##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

Merge pull request #143 from burnbabyburn/master...
drtyhlpr -
r280:4b5b78dca118 Fusion
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,151 +1,151
1 1 #
2 2 # Setup RPi2/3 config and cmdline
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 if [ "$BUILD_KERNEL" = true ] ; then
9 9 if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
10 10 # Install boot binaries from local directory
11 11 cp ${RPI_FIRMWARE_DIR}/boot/bootcode.bin ${BOOT_DIR}/bootcode.bin
12 12 cp ${RPI_FIRMWARE_DIR}/boot/fixup.dat ${BOOT_DIR}/fixup.dat
13 13 cp ${RPI_FIRMWARE_DIR}/boot/fixup_cd.dat ${BOOT_DIR}/fixup_cd.dat
14 14 cp ${RPI_FIRMWARE_DIR}/boot/fixup_x.dat ${BOOT_DIR}/fixup_x.dat
15 15 cp ${RPI_FIRMWARE_DIR}/boot/start.elf ${BOOT_DIR}/start.elf
16 16 cp ${RPI_FIRMWARE_DIR}/boot/start_cd.elf ${BOOT_DIR}/start_cd.elf
17 17 cp ${RPI_FIRMWARE_DIR}/boot/start_x.elf ${BOOT_DIR}/start_x.elf
18 18 else
19 19 # Create temporary directory for boot binaries
20 20 temp_dir=$(as_nobody mktemp -d)
21 21
22 22 # Install latest boot binaries from raspberry/firmware github
23 23 as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
24 24 as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
25 25 as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
26 26 as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
27 27 as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
28 28 as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
29 29 as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
30 30
31 31 # Move downloaded boot binaries
32 32 mv "${temp_dir}/"* "${BOOT_DIR}/"
33 33
34 34 # Remove temporary directory for boot binaries
35 35 rm -fr "${temp_dir}"
36 36
37 37 # Set permissions of the boot binaries
38 38 chown -R root:root "${BOOT_DIR}"
39 39 chmod -R 600 "${BOOT_DIR}"
40 40 fi
41 41 fi
42 42
43 43 # Setup firmware boot cmdline
44 44 if [ "$ENABLE_SPLITFS" = true ] ; then
45 45 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait console=tty1"
46 46 else
47 47 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait console=tty1"
48 48 fi
49 49
50 50 # Add encrypted root partition to cmdline.txt
51 51 if [ "$ENABLE_CRYPTFS" = true ] ; then
52 52 if [ "$ENABLE_SPLITFS" = true ] ; then
53 53 CMDLINE=$(echo ${CMDLINE} | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
54 54 else
55 55 CMDLINE=$(echo ${CMDLINE} | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
56 56 fi
57 57 fi
58 58
59 59 # Add serial console support
60 60 if [ "$ENABLE_CONSOLE" = true ] ; then
61 61 CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
62 62 fi
63 63
64 64 # Remove IPv6 networking support
65 65 if [ "$ENABLE_IPV6" = false ] ; then
66 66 CMDLINE="${CMDLINE} ipv6.disable=1"
67 67 fi
68 68
69 69 # Automatically assign predictable network interface names
70 70 if [ "$ENABLE_IFNAMES" = false ] ; then
71 71 CMDLINE="${CMDLINE} net.ifnames=0"
72 72 else
73 73 CMDLINE="${CMDLINE} net.ifnames=1"
74 74 fi
75 75
76 76 # Set init to systemd if required by Debian release
77 77 if [ "$RELEASE" = "stretch" ] || [ "$RELEASE" = "buster" ] ; then
78 78 CMDLINE="${CMDLINE} init=/bin/systemd"
79 79 fi
80 80
81 81 # Install firmware boot cmdline
82 82 echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
83 83
84 84 # Install firmware config
85 85 install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
86 86
87 87 # Setup minimal GPU memory allocation size: 16MB (no X)
88 88 if [ "$ENABLE_MINGPU" = true ] ; then
89 89 echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
90 90 fi
91 91
92 92 # Setup boot with initramfs
93 93 if [ "$ENABLE_INITRAMFS" = true ] ; then
94 94 echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
95 95 fi
96 96
97 97 # Disable RPi3 Bluetooth and restore ttyAMA0 serial device
98 if [ "$RPI_MODEL" = 3 ] ; then
98 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
99 99 if [ "$ENABLE_CONSOLE" = true ] && [ "$ENABLE_UBOOT" = false ] ; then
100 100 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
101 101 echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
102 102 fi
103 103 fi
104 104
105 105 # Create firmware configuration and cmdline symlinks
106 106 ln -sf firmware/config.txt "${R}/boot/config.txt"
107 107 ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
108 108
109 109 # Install and setup kernel modules to load at boot
110 110 mkdir -p "${R}/lib/modules-load.d/"
111 111 install_readonly files/modules/rpi2.conf "${R}/lib/modules-load.d/rpi2.conf"
112 112
113 113 # Load hardware random module at boot
114 114 if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
115 115 sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${R}/lib/modules-load.d/rpi2.conf"
116 116 fi
117 117
118 118 # Load sound module at boot
119 119 if [ "$ENABLE_SOUND" = true ] ; then
120 120 sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${R}/lib/modules-load.d/rpi2.conf"
121 121 else
122 122 echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
123 123 fi
124 124
125 125 # Enable I2C interface
126 126 if [ "$ENABLE_I2C" = true ] ; then
127 127 echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
128 128 sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${R}/lib/modules-load.d/rpi2.conf"
129 129 sed -i "s/^# i2c-dev/i2c-dev/" "${R}/lib/modules-load.d/rpi2.conf"
130 130 fi
131 131
132 132 # Enable SPI interface
133 133 if [ "$ENABLE_SPI" = true ] ; then
134 134 echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
135 135 echo "spi-bcm2708" >> "${R}/lib/modules-load.d/rpi2.conf"
136 if [ "$RPI_MODEL" = 3 ] ; then
136 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
137 137 sed -i "s/spi-bcm2708/spi-bcm2835/" "${R}/lib/modules-load.d/rpi2.conf"
138 138 fi
139 139 fi
140 140
141 141 # Disable RPi2/3 under-voltage warnings
142 142 if [ ! -z "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
143 143 echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
144 144 fi
145 145
146 146 # Install kernel modules blacklist
147 147 mkdir -p "${ETC_DIR}/modprobe.d/"
148 148 install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
149 149
150 150 # Install sysctl.d configuration files
151 151 install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
Show file before | Show file after | Hide comments
@@ -1,44 +1,49
1 1 #
2 2 # Setup Firewall
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 if [ "$ENABLE_IPTABLES" = true ] ; then
9 9 # Create iptables configuration directory
10 10 mkdir -p "${ETC_DIR}/iptables"
11
11
12 # make sure iptables-legacy,iptables-legacy-restore and iptables-legacy-save are the used alternatives
13 chroot_exec update-alternatives --verbose --set iptables /usr/bin/iptables-legacy
14 chroot_exec update-alternatives --verbose --set iptables-save /usr/bin/iptables-legacy-save
15 chroot_exec update-alternatives --verbose --set iptables-restore /usr/bin/iptables-legacy-restore
16
12 17 # Install iptables systemd service
13 18 install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
14 19
15 20 # Install flush-table script called by iptables service
16 21 install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
17 22
18 23 # Install iptables rule file
19 24 install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
20 25
21 26 # Reload systemd configuration and enable iptables service
22 27 chroot_exec systemctl daemon-reload
23 28 chroot_exec systemctl enable iptables.service
24 29
25 30 if [ "$ENABLE_IPV6" = true ] ; then
26 31 # Install ip6tables systemd service
27 32 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
28 33
29 34 # Install ip6tables file
30 35 install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
31 36
32 37 install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
33 38
34 39 # Reload systemd configuration and enable iptables service
35 40 chroot_exec systemctl daemon-reload
36 41 chroot_exec systemctl enable ip6tables.service
37 42 fi
38 43
39 44 if [ "$ENABLE_SSHD" = false ] ; then
40 45 # Remove SSHD related iptables rules
41 46 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
42 47 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
43 48 fi
44 49 fi
Show file before | Show file after | Hide comments
@@ -1,15 +1,15
1 1 [Unit]
2 2 Description=Packet Filtering Framework
3 3 DefaultDependencies=no
4 4 After=systemd-sysctl.service
5 5 Before=sysinit.target
6 6
7 7 [Service]
8 8 Type=oneshot
9 ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
9 ExecStart=/sbin/ip6tables-restore -w 5 /etc/iptables/ip6tables.rules
10 10 ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
11 11 ExecStop=/etc/iptables/flush-ip6tables.sh
12 12 RemainAfterExit=yes
13 13
14 14 [Install]
15 15 WantedBy=multi-user.target
Show file before | Show file after | Hide comments
@@ -1,15 +1,15
1 1 [Unit]
2 2 Description=Packet Filtering Framework
3 3 DefaultDependencies=no
4 4 After=systemd-sysctl.service
5 5 Before=sysinit.target
6 6
7 7 [Service]
8 8 Type=oneshot
9 ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
9 ExecStart=/sbin/iptables-restore -w 5 /etc/iptables/iptables.rules
10 10 ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
11 11 ExecStop=/etc/iptables/flush-iptables.sh
12 12 RemainAfterExit=yes
13 13
14 14 [Install]
15 15 WantedBy=multi-user.target
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant