Raspi2-3_GenImage Commit - r501:3c3d6ac60789 · Collaboration Tremplin des Sciences

Dropbear initramfs...

Unknown -

r501:3c3d6ac60789

parent child

Context file:

r501:3c3d6ac60789

Collapse all files

files/initramfs/crypt_unlock.sh created 644 +45 0

@@ -0,0 +1,45
	1	#!/bin/sh
	2
	3	PREREQ="dropbear"
	4
	5	prereqs() {
	6	echo "$PREREQ"
	7	}
	8
	9	case "$1" in
	10	prereqs)
	11	prereqs
	12	exit 0
	13	;;
	14	esac
	15
	16	. "${CONFDIR}/initramfs.conf"
	17	. /usr/share/initramfs-tools/hook-functions
	18
	19	if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
	20	cat > "${DESTDIR}/bin/unlock" << EOF
	21	#!/bin/sh
	22	if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
	23	kill \`ps \| grep cryptroot \| grep -v "grep" \| awk '{print \$1}'\`
	24	# following line kill the remote shell right after the passphrase has
	25	# been entered.
	26	kill -9 \`ps \| grep "\-sh" \| grep -v "grep" \| awk '{print \$1}'\`
	27	exit 0
	28	fi
	29	exit 1
	30	EOF
	31
	32	chmod 755 "${DESTDIR}/bin/unlock"
	33
	34	mkdir -p "${DESTDIR}/lib/unlock"
	35	cat > "${DESTDIR}/lib/unlock/plymouth" << EOF
	36	#!/bin/sh
	37	[ "\$1" == "--ping" ] && exit 1
	38	/bin/plymouth "\$@"
	39	EOF
	40
	41	chmod 755 "${DESTDIR}/lib/unlock/plymouth"
	42
	43	echo To unlock root-partition run "unlock" >> ${DESTDIR}/etc/motd
	44
	45	fi No newline at end of file

README.md +6 0

             ##### `CRYPTFS_XTSKEYSIZE`=512
             Sets key size in bits. The argument has to be a multiple of 8.
+            ##### `CRYPTFS_DROPBEAR`=false
+            Enable Dropbear Initramfs support
+            ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
+            Provide path to dropbear Public RSA-OpenSSH Key
             ---
             #### Build settings:

bootstrap.d/14-fstab.sh +36 -1

@@ -29,7 +29,7 if [ "$ENABLE_CRYPTFS" = true ] ; then
29	fi	29	fi
30		30
31	# Generate initramfs file	31	# Generate initramfs file
32	if [ "~~$BUILD_KERNEL~~" = ~~true~~ ] && [ "$ENABLE_INITRAMFS" = true ] ; then	32	if [ "$ENABLE_INITRAMFS" = true ] ; then
33	if [ "$ENABLE_CRYPTFS" = true ] ; then	33	if [ "$ENABLE_CRYPTFS" = true ] ; then
34	# Include initramfs scripts to auto expand encrypted root partition	34	# Include initramfs scripts to auto expand encrypted root partition
35	if [ "$EXPANDROOT" = true ] ; then	35	if [ "$EXPANDROOT" = true ] ; then
@@ -38,8 +38,43 if [ "$BUILD_KERNEL" = true ] && [ "$ENABLE_INITRAMFS" = true ] ; then
38	install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"	38	install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
39	fi	39	fi
40		40
		41	if [ "$CRYPTFS_DROPBEAR" = true ]; then
		42	if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
		43	install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		44	cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
		45	else
		46	# Create key
		47	chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
		48
		49	# Convert dropbear key to openssh key
		50	chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
		51
		52	# Get Public Key Part
		53	chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear \| chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
		54
		55	# Delete unwanted lines
		56	sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		57	sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		58
		59	# Trust the new key
		60	cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
		61
		62	# Save Keys - convert with putty from rsa/openssh to puttkey
		63	cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
		64
		65	# Get unlock script
		66	install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
		67
		68	# Enable Dropbear inside initramfs
		69	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
		70
		71	# Enable Dropbear inside initramfs
		72	sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
		73	fi
		74	else
41	# Disable SSHD inside initramfs	75	# Disable SSHD inside initramfs
42	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"	76	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
		77	fi
43		78
44	# Add cryptsetup modules to initramfs	79	# Add cryptsetup modules to initramfs
45	printf "#\n# CRYPTSETUP: [ y \| n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"	80	printf "#\n# CRYPTSETUP: [ y \| n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"

bootstrap.d/15-rpi-config.sh +32 -38

               fi
             fi
-            #locks cpu at max frequency
+            # Enable Kernel messages on standard output
-            if [ "$ENABLE_TURBO" = true ] ; then
-              echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
-            fi
             if [ "$ENABLE_PRINTK" = true ] ; then
               install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
             fi
-            # Install udev rule for serial alias
+            # Install udev rule for serial alias - serial0 = console serial1=bluetooth
             install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
-            if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
+            # Remove IPv6 networking support
+            if [ "$ENABLE_IPV6" = false ] ; then
+              CMDLINE="${CMDLINE} ipv6.disable=1"
+            fi
+            # Automatically assign predictable network interface names
+            if [ "$ENABLE_IFNAMES" = false ] ; then
+              CMDLINE="${CMDLINE} net.ifnames=0"
+            else
+              CMDLINE="${CMDLINE} net.ifnames=1"
+            fi
+            # Install firmware config
+            install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
+            # Locks CPU frequency at maximum
+            if [ "$ENABLE_TURBO" = true ] ; then
+              echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
+              # helps to avoid sdcard corruption when force_turbo is enabled.
+              echo "boot_delay=1" >> "${BOOT_DIR}/config.txt"
+            fi
-              # RPI0,3,3P Use default ttyS0 (mini-UART)as serial interface
+            if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
-              SET_SERIAL="ttyS0"
               # Bluetooth enabled
               if [ "$ENABLE_BLUETOOTH" = true ] ; then
                 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
                 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
+            	# make scripts executable
+            	chmod +x "${R}/usr/bin/bthelper"
+            	chmod +x "${R}/usr/bin/btuart"
                 # Install bluetooth udev rule
                 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
                 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
                 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
-                # Remove temporary directory
+                # Remove temporary directories
                 rm -fr "${temp_dir}"
+            	rm -fr "${R}"/tmp/pi-bluetooth
                 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
                 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
-            	  SET_SERIAL="ttyAMA0"
             	  # set overlay to swap ttyAMA0 and ttyS0
                   echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
             	  if [ "$ENABLE_TURBO" = false ] ; then
             	    echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
             	  fi
+            	fi
             	# Activate services
             	chroot_exec systemctl enable pi-bluetooth.hciuart.service
-            	  #chroot_exec systemctl enable pi-bluetooth.bthelper@.service
-            	else
-            	  chroot_exec systemctl enable pi-bluetooth.hciuart.service
-            	  #chroot_exec systemctl enable pi-bluetooth.bthelper@.service
-            	fi
               else # if ENABLE_BLUETOOTH = false
               	# set overlay to disable bluetooth
                 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
               fi # ENABLE_BLUETOOTH end
-            else
-              # RPI1,1P,2 Use default ttyAMA0 (full UART) as serial interface
-              SET_SERIAL="ttyAMA0"
             fi
             # may need sudo systemctl disable hciuart
               CMDLINE="${CMDLINE} console=serial0,115200"
               # Enable serial console systemd style
-              chroot_exec systemctl enable serial-getty\@"$SET_SERIAL".service
+              chroot_exec systemctl enable serial-getty\@serial0.service
             else
               echo "enable_uart=0"  >> "${BOOT_DIR}/config.txt"
-              # disable serial console systemd style
-              chroot_exec systemctl disable serial-getty\@"$SET_SERIAL".service
-            fi
-            # Remove IPv6 networking support
-            if [ "$ENABLE_IPV6" = false ] ; then
-              CMDLINE="${CMDLINE} ipv6.disable=1"
-            fi
-            # Automatically assign predictable network interface names
-            if [ "$ENABLE_IFNAMES" = false ] ; then
-              CMDLINE="${CMDLINE} net.ifnames=0"
-            else
-              CMDLINE="${CMDLINE} net.ifnames=1"
             fi
             # Install firmware boot cmdline
             echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
-            # Install firmware config
-            install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
             # Setup minimal GPU memory allocation size: 16MB (no X)
             if [ "$ENABLE_MINGPU" = true ] ; then
               echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"

bootstrap.d/20-networking.sh +14 0

@@ -57,6 +57,20 else # ENABLE_DHCP=false
57	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_1}\|"\	57	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_1}\|"\
58	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_2}\|"\	58	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_2}\|"\
59	"${ETC_DIR}/systemd/network/eth.network"	59	"${ETC_DIR}/systemd/network/eth.network"
		60
		61	if [ "$CRYPTFS_DROPBEAR" = true ] ; then
		62	# Get cdir from NET_ADDRESS e.g. 24
		63	cdir=$(${NET_ADDRESS} \| cut -d '/' -f2)
		64
		65	# Convert cdir ro netmask e.g. 24 to 255.255.255.0
		66	NET_MASK=$(cdr2mask "$cdir")
		67
		68	# Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
		69	sed -i "\$aIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
		70
		71	# Regenerate initramfs
		72	chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
		73	fi
60	fi	74	fi
61		75
62	# Remove empty settings from network configuration	76	# Remove empty settings from network configuration

bootstrap.d/21-firewall.sh +3 0

               chroot_exec systemctl enable iptables.service
               if [ "$ENABLE_IPV6" = true ] ; then
+                # make sure ip6tables-legacy is the used alternatives
+                chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
                 # Install ip6tables systemd service
                 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"

bootstrap.d/30-security.sh 0 -5

@@ -22,8 +22,3 else
22	# Set no root password to disable root login	22	# Set no root password to disable root login
23	chroot_exec usermod -p \'!\' root	23	chroot_exec usermod -p \'!\' root
24	fi	24	fi
25
26	# Enable serial console systemd style
27	if [ "$ENABLE_CONSOLE" = true ] ; then
28	chroot_exec systemctl enable serial-getty\@ttyAMA0.service
29	fi

bootstrap.d/43-videocore.sh +3 0

               #back to root of scriptdir
               cd "${WORKDIR}"
+              # Remove videocore sources
+              rm -fr "${R}"/tmp/userland/
             fi

functions.sh +9 0

@@ -75,3 +75,12 chroot_remove_cc() {
75	COMPILER_PACKAGES=""	75	COMPILER_PACKAGES=""
76	fi	76	fi
77	}	77	}
		78
		79	# https://serverfault.com/a/682849 - converts e.g. /24 to 255.255.255.0
		80	cdr2mask ()
		81	{
		82	# Number of args to shift, 255..255, first non-255 byte, zeroes
		83	set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0
		84	[ $1 -gt 1 ] && shift $1 \|\| shift
		85	echo ${1-0}.${2-0}.${3-0}.${4-0}
		86	} No newline at end of file

rpi23-gen-image.sh +15 -13

             CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
             CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
             CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
+            #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
+            CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
+            #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
+            CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
             # Chroot scripts directory
             CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
             # Packages installed for c/c++ build environment in chroot (keep empty)
             COMPILER_PACKAGES=""
-            set +x
             # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
-            APT_CACHER_RUNNING=$(lsof -i :3142 | grep apt-cacher-ng |  cut -d ' ' -f3 | uniq)
+            APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
-            if [ -n "${APT_CACHER_RUNNING}" ] ; then
+            if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
               APT_PROXY=http://127.0.0.1:3142/
             fi
             # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
             if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
               # Include bluetooth packages on supported boards
-              if [ "$ENABLE_BLUETOOTH" = true ] && [ "$ENABLE_CONSOLE" = false ]; then
+              if [ "$ENABLE_BLUETOOTH" = true ] ; then
                 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
               fi
+              if [ "$ENABLE_WIRELESS" = true ] ; then
+                APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
+              fi
             else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
               # Check if the internal wireless interface is not supported by the RPi model
               if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
               REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
               APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
+              # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
+              if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
+                APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
+              fi
               if [ -z "$CRYPTFS_PASSWORD" ] ; then
                 echo "error: no password defined (CRYPTFS_PASSWORD)!"
                 exit 1
               APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
             fi
-            if [ "$ENABLE_BLUETOOTH" = true ] ; then
-              if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
-                if [ "$ENABLE_CONSOLE" = false ] ; then
-            	  APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
-            	fi
-              fi
-            fi
             # Check if root SSH (v2) public key file exists
             if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
               if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then

General Comments 0

Écrire
Preview

Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages