##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

fix: ENABLE_SOUND
Jan Wagner -
r21:b19241fdfd96
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,845 +1,846
1 #!/bin/sh
1 #!/bin/sh
2
2
3 ########################################################################
3 ########################################################################
4 # rpi2-gen-image.sh ver2a 12/2015
4 # rpi2-gen-image.sh ver2a 12/2015
5 #
5 #
6 # Advanced debian "jessie" bootstrap script for RPi2
6 # Advanced debian "jessie" bootstrap script for RPi2
7 #
7 #
8 # This program is free software; you can redistribute it and/or
8 # This program is free software; you can redistribute it and/or
9 # modify it under the terms of the GNU General Public License
9 # modify it under the terms of the GNU General Public License
10 # as published by the Free Software Foundation; either version 2
10 # as published by the Free Software Foundation; either version 2
11 # of the License, or (at your option) any later version.
11 # of the License, or (at your option) any later version.
12 #
12 #
13 # some parts based on rpi2-build-image:
13 # some parts based on rpi2-build-image:
14 # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
14 # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
15 # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
15 # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
16 ########################################################################
16 ########################################################################
17
17
18 # Clean up all temporary mount points
18 cleanup (){
19 cleanup (){
19 set +x
20 set +x
20 set +e
21 set +e
21 echo "removing temporary mount points ..."
22 echo "removing temporary mount points ..."
22 umount -l $R/proc 2> /dev/null
23 umount -l $R/proc 2> /dev/null
23 umount -l $R/sys 2> /dev/null
24 umount -l $R/sys 2> /dev/null
24 umount -l $R/dev/pts 2> /dev/null
25 umount -l $R/dev/pts 2> /dev/null
25 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
26 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
26 umount "$BUILDDIR/mount" 2> /dev/null
27 umount "$BUILDDIR/mount" 2> /dev/null
27 losetup -d "$EXT4_LOOP" 2> /dev/null
28 losetup -d "$EXT4_LOOP" 2> /dev/null
28 losetup -d "$VFAT_LOOP" 2> /dev/null
29 losetup -d "$VFAT_LOOP" 2> /dev/null
29 trap - 0 1 2 3 6
30 trap - 0 1 2 3 6
30 }
31 }
31
32
32 set -e
33 set -e
33 set -x
34 set -x
34
35
36 # Debian release
35 RELEASE=${RELEASE:=jessie}
37 RELEASE=${RELEASE:=jessie}
36
38
37 # Build settings
39 # Build settings
38 BASEDIR=./images/${RELEASE}
40 BASEDIR=./images/${RELEASE}
39 BUILDDIR=${BASEDIR}/build
41 BUILDDIR=${BASEDIR}/build
40
42
41 # General settings
43 # General settings
42 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
44 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
43 PASSWORD=${PASSWORD:=raspberry}
45 PASSWORD=${PASSWORD:=raspberry}
44 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
46 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
45 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
47 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
46
48
47 # APT settings
49 # APT settings
48 APT_PROXY=${APT_PROXY:=""}
50 APT_PROXY=${APT_PROXY:=""}
49 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
51 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
50
52
51 # Feature settings
53 # Feature settings
52 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
54 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
53 ENABLE_IPV6=${ENABLE_IPV6:=true}
55 ENABLE_IPV6=${ENABLE_IPV6:=true}
54 ENABLE_SSHD=${ENABLE_SSHD:=true}
56 ENABLE_SSHD=${ENABLE_SSHD:=true}
55 ENABLE_SOUND=${ENABLE_SOUND:=true}
57 ENABLE_SOUND=${ENABLE_SOUND:=true}
56 ENABLE_DBUS=${ENABLE_DBUS:=true}
58 ENABLE_DBUS=${ENABLE_DBUS:=true}
57 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
59 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
58 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
60 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
59 ENABLE_XORG=${ENABLE_XORG:=false}
61 ENABLE_XORG=${ENABLE_XORG:=false}
60 ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
62 ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
61
63
62 # Advanced settings
64 # Advanced settings
63 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
65 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
64 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
66 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
65 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
67 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
66 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
68 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
67 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
69 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
68
70
69 # Image chroot path
71 # Image chroot path
70 R=${BUILDDIR}/chroot
72 R=${BUILDDIR}/chroot
71
73
72 # Packages required for bootstrapping
74 # Packages required for bootstrapping
73 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"
75 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"
74
76
75 # Missing packages that need to be installed
77 # Missing packages that need to be installed
76 MISSING_PACKAGES=""
78 MISSING_PACKAGES=""
77
79
78 # Packages required in the chroot build environment
80 # Packages required in the chroot build environment
79 APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,sudo"
81 APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,sudo"
80
82
81 set +x
83 set +x
82
84
83 # Are we running as root?
85 # Are we running as root?
84 if [ "$(id -u)" -ne "0" ] ; then
86 if [ "$(id -u)" -ne "0" ] ; then
85 echo "this script must be executed with root privileges"
87 echo "this script must be executed with root privileges"
86 exit 1
88 exit 1
87 fi
89 fi
88
90
89 # Check if all required packages are installed
91 # Check if all required packages are installed
90 for package in $REQUIRED_PACKAGES ; do
92 for package in $REQUIRED_PACKAGES ; do
91 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
93 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
92 MISSING_PACKAGES="$MISSING_PACKAGES $package"
94 MISSING_PACKAGES="$MISSING_PACKAGES $package"
93 fi
95 fi
94 done
96 done
95
97
96 # Ask if missing packages should get installed right now
98 # Ask if missing packages should get installed right now
97 if [ -n "$MISSING_PACKAGES" ] ; then
99 if [ -n "$MISSING_PACKAGES" ] ; then
98 echo "the following packages needed by this script are not installed:"
100 echo "the following packages needed by this script are not installed:"
99 echo "$MISSING_PACKAGES"
101 echo "$MISSING_PACKAGES"
100
102
101 echo -n "\ndo you want to install the missing packages right now? [y/n] "
103 echo -n "\ndo you want to install the missing packages right now? [y/n] "
102 read confirm
104 read confirm
103 if [ "$confirm" != "y" ] ; then
105 if [ "$confirm" != "y" ] ; then
104 exit 1
106 exit 1
105 fi
107 fi
106 fi
108 fi
107
109
108 # Make sure all required packages are installed
110 # Make sure all required packages are installed
109 apt-get -qq -y install ${REQUIRED_PACKAGES}
111 apt-get -qq -y install ${REQUIRED_PACKAGES}
110
112
111 # Don't clobber an old build
113 # Don't clobber an old build
112 if [ -e "$BUILDDIR" ]; then
114 if [ -e "$BUILDDIR" ]; then
113 echo "directory $BUILDDIR already exists, not proceeding"
115 echo "directory $BUILDDIR already exists, not proceeding"
114 exit 1
116 exit 1
115 fi
117 fi
116
118
117 set -x
119 set -x
118
120
119 # Call "cleanup" function on various signals and errors
121 # Call "cleanup" function on various signals and errors
120 trap cleanup 0 1 2 3 6
122 trap cleanup 0 1 2 3 6
121
123
122 # Set up chroot directory
124 # Set up chroot directory
123 mkdir -p $R
125 mkdir -p $R
124
126
125 # Add required packages for the minbase installation
127 # Add required packages for the minbase installation
126 if [ "$ENABLE_MINBASE" = true ] ; then
128 if [ "$ENABLE_MINBASE" = true ] ; then
127 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools"
129 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools"
128 else
130 else
129 APT_INCLUDES="${APT_INCLUDES},locales"
131 APT_INCLUDES="${APT_INCLUDES},locales"
130 fi
132 fi
131
133
132 # Add dbus package, recommended if using systemd
134 # Add dbus package, recommended if using systemd
133 if [ "$ENABLE_DBUS" = true ] ; then
135 if [ "$ENABLE_DBUS" = true ] ; then
134 APT_INCLUDES="${APT_INCLUDES},dbus"
136 APT_INCLUDES="${APT_INCLUDES},dbus"
135 fi
137 fi
136
138
137 # Add iptables IPv4/IPv6 package
139 # Add iptables IPv4/IPv6 package
138 if [ "$ENABLE_IPTABLES" = true ] ; then
140 if [ "$ENABLE_IPTABLES" = true ] ; then
139 APT_INCLUDES="${APT_INCLUDES},iptables"
141 APT_INCLUDES="${APT_INCLUDES},iptables"
140 fi
142 fi
141
143
142 # Add openssh server package
144 # Add openssh server package
143 if [ "$ENABLE_SSHD" = true ] ; then
145 if [ "$ENABLE_SSHD" = true ] ; then
144 APT_INCLUDES="${APT_INCLUDES},openssh-server"
146 APT_INCLUDES="${APT_INCLUDES},openssh-server"
145 fi
147 fi
146
148
149 # Add alsa-utils package
150 if [ "$ENABLE_SOUND" = true ] ; then
151 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
152 fi
153
147 # Add rng-tools package
154 # Add rng-tools package
148 if [ "$ENABLE_HWRANDOM" = true ] ; then
155 if [ "$ENABLE_HWRANDOM" = true ] ; then
149 APT_INCLUDES="${APT_INCLUDES},rng-tools"
156 APT_INCLUDES="${APT_INCLUDES},rng-tools"
150 fi
157 fi
151
158
152 # Add fbturbo video driver
159 # Add fbturbo video driver
153 if [ "$ENABLE_FBTURBO" = true ] ; then
160 if [ "$ENABLE_FBTURBO" = true ] ; then
154 # Enable xorg package dependencies
161 # Enable xorg package dependencies
155 ENABLE_XORG=true
162 ENABLE_XORG=true
156 fi
163 fi
157
164
158 # Add fluxbox package with eterm
165 # Add fluxbox package with eterm
159 if [ "$ENABLE_FLUXBOX" = true ] ; then
166 if [ "$ENABLE_FLUXBOX" = true ] ; then
160 APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
167 APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
161
168
162 # Enable xorg package dependencies
169 # Enable xorg package dependencies
163 ENABLE_XORG=true
170 ENABLE_XORG=true
164 fi
171 fi
165
172
166 # Add xorg package
173 # Add xorg package
167 if [ "$ENABLE_XORG" = true ] ; then
174 if [ "$ENABLE_XORG" = true ] ; then
168 APT_INCLUDES="${APT_INCLUDES},xorg"
175 APT_INCLUDES="${APT_INCLUDES},xorg"
169 fi
176 fi
170
177
171 # Set empty proxy string
178 # Set empty proxy string
172 if [ -z "$APT_PROXY" ] ; then
179 if [ -z "$APT_PROXY" ] ; then
173 APT_PROXY="http://"
180 APT_PROXY="http://"
174 fi
181 fi
175
182
176 # Base debootstrap (unpack only)
183 # Base debootstrap (unpack only)
177 if [ "$ENABLE_MINBASE" = true ] ; then
184 if [ "$ENABLE_MINBASE" = true ] ; then
178 debootstrap --arch=armhf --variant=minbase --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
185 debootstrap --arch=armhf --variant=minbase --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
179 else
186 else
180 debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
187 debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
181 fi
188 fi
182
189
183 # Copy qemu emulator binary to chroot
190 # Copy qemu emulator binary to chroot
184 cp /usr/bin/qemu-arm-static $R/usr/bin
191 cp /usr/bin/qemu-arm-static $R/usr/bin
185
192
186 # Copy debian-archive-keyring.pgp
193 # Copy debian-archive-keyring.pgp
187 chroot $R mkdir -p /usr/share/keyrings
194 chroot $R mkdir -p /usr/share/keyrings
188 cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
195 cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
189
196
190 # Complete the bootstrapping process
197 # Complete the bootstrapping process
191 chroot $R /debootstrap/debootstrap --second-stage
198 chroot $R /debootstrap/debootstrap --second-stage
192
199
193 # Mount required filesystems
200 # Mount required filesystems
194 mount -t proc none $R/proc
201 mount -t proc none $R/proc
195 mount -t sysfs none $R/sys
202 mount -t sysfs none $R/sys
196 mount --bind /dev/pts $R/dev/pts
203 mount --bind /dev/pts $R/dev/pts
197
204
198 # Use proxy inside chroot
205 # Use proxy inside chroot
199 if [ -z "$APT_PROXY" ] ; then
206 if [ -z "$APT_PROXY" ] ; then
200 echo "Acquire::http::Proxy \"$APT_PROXY\"" >> $R/etc/apt/apt.conf.d/10proxy
207 echo "Acquire::http::Proxy \"$APT_PROXY\"" >> $R/etc/apt/apt.conf.d/10proxy
201 fi
208 fi
202
209
203 # Pin package flash-kernel to repositories.collabora.co.uk
210 # Pin package flash-kernel to repositories.collabora.co.uk
204 cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
211 cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
205 Package: flash-kernel
212 Package: flash-kernel
206 Pin: origin repositories.collabora.co.uk
213 Pin: origin repositories.collabora.co.uk
207 Pin-Priority: 1000
214 Pin-Priority: 1000
208 EOM
215 EOM
209
216
210 # Set up timezone
217 # Set up timezone
211 echo ${TIMEZONE} >$R/etc/timezone
218 echo ${TIMEZONE} >$R/etc/timezone
212 LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
219 LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
213
220
214 # Set up default locales to "en_US.UTF-8" default
221 # Set up default locales to "en_US.UTF-8" default
215 if [ "$ENABLE_MINBASE" = false ] ; then
222 if [ "$ENABLE_MINBASE" = false ] ; then
216 LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
223 LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
217 LANG=C chroot $R locale-gen ${DEFLOCAL}
224 LANG=C chroot $R locale-gen ${DEFLOCAL}
218 fi
225 fi
219
226
220 # Upgrade collabora package index and install collabora keyring
227 # Upgrade collabora package index and install collabora keyring
221 echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
228 echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
222 LANG=C chroot $R apt-get -qq -y update
229 LANG=C chroot $R apt-get -qq -y update
223 LANG=C chroot $R apt-get -qq -y --force-yes install collabora-obs-archive-keyring
230 LANG=C chroot $R apt-get -qq -y --force-yes install collabora-obs-archive-keyring
224
231
225 # Set up initial sources.list
232 # Set up initial sources.list
226 cat <<EOM >$R/etc/apt/sources.list
233 cat <<EOM >$R/etc/apt/sources.list
227 deb http://${APT_SERVER}/debian ${RELEASE} main contrib
234 deb http://${APT_SERVER}/debian ${RELEASE} main contrib
228 #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
235 #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
229
236
230 deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
237 deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
231 #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
238 #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
232
239
233 deb http://security.debian.org/ ${RELEASE}/updates main contrib
240 deb http://security.debian.org/ ${RELEASE}/updates main contrib
234 #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
241 #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
235
242
236 deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
243 deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
237 EOM
244 EOM
238
245
239 # Upgrade package index and update all installed packages and changed dependencies
246 # Upgrade package index and update all installed packages and changed dependencies
240 LANG=C chroot $R apt-get -qq -y update
247 LANG=C chroot $R apt-get -qq -y update
241 LANG=C chroot $R apt-get -qq -y -u dist-upgrade
248 LANG=C chroot $R apt-get -qq -y -u dist-upgrade
242
249
243 # Kernel installation
250 # Kernel installation
244 # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
251 # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
245 LANG=C chroot $R apt-get -qq -y --no-install-recommends install linux-image-3.18.0-trunk-rpi2
252 LANG=C chroot $R apt-get -qq -y --no-install-recommends install linux-image-3.18.0-trunk-rpi2
246 LANG=C chroot $R apt-get -qq -y install flash-kernel
253 LANG=C chroot $R apt-get -qq -y install flash-kernel
247
254
248 VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
255 VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
249 [ -z "$VMLINUZ" ] && exit 1
256 [ -z "$VMLINUZ" ] && exit 1
250 mkdir -p $R/boot/firmware
257 mkdir -p $R/boot/firmware
251
258
252 # required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")
259 # required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")
253 wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin
260 wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin
254 wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat
261 wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat
255 wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat
262 wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat
256 wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat
263 wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat
257 wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf
264 wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf
258 wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf
265 wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf
259 wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf
266 wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf
260 cp $VMLINUZ $R/boot/firmware/kernel7.img
267 cp $VMLINUZ $R/boot/firmware/kernel7.img
261
268
262 # Set up hosts
269 # Set up IPv4 hosts
263 echo ${HOSTNAME} >$R/etc/hostname
270 echo ${HOSTNAME} >$R/etc/hostname
264 cat <<EOM >$R/etc/hosts
271 cat <<EOM >$R/etc/hosts
265 127.0.0.1 localhost
272 127.0.0.1 localhost
266 127.0.1.1 ${HOSTNAME}
273 127.0.1.1 ${HOSTNAME}
267 EOM
274 EOM
268
275
276 # Set up IPv6 hosts
269 if [ "$ENABLE_IPV6" = true ] ; then
277 if [ "$ENABLE_IPV6" = true ] ; then
270 cat <<EOM >>$R/etc/hosts
278 cat <<EOM >>$R/etc/hosts
271
279
272 ::1 localhost ip6-localhost ip6-loopback
280 ::1 localhost ip6-localhost ip6-loopback
273 ff02::1 ip6-allnodes
281 ff02::1 ip6-allnodes
274 ff02::2 ip6-allrouters
282 ff02::2 ip6-allrouters
275 EOM
283 EOM
276 fi
284 fi
277
285
286 # Place hint about network configuration
287 cat <<EOM >$R/etc/network/interfaces
288 # Debian switched to systemd-networkd configuration files.
289 # please configure your networks in '/etc/systemd/network/'
290 EOM
291
292 # Enable systemd-networkd DHCP configuration for interface eth0
293 cat <<EOM >$R/etc/systemd/network/eth.network
294 [Match]
295 Name=eth0
296
297 [Network]
298 DHCP=yes
299 EOM
300
301 # Set DHCP configuration to IPv4 only
302 if [ "$ENABLE_IPV6" = false ] ; then
303 sed -i "s/=yes/=v4/" $R/etc/systemd/network/eth.network
304 fi
305
306 # Enable systemd-networkd service
307 LANG=C chroot $R systemctl enable systemd-networkd
308
278 # Generate crypt(3) password string
309 # Generate crypt(3) password string
279 ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
310 ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
280
311
281 # Set up default user
312 # Set up default user
282 LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi
313 LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi
283 LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
314 LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
284
315
285 # Set up root password
316 # Set up root password
286 LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root
317 LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root
287
318
288 # Set up interfaces
289 cat <<EOM >$R/etc/network/interfaces
290 # interfaces(5) file used by ifup(8) and ifdown(8)
291 # Include files from /etc/network/interfaces.d:
292 source-directory /etc/network/interfaces.d
293
294 # The loopback network interface
295 auto lo
296 iface lo inet loopback
297
298 # The primary network interface
299 allow-hotplug eth0
300 iface eth0 inet dhcp
301 EOM
302
303 # Set up firmware boot cmdline
319 # Set up firmware boot cmdline
304 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
320 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
305
321
306 # Set up serial console support (if requested)
322 # Set up serial console support (if requested)
307 if [ "$ENABLE_CONSOLE" = true ] ; then
323 if [ "$ENABLE_CONSOLE" = true ] ; then
308 CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
324 CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
309 fi
325 fi
310
326
311 # Set up IPv6 networking support
327 # Set up IPv6 networking support
312 if [ "$ENABLE_IPV6" = false ] ; then
328 if [ "$ENABLE_IPV6" = false ] ; then
313 CMDLINE="${CMDLINE} ipv6.disable=1"
329 CMDLINE="${CMDLINE} ipv6.disable=1"
314 fi
330 fi
315
331
316 echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
332 echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
317
333
318 # Set up firmware config
334 # Set up firmware config
319 cat <<EOM >$R/boot/firmware/config.txt
335 cat <<EOM >$R/boot/firmware/config.txt
320 # For more options and information see
336 # For more options and information see
321 # http://www.raspberrypi.org/documentation/configuration/config-txt.md
337 # http://www.raspberrypi.org/documentation/configuration/config-txt.md
322 # Some settings may impact device functionality. See link above for details
338 # Some settings may impact device functionality. See link above for details
323
339
324 # uncomment if you get no picture on HDMI for a default "safe" mode
340 # uncomment if you get no picture on HDMI for a default "safe" mode
325 #hdmi_safe=1
341 #hdmi_safe=1
326
342
327 # uncomment this if your display has a black border of unused pixels visible
343 # uncomment this if your display has a black border of unused pixels visible
328 # and your display can output without overscan
344 # and your display can output without overscan
329 #disable_overscan=1
345 #disable_overscan=1
330
346
331 # uncomment the following to adjust overscan. Use positive numbers if console
347 # uncomment the following to adjust overscan. Use positive numbers if console
332 # goes off screen, and negative if there is too much border
348 # goes off screen, and negative if there is too much border
333 #overscan_left=16
349 #overscan_left=16
334 #overscan_right=16
350 #overscan_right=16
335 #overscan_top=16
351 #overscan_top=16
336 #overscan_bottom=16
352 #overscan_bottom=16
337
353
338 # uncomment to force a console size. By default it will be display's size minus
354 # uncomment to force a console size. By default it will be display's size minus
339 # overscan.
355 # overscan.
340 #framebuffer_width=1280
356 #framebuffer_width=1280
341 #framebuffer_height=720
357 #framebuffer_height=720
342
358
343 # uncomment if hdmi display is not detected and composite is being output
359 # uncomment if hdmi display is not detected and composite is being output
344 #hdmi_force_hotplug=1
360 #hdmi_force_hotplug=1
345
361
346 # uncomment to force a specific HDMI mode (this will force VGA)
362 # uncomment to force a specific HDMI mode (this will force VGA)
347 #hdmi_group=1
363 #hdmi_group=1
348 #hdmi_mode=1
364 #hdmi_mode=1
349
365
350 # uncomment to force a HDMI mode rather than DVI. This can make audio work in
366 # uncomment to force a HDMI mode rather than DVI. This can make audio work in
351 # DMT (computer monitor) modes
367 # DMT (computer monitor) modes
352 #hdmi_drive=2
368 #hdmi_drive=2
353
369
354 # uncomment to increase signal to HDMI, if you have interference, blanking, or
370 # uncomment to increase signal to HDMI, if you have interference, blanking, or
355 # no display
371 # no display
356 #config_hdmi_boost=4
372 #config_hdmi_boost=4
357
373
358 # uncomment for composite PAL
374 # uncomment for composite PAL
359 #sdtv_mode=2
375 #sdtv_mode=2
360
376
361 # uncomment to overclock the arm. 700 MHz is the default.
377 # uncomment to overclock the arm. 700 MHz is the default.
362 #arm_freq=800
378 #arm_freq=800
363 EOM
379 EOM
364
380
381 # Load snd_bcm2835 kernel module at boot time
382 if [ "$ENABLE_SOUND" = true ] ; then
383 echo "snd_bcm2835" >>$R/etc/modules
384 fi
385
365 # Set smallest possible GPU memory allocation size: 16MB (no X)
386 # Set smallest possible GPU memory allocation size: 16MB (no X)
366 if [ "$ENABLE_MINGPU" = true ] ; then
387 if [ "$ENABLE_MINGPU" = true ] ; then
367 echo "gpu_mem=16" >>$R/boot/firmware/config.txt
388 echo "gpu_mem=16" >>$R/boot/firmware/config.txt
368 fi
389 fi
369
390
370 # Create symlinks
391 # Create symlinks
371 ln -sf firmware/config.txt $R/boot/config.txt
392 ln -sf firmware/config.txt $R/boot/config.txt
372 ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
393 ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
373
394
374 # Prepare modules-load.d directory
395 # Prepare modules-load.d directory
375 mkdir -p $R/lib/modules-load.d/
396 mkdir -p $R/lib/modules-load.d/
376
397
377 # Load random module on boot
398 # Load random module on boot
378 if [ "$ENABLE_HWRANDOM" = true ] ; then
399 if [ "$ENABLE_HWRANDOM" = true ] ; then
379 cat <<EOM >$R/lib/modules-load.d/rpi2.conf
400 cat <<EOM >$R/lib/modules-load.d/rpi2.conf
380 bcm2708_rng
401 bcm2708_rng
381 EOM
402 EOM
382 fi
403 fi
383
404
384 # Prepare modprobe.d directory
405 # Prepare modprobe.d directory
385 mkdir -p $R/etc/modprobe.d/
406 mkdir -p $R/etc/modprobe.d/
386
407
387 # Blacklist sound modules
408 # Blacklist sound modules
388 cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf
409 cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf
389 blacklist snd_soc_core
410 blacklist snd_soc_core
390 blacklist snd_pcm
411 blacklist snd_pcm
391 blacklist snd_pcm_dmaengine
412 blacklist snd_pcm_dmaengine
392 blacklist snd_timer
413 blacklist snd_timer
393 blacklist snd_compress
414 blacklist snd_compress
394 blacklist snd_soc_pcm512x_i2c
415 blacklist snd_soc_pcm512x_i2c
395 blacklist snd_soc_pcm512x
416 blacklist snd_soc_pcm512x
396 blacklist snd_soc_tas5713
417 blacklist snd_soc_tas5713
397 blacklist snd_soc_wm8804
418 blacklist snd_soc_wm8804
398 EOM
419 EOM
399
420
400 # Create default fstab
421 # Create default fstab
401 cat <<EOM >$R/etc/fstab
422 cat <<EOM >$R/etc/fstab
402 /dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1
423 /dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1
403 /dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2
424 /dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2
404 EOM
425 EOM
405
426
406 # Avoid swapping and increase cache sizes
427 # Avoid swapping and increase cache sizes
407 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
428 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
408
429
409 # Avoid swapping and increase cache sizes
430 # Avoid swapping and increase cache sizes
410 vm.swappiness=1
431 vm.swappiness=1
411 vm.dirty_background_ratio=20
432 vm.dirty_background_ratio=20
412 vm.dirty_ratio=40
433 vm.dirty_ratio=40
413 vm.dirty_writeback_centisecs=500
434 vm.dirty_writeback_centisecs=500
414 vm.dirty_expire_centisecs=6000
435 vm.dirty_expire_centisecs=6000
415 EOM
436 EOM
416
437
417 # Enable network stack hardening
438 # Enable network stack hardening
418 if [ "$ENABLE_HARDNET" = true ] ; then
439 if [ "$ENABLE_HARDNET" = true ] ; then
419 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
440 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
420
441
421 # Enable network stack hardening
442 # Enable network stack hardening
422 net.ipv4.tcp_timestamps=0
443 net.ipv4.tcp_timestamps=0
423 net.ipv4.tcp_syncookies=1
444 net.ipv4.tcp_syncookies=1
424 net.ipv4.conf.all.rp_filter=1
445 net.ipv4.conf.all.rp_filter=1
425 net.ipv4.conf.all.accept_redirects=0
446 net.ipv4.conf.all.accept_redirects=0
426 net.ipv4.conf.all.send_redirects=0
447 net.ipv4.conf.all.send_redirects=0
427 net.ipv4.conf.all.accept_source_route=0
448 net.ipv4.conf.all.accept_source_route=0
428 net.ipv4.conf.default.rp_filter=1
449 net.ipv4.conf.default.rp_filter=1
429 net.ipv4.conf.default.accept_redirects=0
450 net.ipv4.conf.default.accept_redirects=0
430 net.ipv4.conf.default.send_redirects=0
451 net.ipv4.conf.default.send_redirects=0
431 net.ipv4.conf.default.accept_source_route=0
452 net.ipv4.conf.default.accept_source_route=0
432 net.ipv4.conf.lo.accept_redirects=0
453 net.ipv4.conf.lo.accept_redirects=0
433 net.ipv4.conf.lo.send_redirects=0
454 net.ipv4.conf.lo.send_redirects=0
434 net.ipv4.conf.lo.accept_source_route=0
455 net.ipv4.conf.lo.accept_source_route=0
435 net.ipv4.conf.eth0.accept_redirects=0
456 net.ipv4.conf.eth0.accept_redirects=0
436 net.ipv4.conf.eth0.send_redirects=0
457 net.ipv4.conf.eth0.send_redirects=0
437 net.ipv4.conf.eth0.accept_source_route=0
458 net.ipv4.conf.eth0.accept_source_route=0
438 net.ipv4.icmp_echo_ignore_broadcasts=1
459 net.ipv4.icmp_echo_ignore_broadcasts=1
439 net.ipv4.icmp_ignore_bogus_error_responses=1
460 net.ipv4.icmp_ignore_bogus_error_responses=1
440
461
441 net.ipv6.conf.all.accept_redirects=0
462 net.ipv6.conf.all.accept_redirects=0
442 net.ipv6.conf.all.accept_source_route=0
463 net.ipv6.conf.all.accept_source_route=0
443 net.ipv6.conf.all.router_solicitations=0
464 net.ipv6.conf.all.router_solicitations=0
444 net.ipv6.conf.all.accept_ra_rtr_pref=0
465 net.ipv6.conf.all.accept_ra_rtr_pref=0
445 net.ipv6.conf.all.accept_ra_pinfo=0
466 net.ipv6.conf.all.accept_ra_pinfo=0
446 net.ipv6.conf.all.accept_ra_defrtr=0
467 net.ipv6.conf.all.accept_ra_defrtr=0
447 net.ipv6.conf.all.autoconf=0
468 net.ipv6.conf.all.autoconf=0
448 net.ipv6.conf.all.dad_transmits=0
469 net.ipv6.conf.all.dad_transmits=0
449 net.ipv6.conf.all.max_addresses=1
470 net.ipv6.conf.all.max_addresses=1
450
471
451 net.ipv6.conf.default.accept_redirects=0
472 net.ipv6.conf.default.accept_redirects=0
452 net.ipv6.conf.default.accept_source_route=0
473 net.ipv6.conf.default.accept_source_route=0
453 net.ipv6.conf.default.router_solicitations=0
474 net.ipv6.conf.default.router_solicitations=0
454 net.ipv6.conf.default.accept_ra_rtr_pref=0
475 net.ipv6.conf.default.accept_ra_rtr_pref=0
455 net.ipv6.conf.default.accept_ra_pinfo=0
476 net.ipv6.conf.default.accept_ra_pinfo=0
456 net.ipv6.conf.default.accept_ra_defrtr=0
477 net.ipv6.conf.default.accept_ra_defrtr=0
457 net.ipv6.conf.default.autoconf=0
478 net.ipv6.conf.default.autoconf=0
458 net.ipv6.conf.default.dad_transmits=0
479 net.ipv6.conf.default.dad_transmits=0
459 net.ipv6.conf.default.max_addresses=1
480 net.ipv6.conf.default.max_addresses=1
460
481
461 net.ipv6.conf.lo.accept_redirects=0
482 net.ipv6.conf.lo.accept_redirects=0
462 net.ipv6.conf.lo.accept_source_route=0
483 net.ipv6.conf.lo.accept_source_route=0
463 net.ipv6.conf.lo.router_solicitations=0
484 net.ipv6.conf.lo.router_solicitations=0
464 net.ipv6.conf.lo.accept_ra_rtr_pref=0
485 net.ipv6.conf.lo.accept_ra_rtr_pref=0
465 net.ipv6.conf.lo.accept_ra_pinfo=0
486 net.ipv6.conf.lo.accept_ra_pinfo=0
466 net.ipv6.conf.lo.accept_ra_defrtr=0
487 net.ipv6.conf.lo.accept_ra_defrtr=0
467 net.ipv6.conf.lo.autoconf=0
488 net.ipv6.conf.lo.autoconf=0
468 net.ipv6.conf.lo.dad_transmits=0
489 net.ipv6.conf.lo.dad_transmits=0
469 net.ipv6.conf.lo.max_addresses=1
490 net.ipv6.conf.lo.max_addresses=1
470
491
471 net.ipv6.conf.eth0.accept_redirects=0
492 net.ipv6.conf.eth0.accept_redirects=0
472 net.ipv6.conf.eth0.accept_source_route=0
493 net.ipv6.conf.eth0.accept_source_route=0
473 net.ipv6.conf.eth0.router_solicitations=0
494 net.ipv6.conf.eth0.router_solicitations=0
474 net.ipv6.conf.eth0.accept_ra_rtr_pref=0
495 net.ipv6.conf.eth0.accept_ra_rtr_pref=0
475 net.ipv6.conf.eth0.accept_ra_pinfo=0
496 net.ipv6.conf.eth0.accept_ra_pinfo=0
476 net.ipv6.conf.eth0.accept_ra_defrtr=0
497 net.ipv6.conf.eth0.accept_ra_defrtr=0
477 net.ipv6.conf.eth0.autoconf=0
498 net.ipv6.conf.eth0.autoconf=0
478 net.ipv6.conf.eth0.dad_transmits=0
499 net.ipv6.conf.eth0.dad_transmits=0
479 net.ipv6.conf.eth0.max_addresses=1
500 net.ipv6.conf.eth0.max_addresses=1
480 EOM
501 EOM
481
502
482 # Enable resolver warnings about spoofed addresses
503 # Enable resolver warnings about spoofed addresses
483 cat <<EOM >>$R/etc/host.conf
504 cat <<EOM >>$R/etc/host.conf
484 spoof warn
505 spoof warn
485 EOM
506 EOM
486 fi
507 fi
487
508
488 # Regenerate openssh server host keys
509 # Regenerate openssh server host keys
489 if [ "$ENABLE_SSHD" = true ] ; then
510 if [ "$ENABLE_SSHD" = true ] ; then
490 rm -fr $R/etc/ssh/ssh_host_*
511 rm -fr $R/etc/ssh/ssh_host_*
491 LANG=C chroot $R dpkg-reconfigure openssh-server
512 LANG=C chroot $R dpkg-reconfigure openssh-server
492 fi
513 fi
493
514
494 # Enable serial console systemd style
515 # Enable serial console systemd style
495 if [ "$ENABLE_CONSOLE" = true ] ; then
516 if [ "$ENABLE_CONSOLE" = true ] ; then
496 LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service
517 LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service
497 fi
518 fi
498
519
499 # Enable firewall based on iptables started by systemd service
520 # Enable firewall based on iptables started by systemd service
500 if [ "$ENABLE_IPTABLES" = true ] ; then
521 if [ "$ENABLE_IPTABLES" = true ] ; then
501 # Create iptables configuration directory
522 # Create iptables configuration directory
502 mkdir -p "$R/etc/iptables"
523 mkdir -p "$R/etc/iptables"
503
524
504 # Create iptables systemd service
525 # Create iptables systemd service
505 cat <<EOM >$R/etc/systemd/system/iptables.service
526 cat <<EOM >$R/etc/systemd/system/iptables.service
506 [Unit]
527 [Unit]
507 Description=Packet Filtering Framework
528 Description=Packet Filtering Framework
508 DefaultDependencies=no
529 DefaultDependencies=no
509 After=systemd-sysctl.service
530 After=systemd-sysctl.service
510 Before=sysinit.target
531 Before=sysinit.target
511 [Service]
532 [Service]
512 Type=oneshot
533 Type=oneshot
513 ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
534 ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
514 ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
535 ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
515 ExecStop=/etc/iptables/flush-iptables.sh
536 ExecStop=/etc/iptables/flush-iptables.sh
516 RemainAfterExit=yes
537 RemainAfterExit=yes
517 [Install]
538 [Install]
518 WantedBy=multi-user.target
539 WantedBy=multi-user.target
519 EOM
540 EOM
520
541
521 # Create flush-table script called by iptables service
542 # Create flush-table script called by iptables service
522 cat <<EOM >$R/etc/iptables/flush-iptables.sh
543 cat <<EOM >$R/etc/iptables/flush-iptables.sh
523 #!/bin/sh
544 #!/bin/sh
524 iptables -F
545 iptables -F
525 iptables -X
546 iptables -X
526 iptables -t nat -F
547 iptables -t nat -F
527 iptables -t nat -X
548 iptables -t nat -X
528 iptables -t mangle -F
549 iptables -t mangle -F
529 iptables -t mangle -X
550 iptables -t mangle -X
530 iptables -P INPUT ACCEPT
551 iptables -P INPUT ACCEPT
531 iptables -P FORWARD ACCEPT
552 iptables -P FORWARD ACCEPT
532 iptables -P OUTPUT ACCEPT
553 iptables -P OUTPUT ACCEPT
533 EOM
554 EOM
534
555
535 # Create iptables rule file
556 # Create iptables rule file
536 cat <<EOM >$R/etc/iptables/iptables.rules
557 cat <<EOM >$R/etc/iptables/iptables.rules
537 *filter
558 *filter
538 :INPUT DROP [0:0]
559 :INPUT DROP [0:0]
539 :FORWARD DROP [0:0]
560 :FORWARD DROP [0:0]
540 :OUTPUT ACCEPT [0:0]
561 :OUTPUT ACCEPT [0:0]
541 :TCP - [0:0]
562 :TCP - [0:0]
542 :UDP - [0:0]
563 :UDP - [0:0]
543 :SSH - [0:0]
564 :SSH - [0:0]
544
565
545 # Rate limit ping requests
566 # Rate limit ping requests
546 -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
567 -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
547 -A INPUT -p icmp --icmp-type echo-request -j DROP
568 -A INPUT -p icmp --icmp-type echo-request -j DROP
548
569
549 # Accept established connections
570 # Accept established connections
550 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
571 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
551
572
552 # Accept all traffic on loopback interface
573 # Accept all traffic on loopback interface
553 -A INPUT -i lo -j ACCEPT
574 -A INPUT -i lo -j ACCEPT
554
575
555 # Drop packets declared invalid
576 # Drop packets declared invalid
556 -A INPUT -m conntrack --ctstate INVALID -j DROP
577 -A INPUT -m conntrack --ctstate INVALID -j DROP
557
578
558 # SSH rate limiting
579 # SSH rate limiting
559 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
580 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
560 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
581 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
561 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
582 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
562 -A SSH -m recent --name sshbf --set -j ACCEPT
583 -A SSH -m recent --name sshbf --set -j ACCEPT
563
584
564 # Send TCP and UDP connections to their respective rules chain
585 # Send TCP and UDP connections to their respective rules chain
565 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
586 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
566 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
587 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
567
588
568 # Reject dropped packets with a RFC compliant responce
589 # Reject dropped packets with a RFC compliant responce
569 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
590 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
570 -A INPUT -p tcp -j REJECT --reject-with tcp-rst
591 -A INPUT -p tcp -j REJECT --reject-with tcp-rst
571 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
592 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
572
593
573 ## TCP PORT RULES
594 ## TCP PORT RULES
574 # -A TCP -p tcp -j LOG
595 # -A TCP -p tcp -j LOG
575
596
576 ## UDP PORT RULES
597 ## UDP PORT RULES
577 # -A UDP -p udp -j LOG
598 # -A UDP -p udp -j LOG
578
599
579 COMMIT
600 COMMIT
580 EOM
601 EOM
581
602
582 # Reload systemd configuration and enable iptables service
603 # Reload systemd configuration and enable iptables service
583 LANG=C chroot $R systemctl daemon-reload
604 LANG=C chroot $R systemctl daemon-reload
584 LANG=C chroot $R systemctl enable iptables.service
605 LANG=C chroot $R systemctl enable iptables.service
585
606
586 if [ "$ENABLE_IPV6" = true ] ; then
607 if [ "$ENABLE_IPV6" = true ] ; then
587 # Create ip6tables systemd service
608 # Create ip6tables systemd service
588 cat <<EOM >$R/etc/systemd/system/ip6tables.service
609 cat <<EOM >$R/etc/systemd/system/ip6tables.service
589 [Unit]
610 [Unit]
590 Description=Packet Filtering Framework
611 Description=Packet Filtering Framework
591 DefaultDependencies=no
612 DefaultDependencies=no
592 After=systemd-sysctl.service
613 After=systemd-sysctl.service
593 Before=sysinit.target
614 Before=sysinit.target
594 [Service]
615 [Service]
595 Type=oneshot
616 Type=oneshot
596 ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
617 ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
597 ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
618 ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
598 ExecStop=/etc/iptables/flush-ip6tables.sh
619 ExecStop=/etc/iptables/flush-ip6tables.sh
599 RemainAfterExit=yes
620 RemainAfterExit=yes
600 [Install]
621 [Install]
601 WantedBy=multi-user.target
622 WantedBy=multi-user.target
602 EOM
623 EOM
603
624
604 # Create ip6tables file
625 # Create ip6tables file
605 cat <<EOM >$R/etc/iptables/flush-ip6tables.sh
626 cat <<EOM >$R/etc/iptables/flush-ip6tables.sh
606 #!/bin/sh
627 #!/bin/sh
607 ip6tables -F
628 ip6tables -F
608 ip6tables -X
629 ip6tables -X
609 ip6tables -Z
630 ip6tables -Z
610 for table in $(</proc/net/ip6_tables_names)
631 for table in $(</proc/net/ip6_tables_names)
611 do
632 do
612 ip6tables -t \$table -F
633 ip6tables -t \$table -F
613 ip6tables -t \$table -X
634 ip6tables -t \$table -X
614 ip6tables -t \$table -Z
635 ip6tables -t \$table -Z
615 done
636 done
616 ip6tables -P INPUT ACCEPT
637 ip6tables -P INPUT ACCEPT
617 ip6tables -P OUTPUT ACCEPT
638 ip6tables -P OUTPUT ACCEPT
618 ip6tables -P FORWARD ACCEPT
639 ip6tables -P FORWARD ACCEPT
619 EOM
640 EOM
620
641
621 # Create ip6tables rule file
642 # Create ip6tables rule file
622 cat <<EOM >$R/etc/iptables/ip6tables.rules
643 cat <<EOM >$R/etc/iptables/ip6tables.rules
623 *filter
644 *filter
624 :INPUT DROP [0:0]
645 :INPUT DROP [0:0]
625 :FORWARD DROP [0:0]
646 :FORWARD DROP [0:0]
626 :OUTPUT ACCEPT [0:0]
647 :OUTPUT ACCEPT [0:0]
627 :TCP - [0:0]
648 :TCP - [0:0]
628 :UDP - [0:0]
649 :UDP - [0:0]
629 :SSH - [0:0]
650 :SSH - [0:0]
630
651
631 # Drop packets with RH0 headers
652 # Drop packets with RH0 headers
632 -A INPUT -m rt --rt-type 0 -j DROP
653 -A INPUT -m rt --rt-type 0 -j DROP
633 -A OUTPUT -m rt --rt-type 0 -j DROP
654 -A OUTPUT -m rt --rt-type 0 -j DROP
634 -A FORWARD -m rt --rt-type 0 -j DROP
655 -A FORWARD -m rt --rt-type 0 -j DROP
635
656
636 # Rate limit ping requests
657 # Rate limit ping requests
637 -A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
658 -A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
638 -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
659 -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
639
660
640 # Accept established connections
661 # Accept established connections
641 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
662 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
642
663
643 # Accept all traffic on loopback interface
664 # Accept all traffic on loopback interface
644 -A INPUT -i lo -j ACCEPT
665 -A INPUT -i lo -j ACCEPT
645
666
646 # Drop packets declared invalid
667 # Drop packets declared invalid
647 -A INPUT -m conntrack --ctstate INVALID -j DROP
668 -A INPUT -m conntrack --ctstate INVALID -j DROP
648
669
649 # SSH rate limiting
670 # SSH rate limiting
650 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
671 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
651 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
672 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
652 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
673 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
653 -A SSH -m recent --name sshbf --set -j ACCEPT
674 -A SSH -m recent --name sshbf --set -j ACCEPT
654
675
655 # Send TCP and UDP connections to their respective rules chain
676 # Send TCP and UDP connections to their respective rules chain
656 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
677 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
657 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
678 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
658
679
659 # Reject dropped packets with a RFC compliant responce
680 # Reject dropped packets with a RFC compliant responce
660 -A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited
681 -A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited
661 -A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited
682 -A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited
662 -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
683 -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
663
684
664 ## TCP PORT RULES
685 ## TCP PORT RULES
665 # -A TCP -p tcp -j LOG
686 # -A TCP -p tcp -j LOG
666
687
667 ## UDP PORT RULES
688 ## UDP PORT RULES
668 # -A UDP -p udp -j LOG
689 # -A UDP -p udp -j LOG
669
690
670 COMMIT
691 COMMIT
671 EOM
692 EOM
672
693
673 # Reload systemd configuration and enable iptables service
694 # Reload systemd configuration and enable iptables service
674 LANG=C chroot $R systemctl daemon-reload
695 LANG=C chroot $R systemctl daemon-reload
675 LANG=C chroot $R systemctl enable ip6tables.service
696 LANG=C chroot $R systemctl enable ip6tables.service
676 fi
697 fi
677 fi
698 fi
678
699
679 # Remove SSHD related iptables rules
700 # Remove SSHD related iptables rules
680 if [ "$ENABLE_SSHD" = false ] ; then
701 if [ "$ENABLE_SSHD" = false ] ; then
681 sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/iptables.rules 2> /dev/null
702 sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/iptables.rules 2> /dev/null
682 sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/ip6tables.rules 2> /dev/null
703 sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/ip6tables.rules 2> /dev/null
683 fi
704 fi
684
705
685 # Install gcc/c++ build environment inside the chroot
706 # Install gcc/c++ build environment inside the chroot
686 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ]; then
707 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ]; then
687 # Install minimal gcc/g++ build environment
688 LANG=C chroot $R apt-get install -q -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
708 LANG=C chroot $R apt-get install -q -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
689 fi
709 fi
690
710
691 # Fetch and build U-Boot bootloader
711 # Fetch and build U-Boot bootloader
692 if [ "$ENABLE_UBOOT" = true ] ; then
712 if [ "$ENABLE_UBOOT" = true ] ; then
693 # Fetch U-Boot bootloader sources
713 # Fetch U-Boot bootloader sources
694 git -C $R/tmp clone git://git.denx.de/u-boot.git
714 git -C $R/tmp clone git://git.denx.de/u-boot.git
695
715
696 # Build and install U-Boot inside chroot
716 # Build and install U-Boot inside chroot
697 LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all
717 LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all
698
718
699 # Copy compiled bootloader binary and set config.txt to load it
719 # Copy compiled bootloader binary and set config.txt to load it
700 cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
720 cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
701 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
721 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
702
722
703 # Set U-Boot command file
723 # Set U-Boot command file
704 cat <<EOM >$R/boot/firmware/uboot.mkimage
724 cat <<EOM >$R/boot/firmware/uboot.mkimage
705 # Tell Linux that it is booting on a Raspberry Pi2
725 # Tell Linux that it is booting on a Raspberry Pi2
706 setenv machid 0x00000c42
726 setenv machid 0x00000c42
707
727
708 # Set the kernel boot command line
728 # Set the kernel boot command line
709 setenv bootargs "earlyprintk ${CMDLINE}"
729 setenv bootargs "earlyprintk ${CMDLINE}"
710
730
711 # Save these changes to u-boot's environment
731 # Save these changes to u-boot's environment
712 saveenv
732 saveenv
713
733
714 # Load the existing Linux kernel into RAM
734 # Load the existing Linux kernel into RAM
715 fatload mmc 0:1 \${kernel_addr_r} kernel7.img
735 fatload mmc 0:1 \${kernel_addr_r} kernel7.img
716
736
717 # Boot the kernel we have just loaded
737 # Boot the kernel we have just loaded
718 bootz \${kernel_addr_r}
738 bootz \${kernel_addr_r}
719 EOM
739 EOM
720
740
721 # Generate U-Boot image from command file
741 # Generate U-Boot image from command file
722 LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
742 LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
723 fi
743 fi
724
744
725
726 # Fetch and build fbturbo Xorg driver
745 # Fetch and build fbturbo Xorg driver
727 if [ "$ENABLE_FBTURBO" = true ] ; then
746 if [ "$ENABLE_FBTURBO" = true ] ; then
728 # Fetch fbturbo driver sources
747 # Fetch fbturbo driver sources
729 git -C $R/tmp clone https://github.com/ssvb/xf86-video-fbturbo.git
748 git -C $R/tmp clone https://github.com/ssvb/xf86-video-fbturbo.git
730
749
731 # Install Xorg build dependencies
750 # Install Xorg build dependencies
732 LANG=C chroot $R apt-get install -q -y --no-install-recommends xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
751 LANG=C chroot $R apt-get install -q -y --no-install-recommends xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
733
752
734 # Build and install fbturbo driver inside chroot
753 # Build and install fbturbo driver inside chroot
735 LANG=C chroot $R /bin/bash -c "cd /tmp/xf86-video-fbturbo; autoreconf -vi; ./configure --prefix=/usr; make; make install"
754 LANG=C chroot $R /bin/bash -c "cd /tmp/xf86-video-fbturbo; autoreconf -vi; ./configure --prefix=/usr; make; make install"
736
755
737 # Add fbturbo driver to Xorg configuration
756 # Add fbturbo driver to Xorg configuration
738 cat <<EOM >$R/usr/share/X11/xorg.conf.d/99-fbturbo.conf
757 cat <<EOM >$R/usr/share/X11/xorg.conf.d/99-fbturbo.conf
739 Section "Device"
758 Section "Device"
740 Identifier "Allwinner A10/A13 FBDEV"
759 Identifier "Allwinner A10/A13 FBDEV"
741 Driver "fbturbo"
760 Driver "fbturbo"
742 Option "fbdev" "/dev/fb0"
761 Option "fbdev" "/dev/fb0"
743 Option "SwapbuffersWait" "true"
762 Option "SwapbuffersWait" "true"
744 EndSection
763 EndSection
745 EOM
764 EOM
746
765
747 # Remove Xorg build dependencies
766 # Remove Xorg build dependencies
748 LANG=C chroot $R apt-get -q -y purge --auto-remove xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
767 LANG=C chroot $R apt-get -q -y purge --auto-remove xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
749 fi
768 fi
750
769
751 # Remove gcc/c++ build environment from the chroot
770 # Remove gcc/c++ build environment from the chroot
752 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ]; then
771 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ]; then
753 # Remove minimal gcc/c++ build environment
754 LANG=C chroot $R apt-get -y -q purge --auto-remove bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
772 LANG=C chroot $R apt-get -y -q purge --auto-remove bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
755 fi
773 fi
756
774
757 # Enable systemd-networkd DHCP configuration for the eth0 interface
758 printf "[Match]\nName=eth0\n\n[Network]\nDHCP=yes\n" > $R/etc/systemd/network/eth.network
759
760 # Set DHCP configuration to IPv4 only
761 if [ "$ENABLE_IPV6" = false ] ; then
762 sed -i "s/=yes/=v4/" $R/etc/systemd/network/eth.network
763 fi
764
765 # Enable systemd-networkd service
766 LANG=C chroot $R systemctl enable systemd-networkd
767
768 # Place hint about netowrk configuration
769 cat <<EOM >$R/etc/network/interfaces
770 # Debian switched to systemd-networkd configuration files.
771 # please configure your networks in '/etc/systemd/network/'
772 EOM
773
774 # Clean cached downloads
775 # Clean cached downloads
775 LANG=C chroot $R apt-get -y clean
776 LANG=C chroot $R apt-get -y clean
776 LANG=C chroot $R apt-get -y autoclean
777 LANG=C chroot $R apt-get -y autoclean
777 LANG=C chroot $R apt-get -y autoremove
778 LANG=C chroot $R apt-get -y autoremove
778
779
779 # Unmount mounted filesystems
780 # Unmount mounted filesystems
780 umount -l $R/proc
781 umount -l $R/proc
781 umount -l $R/sys
782 umount -l $R/sys
782
783
783 # Clean up files
784 # Clean up files
784 rm -f $R/etc/apt/sources.list.save
785 rm -f $R/etc/apt/sources.list.save
785 rm -f $R/etc/resolvconf/resolv.conf.d/original
786 rm -f $R/etc/resolvconf/resolv.conf.d/original
786 rm -rf $R/run
787 rm -rf $R/run
787 mkdir -p $R/run
788 mkdir -p $R/run
788 rm -f $R/etc/*-
789 rm -f $R/etc/*-
789 rm -f $R/root/.bash_history
790 rm -f $R/root/.bash_history
790 rm -rf $R/tmp/*
791 rm -rf $R/tmp/*
791 rm -f $R/var/lib/urandom/random-seed
792 rm -f $R/var/lib/urandom/random-seed
792 [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
793 [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
793 rm -f $R/etc/machine-id
794 rm -f $R/etc/machine-id
794 rm -fr $R/etc/apt/apt.conf.d/10proxy
795 rm -fr $R/etc/apt/apt.conf.d/10proxy
795
796
796 # Calculate size of the chroot directory
797 # Calculate size of the chroot directory
797 CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)
798 CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)
798
799
799 # Calculate required image size
800 # Calculate required image size
800 IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`
801 IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`
801
802
802 # Calculate number of sectors for the partition
803 # Calculate number of sectors for the partition
803 IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`
804 IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`
804
805
805 # Prepare date string for image file name
806 # Prepare date string for image file name
806 DATE="$(date +%Y-%m-%d)"
807 DATE="$(date +%Y-%m-%d)"
807
808
808 # Prepare image file
809 # Prepare image file
809 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1
810 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1
810 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}
811 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}
811
812
812 # Write partition table
813 # Write partition table
813 sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
814 sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
814 unit: sectors
815 unit: sectors
815
816
816 1 : start= 2048, size= 131072, Id= c, bootable
817 1 : start= 2048, size= 131072, Id= c, bootable
817 2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83
818 2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83
818 3 : start= 0, size= 0, Id= 0
819 3 : start= 0, size= 0, Id= 0
819 4 : start= 0, size= 0, Id= 0
820 4 : start= 0, size= 0, Id= 0
820 EOM
821 EOM
821
822
822 # Set up temporary loop devices and build filesystems
823 # Set up temporary loop devices and build filesystems
823 VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
824 VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
824 EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
825 EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
825 mkfs.vfat "$VFAT_LOOP"
826 mkfs.vfat "$VFAT_LOOP"
826 mkfs.ext4 "$EXT4_LOOP"
827 mkfs.ext4 "$EXT4_LOOP"
827
828
828 # Mount the temporary loop devices
829 # Mount the temporary loop devices
829 mkdir -p "$BUILDDIR/mount"
830 mkdir -p "$BUILDDIR/mount"
830 mount "$EXT4_LOOP" "$BUILDDIR/mount"
831 mount "$EXT4_LOOP" "$BUILDDIR/mount"
831
832
832 mkdir -p "$BUILDDIR/mount/boot/firmware"
833 mkdir -p "$BUILDDIR/mount/boot/firmware"
833 mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
834 mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
834
835
835 # Copy all files from the chroot to the loop device mount point directory
836 # Copy all files from the chroot to the loop device mount point directory
836 rsync -a "$R/" "$BUILDDIR/mount/"
837 rsync -a "$R/" "$BUILDDIR/mount/"
837
838
838 # Unmount all temporary loop devices and mount points
839 # Unmount all temporary loop devices and mount points
839 cleanup
840 cleanup
840
841
841 # (optinal) create block map file for "bmaptool"
842 # (optinal) create block map file for "bmaptool"
842 bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
843 bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
843
844
844 # Image was successfully created
845 # Image was successfully created
845 echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"
846 echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant