_ALSA m
247 set_kernel_config CONFIG_VIDEO_TM6000_DVB m
253 set_kernel_config CONFIG_VIDEO_TM6000_DVB m
248 set_kernel_config CONFIG_DVB_USB m
254 set_kernel_config CONFIG_DVB_USB m
249 set_kernel_config CONFIG_DVB_USB_DIB3000MC m
255 set_kernel_config CONFIG_DVB_USB_DIB3000MC m
250 set_kernel_config CONFIG_DVB_USB_A800 m
256 set_kernel_config CONFIG_DVB_USB_A800 m
251 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB m
257 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB m
252 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB_FAULTY y
258 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB_FAULTY y
253 set_kernel_config CONFIG_DVB_USB_DIBUSB_MC m
259 set_kernel_config CONFIG_DVB_USB_DIBUSB_MC m
254 set_kernel_config CONFIG_DVB_USB_DIB0700 m
260 set_kernel_config CONFIG_DVB_USB_DIB0700 m
255 set_kernel_config CONFIG_DVB_USB_UMT_010 m
261 set_kernel_config CONFIG_DVB_USB_UMT_010 m
256 set_kernel_config CONFIG_DVB_USB_CXUSB m
262 set_kernel_config CONFIG_DVB_USB_CXUSB m
257 set_kernel_config CONFIG_DVB_USB_M920X m
263 set_kernel_config CONFIG_DVB_USB_M920X m
258 set_kernel_config CONFIG_DVB_USB_DIGITV m
264 set_kernel_config CONFIG_DVB_USB_DIGITV m
259 set_kernel_config CONFIG_DVB_USB_VP7045 m
265 set_kernel_config CONFIG_DVB_USB_VP7045 m
260 set_kernel_config CONFIG_DVB_USB_VP702X m
266 set_kernel_config CONFIG_DVB_USB_VP702X m
261 set_kernel_config CONFIG_DVB_USB_GP8PSK m
267 set_kernel_config CONFIG_DVB_USB_GP8PSK m
262 set_kernel_config CONFIG_DVB_USB_NOVA_T_USB2 m
268 set_kernel_config CONFIG_DVB_USB_NOVA_T_USB2 m
263 set_kernel_config CONFIG_DVB_USB_TTUSB2 m
269 set_kernel_config CONFIG_DVB_USB_TTUSB2 m
264 set_kernel_config CONFIG_DVB_USB_DTT200U m
270 set_kernel_config CONFIG_DVB_USB_DTT200U m
265 set_kernel_config CONFIG_DVB_USB_OPERA1 m
271 set_kernel_config CONFIG_DVB_USB_OPERA1 m
266 set_kernel_config CONFIG_DVB_USB_AF9005 m
272 set_kernel_config CONFIG_DVB_USB_AF9005 m
267 set_kernel_config CONFIG_DVB_USB_AF9005_REMOTE m
273 set_kernel_config CONFIG_DVB_USB_AF9005_REMOTE m
268 set_kernel_config CONFIG_DVB_USB_PCTV452E m
274 set_kernel_config CONFIG_DVB_USB_PCTV452E m
269 set_kernel_config CONFIG_DVB_USB_DW2102 m
275 set_kernel_config CONFIG_DVB_USB_DW2102 m
270 set_kernel_config CONFIG_DVB_USB_CINERGY_T2 m
276 set_kernel_config CONFIG_DVB_USB_CINERGY_T2 m
271 set_kernel_config CONFIG_DVB_USB_DTV5100 m
277 set_kernel_config CONFIG_DVB_USB_DTV5100 m
272 set_kernel_config CONFIG_DVB_USB_AZ6027 m
278 set_kernel_config CONFIG_DVB_USB_AZ6027 m
273 set_kernel_config CONFIG_DVB_USB_TECHNISAT_USB2 m
279 set_kernel_config CONFIG_DVB_USB_TECHNISAT_USB2 m
274 set_kernel_config CONFIG_DVB_USB_AF9015 m
280 set_kernel_config CONFIG_DVB_USB_AF9015 m
275 set_kernel_config CONFIG_DVB_USB_LME2510 m
281 set_kernel_config CONFIG_DVB_USB_LME2510 m
276 set_kernel_config CONFIG_DVB_USB_RTL28XXU m
282 set_kernel_config CONFIG_DVB_USB_RTL28XXU m
277 set_kernel_config CONFIG_VIDEO_EM28XX_RC m
283 set_kernel_config CONFIG_VIDEO_EM28XX_RC m
278 set_kernel_config CONFIG_SMS_SIANO_RC m
284 set_kernel_config CONFIG_SMS_SIANO_RC m
279 set_kernel_config CONFIG_VIDEO_IR_I2C m
285 set_kernel_config CONFIG_VIDEO_IR_I2C m
280 set_kernel_config CONFIG_VIDEO_ADV7180 m
286 set_kernel_config CONFIG_VIDEO_ADV7180 m
281 set_kernel_config CONFIG_VIDEO_TC358743 m
287 set_kernel_config CONFIG_VIDEO_TC358743 m
282 set_kernel_config CONFIG_VIDEO_OV5647 m
288 set_kernel_config CONFIG_VIDEO_OV5647 m
283 set_kernel_config CONFIG_DVB_M88DS3103 m
289 set_kernel_config CONFIG_DVB_M88DS3103 m
284 set_kernel_config CONFIG_DVB_AF9013 m
290 set_kernel_config CONFIG_DVB_AF9013 m
285 set_kernel_config CONFIG_DVB_RTL2830 m
291 set_kernel_config CONFIG_DVB_RTL2830 m
286 set_kernel_config CONFIG_DVB_RTL2832 m
292 set_kernel_config CONFIG_DVB_RTL2832 m
287 set_kernel_config CONFIG_DVB_SI2168 m
293 set_kernel_config CONFIG_DVB_SI2168 m
288 set_kernel_config CONFIG_DVB_GP8PSK_FE m
294 set_kernel_config CONFIG_DVB_GP8PSK_FE m
289 set_kernel_config CONFIG_DVB_USB m
295 set_kernel_config CONFIG_DVB_USB m
290 set_kernel_config CONFIG_DVB_LGDT3306A m
296 set_kernel_config CONFIG_DVB_LGDT3306A m
291 set_kernel_config CONFIG_FB_SIMPLE y
297 set_kernel_config CONFIG_FB_SIMPLE y
292 set_kernel_config CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC m
298 set_kernel_config CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC m
293 set_kernel_config CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M m
299 set_kernel_config CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M m
294 set_kernel_config CONFIG_SND_AUDIOSENSE_PI m
300 set_kernel_config CONFIG_SND_AUDIOSENSE_PI m
295 set_kernel_config CONFIG_SND_SOC_AD193X m
301 set_kernel_config CONFIG_SND_SOC_AD193X m
296 set_kernel_config CONFIG_SND_SOC_AD193X_SPI m
302 set_kernel_config CONFIG_SND_SOC_AD193X_SPI m
297 set_kernel_config CONFIG_SND_SOC_AD193X_I2C m
303 set_kernel_config CONFIG_SND_SOC_AD193X_I2C m
298 set_kernel_config CONFIG_SND_SOC_CS4265 m
304 set_kernel_config CONFIG_SND_SOC_CS4265 m
299 set_kernel_config CONFIG_SND_SOC_DA7213 m
305 set_kernel_config CONFIG_SND_SOC_DA7213 m
300 set_kernel_config CONFIG_SND_SOC_ICS43432 m
306 set_kernel_config CONFIG_SND_SOC_ICS43432 m
301 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4 m
307 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4 m
302 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4_I2C m
308 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4_I2C m
303 set_kernel_config CONFIG_SND_SOC_I_SABRE_CODEC m
309 set_kernel_config CONFIG_SND_SOC_I_SABRE_CODEC m
304 set_kernel_config CONFIG_HID_BIGBEN_FF m
310 set_kernel_config CONFIG_HID_BIGBEN_FF m
305 #set_kernel_config CONFIG_USB_XHCI_PLATFORM y
311 #set_kernel_config CONFIG_USB_XHCI_PLATFORM y
306 set_kernel_config CONFIG_USB_TMC m
312 set_kernel_config CONFIG_USB_TMC m
307 set_kernel_config CONFIG_USB_UAS y
313 set_kernel_config CONFIG_USB_UAS y
308 set_kernel_config CONFIG_USBIP_VUDC m
314 set_kernel_config CONFIG_USBIP_VUDC m
309 set_kernel_config CONFIG_USB_CONFIGFS m
315 set_kernel_config CONFIG_USB_CONFIGFS m
310 set_kernel_config CONFIG_USB_CONFIGFS_SERIAL y
316 set_kernel_config CONFIG_USB_CONFIGFS_SERIAL y
311 set_kernel_config CONFIG_USB_CONFIGFS_ACM y
317 set_kernel_config CONFIG_USB_CONFIGFS_ACM y
312 set_kernel_config CONFIG_USB_CONFIGFS_OBEX y
318 set_kernel_config CONFIG_USB_CONFIGFS_OBEX y
313 set_kernel_config CONFIG_USB_CONFIGFS_NCM y
319 set_kernel_config CONFIG_USB_CONFIGFS_NCM y
314 set_kernel_config CONFIG_USB_CONFIGFS_ECM y
320 set_kernel_config CONFIG_USB_CONFIGFS_ECM y
315 set_kernel_config CONFIG_USB_CONFIGFS_ECM_SUBSET y
321 set_kernel_config CONFIG_USB_CONFIGFS_ECM_SUBSET y
316 set_kernel_config CONFIG_USB_CONFIGFS_RNDIS y
322 set_kernel_config CONFIG_USB_CONFIGFS_RNDIS y
317 set_kernel_config CONFIG_USB_CONFIGFS_EEM y
323 set_kernel_config CONFIG_USB_CONFIGFS_EEM y
318 set_kernel_config CONFIG_USB_CONFIGFS_MASS_STORAGE y
324 set_kernel_config CONFIG_USB_CONFIGFS_MASS_STORAGE y
319 set_kernel_config CONFIG_USB_CONFIGFS_F_LB_SS y
325 set_kernel_config CONFIG_USB_CONFIGFS_F_LB_SS y
320 set_kernel_config CONFIG_USB_CONFIGFS_F_FS y
326 set_kernel_config CONFIG_USB_CONFIGFS_F_FS y
321 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC1 y
327 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC1 y
322 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC2 y
328 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC2 y
323 set_kernel_config CONFIG_USB_CONFIGFS_F_MIDI y
329 set_kernel_config CONFIG_USB_CONFIGFS_F_MIDI y
324 set_kernel_config CONFIG_USB_CONFIGFS_F_HID y
330 set_kernel_config CONFIG_USB_CONFIGFS_F_HID y
325 set_kernel_config CONFIG_USB_CONFIGFS_F_UVC y
331 set_kernel_config CONFIG_USB_CONFIGFS_F_UVC y
326 set_kernel_config CONFIG_USB_CONFIGFS_F_PRINTER y
332 set_kernel_config CONFIG_USB_CONFIGFS_F_PRINTER y
327 set_kernel_config CONFIG_LEDS_PCA963X m
333 set_kernel_config CONFIG_LEDS_PCA963X m
328 set_kernel_config CONFIG_LEDS_IS31FL32XX m
334 set_kernel_config CONFIG_LEDS_IS31FL32XX m
329 set_kernel_config CONFIG_LEDS_TRIGGER_NETDEV m
335 set_kernel_config CONFIG_LEDS_TRIGGER_NETDEV m
330 set_kernel_config CONFIG_RTC_DRV_RV3028 m
336 set_kernel_config CONFIG_RTC_DRV_RV3028 m
331 set_kernel_config CONFIG_AUXDISPLAY y
337 set_kernel_config CONFIG_AUXDISPLAY y
332 set_kernel_config CONFIG_HD44780 m
338 set_kernel_config CONFIG_HD44780 m
333 set_kernel_config CONFIG_FB_TFT_SH1106 m
339 set_kernel_config CONFIG_FB_TFT_SH1106 m
334 set_kernel_config CONFIG_VIDEO_CODEC_BCM2835 m
340 set_kernel_config CONFIG_VIDEO_CODEC_BCM2835 m
335 set_kernel_config CONFIG_BCM2835_POWER y
341 set_kernel_config CONFIG_BCM2835_POWER y
336 set_kernel_config CONFIG_INV_MPU6050_IIO m
342 set_kernel_config CONFIG_INV_MPU6050_IIO m
337 set_kernel_config CONFIG_INV_MPU6050_I2C m
343 set_kernel_config CONFIG_INV_MPU6050_I2C m
338 set_kernel_config CONFIG_SECURITYFS y
344 set_kernel_config CONFIG_SECURITYFS y
339
345
340 # Safer to build this in
346 # Safer to build this in
341 set_kernel_config CONFIG_BINFMT_MISC y
347 set_kernel_config CONFIG_BINFMT_MISC y
342
348
343 # pulseaudio wants a buffer of at least this size
349 # pulseaudio wants a buffer of at least this size
344 set_kernel_config CONFIG_SND_HDA_PREALLOC_SIZE 2048
350 set_kernel_config CONFIG_SND_HDA_PREALLOC_SIZE 2048
345
351
346 # PR#3063: enable 3D acceleration with 64-bit kernel on RPi4
352 # PR#3063: enable 3D acceleration with 64-bit kernel on RPi4
347 # set the appropriate kernel configs unlocked by this PR
353 # set the appropriate kernel configs unlocked by this PR
348 set_kernel_config CONFIG_ARCH_BCM y
354 set_kernel_config CONFIG_ARCH_BCM y
349 set_kernel_config CONFIG_ARCH_BCM2835 y
355 set_kernel_config CONFIG_ARCH_BCM2835 y
350 set_kernel_config CONFIG_DRM_V3D m
356 set_kernel_config CONFIG_DRM_V3D m
351 set_kernel_config CONFIG_DRM_VC4 m
357 set_kernel_config CONFIG_DRM_VC4 m
352 set_kernel_config CONFIG_DRM_VC4_HDMI_CEC y
358 set_kernel_config CONFIG_DRM_VC4_HDMI_CEC y
353
359
354 # PR#3144: add arm64 pcie bounce buffers; enables 4GiB on RPi4
360 # PR#3144: add arm64 pcie bounce buffers; enables 4GiB on RPi4
355 # required by PR#3144; should already be applied, but just to be safe
361 # required by PR#3144; should already be applied, but just to be safe
356 set_kernel_config CONFIG_PCIE_BRCMSTB y
362 set_kernel_config CONFIG_PCIE_BRCMSTB y
357 set_kernel_config CONFIG_BCM2835_MMC y
363 set_kernel_config CONFIG_BCM2835_MMC y
358
364
359 # Snap needs squashfs. The ubuntu eoan-preinstalled-server image at
365 # Snap needs squashfs. The ubuntu eoan-preinstalled-server image at
360 # http://cdimage.ubuntu.com/ubuntu-server/daily-preinstalled/current/ uses snap
366 # http://cdimage.ubuntu.com/ubuntu-server/daily-preinstalled/current/ uses snap
361 # during cloud-init setup at first boot. Without this the login accounts are not
367 # during cloud-init setup at first boot. Without this the login accounts are not
362 # created and the user can not login.
368 # created and the user can not login.
363 set_kernel_config CONFIG_SQUASHFS y
369 set_kernel_config CONFIG_SQUASHFS y
364
370
365 # Ceph support for Block Device (RBD) and Filesystem (FS)
371 # Ceph support for Block Device (RBD) and Filesystem (FS)
366 # https://docs.ceph.com/docs/master/
372 # https://docs.ceph.com/docs/master/
367 set_kernel_config CONFIG_CEPH_LIB m
373 set_kernel_config CONFIG_CEPH_LIB m
368 set_kernel_config CONFIG_CEPH_LIB_USE_DNS_RESOLVER y
374 set_kernel_config CONFIG_CEPH_LIB_USE_DNS_RESOLVER y
369 set_kernel_config CONFIG_CEPH_FS m
375 set_kernel_config CONFIG_CEPH_FS m
370 set_kernel_config CONFIG_CEPH_FSCACHE y
376 set_kernel_config CONFIG_CEPH_FSCACHE y
371 set_kernel_config CONFIG_CEPH_FS_POSIX_ACL y
377 set_kernel_config CONFIG_CEPH_FS_POSIX_ACL y
372 set_kernel_config CONFIG_BLK_DEV_RBD m
378 set_kernel_config CONFIG_BLK_DEV_RBD m
373 fi
379 fi
374
380
375 # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
381 # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
376 if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then
382 if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then
377 set_kernel_config CONFIG_HAVE_KVM y
383 set_kernel_config CONFIG_HAVE_KVM y
378 set_kernel_config CONFIG_HIGH_RES_TIMERS y
384 set_kernel_config CONFIG_HIGH_RES_TIMERS y
379 set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y
385 set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y
380 set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y
386 set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y
381 set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y
387 set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y
382 set_kernel_config CONFIG_HAVE_KVM_EVENTFD y
388 set_kernel_config CONFIG_HAVE_KVM_EVENTFD y
383 set_kernel_config CONFIG_HAVE_KVM_IRQFD y
389 set_kernel_config CONFIG_HAVE_KVM_IRQFD y
384 set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y
390 set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y
385 set_kernel_config CONFIG_HAVE_KVM_MSI y
391 set_kernel_config CONFIG_HAVE_KVM_MSI y
386 set_kernel_config CONFIG_KVM y
392 set_kernel_config CONFIG_KVM y
387 set_kernel_config CONFIG_KVM_ARM_HOST y
393 set_kernel_config CONFIG_KVM_ARM_HOST y
388 set_kernel_config CONFIG_KVM_ARM_PMU y
394 set_kernel_config CONFIG_KVM_ARM_PMU y
389 set_kernel_config CONFIG_KVM_COMPAT y
395 set_kernel_config CONFIG_KVM_COMPAT y
390 set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y
396 set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y
391 set_kernel_config CONFIG_KVM_MMIO y
397 set_kernel_config CONFIG_KVM_MMIO y
392 set_kernel_config CONFIG_KVM_VFIO y
398 set_kernel_config CONFIG_KVM_VFIO y
393 set_kernel_config CONFIG_KVM_MMU_AUDIT y
399 set_kernel_config CONFIG_KVM_MMU_AUDIT y
394 set_kernel_config CONFIG_VHOST m
400 set_kernel_config CONFIG_VHOST m
395 set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
401 set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
396 set_kernel_config CONFIG_VHOST_NET m
402 set_kernel_config CONFIG_VHOST_NET m
397 set_kernel_config CONFIG_VIRTUALIZATION y
403 set_kernel_config CONFIG_VIRTUALIZATION y
398 set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y
404 set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y
399 set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y
405 set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y
400 set_kernel_config CONFIG_MMU_NOTIFIER y
406 set_kernel_config CONFIG_MMU_NOTIFIER y
401
407
402 # erratum
408 # erratum
403 set_kernel_config ARM64_ERRATUM_834220 y
409 set_kernel_config ARM64_ERRATUM_834220 y
404
410
405 # https://sourceforge.net/p/kvm/mailman/message/18440797/
411 # https://sourceforge.net/p/kvm/mailman/message/18440797/
406 set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
412 set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
407 fi
413 fi
408
414
409 # enable apparmor,integrity audit,
415 # enable apparmor,integrity audit,
410 if [ "$KERNEL_SECURITY" = true ] ; then
416 if [ "$KERNEL_SECURITY" = true ] ; then
411
417
412 # security filesystem, security models and audit
418 # security filesystem, security models and audit
413 set_kernel_config CONFIG_SECURITYFS y
419 set_kernel_config CONFIG_SECURITYFS y
414 set_kernel_config CONFIG_SECURITY y
420 set_kernel_config CONFIG_SECURITY y
415 set_kernel_config CONFIG_AUDIT y
421 set_kernel_config CONFIG_AUDIT y
416
422
417 # harden strcpy and memcpy
423 # harden strcpy and memcpy
418 set_kernel_config CONFIG_HARDENED_USERCOPY y
424 set_kernel_config CONFIG_HARDENED_USERCOPY y
419 set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y
425 set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y
420 set_kernel_config CONFIG_FORTIFY_SOURCE y
426 set_kernel_config CONFIG_FORTIFY_SOURCE y
421
427
422 # integrity sub-system
428 # integrity sub-system
423 set_kernel_config CONFIG_INTEGRITY y
429 set_kernel_config CONFIG_INTEGRITY y
424 set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y
430 set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y
425 set_kernel_config CONFIG_INTEGRITY_AUDIT y
431 set_kernel_config CONFIG_INTEGRITY_AUDIT y
426 set_kernel_config CONFIG_INTEGRITY_SIGNATURE y
432 set_kernel_config CONFIG_INTEGRITY_SIGNATURE y
427 set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y
433 set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y
428
434
429 # This option provides support for retaining authentication tokens and access keys in the kernel.
435 # This option provides support for retaining authentication tokens and access keys in the kernel.
430 set_kernel_config CONFIG_KEYS y
436 set_kernel_config CONFIG_KEYS y
431 set_kernel_config CONFIG_KEYS_COMPAT y
437 set_kernel_config CONFIG_KEYS_COMPAT y
432
438
433 # Apparmor
439 # Apparmor
434 set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0
440 set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0
435 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
441 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
436 set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
442 set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
437 set_kernel_config CONFIG_SECURITY_APPARMOR y
443 set_kernel_config CONFIG_SECURITY_APPARMOR y
438 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
444 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
439 set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
445 set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
440
446
441 # restrictions on unprivileged users reading the kernel
447 # restrictions on unprivileged users reading the kernel
442 set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y
448 set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y
443
449
444 # network security hooks
450 # network security hooks
445 set_kernel_config CONFIG_SECURITY_NETWORK y
451 set_kernel_config CONFIG_SECURITY_NETWORK y
446 set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y
452 set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y
447 set_kernel_config CONFIG_SECURITY_PATH y
453 set_kernel_config CONFIG_SECURITY_PATH y
448 set_kernel_config CONFIG_SECURITY_YAMA n
454 set_kernel_config CONFIG_SECURITY_YAMA n
449
455
450 set_kernel_config CONFIG_SECURITY_SELINUX n
456 set_kernel_config CONFIG_SECURITY_SELINUX n
451 set_kernel_config CONFIG_SECURITY_SMACK n
457 set_kernel_config CONFIG_SECURITY_SMACK n
452 set_kernel_config CONFIG_SECURITY_TOMOYO n
458 set_kernel_config CONFIG_SECURITY_TOMOYO n
453 set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n
459 set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n
454 set_kernel_config CONFIG_SECURITY_LOADPIN n
460 set_kernel_config CONFIG_SECURITY_LOADPIN n
455 set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n
461 set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n
456 set_kernel_config CONFIG_IMA n
462 set_kernel_config CONFIG_IMA n
457 set_kernel_config CONFIG_EVM n
463 set_kernel_config CONFIG_EVM n
458 set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y
464 set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y
459 set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y
465 set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y
460 set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y
466 set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y
461 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y
467 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y
462 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
468 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
463 set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y
469 set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y
464 set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n
470 set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n
465 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m
471 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m
466 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
472 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
467
473 fi
468 set_kernel_config CONFIG_ARM64_CRYPTO y
474
475 if [ "$ENABLE_CRYPTFS" = true ] ; then
476 set_kernel_config CONFIG_EMBEDDED y
477 set_kernel_config CONFIG_EXPERT y
478 set_kernel_config CONFIG_DAX y
479 set_kernel_config CONFIG_MD y
480 set_kernel_config CONFIG_BLK_DEV_MD y
481 set_kernel_config CONFIG_MD_AUTODETECT y
482 set_kernel_config CONFIG_BLK_DEV_DM y
483 set_kernel_config CONFIG_BLK_DEV_DM_BUILTIN y
484 set_kernel_config CONFIG_DM_CRYPT y
485 set_kernel_config CONFIG_CRYPTO_BLKCIPHER y
486 set_kernel_config CONFIG_CRYPTO_CBC y
487 set_kernel_config CONFIG_CRYPTO_XTS y
488 set_kernel_config CONFIG_CRYPTO_SHA512 y
489 set_kernel_config CONFIG_CRYPTO_MANAGER y
490 set_kernel_config CONFIG_ARM64_CRYPTO y
469 set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m
491 set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m
470 set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m
492 set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m
471 set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m
493 set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m
472 set_kernel_config CRYPTO_GHASH_ARM64_CE m
494 set_kernel_config CRYPTO_GHASH_ARM64_CE m
473 set_kernel_config CRYPTO_SHA2_ARM64_CE m
495 set_kernel_config CRYPTO_SHA2_ARM64_CE m
474 set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m
496 set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m
475 set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m
497 set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m
476 set_kernel_config CONFIG_CRYPTO_AES_ARM64 m
498 set_kernel_config CONFIG_CRYPTO_AES_ARM64 m
477 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m
499 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m
478 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y
500 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y
479 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y
501 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y
480 set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
502 set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
481 set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
503 set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
482 set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
504 set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
483 fi
505 fi
484
506
485 # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
507 # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
486 if [ "$KERNEL_NF" = true ] ; then
508 if [ "$KERNEL_NF" = true ] ; then
487 set_kernel_config CONFIG_IP_NF_SECURITY m
509 set_kernel_config CONFIG_IP_NF_SECURITY m
488 set_kernel_config CONFIG_NETLABEL y
510 set_kernel_config CONFIG_NETLABEL y
489 set_kernel_config CONFIG_IP6_NF_SECURITY m
511 set_kernel_config CONFIG_IP6_NF_SECURITY m
490 set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
512 set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
491 set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m
513 set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m
492 set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
514 set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
493 set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
515 set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
494 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
516 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
495 set_kernel_config CONFIG_NFT_FIB_INET m
517 set_kernel_config CONFIG_NFT_FIB_INET m
496 set_kernel_config CONFIG_NFT_FIB_IPV4 m
518 set_kernel_config CONFIG_NFT_FIB_IPV4 m
497 set_kernel_config CONFIG_NFT_FIB_IPV6 m
519 set_kernel_config CONFIG_NFT_FIB_IPV6 m
498 set_kernel_config CONFIG_NFT_FIB_NETDEV m
520 set_kernel_config CONFIG_NFT_FIB_NETDEV m
499 set_kernel_config CONFIG_NFT_OBJREF m
521 set_kernel_config CONFIG_NFT_OBJREF m
500 set_kernel_config CONFIG_NFT_RT m
522 set_kernel_config CONFIG_NFT_RT m
501 set_kernel_config CONFIG_NFT_SET_BITMAP m
523 set_kernel_config CONFIG_NFT_SET_BITMAP m
502 set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
524 set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
503 set_kernel_config CONFIG_NF_LOG_ARP m
525 set_kernel_config CONFIG_NF_LOG_ARP m
504 set_kernel_config CONFIG_NF_SOCKET_IPV4 m
526 set_kernel_config CONFIG_NF_SOCKET_IPV4 m
505 set_kernel_config CONFIG_NF_SOCKET_IPV6 m
527 set_kernel_config CONFIG_NF_SOCKET_IPV6 m
506 set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
528 set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
507 set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
529 set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
508 set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
530 set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
509 set_kernel_config CONFIG_IP6_NF_IPTABLES m
531 set_kernel_config CONFIG_IP6_NF_IPTABLES m
510 set_kernel_config CONFIG_IP6_NF_MATCH_AH m
532 set_kernel_config CONFIG_IP6_NF_MATCH_AH m
511 set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
533 set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
512 set_kernel_config CONFIG_IP6_NF_NAT m
534 set_kernel_config CONFIG_IP6_NF_NAT m
513 set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
535 set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
514 set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
536 set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
515 set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
537 set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
516 set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
538 set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
517 set_kernel_config CONFIG_IP_SET_HASH_IP m
539 set_kernel_config CONFIG_IP_SET_HASH_IP m
518 set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
540 set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
519 set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
541 set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
520 set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
542 set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
521 set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
543 set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
522 set_kernel_config CONFIG_IP_SET_HASH_MAC m
544 set_kernel_config CONFIG_IP_SET_HASH_MAC m
523 set_kernel_config CONFIG_IP_SET_HASH_NET m
545 set_kernel_config CONFIG_IP_SET_HASH_NET m
524 set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
546 set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
525 set_kernel_config CONFIG_IP_SET_HASH_NETNET m
547 set_kernel_config CONFIG_IP_SET_HASH_NETNET m
526 set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
548 set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
527 set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
549 set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
528 set_kernel_config CONFIG_IP_SET_LIST_SET m
550 set_kernel_config CONFIG_IP_SET_LIST_SET m
529 set_kernel_config CONFIG_NETFILTER_XTABLES m
551 set_kernel_config CONFIG_NETFILTER_XTABLES m
530 set_kernel_config CONFIG_NETFILTER_XTABLES m
552 set_kernel_config CONFIG_NETFILTER_XTABLES m
531 set_kernel_config CONFIG_NFT_BRIDGE_META m
553 set_kernel_config CONFIG_NFT_BRIDGE_META m
532 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
554 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
533 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
555 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
534 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
556 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
535 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
557 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
536 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
558 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
537 set_kernel_config CONFIG_NFT_COMPAT m
559 set_kernel_config CONFIG_NFT_COMPAT m
538 set_kernel_config CONFIG_NFT_COUNTER m
560 set_kernel_config CONFIG_NFT_COUNTER m
539 set_kernel_config CONFIG_NFT_CT m
561 set_kernel_config CONFIG_NFT_CT m
540 set_kernel_config CONFIG_NFT_DUP_IPV4 m
562 set_kernel_config CONFIG_NFT_DUP_IPV4 m
541 set_kernel_config CONFIG_NFT_DUP_IPV6 m
563 set_kernel_config CONFIG_NFT_DUP_IPV6 m
542 set_kernel_config CONFIG_NFT_DUP_NETDEV m
564 set_kernel_config CONFIG_NFT_DUP_NETDEV m
543 set_kernel_config CONFIG_NFT_EXTHDR m
565 set_kernel_config CONFIG_NFT_EXTHDR m
544 set_kernel_config CONFIG_NFT_FWD_NETDEV m
566 set_kernel_config CONFIG_NFT_FWD_NETDEV m
545 set_kernel_config CONFIG_NFT_HASH m
567 set_kernel_config CONFIG_NFT_HASH m
546 set_kernel_config CONFIG_NFT_LIMIT m
568 set_kernel_config CONFIG_NFT_LIMIT m
547 set_kernel_config CONFIG_NFT_LOG m
569 set_kernel_config CONFIG_NFT_LOG m
548 set_kernel_config CONFIG_NFT_MASQ m
570 set_kernel_config CONFIG_NFT_MASQ m
549 set_kernel_config CONFIG_NFT_MASQ_IPV4 m
571 set_kernel_config CONFIG_NFT_MASQ_IPV4 m
550 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
572 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
551 set_kernel_config CONFIG_NFT_META m
573 set_kernel_config CONFIG_NFT_META m
552 set_kernel_config CONFIG_NFT_NAT m
574 set_kernel_config CONFIG_NFT_NAT m
553 set_kernel_config CONFIG_NFT_NUMGEN m
575 set_kernel_config CONFIG_NFT_NUMGEN m
554 set_kernel_config CONFIG_NFT_QUEUE m
576 set_kernel_config CONFIG_NFT_QUEUE m
555 set_kernel_config CONFIG_NFT_QUOTA m
577 set_kernel_config CONFIG_NFT_QUOTA m
556 set_kernel_config CONFIG_NFT_REDIR m
578 set_kernel_config CONFIG_NFT_REDIR m
557 set_kernel_config CONFIG_NFT_REDIR_IPV4 m
579 set_kernel_config CONFIG_NFT_REDIR_IPV4 m
558 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
580 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
559 set_kernel_config CONFIG_NFT_REJECT m
581 set_kernel_config CONFIG_NFT_REJECT m
560 set_kernel_config CONFIG_NFT_REJECT_INET m
582 set_kernel_config CONFIG_NFT_REJECT_INET m
561 set_kernel_config CONFIG_NFT_REJECT_IPV4 m
583 set_kernel_config CONFIG_NFT_REJECT_IPV4 m
562 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
584 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
563 set_kernel_config CONFIG_NFT_SET_HASH m
585 set_kernel_config CONFIG_NFT_SET_HASH m
564 set_kernel_config CONFIG_NFT_SET_RBTREE m
586 set_kernel_config CONFIG_NFT_SET_RBTREE m
565 set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
587 set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
566 set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
588 set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
567 set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
589 set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
568 set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
590 set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
569 set_kernel_config CONFIG_NF_DUP_IPV4 m
591 set_kernel_config CONFIG_NF_DUP_IPV4 m
570 set_kernel_config CONFIG_NF_DUP_IPV6 m
592 set_kernel_config CONFIG_NF_DUP_IPV6 m
571 set_kernel_config CONFIG_NF_DUP_NETDEV m
593 set_kernel_config CONFIG_NF_DUP_NETDEV m
572 set_kernel_config CONFIG_NF_LOG_BRIDGE m
594 set_kernel_config CONFIG_NF_LOG_BRIDGE m
573 set_kernel_config CONFIG_NF_LOG_IPV4 m
595 set_kernel_config CONFIG_NF_LOG_IPV4 m
574 set_kernel_config CONFIG_NF_LOG_IPV6 m
596 set_kernel_config CONFIG_NF_LOG_IPV6 m
575 set_kernel_config CONFIG_NF_NAT_IPV4 m
597 set_kernel_config CONFIG_NF_NAT_IPV4 m
576 set_kernel_config CONFIG_NF_NAT_IPV6 m
598 set_kernel_config CONFIG_NF_NAT_IPV6 m
577 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y
599 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y
578 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y
600 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y
579 set_kernel_config CONFIG_NF_NAT_PPTP m
601 set_kernel_config CONFIG_NF_NAT_PPTP m
580 set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
602 set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
581 set_kernel_config CONFIG_NF_NAT_REDIRECT y
603 set_kernel_config CONFIG_NF_NAT_REDIRECT y
582 set_kernel_config CONFIG_NF_NAT_SIP m
604 set_kernel_config CONFIG_NF_NAT_SIP m
583 set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
605 set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
584 set_kernel_config CONFIG_NF_NAT_TFTP m
606 set_kernel_config CONFIG_NF_NAT_TFTP m
585 set_kernel_config CONFIG_NF_REJECT_IPV4 m
607 set_kernel_config CONFIG_NF_REJECT_IPV4 m
586 set_kernel_config CONFIG_NF_REJECT_IPV6 m
608 set_kernel_config CONFIG_NF_REJECT_IPV6 m
587 set_kernel_config CONFIG_NF_TABLES m
609 set_kernel_config CONFIG_NF_TABLES m
588 set_kernel_config CONFIG_NF_TABLES_ARP m
589 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
590 set_kernel_config CONFIG_NF_TABLES_INET m
591 set_kernel_config CONFIG_NF_TABLES_IPV4 y
610 set_kernel_config CONFIG_NF_TABLES_IPV4 y
592 set_kernel_config CONFIG_NF_TABLES_IPV6 y
611 set_kernel_config CONFIG_NF_TABLES_IPV6 y
593 set_kernel_config CONFIG_NF_TABLES_NETDEV m
594 set_kernel_config CONFIG_NF_TABLES_SET m
612 set_kernel_config CONFIG_NF_TABLES_SET m
595 set_kernel_config CONFIG_NF_TABLES_INET y
613 set_kernel_config CONFIG_NF_TABLES_INET y
596 set_kernel_config CONFIG_NF_TABLES_NETDEV y
614 set_kernel_config CONFIG_NF_TABLES_NETDEV y
597 set_kernel_config CONFIG_NFT_CONNLIMIT m
615 set_kernel_config CONFIG_NFT_CONNLIMIT m
598 set_kernel_config CONFIG_NFT_TUNNEL m
616 set_kernel_config CONFIG_NFT_TUNNEL m
599 set_kernel_config CONFIG_NFT_SOCKET m
617 set_kernel_config CONFIG_NFT_SOCKET m
600 set_kernel_config CONFIG_NFT_TPROXY m
618 set_kernel_config CONFIG_NFT_TPROXY m
601 set_kernel_config CONFIG_NF_FLOW_TABLE m
619 set_kernel_config CONFIG_NF_FLOW_TABLE m
602 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
620 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
603 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
621 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
604 set_kernel_config CONFIG_NF_TABLES_ARP y
622 set_kernel_config CONFIG_NF_TABLES_ARP y
605 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y
623 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y
606 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y
624 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y
607 set_kernel_config CONFIG_NF_TABLES_BRIDGE y
625 set_kernel_config CONFIG_NF_TABLES_BRIDGE y
608 set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m
626 set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m
609 set_kernel_config CONFIG_NFT_OSF m
627 set_kernel_config CONFIG_NFT_OSF m
610
628
611 fi
629 fi
612
630
613 # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
631 # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
614 if [ "$KERNEL_BPF" = true ] ; then
632 if [ "$KERNEL_BPF" = true ] ; then
615 set_kernel_config CONFIG_BPF_SYSCALL y
633 set_kernel_config CONFIG_BPF_SYSCALL y
616 set_kernel_config CONFIG_BPF_EVENTS y
634 set_kernel_config CONFIG_BPF_EVENTS y
617 set_kernel_config CONFIG_BPF_STREAM_PARSER y
635 set_kernel_config CONFIG_BPF_STREAM_PARSER y
618 set_kernel_config CONFIG_CGROUP_BPF y
636 set_kernel_config CONFIG_CGROUP_BPF y
619 set_kernel_config CONFIG_XDP_SOCKETS y
637 set_kernel_config CONFIG_XDP_SOCKETS y
620 fi
638 fi
621
639
622 # KERNEL_DEFAULT_GOV was set by user
640 # KERNEL_DEFAULT_GOV was set by user
623 if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then
641 if [ "$KERNEL_DEFAULT_GOV" != ondemand ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then
624
625 case "$KERNEL_DEFAULT_GOV" in
642 case "$KERNEL_DEFAULT_GOV" in
626 performance)
643 performance)
627 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
644 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
628 ;;
645 ;;
629 userspace)
646 userspace)
630 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
647 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
631 ;;
648 ;;
632 ondemand)
649 ondemand)
633 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
650 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
634 ;;
651 ;;
635 conservative)
652 conservative)
636 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
653 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
637 ;;
654 ;;
638 shedutil)
655 shedutil)
639 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
656 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
640 ;;
657 ;;
641 *)
658 *)
642 echo "error: unsupported default cpu governor"
659 echo "error: unsupported default cpu governor"
643 exit 1
660 exit 1
644 ;;
661 ;;
645 esac
662 esac
646
663 # unset previous default governor
647 # unset previous default governor
664 unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND
648 unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE
649 fi
665 fi
650
666
651 #Revert to previous directory
667 #Revert to previous directory
652 cd "${WORKDIR}" || exit
668 cd "${WORKDIR}" || exit
653
669
654 # Set kernel configuration parameters to enable qemu emulation
670 # Set kernel configuration parameters to enable qemu emulation
655 if [ "$ENABLE_QEMU" = true ] ; then
671 if [ "$ENABLE_QEMU" = true ] ; then
656 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
672 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
657 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
673 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
658
659 if [ "$ENABLE_CRYPTFS" = true ] ; then
660 {
661 echo "CONFIG_EMBEDDED=y"
662 echo "CONFIG_EXPERT=y"
663 echo "CONFIG_DAX=y"
664 echo "CONFIG_MD=y"
665 echo "CONFIG_BLK_DEV_MD=y"
666 echo "CONFIG_MD_AUTODETECT=y"
667 echo "CONFIG_BLK_DEV_DM=y"
668 echo "CONFIG_BLK_DEV_DM_BUILTIN=y"
669 echo "CONFIG_DM_CRYPT=y"
670 echo "CONFIG_CRYPTO_BLKCIPHER=y"
671 echo "CONFIG_CRYPTO_CBC=y"
672 echo "CONFIG_CRYPTO_XTS=y"
673 echo "CONFIG_CRYPTO_SHA512=y"
674 echo "CONFIG_CRYPTO_MANAGER=y"
675 } >> "${KERNEL_DIR}"/.config
676 fi
677 fi
674 fi
678
675
679 # Copy custom kernel configuration file
676 # Copy custom kernel configuration file
680 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
677 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
681 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
678 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
682 fi
679 fi
683
680
684 # Set kernel configuration parameters to their default values
681 # Set kernel configuration parameters to their default values
685 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
682 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
686 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
683 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
687 fi
684 fi
688
685
689 # Start menu-driven kernel configuration (interactive)
686 # Start menu-driven kernel configuration (interactive)
690 if [ "$KERNEL_MENUCONFIG" = true ] ; then
687 if [ "$KERNEL_MENUCONFIG" = true ] ; then
691 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
688 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
692 fi
689 fi
693 # end if "$KERNELSRC_CONFIG" = true
690 # end if "$KERNELSRC_CONFIG" = true
694 fi
691 fi
695
692
696 # Use ccache to cross compile the kernel
693 # Use ccache to cross compile the kernel
697 if [ "$KERNEL_CCACHE" = true ] ; then
694 if [ "$KERNEL_CCACHE" = true ] ; then
698 cc="ccache ${CROSS_COMPILE}gcc"
695 cc="ccache ${CROSS_COMPILE}gcc"
699 else
696 else
700 cc="${CROSS_COMPILE}gcc"
697 cc="${CROSS_COMPILE}gcc"
701 fi
698 fi
702
699
703 # Cross compile kernel and dtbs
700 # Cross compile kernel and dtbs
704 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
701 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
705
702
706 # Cross compile kernel modules
703 # Cross compile kernel modules
707 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
704 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
708 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
705 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
709 fi
706 fi
710 # end if "$KERNELSRC_PREBUILT" = false
707 # end if "$KERNELSRC_PREBUILT" = false
711 fi
708 fi
712
709
713 # Check if kernel compilation was successful
710 # Check if kernel compilation was successful
714 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
711 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
715 echo "error: kernel compilation failed! (kernel image not found)"
712 echo "error: kernel compilation failed! (kernel image not found)"
716 cleanup
713 cleanup
717 exit 1
714 exit 1
718 fi
715 fi
719
716
720 # Install kernel modules
717 # Install kernel modules
721 if [ "$ENABLE_REDUCE" = true ] ; then
718 if [ "$ENABLE_REDUCE" = true ] ; then
722 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
719 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
723 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
720 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
724 fi
721 fi
725 else
722 else
726 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
723 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
727 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
724 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
728 fi
725 fi
729
726
730 # Install kernel firmware
727 # Install kernel firmware
731 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
728 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
732 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
729 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
733 fi
730 fi
734 fi
731 fi
735
732
736 # Install kernel headers
733 # Install kernel headers
737 if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
734 if [ "$KERNEL_HEADERS" = true ] && [ "$REDUCE_KERNEL" = false ] ; then
738 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
735 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
739 fi
736 fi
740
737
741 # Prepare boot (firmware) directory
738 # Prepare boot (firmware) directory
742 mkdir "${BOOT_DIR}"
739 mkdir "${BOOT_DIR}"
743
740
744 # Get kernel release version
741 # Get kernel release version
745 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
742 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
746
743
747 # Copy kernel configuration file to the boot directory
744 # Copy kernel configuration file to the boot directory
748 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
745 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
749
746
750 # Prepare device tree directory
747 # Prepare device tree directory
751 mkdir "${BOOT_DIR}/overlays"
748 mkdir "${BOOT_DIR}/overlays"
752
749
753 # Ensure the proper .dtb is located
750 # Ensure the proper .dtb is located
754 if [ "$KERNEL_ARCH" = "arm" ] ; then
751 if [ "$KERNEL_ARCH" = "arm" ] ; then
755 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
752 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
756 if [ -f "${dtb}" ] ; then
753 if [ -f "${dtb}" ] ; then
757 install_readonly "${dtb}" "${BOOT_DIR}/"
754 install_readonly "${dtb}" "${BOOT_DIR}/"
758 fi
755 fi
759 done
756 done
760 else
757 else
761 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
758 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
762 if [ -f "${dtb}" ] ; then
759 if [ -f "${dtb}" ] ; then
763 install_readonly "${dtb}" "${BOOT_DIR}/"
760 install_readonly "${dtb}" "${BOOT_DIR}/"
764 fi
761 fi
765 done
762 done
766 fi
763 fi
767
764
768 # Copy compiled dtb device tree files
765 # Copy compiled dtb device tree files
769 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
766 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
770 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do
767 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do
771 if [ -f "${dtb}" ] ; then
768 if [ -f "${dtb}" ] ; then
772 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
769 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
773 fi
770 fi
774 done
771 done
775
772
776 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
773 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
777 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
774 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
778 fi
775 fi
779 fi
776 fi
780
777
781 if [ "$ENABLE_UBOOT" = false ] ; then
778 if [ "$ENABLE_UBOOT" = false ] ; then
782 # Convert and copy kernel image to the boot directory
779 # Convert and copy kernel image to the boot directory
783 cp "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
780 cp "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
784 else
781 else
785 # Copy kernel image to the boot directory
782 # Copy kernel image to the boot directory
786 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
783 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
787 fi
784 fi
788
785
789 # Remove kernel sources
786 # Remove kernel sources
790 if [ "$KERNEL_REMOVESRC" = true ] ; then
787 if [ "$KERNEL_REMOVESRC" = true ] ; then
791 rm -fr "${KERNEL_DIR}"
788 rm -fr "${KERNEL_DIR}"
792 else
789 else
793 # Prepare compiled kernel modules
790 # Prepare compiled kernel modules
794 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
791 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
795 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
792 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
796 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
793 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
797 fi
794 fi
798
795
799 # Create symlinks for kernel modules
796 # Create symlinks for kernel modules
800 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
797 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
801 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
798 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
802 fi
799 fi
803 fi
800 fi
804
801
805 else # BUILD_KERNEL=false
802 else # BUILD_KERNEL=false
806 if [ "$SET_ARCH" = 64 ] ; then
803 if [ "$SET_ARCH" = 64 ] ; then
807 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
804 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
808 # Use Sakakis modified kernel if ZSWAP is active
805 # Use Sakakis modified kernel if ZSWAP is active
809 if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
806 if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
810 RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
807 RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
811 fi
808 fi
812
809
813 # Create temporary directory for dl
810 # Create temporary directory for dl
814 temp_dir=$(as_nobody mktemp -d)
811 temp_dir=$(as_nobody mktemp -d)
815
812
816 # Fetch kernel dl
813 # Fetch kernel dl
817 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
814 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
818 fi
815 fi
819 if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then
816 if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then
820 # Create temporary directory for dl
817 # Create temporary directory for dl
821 temp_dir=$(as_nobody mktemp -d)
818 temp_dir=$(as_nobody mktemp -d)
822
819
823 # Fetch kernel dl
820 # Fetch kernel dl
824 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL"
821 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL"
825 fi
822 fi
826
823
827 #extract download
824 #extract download
828 tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
825 tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
829
826
830 #move extracted kernel to /boot/firmware
827 #move extracted kernel to /boot/firmware
831 mkdir "${R}/boot/firmware"
828 mkdir "${R}/boot/firmware"
832 cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
829 cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
833 cp -r "${temp_dir}"/lib/* "${R}"/lib/
830 cp -r "${temp_dir}"/lib/* "${R}"/lib/
834
831
835 # Remove temporary directory for kernel sources
832 # Remove temporary directory for kernel sources
836 rm -fr "${temp_dir}"
833 rm -fr "${temp_dir}"
837
834
838 # Set permissions of the kernel sources
835 # Set permissions of the kernel sources
839 chown -R root:root "${R}/boot/firmware"
836 chown -R root:root "${R}/boot/firmware"
840 chown -R root:root "${R}/lib/modules"
837 chown -R root:root "${R}/lib/modules"
841 fi
838 fi
842
839
843 # Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel)
840 # Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel)
844 if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then
841 if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then
845 # Create temporary directory for dl
842 # Create temporary directory for dl
846 temp_dir=$(as_nobody mktemp -d)
843 temp_dir=$(as_nobody mktemp -d)
847
844
848 # Fetch kernel
845 # Fetch kernel
849 as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
846 as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
850
847
851 # Copy downloaded kernel package
848 # Copy downloaded kernel package
852 mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
849 mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
853
850
854 # Set permissions
851 # Set permissions
855 chown -R root:root "${R}"/tmp/kernel.deb
852 chown -R root:root "${R}"/tmp/kernel.deb
856
853
857 # Install kernel
854 # Install kernel
858 chroot_exec dpkg -i /tmp/kernel.deb
855 chroot_exec dpkg -i /tmp/kernel.deb
859
856
860 # move /boot to /boot/firmware to fit script env.
857 # move /boot to /boot/firmware to fit script env.
861 #mkdir "${BOOT_DIR}"
858 #mkdir "${BOOT_DIR}"
862 mkdir "${temp_dir}"/firmware
859 mkdir "${temp_dir}"/firmware
863 mv "${R}"/boot/* "${temp_dir}"/firmware/
860 mv "${R}"/boot/* "${temp_dir}"/firmware/
864 mv "${temp_dir}"/firmware "${R}"/boot/
861 mv "${temp_dir}"/firmware "${R}"/boot/
865
862
866 #same for kernel headers
863 #same for kernel headers
867 if [ "$KERNEL_HEADERS" = true ] ; then
864 if [ "$KERNEL_HEADERS" = true ] ; then
868 # Fetch kernel header
865 # Fetch kernel header
869 as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
866 as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
870 mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
867 mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
871 chown -R root:root "${R}"/tmp/kernel-header.deb
868 chown -R root:root "${R}"/tmp/kernel-header.deb
872 # Install kernel header
869 # Install kernel header
873 chroot_exec dpkg -i /tmp/kernel-header.deb
870 chroot_exec dpkg -i /tmp/kernel-header.deb
874 rm -f "${R}"/tmp/kernel-header.deb
871 rm -f "${R}"/tmp/kernel-header.deb
875 fi
872 fi
876
873
877 # Remove temporary directory and files
874 # Remove temporary directory and files
878 rm -fr "${temp_dir}"
875 rm -fr "${temp_dir}"
879 rm -f "${R}"/tmp/kernel.deb
876 rm -f "${R}"/tmp/kernel.deb
880 fi
877 fi
881
878
882 # Check if kernel installation was successful
879 # Check if kernel installation was successful
883 KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
880 KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
884 if [ -z "$KERNEL" ] ; then
881 if [ -z "$KERNEL" ] ; then
885 echo "error: kernel installation failed! (/boot/kernel* not found)"
882 echo "error: kernel installation failed! (/boot/kernel* not found)"
886 cleanup
883 cleanup
887 exit 1
884 exit 1
888 fi
885 fi
889 fi
886 fi No newline at end of file
Show file before | Show file after | Hide comments
@@ -1,120 +1,120
1 #
1 #
2 # Setup fstab and initramfs
2 # Setup fstab and initramfs
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup fstab
8 # Install and setup fstab
9 install_readonly files/mount/fstab "${ETC_DIR}/fstab"
9 install_readonly files/mount/fstab "${ETC_DIR}/fstab"
10
10
11 # Generate initramfs file
11 # Generate initramfs file
12 if [ "$ENABLE_INITRAMFS" = true ] ; then
12 if [ "$ENABLE_INITRAMFS" = true ] ; then
13 if [ "$ENABLE_CRYPTFS" = true ] ; then
13 if [ "$ENABLE_CRYPTFS" = true ] ; then
14
14
15 # Include initramfs scripts to auto expand encrypted root partition
15 # Include initramfs scripts to auto expand encrypted root partition
16 if [ "$EXPANDROOT" = true ] ; then
16 if [ "$EXPANDROOT" = true ] ; then
17 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
17 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
18 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
18 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
19 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
19 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
20 fi
20 fi
21
21
22 # Replace fstab root partition with encrypted partition mapping
22 # Replace fstab root partition with encrypted partition mapping
23 sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
23 sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
24
24
25 # Add encrypted partition to crypttab and fstab
25 # Add encrypted partition to crypttab and fstab
26 install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
26 install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
27 echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
27 echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
28
28
29 if [ "$ENABLE_USBBOOT" = true ] && [ "$ENABLE_SPLITFS" = false ]; then
29 if [ "$ENABLE_USBBOOT" = true ] && [ "$ENABLE_SPLITFS" = false ]; then
30 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
30 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
31 # Add usb/sda2 disk to crypttab
31 # Add usb/sda2 disk to crypttab
32 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/crypttab"
32 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/crypttab"
33 fi
33 fi
34
34
35 # Add encrypted root partition to fstab and crypttab
35 # Add encrypted root partition to fstab and crypttab
36 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_USBBOOT" = false ]; then
36 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_USBBOOT" = false ]; then
37 # Add usb/sda1 disk to crypttab
37 # Add usb/sda1 disk to crypttab
38 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
38 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
39 fi
39 fi
40
40
41 if [ "$CRYPTFS_DROPBEAR" = true ]; then
41 if [ "$CRYPTFS_DROPBEAR" = true ] ; then
42 if [ "$ENABLE_DHCP" = false ] ; then
42 if [ "$ENABLE_ETH_DHCP" = false ] ; then
43 # Get cdir from NET_ADDRESS e.g. 24
43 # Get cdir from NET_ADDRESS e.g. 24
44 cdir=$(printf "%s" "${NET_ADDRESS}" | cut -d '/' -f2)
44 cdir=$(printf "%s" "${NET_ETH_ADDRESS}" | cut -d '/' -f2)
45
45
46 # Convert cdir ro netmask e.g. 24 to 255.255.255.0
46 # Convert cdir ro netmask e.g. 24 to 255.255.255.0
47 NET_MASK=$(cdr2mask "$cdir")
47 NET_MASK=$(cdr2mask "$cdir")
48
48
49 # Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
49 # Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
50 # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>
50 # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<HOSTNAME>:<device>:<autoconf>
51 sed -i "\$a\nIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
51 sed -i "\$a\nIP=${NET_ETH_ADDRESS}::${NET_ETH_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
52 else
52 else
53 sed -i "\$a\nIP=::::${HOSTNAME}::dhcp" "${ETC_DIR}"/initramfs-tools/initramfs.conf
53 sed -i "\$a\nIP=::::${HOSTNAME}::dhcp" "${ETC_DIR}"/initramfs-tools/initramfs.conf
54 fi
54 fi
55
55
56 if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
56 if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
57 install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
57 install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
58 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
58 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
59 else
59 else
60 # Create key
60 # Create key
61 chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
61 chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
62
62
63 # Convert dropbear key to openssh key
63 # Convert dropbear key to openssh key
64 chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
64 chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
65
65
66 # Get Public Key Part
66 # Get Public Key Part
67 chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear | chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
67 chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear | chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
68
68
69 # Delete unwanted lines
69 # Delete unwanted lines
70 sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
70 sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
71 sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
71 sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
72
72
73 # Trust the new key
73 # Trust the new key
74 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
74 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
75
75
76 # Save Keys - convert with putty from rsa/openssh to puttkey
76 # Save Keys - convert with putty from rsa/openssh to puttkey
77 cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
77 cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
78
78
79 # Get unlock script
79 # Get unlock script
80 install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
80 install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
81
81
82 # Enable Dropbear inside initramfs
82 # Enable Dropbear inside initramfs
83 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
83 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
84
84
85 # Enable Dropbear inside initramfs
85 # Enable Dropbear inside initramfs
86 sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
86 sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
87 fi
87 fi
88 # CRYPTFSDROPBEAR=false
88 # CRYPTFSDROPBEAR=false
89 else
89 else
90 # Disable SSHD inside initramfs
90 # Disable SSHD inside initramfs
91 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
91 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
92 fi
92 fi
93
93
94 # Add cryptsetup modules to initramfs
94 # Add cryptsetup modules to initramfs
95 #printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
95 #printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
96
96
97 # Dummy mapping required by mkinitramfs
97 # Dummy mapping required by mkinitramfs
98 echo "0 1 crypt "${CRYPTFS_CIPHER}" ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
98 echo "0 1 crypt "${CRYPTFS_CIPHER}" ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
99
99
100 # Generate initramfs with encrypted root partition support
100 # Generate initramfs with encrypted root partition support
101 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
101 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
102
102
103 # Remove dummy mapping
103 # Remove dummy mapping
104 chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
104 chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
105 # CRYPTFS=false
105 # CRYPTFS=false
106 else
106 else
107 #USB BOOT /boot on sda1 / on sda2
107 #USB BOOT /boot on sda1 / on sda2
108 if [ "$ENABLE_USBBOOT" = true ] ; then
108 if [ "$ENABLE_USBBOOT" = true ] ; then
109 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
109 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
110 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
110 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
111 fi
111 fi
112
112
113 # Add usb/sda disk root partition to fstab
113 # Add usb/sda disk root partition to fstab
114 if [ "$ENABLE_SPLITFS" = true ] ; then
114 if [ "$ENABLE_SPLITFS" = true ] ; then
115 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
115 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
116 fi
116 fi
117 # Generate initramfs without encrypted root partition support
117 # Generate initramfs without encrypted root partition support
118 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
118 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
119 fi
119 fi
120 fi
120 fi
Show file before | Show file after | Hide comments
@@ -1,320 +1,323
1 #
1 #
2 # Setup RPi2/3/4 config and cmdline
2 # Setup RPi2/3/4 config and cmdline
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
8 if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
9 # Install boot binaries from local directory
9 # Install boot binaries from local directory
10 cp "${RPI_FIRMWARE_DIR}"/boot/bootcode.bin "${BOOT_DIR}"/bootcode.bin
10 cp "${RPI_FIRMWARE_DIR}"/boot/bootcode.bin "${BOOT_DIR}"/bootcode.bin
11 cp "${RPI_FIRMWARE_DIR}"/boot/fixup.dat "${BOOT_DIR}"/fixup.dat
11 cp "${RPI_FIRMWARE_DIR}"/boot/fixup.dat "${BOOT_DIR}"/fixup.dat
12 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_cd.dat "${BOOT_DIR}"/fixup_cd.dat
12 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_cd.dat "${BOOT_DIR}"/fixup_cd.dat
13 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_x.dat "${BOOT_DIR}"/fixup_x.dat
13 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_x.dat "${BOOT_DIR}"/fixup_x.dat
14 cp "${RPI_FIRMWARE_DIR}"/boot/start.elf "${BOOT_DIR}"/start.elf
14 cp "${RPI_FIRMWARE_DIR}"/boot/start.elf "${BOOT_DIR}"/start.elf
15 cp "${RPI_FIRMWARE_DIR}"/boot/start_cd.elf "${BOOT_DIR}"/start_cd.elf
15 cp "${RPI_FIRMWARE_DIR}"/boot/start_cd.elf "${BOOT_DIR}"/start_cd.elf
16 cp "${RPI_FIRMWARE_DIR}"/boot/start_x.elf "${BOOT_DIR}"/start_x.elf
16 cp "${RPI_FIRMWARE_DIR}"/boot/start_x.elf "${BOOT_DIR}"/start_x.elf
17 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4cd.dat "${BOOT_DIR}"/fixup4cd.dat
17 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4cd.dat "${BOOT_DIR}"/fixup4cd.dat
18 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4.dat "${BOOT_DIR}"/fixup4.dat
18 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4.dat "${BOOT_DIR}"/fixup4.dat
19 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4db.dat "${BOOT_DIR}"/fixup4db.dat
19 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4db.dat "${BOOT_DIR}"/fixup4db.dat
20 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4x.dat "${BOOT_DIR}"/fixup4x.dat
20 cp "${RPI_FIRMWARE_DIR}"/boot/fixup4x.dat "${BOOT_DIR}"/fixup4x.dat
21 cp "${RPI_FIRMWARE_DIR}"/boot/start4cd.elf "${BOOT_DIR}"/start4cd.elf
21 cp "${RPI_FIRMWARE_DIR}"/boot/start4cd.elf "${BOOT_DIR}"/start4cd.elf
22 cp "${RPI_FIRMWARE_DIR}"/boot/start4db.elf "${BOOT_DIR}"/start4db.elf
22 cp "${RPI_FIRMWARE_DIR}"/boot/start4db.elf "${BOOT_DIR}"/start4db.elf
23 cp "${RPI_FIRMWARE_DIR}"/boot/start4.elf "${BOOT_DIR}"/start4x.elf
23 cp "${RPI_FIRMWARE_DIR}"/boot/start4.elf "${BOOT_DIR}"/start4x.elf
24 cp "${RPI_FIRMWARE_DIR}"/boot/start4x.elf "${BOOT_DIR}"/start4x.elf
24 cp "${RPI_FIRMWARE_DIR}"/boot/start4x.elf "${BOOT_DIR}"/start4x.elf
25 else
25 else
26 # Create temporary directory for boot binaries
26 # Create temporary directory for boot binaries
27 temp_dir=$(as_nobody mktemp -d)
27 temp_dir=$(as_nobody mktemp -d)
28
28
29 # Install latest boot binaries from raspberry/firmware github
29 # Install latest boot binaries from raspberry/firmware github
30 as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
30 as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
31 as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
31 as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
32 as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
32 as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
33 as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
33 as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
34 as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
34 as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
35 as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
35 as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
36 as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
36 as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
37 as_nobody wget -q -O "${temp_dir}/fixup4cd.dat" "${FIRMWARE_URL}/fixup4cd.dat"
37 as_nobody wget -q -O "${temp_dir}/fixup4cd.dat" "${FIRMWARE_URL}/fixup4cd.dat"
38 as_nobody wget -q -O "${temp_dir}/fixup4.dat" "${FIRMWARE_URL}/fixup4.dat"
38 as_nobody wget -q -O "${temp_dir}/fixup4.dat" "${FIRMWARE_URL}/fixup4.dat"
39 as_nobody wget -q -O "${temp_dir}/fixup4db.dat" "${FIRMWARE_URL}/fixup4db.dat"
39 as_nobody wget -q -O "${temp_dir}/fixup4db.dat" "${FIRMWARE_URL}/fixup4db.dat"
40 as_nobody wget -q -O "${temp_dir}/fixup4x.dat" "${FIRMWARE_URL}/fixup4x.dat"
40 as_nobody wget -q -O "${temp_dir}/fixup4x.dat" "${FIRMWARE_URL}/fixup4x.dat"
41 as_nobody wget -q -O "${temp_dir}/start4cd.elf" "${FIRMWARE_URL}/start4cd.elf"
41 as_nobody wget -q -O "${temp_dir}/start4cd.elf" "${FIRMWARE_URL}/start4cd.elf"
42 as_nobody wget -q -O "${temp_dir}/start4db.elf" "${FIRMWARE_URL}/start4db.elf"
42 as_nobody wget -q -O "${temp_dir}/start4db.elf" "${FIRMWARE_URL}/start4db.elf"
43 as_nobody wget -q -O "${temp_dir}/start4x.elf" "${FIRMWARE_URL}/start4x.elf"
43 as_nobody wget -q -O "${temp_dir}/start4x.elf" "${FIRMWARE_URL}/start4x.elf"
44 as_nobody wget -q -O "${temp_dir}/start4x.elf" "${FIRMWARE_URL}/start4x.elf"
44 as_nobody wget -q -O "${temp_dir}/start4x.elf" "${FIRMWARE_URL}/start4x.elf"
45
45
46 # Move downloaded boot binaries
46 # Move downloaded boot binaries
47 mv "${temp_dir}/"* "${BOOT_DIR}/"
47 mv "${temp_dir}/"* "${BOOT_DIR}/"
48
48
49 # Remove temporary directory for boot binaries
49 # Remove temporary directory for boot binaries
50 rm -fr "${temp_dir}"
50 rm -fr "${temp_dir}"
51
51
52 # Set permissions of the boot binaries
52 # Set permissions of the boot binaries
53 chown -R root:root "${BOOT_DIR}"
53 chown -R root:root "${BOOT_DIR}"
54 chmod -R 600 "${BOOT_DIR}"
54 chmod -R 600 "${BOOT_DIR}"
55 fi
55 fi
56
56
57 # Setup firmware boot cmdline
57 # Setup firmware boot cmdline
58 if [ "$ENABLE_USBBOOT" = true ] ; then
58 if [ "$ENABLE_USBBOOT" = true ] ; then
59 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
59 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
60 else
60 else
61 if [ "$ENABLE_SPLITFS" = true ] ; then
61 if [ "$ENABLE_SPLITFS" = true ] ; then
62 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
62 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
63 else
63 else
64 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
64 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
65 fi
65 fi
66 fi
66 fi
67
67
68 # Add encrypted root partition to cmdline.txt
68 # Add encrypted root partition to cmdline.txt
69 if [ "$ENABLE_CRYPTFS" = true ] ; then
69 if [ "$ENABLE_CRYPTFS" = true ] ; then
70 if [ "$ENABLE_SPLITFS" = true ] ; then
70 if [ "$ENABLE_SPLITFS" = true ] ; then
71 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
71 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
72 else
72 else
73 if [ "$ENABLE_USBBOOT" = true ] ; then
73 if [ "$ENABLE_USBBOOT" = true ] ; then
74 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda2:${CRYPTFS_MAPPING}/")
74 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda2:${CRYPTFS_MAPPING}/")
75 else
75 else
76 CMDLINE=$(echo "${CMDLINE}" | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
76 CMDLINE=$(echo "${CMDLINE}" | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
77 fi
77 fi
78 fi
78 fi
79 fi
79 fi
80
80
81 # Enable Kernel messages on standard output
81 # Enable Kernel messages on standard output
82 if [ "$ENABLE_PRINTK" = true ] ; then
82 if [ "$ENABLE_PRINTK" = true ] ; then
83 install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
83 install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
84 fi
84 fi
85
85
86 # Enable Kernel messages on standard output
86 # Enable Kernel messages on standard output
87 if [ "$KERNEL_SECURITY" = true ] ; then
87 if [ "$KERNEL_SECURITY" = true ] ; then
88 install_readonly files/sysctl.d/84-rpi-ASLR.conf "${ETC_DIR}/sysctl.d/84-rpi-ASLR.conf"
88 install_readonly files/sysctl.d/84-rpi-ASLR.conf "${ETC_DIR}/sysctl.d/84-rpi-ASLR.conf"
89 fi
89 fi
90
90
91 # Install udev rule for serial alias - serial0 = console serial1=bluetooth
91 # Install udev rule for serial alias - serial0 = console serial1=bluetooth
92 install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
92 install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
93
93
94 # Remove IPv6 networking support
94 # Remove IPv6 networking support
95 if [ "$ENABLE_IPV6" = false ] ; then
95 if [ "$ENABLE_IPV6" = false ] ; then
96 CMDLINE="${CMDLINE} ipv6.disable=1"
96 CMDLINE="${CMDLINE} ipv6.disable=1"
97 fi
97 fi
98
98
99 # Automatically assign predictable network interface names
99 # Automatically assign predictable network interface names
100 if [ "$ENABLE_IFNAMES" = false ] ; then
100 if [ "$ENABLE_IFNAMES" = false ] ; then
101 CMDLINE="${CMDLINE} net.ifnames=0"
101 CMDLINE="${CMDLINE} net.ifnames=0"
102 else
102 else
103 CMDLINE="${CMDLINE} net.ifnames=1"
103 CMDLINE="${CMDLINE} net.ifnames=1"
104 fi
104 fi
105
105
106 # Disable Raspberry Pi console logo
106 # Disable Raspberry Pi console logo
107 if [ "$ENABLE_LOGO" = false ] ; then
107 if [ "$ENABLE_LOGO" = false ] ; then
108 CMDLINE="${CMDLINE} logo.nologo"
108 CMDLINE="${CMDLINE} logo.nologo"
109 fi
109 fi
110
110
111 # Strictly limit verbosity of boot up console messages
111 # Strictly limit verbosity of boot up console messages
112 if [ "$ENABLE_SILENT_BOOT" = true ] ; then
112 if [ "$ENABLE_SILENT_BOOT" = true ] ; then
113 CMDLINE="${CMDLINE} quiet loglevel=0 rd.systemd.show_status=auto rd.udev.log_priority=0"
113 CMDLINE="${CMDLINE} quiet loglevel=0 rd.systemd.show_status=auto rd.udev.log_priority=0"
114 fi
114 fi
115
115
116 # Install firmware config
116 # Install firmware config
117 install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
117 install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
118
118
119 # Disable Raspberry Pi console logo
119 # Disable Raspberry Pi console logo
120 if [ "$ENABLE_SLASH" = false ] ; then
120 if [ "$ENABLE_SPLASH" = false ] ; then
121 echo "disable_splash=1" >> "${BOOT_DIR}/config.txt"
121 echo "disable_splash=1" >> "${BOOT_DIR}/config.txt"
122 fi
122 fi
123
123
124 # Locks CPU frequency at maximum
124 # Locks CPU frequency at maximum
125 if [ "$ENABLE_TURBO" = true ] ; then
125 if [ "$ENABLE_TURBO" = true ] ; then
126 echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
126 echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
127 # helps to avoid sdcard corruption when force_turbo is enabled.
127 # helps to avoid sdcard corruption when force_turbo is enabled.
128 echo "boot_delay=1" >> "${BOOT_DIR}/config.txt"
128 echo "boot_delay=1" >> "${BOOT_DIR}/config.txt"
129 fi
129 fi
130
130
131 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; then
131 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; then
132
132
133 # Bluetooth enabled
133 # Bluetooth enabled
134 if [ "$ENABLE_BLUETOOTH" = true ] ; then
134 if [ "$ENABLE_BLUETOOTH" = true ] ; then
135 # Create temporary directory for Bluetooth sources
135 # Create temporary directory for Bluetooth sources
136 temp_dir=$(as_nobody mktemp -d)
136 temp_dir=$(as_nobody mktemp -d)
137
137
138 # Fetch Bluetooth sources
138 # Fetch Bluetooth sources
139 as_nobody git -C "${temp_dir}" clone "${BLUETOOTH_URL}"
139 as_nobody git -C "${temp_dir}" clone "${BLUETOOTH_URL}"
140
140
141 # Copy downloaded sources
141 # Copy downloaded sources
142 mv "${temp_dir}/pi-bluetooth" "${R}/tmp/"
142 mv "${temp_dir}/pi-bluetooth" "${R}/tmp/"
143
143
144 # Set permissions
144 # Set permissions
145 chown -R root:root "${R}/tmp/pi-bluetooth"
145 chown -R root:root "${R}/tmp/pi-bluetooth"
146
146
147 # Bluetooth firmware from arch aur https://aur.archlinux.org/packages/pi-bluetooth/
147 # Bluetooth firmware from arch aur https://aur.archlinux.org/packages/pi-bluetooth/
148 wget -q -O "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" https://aur.archlinux.org/cgit/aur.git/plain/LICENCE.broadcom_bcm43xx?h=pi-bluetooth
148 wget -q -O "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" https://aur.archlinux.org/cgit/aur.git/plain/LICENCE.broadcom_bcm43xx?h=pi-bluetooth
149 wget -q -O "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/master/broadcom/BCM43430A1.hcd
149 wget -q -O "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/master/broadcom/BCM43430A1.hcd
150
150
151 # Install tools
151 # Install tools
152 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
152 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
153 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
153 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
154
154
155 # make scripts executable
155 # make scripts executable
156 chmod +x "${R}/usr/bin/bthelper"
156 chmod +x "${R}/usr/bin/bthelper"
157 chmod +x "${R}/usr/bin/btuart"
157 chmod +x "${R}/usr/bin/btuart"
158
158
159 # Install bluetooth udev rule
159 # Install bluetooth udev rule
160 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
160 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
161
161
162 # Install Firmware Flash file and apropiate licence
162 # Install Firmware Flash file and apropiate licence
163 mkdir -p "$BLUETOOTH_FIRMWARE_DIR"
163 mkdir -p "$BLUETOOTH_FIRMWARE_DIR"
164 install_readonly "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
164 install_readonly "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
165 install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/BCM43430A1.hcd"
165 install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/BCM43430A1.hcd"
166 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
166 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
167 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
167 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
168
168
169 # Remove temporary directories
169 # Remove temporary directories
170 rm -fr "${temp_dir}"
170 rm -fr "${temp_dir}"
171 rm -fr "${R}"/tmp/pi-bluetooth
171 rm -fr "${R}"/tmp/pi-bluetooth
172
172
173 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
173 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
174 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
174 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
175 # set overlay to swap ttyAMA0 and ttyS0
175 # set overlay to swap ttyAMA0 and ttyS0
176 echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
176 echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
177
177
178 if [ "$ENABLE_TURBO" = false ] ; then
178 if [ "$ENABLE_TURBO" = false ] ; then
179 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
179 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
180 fi
180 fi
181
181
182 fi
182 fi
183
183
184 # Activate services
184 # Activate services
185 chroot_exec systemctl enable pi-bluetooth.hciuart.service
185 chroot_exec systemctl enable pi-bluetooth.hciuart.service
186
186
187 else # if ENABLE_BLUETOOTH = false
187 else # if ENABLE_BLUETOOTH = false
188 # set overlay to disable bluetooth
188 # set overlay to disable bluetooth
189 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
189 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
190 fi # ENABLE_BLUETOOTH end
190 fi # ENABLE_BLUETOOTH end
191 fi
191 fi
192
192
193 # may need sudo systemctl disable hciuart
193 # may need sudo systemctl disable hciuart
194 if [ "$ENABLE_CONSOLE" = true ] ; then
194 if [ "$ENABLE_CONSOLE" = true ] ; then
195 echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
195 echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
196 #More debug output on early but with serial console
197 echo "uart_2ndstage=1" >> "${BOOT_DIR}/config.txt"
198
196 # add string to cmdline
199 # add string to cmdline
197 CMDLINE="${CMDLINE} console=serial0,115200"
200 CMDLINE="${CMDLINE} console=serial0,115200"
198
201
199 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]|| [ "$RPI_MODEL" = 0 ]; then
202 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]|| [ "$RPI_MODEL" = 0 ]; then
200 # if force_turbo didn't lock cpu at high speed, lock it at low speed (XOR logic) or miniuart will be broken
203 # if force_turbo didn't lock cpu at high speed, lock it at low speed (XOR logic) or miniuart will be broken
201 if [ "$ENABLE_TURBO" = false ] ; then
204 if [ "$ENABLE_TURBO" = false ] ; then
202 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
205 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
203 fi
206 fi
204 fi
207 fi
205
208
206 # Enable serial console systemd style
209 # Enable serial console systemd style
207 chroot_exec systemctl enable serial-getty@serial0.service
210 chroot_exec systemctl enable serial-getty@serial0.service
208 else
211 else
209 echo "enable_uart=0" >> "${BOOT_DIR}/config.txt"
212 echo "enable_uart=0" >> "${BOOT_DIR}/config.txt"
210 fi
213 fi
211
214
212 # Disable dphys-swapfile service. Will get enabled on first boot
215 # Disable dphys-swapfile service. Will get enabled on first boot
213 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
216 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
214 chroot_exec systemctl disable dphys-swapfile
217 chroot_exec systemctl disable dphys-swapfile
215 fi
218 fi
216
219
217 if [ "$ENABLE_SYSTEMDSWAP" = true ] ; then
220 if [ "$ENABLE_SYSTEMDSWAP" = true ] ; then
218 # Create temporary directory for systemd-swap sources
221 # Create temporary directory for systemd-swap sources
219 temp_dir=$(as_nobody mktemp -d)
222 temp_dir=$(as_nobody mktemp -d)
220
223
221 # Fetch systemd-swap sources
224 # Fetch systemd-swap sources
222 as_nobody git -C "${temp_dir}" clone "${SYSTEMDSWAP_URL}"
225 as_nobody git -C "${temp_dir}" clone "${SYSTEMDSWAP_URL}"
223
226
224 # Copy downloaded systemd-swap sources
227 # Copy downloaded systemd-swap sources
225 mv "${temp_dir}/systemd-swap" "${R}/tmp/"
228 mv "${temp_dir}/systemd-swap" "${R}/tmp/"
226
229
227 # Change into downloaded src dir
230 # Change into downloaded src dir
228 cd "${R}/tmp/systemd-swap" || exit
231 cd "${R}/tmp/systemd-swap" || exit
229
232
230 # Get Verion
233 # Get Verion
231 VERSION=$(git tag | tail -n 1)
234 VERSION=$(git tag | tail -n 1)
232 #sed -i "s/DEB_NAME=.*/DEB_NAME=systemd-swap_all/g" "${R}/tmp/systemd-swap/package.sh"
235 #sed -i "s/DEB_NAME=.*/DEB_NAME=systemd-swap_all/g" "${R}/tmp/systemd-swap/package.sh"
233
236
234 # Build package
237 # Build package
235 bash ./package.sh debian
238 bash ./package.sh debian
236
239
237 # Change back into script root dir
240 # Change back into script root dir
238 cd "${WORKDIR}" || exit
241 cd "${WORKDIR}" || exit
239
242
240 # Set permissions of the systemd-swap sources
243 # Set permissions of the systemd-swap sources
241 chown -R root:root "${R}/tmp/systemd-swap"
244 chown -R root:root "${R}/tmp/systemd-swap"
242
245
243 # Install package - IMPROVE AND MAKE IT POSSIBLE WITHOUT VERSION NR.
246 # Install package - IMPROVE AND MAKE IT POSSIBLE WITHOUT VERSION NR.
244 chroot_exec dpkg -i /tmp/systemd-swap/systemd-swap_"$VERSION"_all.deb
247 chroot_exec dpkg -i /tmp/systemd-swap/systemd-swap_"$VERSION"_all.deb
245
248
246 # Enable service
249 # Enable service
247 chroot_exec systemctl enable systemd-swap
250 chroot_exec systemctl enable systemd-swap
248
251
249 # Remove temporary directory for systemd-swap sources
252 # Remove temporary directory for systemd-swap sources
250 rm -fr "${temp_dir}"
253 rm -fr "${temp_dir}"
251 else
254 else
252 # Enable ZSWAP in cmdline if systemd-swap is not used
255 # Enable ZSWAP in cmdline if systemd-swap is not used
253 if [ "$KERNEL_ZSWAP" = true ] ; then
256 if [ "$KERNEL_ZSWAP" = true ] ; then
254 CMDLINE="${CMDLINE} zswap.enabled=1 zswap.max_pool_percent=25 zswap.compressor=lz4"
257 CMDLINE="${CMDLINE} zswap.enabled=1 zswap.max_pool_percent=25 zswap.compressor=lz4"
255 fi
258 fi
256 fi
259 fi
257 if [ "$KERNEL_SECURITY" = true ] ; then
260 if [ "$KERNEL_SECURITY" = true ] ; then
258 CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
261 CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
259 fi
262 fi
260
263
261 # Install firmware boot cmdline
264 # Install firmware boot cmdline
262 echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
265 echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
263
266
264 # Setup minimal GPU memory allocation size: 16MB (no X)
267 # Setup minimal GPU memory allocation size: 16MB (no X)
265 if [ "$ENABLE_MINGPU" = true ] ; then
268 if [ "$ENABLE_MINGPU" = true ] ; then
266 echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
269 echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
267 fi
270 fi
268
271
269 # Setup boot with initramfs
272 # Setup boot with initramfs
270 if [ "$ENABLE_INITRAMFS" = true ] ; then
273 if [ "$ENABLE_INITRAMFS" = true ] ; then
271 echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
274 echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
272 fi
275 fi
273
276
274 # Create firmware configuration and cmdline symlinks
277 # Create firmware configuration and cmdline symlinks
275 ln -sf firmware/config.txt "${R}/boot/config.txt"
278 ln -sf firmware/config.txt "${R}/boot/config.txt"
276 ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
279 ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
277
280
278 # Install and setup kernel modules to load at boot
281 # Install and setup kernel modules to load at boot
279 mkdir -p "${LIB_DIR}/modules-load.d/"
282 mkdir -p "${LIB_DIR}/modules-load.d/"
280 install_readonly files/modules/rpi2.conf "${LIB_DIR}/modules-load.d/rpi2.conf"
283 install_readonly files/modules/rpi2.conf "${LIB_DIR}/modules-load.d/rpi2.conf"
281
284
282 # Load hardware random module at boot
285 # Load hardware random module at boot
283 if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
286 if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
284 sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${LIB_DIR}/modules-load.d/rpi2.conf"
287 sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${LIB_DIR}/modules-load.d/rpi2.conf"
285 fi
288 fi
286
289
287 # Load sound module at boot
290 # Load sound module at boot
288 if [ "$ENABLE_SOUND" = true ] ; then
291 if [ "$ENABLE_SOUND" = true ] ; then
289 sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
292 sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
290 else
293 else
291 echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
294 echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
292 fi
295 fi
293
296
294 # Enable I2C interface
297 # Enable I2C interface
295 if [ "$ENABLE_I2C" = true ] ; then
298 if [ "$ENABLE_I2C" = true ] ; then
296 echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
299 echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
297 sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${LIB_DIR}/modules-load.d/rpi2.conf"
300 sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${LIB_DIR}/modules-load.d/rpi2.conf"
298 sed -i "s/^# i2c-dev/i2c-dev/" "${LIB_DIR}/modules-load.d/rpi2.conf"
301 sed -i "s/^# i2c-dev/i2c-dev/" "${LIB_DIR}/modules-load.d/rpi2.conf"
299 fi
302 fi
300
303
301 # Enable SPI interface
304 # Enable SPI interface
302 if [ "$ENABLE_SPI" = true ] ; then
305 if [ "$ENABLE_SPI" = true ] ; then
303 echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
306 echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
304 echo "spi-bcm2708" >> "${LIB_DIR}/modules-load.d/rpi2.conf"
307 echo "spi-bcm2708" >> "${LIB_DIR}/modules-load.d/rpi2.conf"
305 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
308 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
306 sed -i "s/spi-bcm2708/spi-bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
309 sed -i "s/spi-bcm2708/spi-bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
307 fi
310 fi
308 fi
311 fi
309
312
310 # Disable RPi2/3 under-voltage warnings
313 # Disable RPi2/3 under-voltage warnings
311 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
314 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
312 echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
315 echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
313 fi
316 fi
314
317
315 # Install kernel modules blacklist
318 # Install kernel modules blacklist
316 mkdir -p "${ETC_DIR}/modprobe.d/"
319 mkdir -p "${ETC_DIR}/modprobe.d/"
317 install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
320 install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
318
321
319 # Install sysctl.d configuration files
322 # Install sysctl.d configuration files
320 install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
323 install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
Show file before | Show file after | Hide comments
@@ -1,136 +1,186
1 #
1 #
2 # Setup Networking
2 # Setup Networking
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup hostname
8 # Install and setup hostname
9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
10 sed -i "s/^RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hostname"
10 sed -i "s/^RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hostname"
11
11
12 # Install and setup hosts
12 # Install and setup hosts
13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
14 sed -i "s/RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hosts"
14 sed -i "s/RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hosts"
15
15
16 # Setup hostname entry with static IP
16 # Setup hostname entry with static IP
17 if [ "$NET_ADDRESS" != "" ] ; then
17 if [ "$NET_ETH_ADDRESS" != "" ] ; then
18 NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
18 NET_IP=$(echo "${NET_ETH_ADDRESS}" | cut -f 1 -d'/')
19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
20 fi
20 fi
21
21
22 # Remove IPv6 hosts
22 # Remove IPv6 hosts
23 if [ "$ENABLE_IPV6" = false ] ; then
23 if [ "$ENABLE_IPV6" = false ] ; then
24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
25 fi
25 fi
26
26
27 # Install hint about network configuration
27 # Install hint about network configuration
28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
29
29
30 # Install configuration for interface eth0
30 # Install configuration for interface eth0
31 install_readonly files/network/eth.network "${ETC_DIR}/systemd/network/eth.network"
31 install_readonly files/network/eth0.network "${ETC_DIR}/systemd/network/eth0.network"
32
32
33 if [ "$RPI_MODEL" = 3P ] ; then
33 if [ "$RPI_MODEL" = 3P ] ; then
34 printf "\n[Link]\nGenericReceiveOffload=off\nTCPSegmentationOffload=off\nGenericSegmentationOffload=off" >> "${ETC_DIR}/systemd/network/eth.network"
34 printf "\n[Link]\nGenericReceiveOffload=off\nTCPSegmentationOffload=off\nGenericSegmentationOffload=off" >> "${ETC_DIR}/systemd/network/eth0.network"
35 fi
35 fi
36
36
37 # Install configuration for interface wl*
37 # Install configuration for interface wl*
38 install_readonly files/network/wlan.network "${ETC_DIR}/systemd/network/wlan.network"
38 install_readonly files/network/wlan0.network "${ETC_DIR}/systemd/network/wlan0.network"
39
39
40 #always with dhcp since wpa_supplicant integration is missing
40 #always with dhcp since wpa_supplicant integration is missing
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan.network"
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan0.network"
42
42
43 if [ "$ENABLE_DHCP" = true ] ; then
43 if [ "$ENABLE_ETH_DHCP" = true ] ; then
44 # Enable DHCP configuration for interface eth0
44 # Enable DHCP configuration for interface eth0
45 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth.network"
45 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth0.network"
46
46
47 # Set DHCP configuration to IPv4 only
47 # Set DHCP configuration to IPv4 only
48 if [ "$ENABLE_IPV6" = false ] ; then
48 if [ "$ENABLE_IPV6" = false ] ; then
49 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth.network"
49 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth0.network"
50 sed '/IPv6PrivacyExtensions=true/d' "${ETC_DIR}/systemd/network/eth0.network"
50 fi
51 fi
51
52
52 else # ENABLE_DHCP=false
53 else # ENABLE_ETH_DHCP=false
53 # Set static network configuration for interface eth0
54 # Set static network configuration for interface eth0
54 sed -i\
55 if [ -n NET_ETH_ADDRESS ] && [ -n NET_ETH_GATEWAY ] && [ -n NET_ETH_DNS_1 ] ; then
55 -e "s|DHCP=.*|DHCP=no|"\
56 sed -i\
56 -e "s|Address=\$|Address=${NET_ADDRESS}|"\
57 -e "s|DHCP=.*|DHCP=no|"\
57 -e "s|Gateway=\$|Gateway=${NET_GATEWAY}|"\
58 -e "s|Address=\$|Address=${NET_ETH_ADDRESS}|"\
58 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_1}|"\
59 -e "s|Gateway=\$|Gateway=${NET_ETH_GATEWAY}|"\
59 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_2}|"\
60 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_ETH_DNS_1}|"\
60 -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
61 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_ETH_DNS_2}|"\
61 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
62 -e "s|Domains=\$|Domains=${NET_ETH_DNS_DOMAINS}|"\
62 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
63 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_ETH_NTP_1}|"\
63 "${ETC_DIR}/systemd/network/eth.network"
64 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_ETH_NTP_2}|"\
65 "${ETC_DIR}/systemd/network/eth0.network"
66 fi
64 fi
67 fi
65
68
66 # Remove empty settings from network configuration
67 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth.network"
68 # Remove empty settings from wlan configuration
69 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan.network"
70
69
71 # Move systemd network configuration if required by Debian release
72 mv -v "${ETC_DIR}/systemd/network/eth.network" "${LIB_DIR}/systemd/network/10-eth.network"
73 # If WLAN is enabled copy wlan configuration too
74 if [ "$ENABLE_WIRELESS" = true ] ; then
70 if [ "$ENABLE_WIRELESS" = true ] ; then
75 mv -v "${ETC_DIR}/systemd/network/wlan.network" "${LIB_DIR}/systemd/network/11-wlan.network"
71 if [ "$ENABLE_WIFI_DHCP" = true ] ; then
72 # Enable DHCP configuration for interface eth0
73 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan0.network"
74
75 # Set DHCP configuration to IPv4 only
76 if [ "$ENABLE_IPV6" = false ] ; then
77 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/wlan0.network"
78 sed '/IPv6PrivacyExtensions=true/d' "${ETC_DIR}/systemd/network/wlan0.network"
79 fi
80
81 else # ENABLE_WIFI_DHCP=false
82 # Set static network configuration for interface eth0
83 if [ -n NET_WIFI_ADDRESS ] && [ -n NET_WIFI_GATEWAY ] && [ -n NET_WIFI_DNS_1 ] ; then
84 sed -i\
85 -e "s|DHCP=.*|DHCP=no|"\
86 -e "s|Address=\$|Address=${NET_WIFI_ADDRESS}|"\
87 -e "s|Gateway=\$|Gateway=${NET_WIFI_GATEWAY}|"\
88 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_WIFI_DNS_1}|"\
89 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_WIFI_DNS_2}|"\
90 -e "s|Domains=\$|Domains=${NET_WIFI_DNS_DOMAINS}|"\
91 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_WIFI_NTP_1}|"\
92 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_WIFI_NTP_2}|"\
93 "${ETC_DIR}/systemd/network/wlan0.network"
94 fi
95 fi
96
97 if [ -z "$NET_WIFI_SSID" ] && [ -z "$NET_WIFI_PSK" ] ; then
98 printf "
99 ctrl_interface=/run/wpa_supplicant
100 ctrl_interface_group=wheel
101 update_config=1
102 eapol_version=1
103 ap_scan=1
104 fast_reauth=1
105
106 " > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
107
108 #Configure WPA_supplicant
109 chroot_exec wpa_passphrase "$NET_SSID" "$NET_WPAPSK" >> /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
110
111 chroot_exec systemctl enable wpa_supplicant.service
112 chroot_exec systemctl enable wpa_supplicant@wlan0.service
113 fi
114 # Remove empty settings from wlan configuration
115 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan0.network"
116 # If WLAN is enabled copy wlan configuration too
117 mv -v "${ETC_DIR}/systemd/network/wlan0.network" "${LIB_DIR}/systemd/network/11-wlan0.network"
76 fi
118 fi
119
120 # Remove empty settings from network configuration
121 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth0.network"
122
123 # Move systemd network configuration if required by Debian release
124 mv -v "${ETC_DIR}/systemd/network/eth0.network" "${LIB_DIR}/systemd/network/10-eth0.network"
125
126 #Clean up
77 rm -fr "${ETC_DIR}/systemd/network"
127 rm -fr "${ETC_DIR}/systemd/network"
78
128
79 # Enable systemd-networkd service
129 # Enable systemd-networkd service
80 chroot_exec systemctl enable systemd-networkd
130 chroot_exec systemctl enable systemd-networkd
81
131
82 # Install host.conf resolver configuration
132 # Install host.conf resolver configuration
83 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
133 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
84
134
85 # Enable network stack hardening
135 # Enable network stack hardening
86 if [ "$ENABLE_HARDNET" = true ] ; then
136 if [ "$ENABLE_HARDNET" = true ] ; then
87 # Install sysctl.d configuration files
137 # Install sysctl.d configuration files
88 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
138 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
89
139
90 # Setup resolver warnings about spoofed addresses
140 # Setup resolver warnings about spoofed addresses
91 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
141 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
92 fi
142 fi
93
143
94 # Enable time sync
144 # Enable time sync
95 if [ "$NET_NTP_1" != "" ] ; then
145 if [ "$NET_NTP_1" != "" ] ; then
96 chroot_exec systemctl enable systemd-timesyncd.service
146 chroot_exec systemctl enable systemd-timesyncd.service
97 fi
147 fi
98
148
99 # Download the firmware binary blob required to use the RPi3 wireless interface
149 # Download the firmware binary blob required to use the RPi3 wireless interface
100 if [ "$ENABLE_WIRELESS" = true ] ; then
150 if [ "$ENABLE_WIRELESS" = true ] ; then
101 if [ ! -d "${WLAN_FIRMWARE_DIR}" ] ; then
151 if [ ! -d "${WLAN_FIRMWARE_DIR}" ] ; then
102 mkdir -p "${WLAN_FIRMWARE_DIR}"
152 mkdir -p "${WLAN_FIRMWARE_DIR}"
103 fi
153 fi
104
154
105 # Create temporary directory for firmware binary blob
155 # Create temporary directory for firmware binary blob
106 temp_dir=$(as_nobody mktemp -d)
156 temp_dir=$(as_nobody mktemp -d)
107
157
108 # Fetch firmware binary blob for RPI3B+ or Pi4
158 # Fetch firmware binary blob for RPI3B+ or Pi4
109 if [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
159 if [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
110 # Fetch firmware binary blob for RPi3P
160 # Fetch firmware binary blob for RPi3P
111 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin"
161 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin"
112 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt"
162 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt"
113 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob"
163 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob"
114
164
115 # Move downloaded firmware binary blob
165 # Move downloaded firmware binary blob
116 mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
166 mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
117
167
118 # Set permissions of the firmware binary blob
168 # Set permissions of the firmware binary blob
119 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
169 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
120 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
170 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
121 elif [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 0 ] ; then
171 elif [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 0 ] ; then
122 # Fetch firmware binary blob for RPi3
172 # Fetch firmware binary blob for RPi3
123 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
173 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
124 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
174 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
125
175
126 # Move downloaded firmware binary blob
176 # Move downloaded firmware binary blob
127 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
177 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
128
178
129 # Set permissions of the firmware binary blob
179 # Set permissions of the firmware binary blob
130 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
180 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
131 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
181 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
132 fi
182 fi
133
183
134 # Remove temporary directory for firmware binary blob
184 # Remove temporary directory for firmware binary blob
135 rm -fr "${temp_dir}"
185 rm -fr "${temp_dir}"
136 fi
186 fi
Show file before | Show file after | Hide comments
@@ -1,54 +1,54
1 #
1 #
2 # Setup Firewall
2 # Setup Firewall
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ "$ENABLE_IPTABLES" = true ] ; then
8 if [ "$ENABLE_IPTABLES" = true ] ; then
9 # Create iptables configuration directory
9 # Create iptables configuration directory
10 mkdir -p "${ETC_DIR}/iptables"
10 mkdir -p "${ETC_DIR}/iptables"
11
11
12 if [ "$KERNEL_NF" = false ] ; then
12 if [ "$KERNEL_NF" = false ] ; then
13 # iptables-save and -restore are slaves of iptables and thus are set accordingly
13 # iptables-save and -restore are slaves of iptables and thus are set accordingly
14 chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy
14 chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy
15 fi
15 fi
16
16
17 # Install iptables systemd service
17 # Install iptables systemd service
18 install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
18 install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
19
19
20 # Install flush-table script called by iptables service
20 # Install flush-table script called by iptables service
21 install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
21 install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
22
22
23 # Install iptables rule file
23 # Install iptables rule file
24 install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
24 install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
25
25
26 # Reload systemd configuration and enable iptables service
26 # Reload systemd configuration and enable iptables service
27 chroot_exec systemctl daemon-reload
27 chroot_exec systemctl daemon-reload
28 chroot_exec systemctl enable iptables.service
28 chroot_exec systemctl enable iptables.service
29
29
30 if [ "$ENABLE_IPV6" = true ] ; then
30 if [ "$ENABLE_IPV6" = true ] ; then
31 if [ "$KERNEL_NF" = false ] ; then
31 if [ "$KERNEL_NF" = false ] ; then
32 # iptables-save and -restore are slaves of iptables and thus are set accordingly
32 # iptables-save and -restore are slaves of iptables and thus are set accordingly
33 chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
33 chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
34 fi
34 fi
35
35
36 # Install ip6tables systemd service
36 # Install ip6tables systemd service
37 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
37 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
38
38
39 # Install ip6tables file
39 # Install ip6tables file
40 install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
40 install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
41
41
42 install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
42 install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
43
43
44 # Reload systemd configuration and enable iptables service
44 # Reload systemd configuration and enable iptables service
45 chroot_exec systemctl daemon-reload
45 chroot_exec systemctl daemon-reload
46 chroot_exec systemctl enable ip6tables.service
46 chroot_exec systemctl enable ip6tables.service
47 fi
47 fi
48
48
49 if [ "$ENABLE_SSHD" = false ] ; then
49 if [ "$SSH_ENABLE" = false ] ; then
50 # Remove SSHD related iptables rules
50 # Remove SSHD related iptables rules
51 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
51 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
52 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
52 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
53 fi
53 fi
54 fi
54 fi
Show file before | Show file after | Hide comments
@@ -1,24 +1,24
1 #
1 #
2 # Setup users and security settings
2 # Setup users and security settings
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Generate crypt(3) password string
8 # Generate crypt(3) password string
9 ENCRYPTED_PASSWORD=$(mkpasswd -m sha-512 "${PASSWORD}")
9 ENCRYPTED_PASSWORD=$(mkpasswd -m sha-512 "${ROOT_PASSWORD}")
10 ENCRYPTED_USER_PASSWORD=$(mkpasswd -m sha-512 "${USER_PASSWORD}")
10 ENCRYPTED_USER_PASSWORD=$(mkpasswd -m sha-512 "${USER_PASSWORD}")
11
11
12 # Setup default user
12 # Setup default user
13 if [ "$ENABLE_USER" = true ] ; then
13 if [ "$ENABLE_USER" = true ] ; then
14 chroot_exec adduser --gecos "$USER_NAME" --add_extra_groups --disabled-password "$USER_NAME"
14 chroot_exec adduser --gecos "$USER_NAME" --add_extra_groups --disabled-password "$USER_NAME"
15 chroot_exec usermod -a -G sudo -p "${ENCRYPTED_USER_PASSWORD}" "$USER_NAME"
15 chroot_exec usermod -a -G sudo -p "${ENCRYPTED_USER_PASSWORD}" "$USER_NAME"
16 fi
16 fi
17
17
18 # Setup root password or not
18 # Setup root password or not
19 if [ "$ENABLE_ROOT" = true ] ; then
19 if [ "$ENABLE_ROOT" = true ] ; then
20 chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
20 chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
21 else
21 else
22 # Set no root password to disable root login
22 # Set no root password to disable root login
23 chroot_exec usermod -p \'!\' root
23 chroot_exec usermod -p \'!\' root
24 fi
24 fi
Show file before | Show file after | Hide comments
@@ -1,116 +1,116
1 #
1 #
2 # Setup SSH settings and public keys
2 # Setup SSH settings and public keys
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ "$ENABLE_SSHD" = true ] ; then
8 if [ "$SSH_ENABLE" = true ] ; then
9 DROPBEAR_ARGS=""
9 DROPBEAR_ARGS=""
10
10
11 if [ "$SSH_ENABLE_ROOT" = false ] ; then
11 if [ "$SSH_ENABLE_ROOT" = false ] ; then
12 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
12 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
13 # User root is not allowed to log in
13 # User root is not allowed to log in
14 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin no|g" "${ETC_DIR}/ssh/sshd_config"
14 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin no|g" "${ETC_DIR}/ssh/sshd_config"
15 else
15 else
16 # User root is not allowed to log in
16 # User root is not allowed to log in
17 DROPBEAR_ARGS="-w"
17 DROPBEAR_ARGS="-w"
18 fi
18 fi
19 fi
19 fi
20
20
21 if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
21 if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
22 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
22 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
23 # Permit SSH root login
23 # Permit SSH root login
24 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "${ETC_DIR}/ssh/sshd_config"
24 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "${ETC_DIR}/ssh/sshd_config"
25 else
25 else
26 # Permit SSH root login
26 # Permit SSH root login
27 DROPBEAR_ARGS=""
27 DROPBEAR_ARGS=""
28 fi
28 fi
29
29
30 # Add SSH (v2) public key for user root
30 # Add SSH (v2) public key for user root
31 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
31 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
32 # Create root SSH config directory
32 # Create root SSH config directory
33 mkdir -p "${R}/root/.ssh"
33 mkdir -p "${R}/root/.ssh"
34
34
35 # Set permissions of root SSH config directory
35 # Set permissions of root SSH config directory
36 chroot_exec chmod 700 "/root/.ssh"
36 chroot_exec chmod 700 "/root/.ssh"
37 chroot_exec chown root:root "/root/.ssh"
37 chroot_exec chown root:root "/root/.ssh"
38
38
39 # Add SSH (v2) public key(s) to authorized_keys file
39 # Add SSH (v2) public key(s) to authorized_keys file
40 cat "$SSH_ROOT_PUB_KEY" >> "${R}/root/.ssh/authorized_keys"
40 cat "$SSH_ROOT_PUB_KEY" >> "${R}/root/.ssh/authorized_keys"
41
41
42 # Set permissions of root SSH authorized_keys file
42 # Set permissions of root SSH authorized_keys file
43 chroot_exec chmod 600 "/root/.ssh/authorized_keys"
43 chroot_exec chmod 600 "/root/.ssh/authorized_keys"
44 chroot_exec chown root:root "/root/.ssh/authorized_keys"
44 chroot_exec chown root:root "/root/.ssh/authorized_keys"
45
45
46 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
46 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
47 # Allow SSH public key authentication
47 # Allow SSH public key authentication
48 sed -i "s|[#]*PubkeyAuthentication.*|PubkeyAuthentication yes|g" "${ETC_DIR}/ssh/sshd_config"
48 sed -i "s|[#]*PubkeyAuthentication.*|PubkeyAuthentication yes|g" "${ETC_DIR}/ssh/sshd_config"
49 fi
49 fi
50 fi
50 fi
51 fi
51 fi
52
52
53 if [ "$ENABLE_USER" = true ] ; then
53 if [ "$ENABLE_USER" = true ] ; then
54 # Add SSH (v2) public key for user $USER_NAME
54 # Add SSH (v2) public key for user $USER_NAME
55 if [ -n "$SSH_USER_PUB_KEY" ] ; then
55 if [ -n "$SSH_USER_PUB_KEY" ] ; then
56 # Create $USER_NAME SSH config directory
56 # Create $USER_NAME SSH config directory
57 mkdir -p "${R}/home/${USER_NAME}/.ssh"
57 mkdir -p "${R}/home/${USER_NAME}/.ssh"
58
58
59 # Set permissions of $USER_NAME SSH config directory
59 # Set permissions of $USER_NAME SSH config directory
60 chroot_exec chmod 700 "/home/${USER_NAME}/.ssh"
60 chroot_exec chmod 700 "/home/${USER_NAME}/.ssh"
61 chroot_exec chown "${USER_NAME}":"${USER_NAME}" "/home/${USER_NAME}/.ssh"
61 chroot_exec chown "${USER_NAME}":"${USER_NAME}" "/home/${USER_NAME}/.ssh"
62
62
63 # Add SSH (v2) public key(s) to authorized_keys file
63 # Add SSH (v2) public key(s) to authorized_keys file
64 cat "$SSH_USER_PUB_KEY" >> "${R}/home/${USER_NAME}/.ssh/authorized_keys"
64 cat "$SSH_USER_PUB_KEY" >> "${R}/home/${USER_NAME}/.ssh/authorized_keys"
65
65
66 # Set permissions of $USER_NAME SSH config directory
66 # Set permissions of $USER_NAME SSH config directory
67 chroot_exec chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys"
67 chroot_exec chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys"
68 chroot_exec chown "${USER_NAME}":"${USER_NAME}" "/home/${USER_NAME}/.ssh/authorized_keys"
68 chroot_exec chown "${USER_NAME}":"${USER_NAME}" "/home/${USER_NAME}/.ssh/authorized_keys"
69
69
70 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
70 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
71 # Allow SSH public key authentication
71 # Allow SSH public key authentication
72 sed -i "s|[#]*PubkeyAuthentication.*|PubkeyAuthentication yes|g" "${ETC_DIR}/ssh/sshd_config"
72 sed -i "s|[#]*PubkeyAuthentication.*|PubkeyAuthentication yes|g" "${ETC_DIR}/ssh/sshd_config"
73 fi
73 fi
74 fi
74 fi
75 fi
75 fi
76
76
77 # Limit the users that are allowed to login via SSH
77 # Limit the users that are allowed to login via SSH
78 if [ "$SSH_LIMIT_USERS" = true ] && [ "$ENABLE_REDUCE" = false ] ; then
78 if [ "$SSH_LIMIT_USERS" = true ] && [ "$ENABLE_REDUCE" = false ] ; then
79 allowed_users=""
79 allowed_users=""
80 if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
80 if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
81 allowed_users="root"
81 allowed_users="root"
82 fi
82 fi
83
83
84 if [ "$ENABLE_USER" = true ] ; then
84 if [ "$ENABLE_USER" = true ] ; then
85 allowed_users="${allowed_users} ${USER_NAME}"
85 allowed_users="${allowed_users} ${USER_NAME}"
86 fi
86 fi
87
87
88 if [ -n "$allowed_users" ] ; then
88 if [ -n "$allowed_users" ] ; then
89 echo "AllowUsers ${allowed_users}" >> "${ETC_DIR}/ssh/sshd_config"
89 echo "AllowUsers ${allowed_users}" >> "${ETC_DIR}/ssh/sshd_config"
90 fi
90 fi
91 fi
91 fi
92
92
93 # Disable password-based authentication
93 # Disable password-based authentication
94 if [ "$SSH_DISABLE_PASSWORD_AUTH" = true ] ; then
94 if [ "$SSH_DISABLE_PASSWORD_AUTH" = true ] ; then
95 if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
95 if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
96 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
96 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
97 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin without-password|g" "${ETC_DIR}/ssh/sshd_config"
97 sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin without-password|g" "${ETC_DIR}/ssh/sshd_config"
98 else
98 else
99 DROPBEAR_ARGS="-g"
99 DROPBEAR_ARGS="-g"
100 fi
100 fi
101 fi
101 fi
102
102
103 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
103 if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
104 sed -i "s|[#]*PasswordAuthentication.*|PasswordAuthentication no|g" "${ETC_DIR}/ssh/sshd_config"
104 sed -i "s|[#]*PasswordAuthentication.*|PasswordAuthentication no|g" "${ETC_DIR}/ssh/sshd_config"
105 sed -i "s|[#]*ChallengeResponseAuthentication no.*|ChallengeResponseAuthentication no|g" "${ETC_DIR}/ssh/sshd_config"
105 sed -i "s|[#]*ChallengeResponseAuthentication no.*|ChallengeResponseAuthentication no|g" "${ETC_DIR}/ssh/sshd_config"
106 sed -i "s|[#]*UsePAM.*|UsePAM no|g" "${ETC_DIR}/ssh/sshd_config"
106 sed -i "s|[#]*UsePAM.*|UsePAM no|g" "${ETC_DIR}/ssh/sshd_config"
107 else
107 else
108 DROPBEAR_ARGS="${DROPBEAR_ARGS} -s"
108 DROPBEAR_ARGS="${DROPBEAR_ARGS} -s"
109 fi
109 fi
110 fi
110 fi
111
111
112 # Update dropbear SSH configuration
112 # Update dropbear SSH configuration
113 if [ "$ENABLE_REDUCE" = true ] && [ "$REDUCE_SSHD" = true ] ; then
113 if [ "$ENABLE_REDUCE" = true ] && [ "$REDUCE_SSHD" = true ] ; then
114 sed "s|^DROPBEAR_EXTRA_ARGS=.*|DROPBEAR_EXTRA_ARGS=\"${DROPBEAR_ARGS}\"|g" "${ETC_DIR}/default/dropbear"
114 sed "s|^DROPBEAR_EXTRA_ARGS=.*|DROPBEAR_EXTRA_ARGS=\"${DROPBEAR_ARGS}\"|g" "${ETC_DIR}/default/dropbear"
115 fi
115 fi
116 fi No newline at end of file
116 fi
Show file before | Show file after | Hide comments
@@ -1,54 +1,63
1 #
1 #
2 # First boot actions
2 # First boot actions
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Prepare rc.firstboot script
8 # Prepare rc.firstboot script
9 cat files/firstboot/10-begin.sh > "${ETC_DIR}/rc.firstboot"
9 cat files/firstboot/10-begin.sh > "${ETC_DIR}/rc.firstboot"
10
10
11 # Prepare filesystem auto expand
11 # Prepare filesystem auto expand
12 if [ "$EXPANDROOT" = true ] ; then
12 if [ "$EXPANDROOT" = true ] ; then
13 if [ "$ENABLE_CRYPTFS" = false ] ; then
13 if [ "$ENABLE_CRYPTFS" = false ] ; then
14 cat files/firstboot/20-expandroot.sh >> "${ETC_DIR}/rc.firstboot"
14 cat files/firstboot/20-expandroot.sh >> "${ETC_DIR}/rc.firstboot"
15 else
15 else
16 # Regenerate initramfs to remove encrypted root partition auto expand
16 # Regenerate initramfs to remove encrypted root partition auto expand
17 cat files/firstboot/21-regenerate-initramfs.sh >> "${ETC_DIR}/rc.firstboot"
17 cat files/firstboot/21-regenerate-initramfs.sh >> "${ETC_DIR}/rc.firstboot"
18 fi
18 fi
19
19
20 # Restart dphys-swapfile so the size of the swap file is relative to the resized root partition
20 # Restart dphys-swapfile so the size of the swap file is relative to the resized root partition
21 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
21 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
22 cat files/firstboot/23-restart-dphys-swapfile.sh >> "${ETC_DIR}/rc.firstboot"
22 cat files/firstboot/23-restart-dphys-swapfile.sh >> "${ETC_DIR}/rc.firstboot"
23 fi
23 fi
24 fi
24 fi
25
25
26 # Ensure openssh server host keys are regenerated on first boot
26 # Ensure openssh server host keys are regenerated on first boot
27 if [ "$ENABLE_SSHD" = true ] ; then
27 if [ "$SSH_ENABLE" = true ] ; then
28 cat files/firstboot/30-generate-ssh-keys.sh >> "${ETC_DIR}/rc.firstboot"
28 cat files/firstboot/30-generate-ssh-keys.sh >> "${ETC_DIR}/rc.firstboot"
29 fi
29 fi
30
30
31 if [ "$ENABLE_DBUS" = true ] ; then
31 # Ensure that dbus machine-id exists
32 # Ensure that dbus machine-id exists
32 cat files/firstboot/40-generate-machineid.sh >> "${ETC_DIR}/rc.firstboot"
33 cat files/firstboot/40-generate-machineid.sh >> "${ETC_DIR}/rc.firstboot"
34 fi
33
35
34 # Create /etc/resolv.conf symlink
36 # Create /etc/resolv.conf symlink
35 cat files/firstboot/41-create-resolv-symlink.sh >> "${ETC_DIR}/rc.firstboot"
37 cat files/firstboot/41-create-resolv-symlink.sh >> "${ETC_DIR}/rc.firstboot"
36
38
37 # Configure automatic network interface names
39 # Configure automatic network interface names
38 if [ "$ENABLE_IFNAMES" = true ] ; then
40 if [ "$ENABLE_IFNAMES" = true ] ; then
39 cat files/firstboot/42-config-ifnames.sh >> "${ETC_DIR}/rc.firstboot"
41 cat files/firstboot/42-config-ifnames.sh >> "${ETC_DIR}/rc.firstboot"
40 fi
42 fi
41
43
44 # Execute custom firstboot scripts
45 if [ -d "custom.d/firstboot" ] ; then
46 for SCRIPT in custom.d/firstboot/*.sh; do
47 . "$SCRIPT"
48 done
49 fi
50
42 # Finalize rc.firstboot script
51 # Finalize rc.firstboot script
43 cat files/firstboot/99-finish.sh >> "${ETC_DIR}/rc.firstboot"
52 cat files/firstboot/99-finish.sh >> "${ETC_DIR}/rc.firstboot"
44 chmod +x "${ETC_DIR}/rc.firstboot"
53 chmod +x "${ETC_DIR}/rc.firstboot"
45
54
46 # Install default rc.local if it does not exist
55 # Install default rc.local if it does not exist
47 if [ ! -f "${ETC_DIR}/rc.local" ] ; then
56 if [ ! -f "${ETC_DIR}/rc.local" ] ; then
48 install_exec files/etc/rc.local "${ETC_DIR}/rc.local"
57 install_exec files/etc/rc.local "${ETC_DIR}/rc.local"
49 fi
58 fi
50
59
51 # Add rc.firstboot script to rc.local
60 # Add rc.firstboot script to rc.local
52 sed -i '/exit 0/d' "${ETC_DIR}/rc.local"
61 sed -i '/exit 0/d' "${ETC_DIR}/rc.local"
53 echo /etc/rc.firstboot >> "${ETC_DIR}/rc.local"
62 echo /etc/rc.firstboot >> "${ETC_DIR}/rc.local"
54 echo exit 0 >> "${ETC_DIR}/rc.local"
63 echo exit 0 >> "${ETC_DIR}/rc.local"
Show file before | Show file after | Hide comments
@@ -1,76 +1,98
1 #
1 #
2 # Reduce system disk usage
2 # Reduce system disk usage
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ "$ENABLE_IPV6" = false ] ; then
9 "$LIB_DIR"/xtables/libip6t_ah.so
10 "$LIB_DIR"/xtables/libip6t_dst.so
11 "$LIB_DIR"/xtables/libip6t_eui64.so
12 "$LIB_DIR"/xtables/libip6t_frag.so
13 "$LIB_DIR"/xtables/libip6t_hbh.so
14 "$LIB_DIR"/xtables/libip6t_hl.so
15 "$LIB_DIR"/xtables/libip6t_HL.so
16 "$LIB_DIR"/xtables/libip6t_icmp6.so
17 "$LIB_DIR"/xtables/libip6t_ipv6header.so
18 "$LIB_DIR"/xtables/libip6t_LOG.so
19 "$LIB_DIR"/xtables/libip6t_mh.so
20 "$LIB_DIR"/xtables/libip6t_REJECT.so
21 "$LIB_DIR"/xtables/libip6t_rt.so
22 "$LIB_DIR"/xtables/libip6t_DNAT.so
23 "$LIB_DIR"/xtables/libip6t_DNPT.so
24 "$LIB_DIR"/xtables/libip6t_MASQUERADE.so
25 "$LIB_DIR"/xtables/libip6t_NETMAP.so
26 "$LIB_DIR"/xtables/libip6t_REDIRECT.so
27 "$LIB_DIR"/xtables/libip6t_SNAT.so
28 "$LIB_DIR"/xtables/libip6t_SNPT.so
29 fi
8 # Reduce the image size by various operations
30 # Reduce the image size by various operations
9 if [ "$ENABLE_REDUCE" = true ] ; then
31 if [ "$ENABLE_REDUCE" = true ] ; then
10 if [ "$REDUCE_APT" = true ] ; then
32 if [ "$REDUCE_APT" = true ] ; then
11 # Install dpkg configuration file
33 # Install dpkg configuration file
12 if [ "$REDUCE_DOC" = true ] || [ "$REDUCE_MAN" = true ] ; then
34 if [ "$REDUCE_DOC" = true ] || [ "$REDUCE_MAN" = true ] ; then
13 install_readonly files/dpkg/01nodoc "${ETC_DIR}/dpkg/dpkg.cfg.d/01nodoc"
35 install_readonly files/dpkg/01nodoc "${ETC_DIR}/dpkg/dpkg.cfg.d/01nodoc"
14 fi
36 fi
15
37
16 # Install APT configuration files
38 # Install APT configuration files
17 install_readonly files/apt/02nocache "${ETC_DIR}/apt/apt.conf.d/02nocache"
39 install_readonly files/apt/02nocache "${ETC_DIR}/apt/apt.conf.d/02nocache"
18 install_readonly files/apt/03compress "${ETC_DIR}/apt/apt.conf.d/03compress"
40 install_readonly files/apt/03compress "${ETC_DIR}/apt/apt.conf.d/03compress"
19 install_readonly files/apt/04norecommends "${ETC_DIR}/apt/apt.conf.d/04norecommends"
41 install_readonly files/apt/04norecommends "${ETC_DIR}/apt/apt.conf.d/04norecommends"
20
42
21 # Remove APT cache files
43 # Remove APT cache files
22 rm -fr "${R}/var/cache/apt/pkgcache.bin"
44 rm -fr "${R}/var/cache/apt/pkgcache.bin"
23 rm -fr "${R}/var/cache/apt/srcpkgcache.bin"
45 rm -fr "${R}/var/cache/apt/srcpkgcache.bin"
24 fi
46 fi
25
47
26 # Remove all doc files
48 # Remove all doc files
27 if [ "$REDUCE_DOC" = true ] ; then
49 if [ "$REDUCE_DOC" = true ] ; then
28 find "${R}/usr/share/doc" -depth -type f ! -name copyright -print0 | xargs -0 rm || true
50 find "${R}/usr/share/doc" -depth -type f ! -name copyright -print0 | xargs -0 rm || true
29 find "${R}/usr/share/doc" -empty -print0 | xargs -0 rmdir || true
51 find "${R}/usr/share/doc" -empty -print0 | xargs -0 rmdir || true
30 fi
52 fi
31
53
32 # Remove all man pages and info files
54 # Remove all man pages and info files
33 if [ "$REDUCE_MAN" = true ] ; then
55 if [ "$REDUCE_MAN" = true ] ; then
34 rm -rf "${R}/usr/share/man" "${R}/usr/share/groff" "${R}/usr/share/info" "${R}/usr/share/lintian" "${R}/usr/share/linda" "${R}/var/cache/man"
56 rm -rf "${R}/usr/share/man" "${R}/usr/share/groff" "${R}/usr/share/info" "${R}/usr/share/lintian" "${R}/usr/share/linda" "${R}/var/cache/man"
35 fi
57 fi
36
58
37 # Remove all locale translation files
59 # Remove all locale translation files
38 if [ "$REDUCE_LOCALE" = true ] ; then
60 if [ "$REDUCE_LOCALE" = true ] ; then
39 find "${R}/usr/share/locale" -mindepth 1 -maxdepth 1 ! -name 'en' -print0 | xargs -0 rm -r
61 find "${R}/usr/share/locale" -mindepth 1 -maxdepth 1 ! -name 'en' -print0 | xargs -0 rm -r
40 fi
62 fi
41
63
42 # Remove hwdb PCI device classes (experimental)
64 # Remove hwdb PCI device classes (experimental)
43 if [ "$REDUCE_HWDB" = true ] ; then
65 if [ "$REDUCE_HWDB" = true ] ; then
44 rm -fr "/lib/udev/hwdb.d/20-pci-*"
66 rm -fr "/lib/udev/hwdb.d/20-pci-*"
45 fi
67 fi
46
68
47 # Replace bash shell by dash shell (experimental)
69 # Replace bash shell by dash shell (experimental)
48 if [ "$REDUCE_BASH" = true ] ; then
70 if [ "$REDUCE_BASH" = true ] ; then
49 # Purge bash and update alternatives
71 # Purge bash and update alternatives
50 echo "Yes, do as I say!" | chroot_exec apt-get purge -qq -y --allow-remove-essential bash
72 echo "Yes, do as I say!" | chroot_exec apt-get purge -qq -y --allow-remove-essential bash
51 chroot_exec update-alternatives --install /bin/bash bash /bin/dash 100
73 chroot_exec update-alternatives --install /bin/bash bash /bin/dash 100
52 fi
74 fi
53
75
54 # Remove sound utils and libraries
76 # Remove sound utils and libraries
55 if [ "$ENABLE_SOUND" = false ] ; then
77 if [ "$ENABLE_SOUND" = false ] ; then
56 chroot_exec apt-get -qq -y purge alsa-utils libsamplerate0 libasound2 libasound2-data
78 chroot_exec apt-get -qq -y purge alsa-utils libsamplerate0 libasound2 libasound2-data
57 fi
79 fi
58
80
59 # Remove GPU kernels
81 # Remove GPU kernels
60 if [ "$ENABLE_MINGPU" = true ] ; then
82 if [ "$ENABLE_MINGPU" = true ] ; then
61 rm -f "${BOOT_DIR}/start.elf"
83 rm -f "${BOOT_DIR}/start.elf"
62 rm -f "${BOOT_DIR}/fixup.dat"
84 rm -f "${BOOT_DIR}/fixup.dat"
63 rm -f "${BOOT_DIR}/start_x.elf"
85 rm -f "${BOOT_DIR}/start_x.elf"
64 rm -f "${BOOT_DIR}/fixup_x.dat"
86 rm -f "${BOOT_DIR}/fixup_x.dat"
65 fi
87 fi
66
88
67 # Remove kernel and initrd from /boot (already in /boot/firmware)
89 # Remove kernel and initrd from /boot (already in /boot/firmware)
68 if [ "$BUILD_KERNEL" = false ] ; then
90 if [ "$BUILD_KERNEL" = false ] ; then
69 rm -f "${R}/boot/vmlinuz-*"
91 rm -f "${R}/boot/vmlinuz-*"
70 rm -f "${R}/boot/initrd.img-*"
92 rm -f "${R}/boot/initrd.img-*"
71 fi
93 fi
72
94
73 # Clean APT list of repositories
95 # Clean APT list of repositories
74 rm -fr "${R}/var/lib/apt/lists/*"
96 rm -fr "${R}/var/lib/apt/lists/*"
75 chroot_exec apt-get -qq -y update
97 chroot_exec apt-get -qq -y update
76 fi
98 fi
Show file before | Show file after | Hide comments
@@ -1,13 +1,32
1 logger -t "rc.firstboot" "Configuring network interface name"
1 logger -t "rc.firstboot" "Configuring network interface name"
2
2
3 INTERFACE_NAME=$(dmesg | grep "renamed from eth0" | awk -F ":| " '{ print $9 }')
3 INTERFACE_NAME_ETH=$(dmesg | grep "renamed from eth0" | awk -F ":| " '{ print $9 }')
4 INTERFACE_NAME_WIFI=$(dmesg | grep "renamed from wlan0" | awk -F ":| " '{ print $9 }')
4
5
5 if [ ! -z INTERFACE_NAME ] ; then
6 if [ ! -z INTERFACE_NAME_ETH ] ; then
6 if [ -r "/etc/systemd/network/eth.network" ] ; then
7 if [ -r "/etc/systemd/network/eth0.network" ] ; then
7 sed -i "s/eth0/${INTERFACE_NAME}/" /etc/systemd/network/eth.network
8 sed -i "s/eth0/${INTERFACE_NAME_ETH}/" /etc/systemd/network/eth0.network
8 fi
9 fi
9
10
10 if [ -r "/lib/systemd/network/10-eth.network" ] ; then
11 if [ -r "/lib/systemd/network/10-eth0.network" ] ; then
11 sed -i "s/eth0/${INTERFACE_NAME}/" /lib/systemd/network/10-eth.network
12 sed -i "s/eth0/${INTERFACE_NAME_ETH}/" /lib/systemd/network/10-eth0.network
12 fi
13 fi
14 # Move config to new interface name
15 mv /etc/systemd/network/eth0.network /etc/systemd/network/"${INTERFACE_NAME_ETH}".network
16 fi
17
18 if [ ! -z INTERFACE_NAME_WIFI ] ; then
19 if [ -r "/etc/systemd/network/wlan0.network" ] ; then
20 sed -i "s/wlan0/${INTERFACE_NAME_WIFI}/" /etc/systemd/network/wlan0.network
21 fi
22
23 if [ -r "/lib/systemd/network/11-wlan0.network" ] ; then
24 sed -i "s/wlan0/${INTERFACE_NAME_WIFI}/" /lib/systemd/network/11-wlan0.network
25 fi
26 # Move config to new interface name
27 mv /etc/systemd/network/wlan0.network /etc/systemd/network/"${INTERFACE_NAME_WIFI}".network
28
29 systemctl disable wpa_supplicant@wlan0.service
30 systemctl enable wpa_supplicant@"${INTERFACE_NAME_WIFI}".service
31 systemctl start wpa_supplicant@"${INTERFACE_NAME_WIFI}".service
13 fi
32 fi
Show file before | Show file after | Hide comments
@@ -1,897 +1,920
1 #!/bin/sh
1 #!/bin/sh
2 ########################################################################
2 ########################################################################
3 # rpi23-gen-image.sh 2015-2017
3 # rpi23-gen-image.sh 2015-2017
4 #
4 #
5 # Advanced Debian "buster" and "bullseye" bootstrap script for Raspberry Pi
5 # Advanced Debian "buster" and "bullseye" bootstrap script for Raspberry Pi
6 #
6 #
7 # This program is free software; you can redistribute it and/or
7 # This program is free software; you can redistribute it and/or
8 # modify it under the terms of the GNU General Public License
8 # modify it under the terms of the GNU General Public License
9 # as published by the Free Software Foundation; either version 2
9 # as published by the Free Software Foundation; either version 2
10 # of the License, or (at your option) any later version.
10 # of the License, or (at your option) any later version.
11 #
11 #
12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 #
13 #
14 # Big thanks for patches and enhancements by 20+ github contributors!
14 # Big thanks for patches and enhancements by 20+ github contributors!
15 ########################################################################
15 ########################################################################
16
16
17 # Are we running as root?
17 # Are we running as root?
18 if [ "$(id -u)" -ne "0" ] ; then
18 if [ "$(id -u)" -ne "0" ] ; then
19 echo "error: this script must be executed with root privileges!"
19 echo "error: this script must be executed with root privileges!"
20 exit 1
20 exit 1
21 fi
21 fi
22
22
23 # Check if ./functions.sh script exists
23 # Check if ./functions.sh script exists
24 if [ ! -r "./functions.sh" ] ; then
24 if [ ! -r "./functions.sh" ] ; then
25 echo "error: './functions.sh' required script not found!"
25 echo "error: './functions.sh' required script not found!"
26 exit 1
26 exit 1
27 fi
27 fi
28
28
29 # Load utility functions
29 # Load utility functions
30 . ./functions.sh
30 . ./functions.sh
31
31
32 # Load parameters from configuration template file
32 # Load parameters from configuration template file
33 if [ -n "$CONFIG_TEMPLATE" ] ; then
33 if [ -n "$CONFIG_TEMPLATE" ] ; then
34 use_template
34 use_template
35 fi
35 fi
36
36
37 # Introduce settings
37 # Introduce settings
38 set -e
38 set -e
39 echo -n -e "\n#\n# RPi 0/1/2/3/4 Bootstrap Settings\n#\n"
39 echo -n -e "\n#\n# RPi 0/1/2/3/4 Bootstrap Settings\n#\n"
40 set -x
40 set -x
41
41
42 # Raspberry Pi model configuration
42 # Raspberry Pi model configuration
43 RPI_MODEL=${RPI_MODEL:=3}
43 RPI_MODEL=${RPI_MODEL:=3P}
44
44
45 # Debian release
45 # Debian release
46 RELEASE=${RELEASE:=buster}
46 RELEASE=${RELEASE:=buster}
47 if [ $RELEASE = "bullseye" ] ; then
47 if [ $RELEASE = "bullseye" ] ; then
48 RELEASE=testing
48 RELEASE=testing
49 fi
49 fi
50
50
51 # Kernel Branch
51 # Kernel Branch
52 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
52 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
53
53
54 # URLs
54 # URLs
55 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
55 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
56 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
56 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
57 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
57 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
58 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
58 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
59 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
59 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
60 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
60 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
61 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
61 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
62 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
62 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
63 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
63 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
64
64
65 # Kernel deb packages for 32bit kernel
65 # Kernel deb packages for 32bit kernel
66 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
66 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
67 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
67 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
68 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
68 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
69 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.19.80.20191022/bcmrpi3-kernel-bis-4.19.80.20191022.tar.xz}
69 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.19.102.20200211/bcmrpi3-kernel-bis-4.19.102.20200211.tar.xz}
70 # Default precompiled 64bit kernel
70 # Default precompiled 64bit kernel
71 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.19.80.20191022/bcmrpi3-kernel-4.19.80.20191022.tar.xz}
71 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.19.102.20200211/bcmrpi3-kernel-4.19.102.20200211.tar.xz}
72 # Sakaki BIS Kernel RPI4 - https://github.com/sakaki-/bcm2711-kernel-bis
72 # Sakaki BIS Kernel RPI4 - https://github.com/sakaki-/bcm2711-kernel-bis
73 RPI4_64_BIS_KERNEL_URL=${RPI4_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
73 RPI4_64_BIS_KERNEL_URL=${RPI4_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.102.20200211/bcm2711-kernel-bis-4.19.102.20200211.tar.xz}
74 # Default precompiled 64bit kernel - https://github.com/sakaki-/bcm2711-kernel
74 # Default precompiled 64bit kernel - https://github.com/sakaki-/bcm2711-kernel
75 RPI4_64_DEF_KERNEL_URL=${RPI4_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
75 RPI4_64_DEF_KERNEL_URL=${RPI4_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.102.20200211/bcm2711-kernel-bis-4.19.102.20200211.tar.xz}
76 # Generic
76 # Generic
77 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
77 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
78 RPI4_64_KERNEL_URL=${RPI4_64_KERNEL_URL:=$RPI4_64_DEF_KERNEL_URL}
78 RPI4_64_KERNEL_URL=${RPI4_64_KERNEL_URL:=$RPI4_64_DEF_KERNEL_URL}
79 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
79 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
80 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
80 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
81
81
82 # Build directories
82 # Build directories
83 WORKDIR=$(pwd)
83 WORKDIR=$(pwd)
84 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
84 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
85 BUILDDIR="${BASEDIR}/build"
85 BUILDDIR="${BASEDIR}/build"
86
86
87 # Chroot directories
87 # Chroot directories
88 R="${BUILDDIR}/chroot"
88 R="${BUILDDIR}/chroot"
89 ETC_DIR="${R}/etc"
89 ETC_DIR="${R}/etc"
90 LIB_DIR="${R}/lib"
90 LIB_DIR="${R}/lib"
91 BOOT_DIR="${R}/boot/firmware"
91 BOOT_DIR="${R}/boot/firmware"
92 KERNEL_DIR="${R}/usr/src/linux"
92 KERNEL_DIR="${R}/usr/src/linux"
93 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
93 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
94 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
94 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
95
95
96 # Firmware directory: Blank if download from github
96 # APT settings
97 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
97 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
98 APT_PROXY=${APT_PROXY:=""}
99 KEEP_APT_PROXY=${KEEP_APT_PROXY:=false}
100 # Packages required in the chroot build environment
101 APT_INCLUDES=${APT_INCLUDES:=""}
102 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
103 # Packages to exclude from chroot build environment
104 APT_EXCLUDES=${APT_EXCLUDES:=""}
98
105
99 # General settings
106 # General settings
100 SET_ARCH=${SET_ARCH:=32}
107 SET_ARCH=${SET_ARCH:=32}
101 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
108 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
102 PASSWORD=${PASSWORD:=raspberry}
103 USER_PASSWORD=${USER_PASSWORD:=raspberry}
104 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
109 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
105 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
110 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
106 EXPANDROOT=${EXPANDROOT:=true}
111 EXPANDROOT=${EXPANDROOT:=true}
107 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
112
113 ENABLE_ROOT=${ENABLE_ROOT:=false}
114 ROOT_PASSWORD=${ROOT_PASSWORD:=raspberry}
115 ENABLE_USER=${ENABLE_USER:=true}
116 USER_NAME=${USER_NAME:="pi"}
117 USER_PASSWORD=${USER_PASSWORD:=raspberry}
108
118
109 # Keyboard settings
119 # Keyboard settings
110 XKB_MODEL=${XKB_MODEL:=""}
120 XKB_MODEL=${XKB_MODEL:=""}
111 XKB_LAYOUT=${XKB_LAYOUT:=""}
121 XKB_LAYOUT=${XKB_LAYOUT:=""}
112 XKB_VARIANT=${XKB_VARIANT:=""}
122 XKB_VARIANT=${XKB_VARIANT:=""}
113 XKB_OPTIONS=${XKB_OPTIONS:=""}
123 XKB_OPTIONS=${XKB_OPTIONS:=""}
114
124
125 # Networking settings:
126 ENABLE_IPV6=${ENABLE_IPV6:=true}
127 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
128 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
129 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
130 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
131
115 # Network settings (DHCP)
132 # Network settings (DHCP)
116 ENABLE_DHCP=${ENABLE_DHCP:=true}
133 ENABLE_ETH_DHCP=${ENABLE_ETH_DHCP:=true}
134 ENABLE_WIFI_DHCP=${ENABLE_ETH_DHCP:=true}
117
135
118 # Network settings (static)
136 # Network settings (static)
119 NET_ADDRESS=${NET_ADDRESS:=""}
137 NET_ETH_ADDRESS=${NET_ETH_ADDRESS:=""}
120 NET_GATEWAY=${NET_GATEWAY:=""}
138 NET_ETH_GATEWAY=${NET_ETH_GATEWAY:=""}
121 NET_DNS_1=${NET_DNS_1:=""}
139 NET_ETH_DNS_1=${NET_ETH_DNS_1:=""}
122 NET_DNS_2=${NET_DNS_2:=""}
140 NET_ETH_DNS_2=${NET_ETH_DNS_2:=""}
123 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
141 NET_ETH_DNS_DOMAINS=${NET_ETH_DNS_DOMAINS:=""}
124 NET_NTP_1=${NET_NTP_1:=""}
142 NET_ETH_NTP_1=${NET_ETH_NTP_1:=""}
125 NET_NTP_2=${NET_NTP_2:=""}
143 NET_ETH_NTP_2=${NET_ETH_NTP_2:=""}
144
145 # Networking settings (WIFI):
146 NET_WIFI_SSID=${NET_WIFI_SSID:=""}
147 NET_WIFI_PSK=${NET_WIFI_PSK:=""}
126
148
127 # APT settings
149 # Network settings (static)
128 APT_PROXY=${APT_PROXY:=""}
150 NET_WIFI_ADDRESS=${NET_WIFI_ADDRESS:=""}
129 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
151 NET_WIFI_GATEWAY=${NET_WIFI_GATEWAY:=""}
130 KEEP_APT_PROXY=${KEEP_APT_PROXY:=false}
152 NET_WIFI_DNS_1=${NET_WIFI_DNS_1:=""}
153 NET_WIFI_DNS_2=${NET_WIFI_DNS_2:=""}
154 NET_WIFI_DNS_DOMAINS=${NET_WIFI_DNS_DOMAINS:=""}
155 NET_WIFI_NTP_1=${NET_WIFI_NTP_1:=""}
156 NET_WIFI_NTP_2=${NET_WIFI_NTP_2:=""}
131
157
132 # Feature settings
158 # Feature settings
159 ENABLE_CONSOLE=${ENABLE_CONSOLE:=false}
133 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
160 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
134 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
161 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
135 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
162 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
136 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
163 ENABLE_TURBO=${ENABLE_TURBO:=false}
137 ENABLE_I2C=${ENABLE_I2C:=false}
164 ENABLE_I2C=${ENABLE_I2C:=false}
138 ENABLE_SPI=${ENABLE_SPI:=false}
165 ENABLE_SPI=${ENABLE_SPI:=false}
139 ENABLE_IPV6=${ENABLE_IPV6:=true}
166
140 ENABLE_SSHD=${ENABLE_SSHD:=true}
141 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
167 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
142 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
168 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
143 ENABLE_SOUND=${ENABLE_SOUND:=true}
169 ENABLE_SOUND=${ENABLE_SOUND:=false}
144 ENABLE_DBUS=${ENABLE_DBUS:=true}
145 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
170 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
146 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
171 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
147 ENABLE_XORG=${ENABLE_XORG:=false}
172 ENABLE_XORG=${ENABLE_XORG:=false}
148 ENABLE_WM=${ENABLE_WM:=""}
173 ENABLE_WM=${ENABLE_WM:=""}
149 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
150 ENABLE_USER=${ENABLE_USER:=true}
151 USER_NAME=${USER_NAME:="pi"}
152 ENABLE_ROOT=${ENABLE_ROOT:=false}
153 ENABLE_QEMU=${ENABLE_QEMU:=false}
154 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
174 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
155
175 ENABLE_SPLASH=${ENABLE_SPLASH:=true}
156 # SSH settings
176 ENABLE_LOGO=${ENABLE_LOGO:=true}
157 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
177 ENABLE_SILENT_BOOT=${ENABLE_SILENT_BOOT=false}
158 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
178 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
159 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
160 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
161 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
162
179
163 # Advanced settings
180 # Advanced settings
181 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
164 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
182 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
183 ENABLE_QEMU=${ENABLE_QEMU:=false}
184 ENABLE_KEYGEN=${ENABLE_KEYGEN:=false}
165 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
185 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
166 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
186 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
187 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
188 ENABLE_DBUS=${ENABLE_DBUS:=true}
189 ENABLE_USBBOOT=${ENABLE_USBBOOT=false}
190 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
167 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
191 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
168 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
192 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
169 ENABLE_USBBOOT=${ENABLE_USBBOOT=false}
170 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
193 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
194 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
171 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
195 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
172 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
173 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
196 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
174 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
197 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
175 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
198 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
176 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
199
177 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
200 # SSH settings
178 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
201 SSH_ENABLE=${SSH_ENABLE:=true}
179 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
202 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
180 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
203 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
181 ENABLE_SPLASH=${ENABLE_SPLASH:=true}
204 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
182 ENABLE_LOGO=${ENABLE_LOGO:=true}
205 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
183 ENABLE_SILENT_BOOT=${ENABLE_SILENT_BOOT=false}
206 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
184 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
185
207
186 # Kernel compilation settings
208 # Kernel compilation settings
187 BUILD_KERNEL=${BUILD_KERNEL:=true}
209 BUILD_KERNEL=${BUILD_KERNEL:=true}
188 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
189 KERNEL_THREADS=${KERNEL_THREADS:=1}
210 KERNEL_THREADS=${KERNEL_THREADS:=1}
190 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
211 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
191 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
212 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
192 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
193 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
213 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
194 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
214 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
195 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
215 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
216 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
217 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
218 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
219 KERNELSRC_USRCONFIG=${KERNELSRC_USRCONFIG:=""}
220 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
221 # Firmware directory: Blank if download from github
222 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
223 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=ondemand}
224 KERNEL_NF=${KERNEL_NF:=false}
196 KERNEL_VIRT=${KERNEL_VIRT:=false}
225 KERNEL_VIRT=${KERNEL_VIRT:=false}
226 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
197 KERNEL_BPF=${KERNEL_BPF:=false}
227 KERNEL_BPF=${KERNEL_BPF:=false}
198 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=ondemand}
199 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
228 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
200 KERNEL_NF=${KERNEL_NF:=false}
201 KERNEL_DHKEY=${KERNEL_DHKEY:=true}
202 KERNEL_BTRFS=${KERNEL_BTRFS:=false}
229 KERNEL_BTRFS=${KERNEL_BTRFS:=false}
203 KERNEL_NSPAN=${KERNEL_NSPAN:=false}
204 KERNEL_POEHAT=${KERNEL_POEHAT:=false}
230 KERNEL_POEHAT=${KERNEL_POEHAT:=false}
205
231 KERNEL_NSPAN=${KERNEL_NSPAN:=false}
206 # Kernel compilation from source directory settings
232 KERNEL_DHKEY=${KERNEL_DHKEY:=true}
207 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
208 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
209 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
210 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
211
233
212 # Reduce disk usage settings
234 # Reduce disk usage settings
235 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
213 REDUCE_APT=${REDUCE_APT:=true}
236 REDUCE_APT=${REDUCE_APT:=true}
214 REDUCE_DOC=${REDUCE_DOC:=true}
237 REDUCE_DOC=${REDUCE_DOC:=false}
215 REDUCE_MAN=${REDUCE_MAN:=true}
238 REDUCE_MAN=${REDUCE_MAN:=false}
216 REDUCE_VIM=${REDUCE_VIM:=false}
239 REDUCE_VIM=${REDUCE_VIM:=false}
217 REDUCE_BASH=${REDUCE_BASH:=false}
240 REDUCE_BASH=${REDUCE_BASH:=false}
218 REDUCE_HWDB=${REDUCE_HWDB:=true}
241 REDUCE_HWDB=${REDUCE_HWDB:=false}
219 REDUCE_SSHD=${REDUCE_SSHD:=true}
242 REDUCE_SSHD=${REDUCE_SSHD:=false}
220 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
243 REDUCE_LOCALE=${REDUCE_LOCALE:=false}
244 REDUCE_KERNEL=${REDUCE_KERNEL:=false}
221
245
222 # Encrypted filesystem settings
246 # Encrypted filesystem settings
223 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
247 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
224 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
248 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
225 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
249 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
226 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64"}
250 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64"}
227 CRYPTFS_HASH=${CRYPTFS_HASH:="sha512"}
251 CRYPTFS_HASH=${CRYPTFS_HASH:="sha256"}
228 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
252 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=256}
229 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
253 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
230 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
254 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
231 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
255 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
232 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
256 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
233
257
234 # Chroot scripts directory
235 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
236
237 # Packages required in the chroot build environment
238 APT_INCLUDES=${APT_INCLUDES:=""}
239 APT_INCLUDES="${APT_INCLUDES},flex,bison,libssl-dev,apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
240
241 # Packages to exclude from chroot build environment
242 APT_EXCLUDES=${APT_EXCLUDES:=""}
243
244 # Packages required for bootstrapping
258 # Packages required for bootstrapping
245 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus bison flex libssl-dev sudo"
259 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus bison flex libssl-dev sudo"
246 MISSING_PACKAGES=""
260 MISSING_PACKAGES=""
247
261
248 # Packages installed for c/c++ build environment in chroot (keep empty)
262 # Packages installed for c/c++ build environment in chroot (keep empty)
249 COMPILER_PACKAGES=""
263 COMPILER_PACKAGES=""
250
264
251 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
265 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
252 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
266 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
253 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
267 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
254 APT_PROXY=http://127.0.0.1:3142/
268 APT_PROXY=http://127.0.0.1:3142/
255 fi
269 fi
256
270
257 # Setup architecture specific settings
271 # Setup architecture specific settings
258 if [ -n "$SET_ARCH" ] ; then
272 if [ -n "$SET_ARCH" ] ; then
259 # 64-bit configuration
273 # 64-bit configuration
260 if [ "$SET_ARCH" = 64 ] ; then
274 if [ "$SET_ARCH" = 64 ] ; then
261 # General 64-bit depended settings
275 # General 64-bit depended settings
262 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
276 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
263 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
277 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
264 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
278 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
265
279
266 # Raspberry Pi model specific settings
280 # Raspberry Pi model specific settings
267 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
281 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
268 if [ "$RPI_MODEL" != 4 ] ; then
282 if [ "$RPI_MODEL" != 4 ] ; then
269 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
283 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
270 else
284 else
271 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
285 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
272 fi
286 fi
273
287
274 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
288 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
275 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
289 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
276 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
290 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
277 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
291 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
278 else
292 else
279 echo "error: Only Raspberry PI 3, 3B+ and 4 support 64-bit"
293 echo "error: Only Raspberry PI 3, 3B+ and 4 support 64-bit"
280 exit 1
294 exit 1
281 fi
295 fi
282 fi
296 fi
283
297
284 # 32-bit configuration
298 # 32-bit configuration
285 if [ "$SET_ARCH" = 32 ] ; then
299 if [ "$SET_ARCH" = 32 ] ; then
286 # General 32-bit dependend settings
300 # General 32-bit dependend settings
287 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
301 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
288 KERNEL_ARCH=${KERNEL_ARCH:=arm}
302 KERNEL_ARCH=${KERNEL_ARCH:=arm}
289 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
303 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
290
304
291 # Raspberry Pi model specific settings
305 # Raspberry Pi model specific settings
292 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
306 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
293 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
307 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
294 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
308 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
295 RELEASE_ARCH=${RELEASE_ARCH:=armel}
309 RELEASE_ARCH=${RELEASE_ARCH:=armel}
296 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
310 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
297 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
311 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
298 fi
299
312
313 if [ $ENABLE_XORG = true ] ; then
314 if [$RELEASE = "stretch" ] || [$RELEASE = "oldstable" ] ; then
315 printf "\nBest support for armel architecture is provided under Debian stretch/oldstable. Choose yes to change release to Debian stretch[y/n] "
316 read -r confirm
317 if [ "$confirm" = "y" ] ; then
318 $RELEASE = "stretch"
319 fi
320 fi
321 fi
322 fi
300 # Raspberry Pi model specific settings
323 # Raspberry Pi model specific settings
301 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
324 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
302 if [ "$RPI_MODEL" != 4 ] ; then
325 if [ "$RPI_MODEL" != 4 ] ; then
303 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
326 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
304 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
327 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
305 else
328 else
306 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
329 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
307 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7l.img}
330 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7l.img}
308 fi
331 fi
309
332
310 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
333 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
311 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
334 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
312
335
313 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
336 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
314 fi
337 fi
315 fi
338 fi
316 # SET_ARCH not set
339 # SET_ARCH not set
317 else
340 else
318 echo "error: Please set '32' or '64' as value for SET_ARCH"
341 echo "error: Please set '32' or '64' as value for SET_ARCH"
319 exit 1
342 exit 1
320 fi
343 fi
321 # Device specific configuration and U-Boot configuration
344 # Device specific configuration and U-Boot configuration
322 case "$RPI_MODEL" in
345 case "$RPI_MODEL" in
323 0)
346 0)
324 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
347 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
325 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
348 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
326 ;;
349 ;;
327 1)
350 1)
328 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
351 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
329 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
352 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
330 ;;
353 ;;
331 1P)
354 1P)
332 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
355 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
333 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
356 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
334 ;;
357 ;;
335 2)
358 2)
336 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
359 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
337 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
360 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
338 ;;
361 ;;
339 3)
362 3)
340 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
363 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
341 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
364 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
342 ;;
365 ;;
343 3P)
366 3P)
344 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
367 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
345 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
368 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
346 ;;
369 ;;
347 4)
370 4)
348 DTB_FILE=${DTB_FILE:=bcm2711-rpi-4-b.dtb}
371 DTB_FILE=${DTB_FILE:=bcm2711-rpi-4-b.dtb}
349 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_4_defconfig}
372 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_4_defconfig}
350 ;;
373 ;;
351 *)
374 *)
352 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
375 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
353 exit 1
376 exit 1
354 ;;
377 ;;
355 esac
378 esac
356
379
357 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
380 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
358 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
381 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
359 # Include bluetooth packages on supported boards
382 # Include bluetooth packages on supported boards
360 if [ "$ENABLE_BLUETOOTH" = true ] ; then
383 if [ "$ENABLE_BLUETOOTH" = true ] ; then
361 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
384 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
362 fi
385 fi
363 if [ "$ENABLE_WIRELESS" = true ] ; then
386 if [ "$ENABLE_WIRELESS" = true ] ; then
364 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
387 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb,wpasupplicant"
365 fi
388 fi
366 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
389 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
367 # Check if the internal wireless interface is not supported by the RPi model
390 # Check if the internal wireless interface is not supported by the RPi model
368 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
391 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
369 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
392 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
370 exit 1
393 exit 1
371 fi
394 fi
372 fi
395 fi
373
396
374 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
397 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
375 echo "error: You have to compile kernel sources, if you want to enable nexmon"
398 echo "error: You have to compile kernel sources, if you want to enable nexmon"
376 exit 1
399 exit 1
377 fi
400 fi
378
401
379 # Prepare date string for default image file name
402 # Prepare date string for default image file name
380 DATE="$(date +%Y-%m-%d)"
403 DATE="$(date +%Y-%m-%d)"
381 if [ -z "$KERNEL_BRANCH" ] ; then
404 if [ -z "$KERNEL_BRANCH" ] ; then
382 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
405 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
383 else
406 else
384 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
407 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
385 fi
408 fi
386
409
387 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
410 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
388 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
411 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
389 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
412 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
390 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
413 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
391 exit 1
414 exit 1
392 fi
415 fi
393 fi
416 fi
394
417
395 # Add cmake to compile videocore sources
418 # Add cmake to compile videocore sources
396 if [ "$ENABLE_VIDEOCORE" = true ] ; then
419 if [ "$ENABLE_VIDEOCORE" = true ] ; then
397 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
420 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
398 fi
421 fi
399
422
400 # Add deps for nexmon
423 # Add deps for nexmon
401 if [ "$ENABLE_NEXMON" = true ] ; then
424 if [ "$ENABLE_NEXMON" = true ] ; then
402 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf make autoconf automake build-essential libtool"
425 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf make autoconf automake build-essential libtool"
403 fi
426 fi
404
427
405 # Add libncurses5 to enable kernel menuconfig
428 # Add libncurses5 to enable kernel menuconfig
406 if [ "$KERNEL_MENUCONFIG" = true ] ; then
429 if [ "$KERNEL_MENUCONFIG" = true ] ; then
407 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
430 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
408 fi
431 fi
409
432
410 # Add ccache compiler cache for (faster) kernel cross (re)compilation
433 # Add ccache compiler cache for (faster) kernel cross (re)compilation
411 if [ "$KERNEL_CCACHE" = true ] ; then
434 if [ "$KERNEL_CCACHE" = true ] ; then
412 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
435 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
413 fi
436 fi
414
437
415 # Add cryptsetup package to enable filesystem encryption
438 # Add cryptsetup package to enable filesystem encryption
416 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
439 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
417 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
440 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
418 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup,cryptsetup-initramfs"
441 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup,cryptsetup-initramfs"
419
442
420 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
443 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
421 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
444 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
422 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
445 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
423 fi
446 fi
424
447
425 if [ -z "$CRYPTFS_PASSWORD" ] ; then
448 if [ -z "$CRYPTFS_PASSWORD" ] ; then
426 echo "error: no password defined (CRYPTFS_PASSWORD)!"
449 echo "error: no password defined (CRYPTFS_PASSWORD)!"
427 exit 1
450 exit 1
428 fi
451 fi
429 ENABLE_INITRAMFS=true
452 ENABLE_INITRAMFS=true
430 fi
453 fi
431
454
432 # Add initramfs generation tools
455 # Add initramfs generation tools
433 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
456 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
434 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
457 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
435 fi
458 fi
436
459
437 # Add device-tree-compiler required for building the U-Boot bootloader
460 # Add device-tree-compiler required for building the U-Boot bootloader
438 if [ "$ENABLE_UBOOT" = true ] ; then
461 if [ "$ENABLE_UBOOT" = true ] ; then
439 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
462 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bc"
440 fi
463 fi
441
464
442 if [ "$ENABLE_USBBOOT" = true ] ; then
465 if [ "$ENABLE_USBBOOT" = true ] ; then
443 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1P ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 2 ]; then
466 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1P ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 2 ]; then
444 echo "error: Booting from USB alone is only supported by Raspberry Pi 3 and 3P"
467 echo "error: Booting from USB alone is only supported by Raspberry Pi 3 and 3P"
445 exit 1
468 exit 1
446 fi
469 fi
447 fi
470 fi
448
471
449 # Check if root SSH (v2) public key file exists
472 # Check if root SSH (v2) public key file exists
450 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
473 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
451 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
474 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
452 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
475 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
453 exit 1
476 exit 1
454 fi
477 fi
455 fi
478 fi
456
479
457 # Check if $USER_NAME SSH (v2) public key file exists
480 # Check if $USER_NAME SSH (v2) public key file exists
458 if [ -n "$SSH_USER_PUB_KEY" ] ; then
481 if [ -n "$SSH_USER_PUB_KEY" ] ; then
459 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
482 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
460 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
483 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
461 exit 1
484 exit 1
462 fi
485 fi
463 fi
486 fi
464
487
465 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
488 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
466 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
489 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
467 exit 1
490 exit 1
468 fi
491 fi
469
492
470 # Check if all required packages are installed on the build system
493 # Check if all required packages are installed on the build system
471 for package in $REQUIRED_PACKAGES ; do
494 for package in $REQUIRED_PACKAGES ; do
472 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
495 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
473 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
496 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
474 fi
497 fi
475 done
498 done
476
499
477 # If there are missing packages ask confirmation for install, or exit
500 # If there are missing packages ask confirmation for install, or exit
478 if [ -n "$MISSING_PACKAGES" ] ; then
501 if [ -n "$MISSING_PACKAGES" ] ; then
479 echo "the following packages needed by this script are not installed:"
502 echo "the following packages needed by this script are not installed:"
480 echo "$MISSING_PACKAGES"
503 echo "$MISSING_PACKAGES"
481
504
482 printf "\ndo you want to install the missing packages right now? [y/n] "
505 printf "\ndo you want to install the missing packages right now? [y/n] "
483 read -r confirm
506 read -r confirm
484 [ "$confirm" != "y" ] && exit 1
507 [ "$confirm" != "y" ] && exit 1
485
508
486 # Make sure all missing required packages are installed
509 # Make sure all missing required packages are installed
487 apt-get update && apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
510 apt-get update && apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
488 fi
511 fi
489
512
490 # Check if ./bootstrap.d directory exists
513 # Check if ./bootstrap.d directory exists
491 if [ ! -d "./bootstrap.d/" ] ; then
514 if [ ! -d "./bootstrap.d/" ] ; then
492 echo "error: './bootstrap.d' required directory not found!"
515 echo "error: './bootstrap.d' required directory not found!"
493 exit 1
516 exit 1
494 fi
517 fi
495
518
496 # Check if ./files directory exists
519 # Check if ./files directory exists
497 if [ ! -d "./files/" ] ; then
520 if [ ! -d "./files/" ] ; then
498 echo "error: './files' required directory not found!"
521 echo "error: './files' required directory not found!"
499 exit 1
522 exit 1
500 fi
523 fi
501
524
502 # Check if specified KERNELSRC_DIR directory exists
525 # Check if specified KERNELSRC_DIR directory exists
503 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
526 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
504 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
527 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
505 exit 1
528 exit 1
506 fi
529 fi
507
530
508 # Check if specified UBOOTSRC_DIR directory exists
531 # Check if specified UBOOTSRC_DIR directory exists
509 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
532 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
510 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
533 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
511 exit 1
534 exit 1
512 fi
535 fi
513
536
514 # Check if specified VIDEOCORESRC_DIR directory exists
537 # Check if specified VIDEOCORESRC_DIR directory exists
515 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
538 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
516 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
539 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
517 exit 1
540 exit 1
518 fi
541 fi
519
542
520 # Check if specified FBTURBOSRC_DIR directory exists
543 # Check if specified FBTURBOSRC_DIR directory exists
521 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
544 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
522 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
545 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
523 exit 1
546 exit 1
524 fi
547 fi
525
548
526 # Check if specified NEXMONSRC_DIR directory exists
549 # Check if specified NEXMONSRC_DIR directory exists
527 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
550 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
528 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
551 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
529 exit 1
552 exit 1
530 fi
553 fi
531
554
532 # Check if specified CHROOT_SCRIPTS directory exists
555 # Check if specified CHROOT_SCRIPTS directory exists
533 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
556 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
534 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
557 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
535 exit 1
558 exit 1
536 fi
559 fi
537
560
538 # Check if specified device mapping already exists (will be used by cryptsetup)
561 # Check if specified device mapping already exists (will be used by cryptsetup)
539 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
562 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
540 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
563 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
541 exit 1
564 exit 1
542 fi
565 fi
543
566
544 # Don't clobber an old build
567 # Don't clobber an old build
545 if [ -e "$BUILDDIR" ] ; then
568 if [ -e "$BUILDDIR" ] ; then
546 echo "error: directory ${BUILDDIR} already exists, not proceeding"
569 echo "error: directory ${BUILDDIR} already exists, not proceeding"
547 exit 1
570 exit 1
548 fi
571 fi
549
572
550 # Setup chroot directory
573 # Setup chroot directory
551 mkdir -p "${R}"
574 mkdir -p "${R}"
552
575
553 # Check if build directory has enough of free disk space >512MB
576 # Check if build directory has enough of free disk space >512MB
554 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
577 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
555 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
578 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
556 exit 1
579 exit 1
557 fi
580 fi
558
581
559 set -x
582 set -x
560
583
561 # Call "cleanup" function on various signals and errors
584 # Call "cleanup" function on various signals and errors
562 trap cleanup 0 1 2 3 6
585 trap cleanup 0 1 2 3 6
563
586
564 # Add required packages for the minbase installation
587 # Add required packages for the minbase installation
565 if [ "$ENABLE_MINBASE" = true ] ; then
588 if [ "$ENABLE_MINBASE" = true ] ; then
566 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
589 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
567 fi
590 fi
568
591
569 # Add parted package, required to get partprobe utility
592 # Add parted package, required to get partprobe utility
570 if [ "$EXPANDROOT" = true ] ; then
593 if [ "$EXPANDROOT" = true ] ; then
571 APT_INCLUDES="${APT_INCLUDES},parted"
594 APT_INCLUDES="${APT_INCLUDES},parted"
572 fi
595 fi
573
596
574 # Add dphys-swapfile package, required to enable swap
597 # Add dphys-swapfile package, required to enable swap
575 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
598 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
576 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
599 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
577 fi
600 fi
578
601
579 # Add dbus package, recommended if using systemd
602 # Add dbus package, recommended if using systemd
580 if [ "$ENABLE_DBUS" = true ] ; then
603 if [ "$ENABLE_DBUS" = true ] ; then
581 APT_INCLUDES="${APT_INCLUDES},dbus"
604 APT_INCLUDES="${APT_INCLUDES},dbus"
582 fi
605 fi
583
606
584 # Add iptables IPv4/IPv6 package
607 # Add iptables IPv4/IPv6 package
585 if [ "$ENABLE_IPTABLES" = true ] ; then
608 if [ "$ENABLE_IPTABLES" = true ] ; then
586 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
609 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
587 fi
610 fi
588 # Add apparmor for KERNEL_SECURITY
611 # Add apparmor for KERNEL_SECURITY
589 if [ "$KERNEL_SECURITY" = true ] ; then
612 if [ "$KERNEL_SECURITY" = true ] ; then
590 APT_INCLUDES="${APT_INCLUDES},apparmor,apparmor-utils,apparmor-profiles,apparmor-profiles-extra,libapparmor-perl"
613 APT_INCLUDES="${APT_INCLUDES},apparmor,apparmor-utils,apparmor-profiles,apparmor-profiles-extra,libapparmor-perl"
591 fi
614 fi
592
615
593 # Add openssh server package
616 # Add openssh server package
594 if [ "$ENABLE_SSHD" = true ] ; then
617 if [ "$SSH_ENABLE" = true ] ; then
595 APT_INCLUDES="${APT_INCLUDES},openssh-server"
618 APT_INCLUDES="${APT_INCLUDES},openssh-server"
596 fi
619 fi
597
620
598 # Add alsa-utils package
621 # Add alsa-utils package
599 if [ "$ENABLE_SOUND" = true ] ; then
622 if [ "$ENABLE_SOUND" = true ] ; then
600 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
623 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
601 fi
624 fi
602
625
603 # Add rng-tools package
626 # Add rng-tools package
604 if [ "$ENABLE_HWRANDOM" = true ] ; then
627 if [ "$ENABLE_HWRANDOM" = true ] ; then
605 APT_INCLUDES="${APT_INCLUDES},rng-tools"
628 APT_INCLUDES="${APT_INCLUDES},rng-tools"
606 fi
629 fi
607
630
608 # Add fbturbo video driver
631 # Add fbturbo video driver
609 if [ "$ENABLE_FBTURBO" = true ] ; then
632 if [ "$ENABLE_FBTURBO" = true ] ; then
610 # Enable xorg package dependencies
633 # Enable xorg package dependencies
611 ENABLE_XORG=true
634 ENABLE_XORG=true
612 fi
635 fi
613
636
614 # Add user defined window manager package
637 # Add user defined window manager package
615 if [ -n "$ENABLE_WM" ] ; then
638 if [ -n "$ENABLE_WM" ] ; then
616 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
639 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
617
640
618 # Enable xorg package dependencies
641 # Enable xorg package dependencies
619 ENABLE_XORG=true
642 ENABLE_XORG=true
620 fi
643 fi
621
644
622 # Add xorg package
645 # Add xorg package
623 if [ "$ENABLE_XORG" = true ] ; then
646 if [ "$ENABLE_XORG" = true ] ; then
624 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
647 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
625 fi
648 fi
626
649
627 # Replace selected packages with smaller clones
650 # Replace selected packages with smaller clones
628 if [ "$ENABLE_REDUCE" = true ] ; then
651 if [ "$ENABLE_REDUCE" = true ] ; then
629 # Add levee package instead of vim-tiny
652 # Add levee package instead of vim-tiny
630 if [ "$REDUCE_VIM" = true ] ; then
653 if [ "$REDUCE_VIM" = true ] ; then
631 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
654 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
632 fi
655 fi
633
656
634 # Add dropbear package instead of openssh-server
657 # Add dropbear package instead of openssh-server
635 if [ "$REDUCE_SSHD" = true ] ; then
658 if [ "$REDUCE_SSHD" = true ] ; then
636 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
659 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
637 fi
660 fi
638 fi
661 fi
639
662
640 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
663 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
641 if [ "$ENABLE_SYSVINIT" = false ] ; then
664 if [ "$ENABLE_SYSVINIT" = false ] ; then
642 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
665 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
643 fi
666 fi
644
667
645 # Configure kernel sources if no KERNELSRC_DIR
668 # Configure kernel sources if no KERNELSRC_DIR
646 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
669 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
647 KERNELSRC_CONFIG=true
670 KERNELSRC_CONFIG=true
648 fi
671 fi
649
672
650 # Configure reduced kernel
673 # Configure reduced kernel
651 if [ "$KERNEL_REDUCE" = true ] ; then
674 if [ "$KERNEL_REDUCE" = true ] ; then
652 KERNELSRC_CONFIG=false
675 KERNELSRC_CONFIG=false
653 fi
676 fi
654
677
655 # Configure qemu compatible kernel
678 # Configure qemu compatible kernel
656 if [ "$ENABLE_QEMU" = true ] ; then
679 if [ "$ENABLE_QEMU" = true ] ; then
657 DTB_FILE=vexpress-v2p-ca15_a7.dtb
680 DTB_FILE=vexpress-v2p-ca15_a7.dtb
658 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
681 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
659 KERNEL_DEFCONFIG="vexpress_defconfig"
682 KERNEL_DEFCONFIG="vexpress_defconfig"
660 if [ "$KERNEL_MENUCONFIG" = false ] ; then
683 if [ "$KERNEL_MENUCONFIG" = false ] ; then
661 KERNEL_OLDDEFCONFIG=true
684 KERNEL_OLDDEFCONFIG=true
662 fi
685 fi
663 fi
686 fi
664
687
665 # Execute bootstrap scripts
688 # Execute bootstrap scripts
666 for SCRIPT in bootstrap.d/*.sh; do
689 for SCRIPT in bootstrap.d/*.sh; do
667 head -n 3 "$SCRIPT"
690 head -n 3 "$SCRIPT"
668 . "$SCRIPT"
691 . "$SCRIPT"
669 done
692 done
670
693
671 ## Execute custom bootstrap scripts
694 ## Execute custom bootstrap scripts
672 if [ -d "custom.d" ] ; then
695 if [ -d "custom.d" ] ; then
673 for SCRIPT in custom.d/*.sh; do
696 for SCRIPT in custom.d/*.sh; do
674 . "$SCRIPT"
697 . "$SCRIPT"
675 done
698 done
676 fi
699 fi
677
700
678 # Execute custom scripts inside the chroot
701 # Execute custom scripts inside the chroot
679 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
702 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
680 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
703 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
681 chroot_exec /bin/bash -x <<'EOF'
704 chroot_exec /bin/bash -x <<'EOF'
682 for SCRIPT in /chroot_scripts/* ; do
705 for SCRIPT in /chroot_scripts/* ; do
683 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
706 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
684 $SCRIPT
707 $SCRIPT
685 fi
708 fi
686 done
709 done
687 EOF
710 EOF
688 rm -rf "${R}/chroot_scripts"
711 rm -rf "${R}/chroot_scripts"
689 fi
712 fi
690
713
691 # Remove c/c++ build environment from the chroot
714 # Remove c/c++ build environment from the chroot
692 chroot_remove_cc
715 chroot_remove_cc
693
716
694 # Generate required machine-id
717 # Generate required machine-id
695 MACHINE_ID=$(dbus-uuidgen)
718 MACHINE_ID=$(dbus-uuidgen)
696 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
719 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
697 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
720 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
698
721
699 # APT Cleanup
722 # APT Cleanup
700 chroot_exec apt-get -y clean
723 chroot_exec apt-get -y clean
701 chroot_exec apt-get -y autoclean
724 chroot_exec apt-get -y autoclean
702 chroot_exec apt-get -y autoremove
725 chroot_exec apt-get -y autoremove
703
726
704 # Unmount mounted filesystems
727 # Unmount mounted filesystems
705 umount -l "${R}/proc"
728 umount -l "${R}/proc"
706 umount -l "${R}/sys"
729 umount -l "${R}/sys"
707
730
708 # Clean up directories
731 # Clean up directories
709 rm -rf "${R}/run/*"
732 rm -rf "${R}/run/*"
710 rm -rf "${R}/tmp/*"
733 rm -rf "${R}/tmp/*"
711
734
712 # Clean up APT proxy settings
735 # Clean up APT proxy settings
713 if [ "$KEEP_APT_PROXY" = false ] ; then
736 if [ "$KEEP_APT_PROXY" = false ] ; then
714 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
737 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
715 fi
738 fi
716
739
717 # Clean up files
740 # Clean up files
718 rm -f "${ETC_DIR}/ssh/ssh_host_*"
741 rm -f "${ETC_DIR}/ssh/ssh_host_*"
719 rm -f "${ETC_DIR}/dropbear/dropbear_*"
742 rm -f "${ETC_DIR}/dropbear/dropbear_*"
720 rm -f "${ETC_DIR}/apt/sources.list.save"
743 rm -f "${ETC_DIR}/apt/sources.list.save"
721 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
744 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
722 rm -f "${ETC_DIR}/*-"
745 rm -f "${ETC_DIR}/*-"
723 rm -f "${ETC_DIR}/resolv.conf"
746 rm -f "${ETC_DIR}/resolv.conf"
724 rm -f "${R}/root/.bash_history"
747 rm -f "${R}/root/.bash_history"
725 rm -f "${R}/var/lib/urandom/random-seed"
748 rm -f "${R}/var/lib/urandom/random-seed"
726 rm -f "${R}/initrd.img"
749 rm -f "${R}/initrd.img"
727 rm -f "${R}/vmlinuz"
750 rm -f "${R}/vmlinuz"
728 rm -f "${R}${QEMU_BINARY}"
751 rm -f "${R}${QEMU_BINARY}"
729
752
730 if [ "$ENABLE_QEMU" = true ] ; then
753 if [ "$ENABLE_QEMU" = true ] ; then
731 # Setup QEMU directory
754 # Setup QEMU directory
732 mkdir "${BASEDIR}/qemu"
755 mkdir "${BASEDIR}/qemu"
733
756
734 # Copy kernel image to QEMU directory
757 # Copy kernel image to QEMU directory
735 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
758 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
736
759
737 # Copy kernel config to QEMU directory
760 # Copy kernel config to QEMU directory
738 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
761 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
739
762
740 # Copy kernel dtbs to QEMU directory
763 # Copy kernel dtbs to QEMU directory
741 for dtb in "${BOOT_DIR}/"*.dtb ; do
764 for dtb in "${BOOT_DIR}/"*.dtb ; do
742 if [ -f "${dtb}" ] ; then
765 if [ -f "${dtb}" ] ; then
743 install_readonly "${dtb}" "${BASEDIR}/qemu/"
766 install_readonly "${dtb}" "${BASEDIR}/qemu/"
744 fi
767 fi
745 done
768 done
746
769
747 # Copy kernel overlays to QEMU directory
770 # Copy kernel overlays to QEMU directory
748 if [ -d "${BOOT_DIR}/overlays" ] ; then
771 if [ -d "${BOOT_DIR}/overlays" ] ; then
749 # Setup overlays dtbs directory
772 # Setup overlays dtbs directory
750 mkdir "${BASEDIR}/qemu/overlays"
773 mkdir "${BASEDIR}/qemu/overlays"
751
774
752 for dtb in "${BOOT_DIR}/overlays/"*.dtbo ; do
775 for dtb in "${BOOT_DIR}/overlays/"*.dtbo ; do
753 if [ -f "${dtb}" ] ; then
776 if [ -f "${dtb}" ] ; then
754 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
777 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
755 fi
778 fi
756 done
779 done
757 fi
780 fi
758
781
759 # Copy u-boot files to QEMU directory
782 # Copy u-boot files to QEMU directory
760 if [ "$ENABLE_UBOOT" = true ] ; then
783 if [ "$ENABLE_UBOOT" = true ] ; then
761 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
784 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
762 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
785 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
763 fi
786 fi
764 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
787 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
765 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
788 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
766 fi
789 fi
767 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
790 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
768 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
791 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
769 fi
792 fi
770 fi
793 fi
771
794
772 # Copy initramfs to QEMU directory
795 # Copy initramfs to QEMU directory
773 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
796 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
774 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
797 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
775 fi
798 fi
776 fi
799 fi
777
800
778 # Calculate size of the chroot directory in KB
801 # Calculate size of the chroot directory in KB
779 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
802 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
780
803
781 # Calculate the amount of needed 512 Byte sectors
804 # Calculate the amount of needed 512 Byte sectors
782 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
805 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
783 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
806 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
784 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
807 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
785
808
786 # The root partition is EXT4
809 # The root partition is EXT4
787 # This means more space than the actual used space of the chroot is used.
810 # This means more space than the actual used space of the chroot is used.
788 # As overhead for journaling and reserved blocks 35% are added.
811 # As overhead for journaling and reserved blocks 35% are added.
789 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
812 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
790
813
791 # Calculate required image size in 512 Byte sectors
814 # Calculate required image size in 512 Byte sectors
792 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
815 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
793
816
794 # Prepare image file
817 # Prepare image file
795 if [ "$ENABLE_SPLITFS" = true ] ; then
818 if [ "$ENABLE_SPLITFS" = true ] ; then
796 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
819 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
797 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
820 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
798 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
821 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
799 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
822 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
800
823
801 # Write firmware/boot partition tables
824 # Write firmware/boot partition tables
802 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
825 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
803 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
826 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
804 EOM
827 EOM
805
828
806 # Write root partition table
829 # Write root partition table
807 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
830 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
808 ${TABLE_SECTORS},${ROOT_SECTORS},83
831 ${TABLE_SECTORS},${ROOT_SECTORS},83
809 EOM
832 EOM
810
833
811 # Setup temporary loop devices
834 # Setup temporary loop devices
812 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
835 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
813 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
836 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
814 else # ENABLE_SPLITFS=false
837 else # ENABLE_SPLITFS=false
815 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
838 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
816 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
839 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
817
840
818 # Write partition table
841 # Write partition table
819 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
842 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
820 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
843 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
821 ${ROOT_OFFSET},${ROOT_SECTORS},83
844 ${ROOT_OFFSET},${ROOT_SECTORS},83
822 EOM
845 EOM
823
846
824 # Setup temporary loop devices
847 # Setup temporary loop devices
825 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
848 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
826 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
849 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
827 fi
850 fi
828
851
829 if [ "$ENABLE_CRYPTFS" = true ] ; then
852 if [ "$ENABLE_CRYPTFS" = true ] ; then
830 # Create dummy ext4 fs
853 # Create dummy ext4 fs
831 mkfs.ext4 "$ROOT_LOOP"
854 mkfs.ext4 "$ROOT_LOOP"
832
855
833 # Setup password keyfile
856 # Setup password keyfile
834 touch .password
857 touch .password
835 chmod 600 .password
858 chmod 600 .password
836 echo -n ${CRYPTFS_PASSWORD} > .password
859 echo -n ${CRYPTFS_PASSWORD} > .password
837
860
838 # Initialize encrypted partition
861 # Initialize encrypted partition
839 cryptsetup --verbose --debug -q luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -h "${CRYPTFS_HASH}" -s "${CRYPTFS_XTSKEYSIZE}" .password
862 cryptsetup --verbose --debug -q luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -h "${CRYPTFS_HASH}" -s "${CRYPTFS_XTSKEYSIZE}" .password
840
863
841 # Open encrypted partition and setup mapping
864 # Open encrypted partition and setup mapping
842 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
865 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
843
866
844 # Secure delete password keyfile
867 # Secure delete password keyfile
845 shred -zu .password
868 shred -zu .password
846
869
847 # Update temporary loop device
870 # Update temporary loop device
848 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
871 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
849
872
850 # Wipe encrypted partition (encryption cipher is used for randomness)
873 # Wipe encrypted partition (encryption cipher is used for randomness)
851 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
874 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
852 fi
875 fi
853
876
854 # Build filesystems
877 # Build filesystems
855 mkfs.vfat "$FRMW_LOOP"
878 mkfs.vfat "$FRMW_LOOP"
856 mkfs.ext4 "$ROOT_LOOP"
879 mkfs.ext4 "$ROOT_LOOP"
857
880
858 # Mount the temporary loop devices
881 # Mount the temporary loop devices
859 mkdir -p "$BUILDDIR/mount"
882 mkdir -p "$BUILDDIR/mount"
860 mount "$ROOT_LOOP" "$BUILDDIR/mount"
883 mount "$ROOT_LOOP" "$BUILDDIR/mount"
861
884
862 mkdir -p "$BUILDDIR/mount/boot/firmware"
885 mkdir -p "$BUILDDIR/mount/boot/firmware"
863 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
886 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
864
887
865 # Copy all files from the chroot to the loop device mount point directory
888 # Copy all files from the chroot to the loop device mount point directory
866 rsync -a "${R}/" "$BUILDDIR/mount/"
889 rsync -a "${R}/" "$BUILDDIR/mount/"
867
890
868 # Unmount all temporary loop devices and mount points
891 # Unmount all temporary loop devices and mount points
869 cleanup
892 cleanup
870
893
871 # Create block map file(s) of image(s)
894 # Create block map file(s) of image(s)
872 if [ "$ENABLE_SPLITFS" = true ] ; then
895 if [ "$ENABLE_SPLITFS" = true ] ; then
873 # Create block map files for "bmaptool"
896 # Create block map files for "bmaptool"
874 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
897 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
875 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
898 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
876
899
877 # Image was successfully created
900 # Image was successfully created
878 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
901 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
879 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
902 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
880 else
903 else
881 # Create block map file for "bmaptool"
904 # Create block map file for "bmaptool"
882 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
905 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
883
906
884 # Image was successfully created
907 # Image was successfully created
885 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
908 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
886
909
887 # Create qemu qcow2 image
910 # Create qemu qcow2 image
888 if [ "$ENABLE_QEMU" = true ] ; then
911 if [ "$ENABLE_QEMU" = true ] ; then
889 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
912 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
890 QEMU_SIZE=16G
913 QEMU_SIZE=16G
891
914
892 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
915 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
893 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
916 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
894
917
895 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
918 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
896 fi
919 fi
897 fi
920 fi
Show file before | Show file after | Hide comments
1 NO CONTENT: file was removed
NO CONTENT: file was removed
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant