##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

fix: collabora keyring fix
Jan Wagner -
r10:b30726a6ed52
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,761 +1,761
1 #!/bin/sh
1 #!/bin/sh
2
2
3 ########################################################################
3 ########################################################################
4 # rpi2-gen-image.sh ver2a 12/2015
4 # rpi2-gen-image.sh ver2a 12/2015
5 #
5 #
6 # Advanced debian "jessie" bootstrap script for RPi2
6 # Advanced debian "jessie" bootstrap script for RPi2
7 #
7 #
8 # This program is free software; you can redistribute it and/or
8 # This program is free software; you can redistribute it and/or
9 # modify it under the terms of the GNU General Public License
9 # modify it under the terms of the GNU General Public License
10 # as published by the Free Software Foundation; either version 2
10 # as published by the Free Software Foundation; either version 2
11 # of the License, or (at your option) any later version.
11 # of the License, or (at your option) any later version.
12 #
12 #
13 # some parts based on rpi2-build-image:
13 # some parts based on rpi2-build-image:
14 # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
14 # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
15 # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
15 # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
16 ########################################################################
16 ########################################################################
17
17
18 cleanup (){
18 cleanup (){
19 set +x
19 set +x
20 set +e
20 set +e
21 echo "removing temporary mount points ..."
21 echo "removing temporary mount points ..."
22 umount -l $R/proc 2> /dev/null
22 umount -l $R/proc 2> /dev/null
23 umount -l $R/sys 2> /dev/null
23 umount -l $R/sys 2> /dev/null
24 umount -l $R/dev/pts 2> /dev/null
24 umount -l $R/dev/pts 2> /dev/null
25 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
25 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
26 umount "$BUILDDIR/mount" 2> /dev/null
26 umount "$BUILDDIR/mount" 2> /dev/null
27 losetup -d "$EXT4_LOOP" 2> /dev/null
27 losetup -d "$EXT4_LOOP" 2> /dev/null
28 losetup -d "$VFAT_LOOP" 2> /dev/null
28 losetup -d "$VFAT_LOOP" 2> /dev/null
29 trap - 0 1 2 3 6
29 trap - 0 1 2 3 6
30 }
30 }
31
31
32 set -e
32 set -e
33 set -x
33 set -x
34
34
35 RELEASE=${RELEASE:=jessie}
35 RELEASE=${RELEASE:=jessie}
36
36
37 # Build settings
37 # Build settings
38 BASEDIR=./images/${RELEASE}
38 BASEDIR=./images/${RELEASE}
39 BUILDDIR=${BASEDIR}/build
39 BUILDDIR=${BASEDIR}/build
40
40
41 # General settings
41 # General settings
42 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
42 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
43 PASSWORD=${PASSWORD:=raspberry}
43 PASSWORD=${PASSWORD:=raspberry}
44 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
44 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
45 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
45 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
46
46
47 # APT settings
47 # APT settings
48 APT_PROXY=${APT_PROXY:=""}
48 APT_PROXY=${APT_PROXY:=""}
49 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
49 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
50
50
51 # Feature settings
51 # Feature settings
52 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
52 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
53 ENABLE_IPV6=${ENABLE_IPV6:=true}
53 ENABLE_IPV6=${ENABLE_IPV6:=true}
54 ENABLE_SSHD=${ENABLE_SSHD:=true}
54 ENABLE_SSHD=${ENABLE_SSHD:=true}
55 ENABLE_SOUND=${ENABLE_SOUND:=true}
55 ENABLE_SOUND=${ENABLE_SOUND:=true}
56 ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}
56 ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}
57 ENABLE_DBUS=${ENABLE_DBUS:=true}
57 ENABLE_DBUS=${ENABLE_DBUS:=true}
58 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
58 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
59 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
59 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
60 ENABLE_XORG=${ENABLE_XORG:=false}
60 ENABLE_XORG=${ENABLE_XORG:=false}
61 ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
61 ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
62
62
63 # Advanced settings
63 # Advanced settings
64 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
64 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
65 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
65 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
66 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
66 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
67
67
68 # Image chroot path
68 # Image chroot path
69 R=${BUILDDIR}/chroot
69 R=${BUILDDIR}/chroot
70
70
71 # Packages required for bootstrapping
71 # Packages required for bootstrapping
72 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"
72 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"
73
73
74 # Missing packages that need to be installed
74 # Missing packages that need to be installed
75 MISSING_PACKAGES=""
75 MISSING_PACKAGES=""
76
76
77 # Packages required in the chroot build enviroment
77 # Packages required in the chroot build enviroment
78 APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"
78 APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"
79
79
80 set +x
80 set +x
81
81
82 # Are we running as root?
82 # Are we running as root?
83 if [ "$(id -u)" -ne "0" ] ; then
83 if [ "$(id -u)" -ne "0" ] ; then
84 echo "this script must be executed with root privileges"
84 echo "this script must be executed with root privileges"
85 exit 1
85 exit 1
86 fi
86 fi
87
87
88 # Check if all required packages are installed
88 # Check if all required packages are installed
89 for package in $REQUIRED_PACKAGES ; do
89 for package in $REQUIRED_PACKAGES ; do
90 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
90 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
91 MISSING_PACKAGES="$MISSING_PACKAGES $package"
91 MISSING_PACKAGES="$MISSING_PACKAGES $package"
92 fi
92 fi
93 done
93 done
94
94
95 # Ask if missing packages should get installed right now
95 # Ask if missing packages should get installed right now
96 if [ -n "$MISSING_PACKAGES" ] ; then
96 if [ -n "$MISSING_PACKAGES" ] ; then
97 echo "the following packages needed by this script are not installed:"
97 echo "the following packages needed by this script are not installed:"
98 echo "$MISSING_PACKAGES"
98 echo "$MISSING_PACKAGES"
99
99
100 echo -n "\ndo you want to install the missing packages right now? [y/n] "
100 echo -n "\ndo you want to install the missing packages right now? [y/n] "
101 read confirm
101 read confirm
102 if [ "$confirm" != "y" ] ; then
102 if [ "$confirm" != "y" ] ; then
103 exit 1
103 exit 1
104 fi
104 fi
105 fi
105 fi
106
106
107 # Make sure all required packages are installed
107 # Make sure all required packages are installed
108 apt-get -qq -y install ${REQUIRED_PACKAGES}
108 apt-get -qq -y install ${REQUIRED_PACKAGES}
109
109
110 # Don't clobber an old build
110 # Don't clobber an old build
111 if [ -e "$BUILDDIR" ]; then
111 if [ -e "$BUILDDIR" ]; then
112 echo "directory $BUILDDIR already exists, not proceeding"
112 echo "directory $BUILDDIR already exists, not proceeding"
113 exit 1
113 exit 1
114 fi
114 fi
115
115
116 set -x
116 set -x
117
117
118 # Call "cleanup" function on various signals and errors
118 # Call "cleanup" function on various signals and errors
119 trap cleanup 0 1 2 3 6
119 trap cleanup 0 1 2 3 6
120
120
121 # Set up chroot directory
121 # Set up chroot directory
122 mkdir -p $R
122 mkdir -p $R
123
123
124 # Use traditional SystemV init instead of systemd services
124 # Use traditional SystemV init instead of systemd services
125 if [ "$ENABLE_SYSTEMD" = false ] ; then
125 if [ "$ENABLE_SYSTEMD" = false ] ; then
126 APT_INCLUDES="${APT_INCLUDES},sysvinit-core"
126 APT_INCLUDES="${APT_INCLUDES},sysvinit-core"
127 fi
127 fi
128
128
129 # Add dbus package, recommended if using systemd
129 # Add dbus package, recommended if using systemd
130 if [ "$ENABLE_DBUS" = true ] ; then
130 if [ "$ENABLE_DBUS" = true ] ; then
131 APT_INCLUDES="${APT_INCLUDES},dbus"
131 APT_INCLUDES="${APT_INCLUDES},dbus"
132 fi
132 fi
133
133
134 # Add openssh server package
134 # Add openssh server package
135 if [ "$ENABLE_SSHD" = true ] ; then
135 if [ "$ENABLE_SSHD" = true ] ; then
136 APT_INCLUDES="${APT_INCLUDES},openssh-server"
136 APT_INCLUDES="${APT_INCLUDES},openssh-server"
137 fi
137 fi
138
138
139 # Add rng-tools package
139 # Add rng-tools package
140 if [ "$ENABLE_HWRANDOM" = true ] ; then
140 if [ "$ENABLE_HWRANDOM" = true ] ; then
141 APT_INCLUDES="${APT_INCLUDES},rng-tools"
141 APT_INCLUDES="${APT_INCLUDES},rng-tools"
142 fi
142 fi
143
143
144 # Add xorg package
144 # Add xorg package
145 if [ "$ENABLE_XORG" = true ] ; then
145 if [ "$ENABLE_XORG" = true ] ; then
146 APT_INCLUDES="${APT_INCLUDES},xorg"
146 APT_INCLUDES="${APT_INCLUDES},xorg"
147 fi
147 fi
148
148
149 # Add fluxbox package with eterm
149 # Add fluxbox package with eterm
150 if [ "$ENABLE_FLUXBOX" = true ] ; then
150 if [ "$ENABLE_FLUXBOX" = true ] ; then
151 APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
151 APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
152 fi
152 fi
153
153
154 if [ -z "$APT_PROXY" ] ; then
154 if [ -z "$APT_PROXY" ] ; then
155 APT_PROXY="http://"
155 APT_PROXY="http://"
156 fi
156 fi
157
157
158 # Base debootstrap (unpack only)
158 # Base debootstrap (unpack only)
159 debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
159 debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
160 cp /usr/bin/qemu-arm-static $R/usr/bin
160 cp /usr/bin/qemu-arm-static $R/usr/bin
161
161
162 # Remove systemd related packages from list of packages to be bootstrapped
162 # Remove systemd related packages from list of packages to be bootstrapped
163 if [ "$ENABLE_SYSTEMD" = false ] ; then
163 if [ "$ENABLE_SYSTEMD" = false ] ; then
164 chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required
164 chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required
165 fi
165 fi
166
166
167 # Copy debian-archive-keyring.pgp
167 # Copy debian-archive-keyring.pgp
168 chroot $R mkdir -p /usr/share/keyrings
168 chroot $R mkdir -p /usr/share/keyrings
169 cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
169 cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
170
170
171 # Complete the bootstrapping proccess
171 # Complete the bootstrapping proccess
172 chroot $R /debootstrap/debootstrap --second-stage
172 chroot $R /debootstrap/debootstrap --second-stage
173
173
174 # Mount required filesystems
174 # Mount required filesystems
175 mount -t proc none $R/proc
175 mount -t proc none $R/proc
176 mount -t sysfs none $R/sys
176 mount -t sysfs none $R/sys
177 mount --bind /dev/pts $R/dev/pts
177 mount --bind /dev/pts $R/dev/pts
178
178
179 # Set up initial sources.list
180 cat <<EOM >$R/etc/apt/sources.list
181 deb http://${APT_SERVER}/debian ${RELEASE} main contrib
182 #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
183
184 deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
185 #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
186
187 deb http://security.debian.org/ ${RELEASE}/updates main contrib
188 #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
189
190 deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
191 EOM
192
193 # Pin package flash-kernel to repositories.collabora.co.uk
179 # Pin package flash-kernel to repositories.collabora.co.uk
194 cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
180 cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
195 Package: flash-kernel
181 Package: flash-kernel
196 Pin: origin repositories.collabora.co.uk
182 Pin: origin repositories.collabora.co.uk
197 Pin-Priority: 1000
183 Pin-Priority: 1000
198 EOM
184 EOM
199
185
200 # Set up timezone
186 # Set up timezone
201 echo ${TIMEZONE} >$R/etc/timezone
187 echo ${TIMEZONE} >$R/etc/timezone
202 LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
188 LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
203
189
204 # Set up default locales to "en_US.UTF-8" default
190 # Set up default locales to "en_US.UTF-8" default
205 LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
191 LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
206 LANG=C chroot $R locale-gen ${DEFLOCAL}
192 LANG=C chroot $R locale-gen ${DEFLOCAL}
207
193
208 # Fetch APT public key "Collabora Raspbian Archive Signing Key <daniels@collabora.com>"
194 # Upgrade collabora package index and install collabora keyring
209 LANG=C chroot $R apt-key adv --keyserver hkp://pool.sks-keyservers.net --recv-keys ED4BF9140C50B1C5
195 echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
196 LANG=C chroot $R apt-get -qq -y update
197 LANG=C chroot $R apt-get -qq -y --force-yes install collabora-obs-archive-keyring
198
199 # Set up initial sources.list
200 cat <<EOM >$R/etc/apt/sources.list
201 deb http://${APT_SERVER}/debian ${RELEASE} main contrib
202 #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
203
204 deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
205 #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
206
207 deb http://security.debian.org/ ${RELEASE}/updates main contrib
208 #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
209
210 deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
211 EOM
210
212
211 # Upgrade package index and update all installed packages and changed dependencies
213 # Upgrade package index and update all installed packages and changed dependencies
212 LANG=C chroot $R apt-get -q -y update
214 LANG=C chroot $R apt-get -qq -y update
213 LANG=C chroot $R apt-get -q -y -u dist-upgrade
215 LANG=C chroot $R apt-get -qq -y -u dist-upgrade
214
216
215 # Kernel installation
217 # Kernel installation
216 # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
218 # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
217
219 LANG=C chroot $R apt-get -qq -y --no-install-recommends install linux-image-3.18.0-trunk-rpi2
218 LANG=C chroot $R apt-get -q -y --force-yes --no-install-recommends install linux-image-3.18.0-trunk-rpi2
220 LANG=C chroot $R apt-get -qq -y install flash-kernel
219 LANG=C chroot $R apt-get -q -y --force-yes install flash-kernel
220
221
221 VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
222 VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
222 [ -z "$VMLINUZ" ] && exit 1
223 [ -z "$VMLINUZ" ] && exit 1
223 mkdir -p $R/boot/firmware
224 mkdir -p $R/boot/firmware
224
225
225 # required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")
226 # required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")
226 wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin
227 wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin
227 wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat
228 wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat
228 wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat
229 wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat
229 wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat
230 wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat
230 wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf
231 wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf
231 wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf
232 wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf
232 wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf
233 wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf
233 cp $VMLINUZ $R/boot/firmware/kernel7.img
234 cp $VMLINUZ $R/boot/firmware/kernel7.img
234
235
235 # Set up hosts
236 # Set up hosts
236 echo ${HOSTNAME} >$R/etc/hostname
237 echo ${HOSTNAME} >$R/etc/hostname
237 cat <<EOM >$R/etc/hosts
238 cat <<EOM >$R/etc/hosts
238 127.0.0.1 localhost
239 127.0.0.1 localhost
239 127.0.1.1 ${HOSTNAME}
240 127.0.1.1 ${HOSTNAME}
240 EOM
241 EOM
241
242
242 if [ "$ENABLE_IPV6" = true ] ; then
243 if [ "$ENABLE_IPV6" = true ] ; then
243 cat <<EOM >>$R/etc/hosts
244 cat <<EOM >>$R/etc/hosts
244
245
245 ::1 localhost ip6-localhost ip6-loopback
246 ::1 localhost ip6-localhost ip6-loopback
246 ff02::1 ip6-allnodes
247 ff02::1 ip6-allnodes
247 ff02::2 ip6-allrouters
248 ff02::2 ip6-allrouters
248 EOM
249 EOM
249 fi
250 fi
250
251
251 # Generate crypt(3) password string
252 # Generate crypt(3) password string
252 ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
253 ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
253
254
254 # Set up default user
255 # Set up default user
255 LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi
256 LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi
256 LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
257 LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
257
258
258 # Set up root password
259 # Set up root password
259 LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root
260 LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root
260
261
261
262 # Set up interfaces
262 # Set up interfaces
263 cat <<EOM >$R/etc/network/interfaces
263 cat <<EOM >$R/etc/network/interfaces
264 # interfaces(5) file used by ifup(8) and ifdown(8)
264 # interfaces(5) file used by ifup(8) and ifdown(8)
265 # Include files from /etc/network/interfaces.d:
265 # Include files from /etc/network/interfaces.d:
266 source-directory /etc/network/interfaces.d
266 source-directory /etc/network/interfaces.d
267
267
268 # The loopback network interface
268 # The loopback network interface
269 auto lo
269 auto lo
270 iface lo inet loopback
270 iface lo inet loopback
271
271
272 # The primary network interface
272 # The primary network interface
273 allow-hotplug eth0
273 allow-hotplug eth0
274 iface eth0 inet dhcp
274 iface eth0 inet dhcp
275 EOM
275 EOM
276
276
277 # Set up firmware boot cmdline
277 # Set up firmware boot cmdline
278 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
278 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
279
279
280 # Set up serial console support (if requested)
280 # Set up serial console support (if requested)
281 if [ "$ENABLE_CONSOLE" = true ] ; then
281 if [ "$ENABLE_CONSOLE" = true ] ; then
282 CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
282 CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
283 fi
283 fi
284
284
285 # Set up ipv6 support (if requested)
285 # Set up ipv6 support (if requested)
286 if [ "$ENABLE_IPV6" = false ] ; then
286 if [ "$ENABLE_IPV6" = false ] ; then
287 CMDLINE="${CMDLINE} ipv6.disable=1"
287 CMDLINE="${CMDLINE} ipv6.disable=1"
288 fi
288 fi
289
289
290 echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
290 echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
291
291
292 # Set up firmware config
292 # Set up firmware config
293 cat <<EOM >$R/boot/firmware/config.txt
293 cat <<EOM >$R/boot/firmware/config.txt
294 # For more options and information see
294 # For more options and information see
295 # http://www.raspberrypi.org/documentation/configuration/config-txt.md
295 # http://www.raspberrypi.org/documentation/configuration/config-txt.md
296 # Some settings may impact device functionality. See link above for details
296 # Some settings may impact device functionality. See link above for details
297
297
298 # uncomment if you get no picture on HDMI for a default "safe" mode
298 # uncomment if you get no picture on HDMI for a default "safe" mode
299 #hdmi_safe=1
299 #hdmi_safe=1
300
300
301 # uncomment this if your display has a black border of unused pixels visible
301 # uncomment this if your display has a black border of unused pixels visible
302 # and your display can output without overscan
302 # and your display can output without overscan
303 #disable_overscan=1
303 #disable_overscan=1
304
304
305 # uncomment the following to adjust overscan. Use positive numbers if console
305 # uncomment the following to adjust overscan. Use positive numbers if console
306 # goes off screen, and negative if there is too much border
306 # goes off screen, and negative if there is too much border
307 #overscan_left=16
307 #overscan_left=16
308 #overscan_right=16
308 #overscan_right=16
309 #overscan_top=16
309 #overscan_top=16
310 #overscan_bottom=16
310 #overscan_bottom=16
311
311
312 # uncomment to force a console size. By default it will be display's size minus
312 # uncomment to force a console size. By default it will be display's size minus
313 # overscan.
313 # overscan.
314 #framebuffer_width=1280
314 #framebuffer_width=1280
315 #framebuffer_height=720
315 #framebuffer_height=720
316
316
317 # uncomment if hdmi display is not detected and composite is being output
317 # uncomment if hdmi display is not detected and composite is being output
318 #hdmi_force_hotplug=1
318 #hdmi_force_hotplug=1
319
319
320 # uncomment to force a specific HDMI mode (this will force VGA)
320 # uncomment to force a specific HDMI mode (this will force VGA)
321 #hdmi_group=1
321 #hdmi_group=1
322 #hdmi_mode=1
322 #hdmi_mode=1
323
323
324 # uncomment to force a HDMI mode rather than DVI. This can make audio work in
324 # uncomment to force a HDMI mode rather than DVI. This can make audio work in
325 # DMT (computer monitor) modes
325 # DMT (computer monitor) modes
326 #hdmi_drive=2
326 #hdmi_drive=2
327
327
328 # uncomment to increase signal to HDMI, if you have interference, blanking, or
328 # uncomment to increase signal to HDMI, if you have interference, blanking, or
329 # no display
329 # no display
330 #config_hdmi_boost=4
330 #config_hdmi_boost=4
331
331
332 # uncomment for composite PAL
332 # uncomment for composite PAL
333 #sdtv_mode=2
333 #sdtv_mode=2
334
334
335 # uncomment to overclock the arm. 700 MHz is the default.
335 # uncomment to overclock the arm. 700 MHz is the default.
336 #arm_freq=800
336 #arm_freq=800
337 EOM
337 EOM
338
338
339 # Set smallest possible GPU memory allocation size: 16MB (no X)
339 # Set smallest possible GPU memory allocation size: 16MB (no X)
340 if [ "$ENABLE_MINGPU" = true ] ; then
340 if [ "$ENABLE_MINGPU" = true ] ; then
341 echo "gpu_mem=16" >>$R/boot/firmware/config.txt
341 echo "gpu_mem=16" >>$R/boot/firmware/config.txt
342 fi
342 fi
343
343
344 # Create symlinks
344 # Create symlinks
345 ln -sf firmware/config.txt $R/boot/config.txt
345 ln -sf firmware/config.txt $R/boot/config.txt
346 ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
346 ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
347
347
348 # Prepare modules-load.d directory
348 # Prepare modules-load.d directory
349 mkdir -p $R/lib/modules-load.d/
349 mkdir -p $R/lib/modules-load.d/
350
350
351 # Load random module on boot
351 # Load random module on boot
352 if [ "$ENABLE_HWRANDOM" = true ] ; then
352 if [ "$ENABLE_HWRANDOM" = true ] ; then
353 cat <<EOM >$R/lib/modules-load.d/rpi2.conf
353 cat <<EOM >$R/lib/modules-load.d/rpi2.conf
354 bcm2708_rng
354 bcm2708_rng
355 EOM
355 EOM
356 fi
356 fi
357
357
358 # Prepare modprobe.d directory
358 # Prepare modprobe.d directory
359 mkdir -p $R/etc/modprobe.d/
359 mkdir -p $R/etc/modprobe.d/
360
360
361 # Blacklist sound modules
361 # Blacklist sound modules
362 cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf
362 cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf
363 blacklist snd_soc_core
363 blacklist snd_soc_core
364 blacklist snd_pcm
364 blacklist snd_pcm
365 blacklist snd_pcm_dmaengine
365 blacklist snd_pcm_dmaengine
366 blacklist snd_timer
366 blacklist snd_timer
367 blacklist snd_compress
367 blacklist snd_compress
368 blacklist snd_soc_pcm512x_i2c
368 blacklist snd_soc_pcm512x_i2c
369 blacklist snd_soc_pcm512x
369 blacklist snd_soc_pcm512x
370 blacklist snd_soc_tas5713
370 blacklist snd_soc_tas5713
371 blacklist snd_soc_wm8804
371 blacklist snd_soc_wm8804
372 EOM
372 EOM
373
373
374 # Create default fstab
374 # Create default fstab
375 cat <<EOM >$R/etc/fstab
375 cat <<EOM >$R/etc/fstab
376 /dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1
376 /dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1
377 /dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2
377 /dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2
378 EOM
378 EOM
379
379
380 # Avoid swapping and increase cache sizes
380 # Avoid swapping and increase cache sizes
381 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
381 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
382
382
383 # Avoid swapping and increase cache sizes
383 # Avoid swapping and increase cache sizes
384 vm.swappiness=1
384 vm.swappiness=1
385 vm.dirty_background_ratio=20
385 vm.dirty_background_ratio=20
386 vm.dirty_ratio=40
386 vm.dirty_ratio=40
387 vm.dirty_writeback_centisecs=500
387 vm.dirty_writeback_centisecs=500
388 vm.dirty_expire_centisecs=6000
388 vm.dirty_expire_centisecs=6000
389 EOM
389 EOM
390
390
391 # Enable network stack hardening
391 # Enable network stack hardening
392 if [ "$ENABLE_HARDNET" = true ] ; then
392 if [ "$ENABLE_HARDNET" = true ] ; then
393 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
393 cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
394
394
395 # Enable network stack hardening
395 # Enable network stack hardening
396 net.ipv4.tcp_timestamps=0
396 net.ipv4.tcp_timestamps=0
397 net.ipv4.tcp_syncookies=1
397 net.ipv4.tcp_syncookies=1
398 net.ipv4.conf.all.rp_filter=1
398 net.ipv4.conf.all.rp_filter=1
399 net.ipv4.conf.all.accept_redirects=0
399 net.ipv4.conf.all.accept_redirects=0
400 net.ipv4.conf.all.send_redirects=0
400 net.ipv4.conf.all.send_redirects=0
401 net.ipv4.conf.all.accept_source_route=0
401 net.ipv4.conf.all.accept_source_route=0
402 net.ipv4.conf.default.rp_filter=1
402 net.ipv4.conf.default.rp_filter=1
403 net.ipv4.conf.default.accept_redirects=0
403 net.ipv4.conf.default.accept_redirects=0
404 net.ipv4.conf.default.send_redirects=0
404 net.ipv4.conf.default.send_redirects=0
405 net.ipv4.conf.default.accept_source_route=0
405 net.ipv4.conf.default.accept_source_route=0
406 net.ipv4.conf.lo.accept_redirects=0
406 net.ipv4.conf.lo.accept_redirects=0
407 net.ipv4.conf.lo.send_redirects=0
407 net.ipv4.conf.lo.send_redirects=0
408 net.ipv4.conf.lo.accept_source_route=0
408 net.ipv4.conf.lo.accept_source_route=0
409 net.ipv4.conf.eth0.accept_redirects=0
409 net.ipv4.conf.eth0.accept_redirects=0
410 net.ipv4.conf.eth0.send_redirects=0
410 net.ipv4.conf.eth0.send_redirects=0
411 net.ipv4.conf.eth0.accept_source_route=0
411 net.ipv4.conf.eth0.accept_source_route=0
412 net.ipv4.icmp_echo_ignore_broadcasts=1
412 net.ipv4.icmp_echo_ignore_broadcasts=1
413 net.ipv4.icmp_ignore_bogus_error_responses=1
413 net.ipv4.icmp_ignore_bogus_error_responses=1
414
414
415 net.ipv6.conf.all.accept_redirects=0
415 net.ipv6.conf.all.accept_redirects=0
416 net.ipv6.conf.all.accept_source_route=0
416 net.ipv6.conf.all.accept_source_route=0
417 net.ipv6.conf.all.router_solicitations=0
417 net.ipv6.conf.all.router_solicitations=0
418 net.ipv6.conf.all.accept_ra_rtr_pref=0
418 net.ipv6.conf.all.accept_ra_rtr_pref=0
419 net.ipv6.conf.all.accept_ra_pinfo=0
419 net.ipv6.conf.all.accept_ra_pinfo=0
420 net.ipv6.conf.all.accept_ra_defrtr=0
420 net.ipv6.conf.all.accept_ra_defrtr=0
421 net.ipv6.conf.all.autoconf=0
421 net.ipv6.conf.all.autoconf=0
422 net.ipv6.conf.all.dad_transmits=0
422 net.ipv6.conf.all.dad_transmits=0
423 net.ipv6.conf.all.max_addresses=1
423 net.ipv6.conf.all.max_addresses=1
424
424
425 net.ipv6.conf.default.accept_redirects=0
425 net.ipv6.conf.default.accept_redirects=0
426 net.ipv6.conf.default.accept_source_route=0
426 net.ipv6.conf.default.accept_source_route=0
427 net.ipv6.conf.default.router_solicitations=0
427 net.ipv6.conf.default.router_solicitations=0
428 net.ipv6.conf.default.accept_ra_rtr_pref=0
428 net.ipv6.conf.default.accept_ra_rtr_pref=0
429 net.ipv6.conf.default.accept_ra_pinfo=0
429 net.ipv6.conf.default.accept_ra_pinfo=0
430 net.ipv6.conf.default.accept_ra_defrtr=0
430 net.ipv6.conf.default.accept_ra_defrtr=0
431 net.ipv6.conf.default.autoconf=0
431 net.ipv6.conf.default.autoconf=0
432 net.ipv6.conf.default.dad_transmits=0
432 net.ipv6.conf.default.dad_transmits=0
433 net.ipv6.conf.default.max_addresses=1
433 net.ipv6.conf.default.max_addresses=1
434
434
435 net.ipv6.conf.lo.accept_redirects=0
435 net.ipv6.conf.lo.accept_redirects=0
436 net.ipv6.conf.lo.accept_source_route=0
436 net.ipv6.conf.lo.accept_source_route=0
437 net.ipv6.conf.lo.router_solicitations=0
437 net.ipv6.conf.lo.router_solicitations=0
438 net.ipv6.conf.lo.accept_ra_rtr_pref=0
438 net.ipv6.conf.lo.accept_ra_rtr_pref=0
439 net.ipv6.conf.lo.accept_ra_pinfo=0
439 net.ipv6.conf.lo.accept_ra_pinfo=0
440 net.ipv6.conf.lo.accept_ra_defrtr=0
440 net.ipv6.conf.lo.accept_ra_defrtr=0
441 net.ipv6.conf.lo.autoconf=0
441 net.ipv6.conf.lo.autoconf=0
442 net.ipv6.conf.lo.dad_transmits=0
442 net.ipv6.conf.lo.dad_transmits=0
443 net.ipv6.conf.lo.max_addresses=1
443 net.ipv6.conf.lo.max_addresses=1
444
444
445 net.ipv6.conf.eth0.accept_redirects=0
445 net.ipv6.conf.eth0.accept_redirects=0
446 net.ipv6.conf.eth0.accept_source_route=0
446 net.ipv6.conf.eth0.accept_source_route=0
447 net.ipv6.conf.eth0.router_solicitations=0
447 net.ipv6.conf.eth0.router_solicitations=0
448 net.ipv6.conf.eth0.accept_ra_rtr_pref=0
448 net.ipv6.conf.eth0.accept_ra_rtr_pref=0
449 net.ipv6.conf.eth0.accept_ra_pinfo=0
449 net.ipv6.conf.eth0.accept_ra_pinfo=0
450 net.ipv6.conf.eth0.accept_ra_defrtr=0
450 net.ipv6.conf.eth0.accept_ra_defrtr=0
451 net.ipv6.conf.eth0.autoconf=0
451 net.ipv6.conf.eth0.autoconf=0
452 net.ipv6.conf.eth0.dad_transmits=0
452 net.ipv6.conf.eth0.dad_transmits=0
453 net.ipv6.conf.eth0.max_addresses=1
453 net.ipv6.conf.eth0.max_addresses=1
454 EOM
454 EOM
455
455
456 # Enable resolver warnings about spoofed addresses
456 # Enable resolver warnings about spoofed addresses
457 cat <<EOM >>$R/etc/host.conf
457 cat <<EOM >>$R/etc/host.conf
458 spoof warn
458 spoof warn
459 EOM
459 EOM
460 fi
460 fi
461
461
462 # Regenerate openssh server host keys
462 # Regenerate openssh server host keys
463 if [ "$ENABLE_SSHD" = true ] ; then
463 if [ "$ENABLE_SSHD" = true ] ; then
464 rm -fr $R/etc/ssh/ssh_host_*
464 rm -fr $R/etc/ssh/ssh_host_*
465 LANG=C chroot $R dpkg-reconfigure openssh-server
465 LANG=C chroot $R dpkg-reconfigure openssh-server
466 fi
466 fi
467
467
468 # Enable serial console systemd style
468 # Enable serial console systemd style
469 if [ "$ENABLE_CONSOLE" = true ] ; then
469 if [ "$ENABLE_CONSOLE" = true ] ; then
470 LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service
470 LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service
471 fi
471 fi
472
472
473 # Enable firewall based on iptables started by systemd service
473 # Enable firewall based on iptables started by systemd service
474 if [ "$ENABLE_IPTABLES" = true ] ; then
474 if [ "$ENABLE_IPTABLES" = true ] ; then
475 # Create iptables configuration directory
475 # Create iptables configuration directory
476 mkdir -p "$R/etc/iptables"
476 mkdir -p "$R/etc/iptables"
477
477
478 # Create iptables systemd service
478 # Create iptables systemd service
479 cat <<EOM >$R/etc/systemd/system/iptables.service
479 cat <<EOM >$R/etc/systemd/system/iptables.service
480 [Unit]
480 [Unit]
481 Description=Packet Filtering Framework
481 Description=Packet Filtering Framework
482 DefaultDependencies=no
482 DefaultDependencies=no
483 After=systemd-sysctl.service
483 After=systemd-sysctl.service
484 Before=sysinit.target
484 Before=sysinit.target
485 [Service]
485 [Service]
486 Type=oneshot
486 Type=oneshot
487 ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
487 ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
488 ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
488 ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
489 ExecStop=/etc/iptables/flush-iptables.sh
489 ExecStop=/etc/iptables/flush-iptables.sh
490 RemainAfterExit=yes
490 RemainAfterExit=yes
491 [Install]
491 [Install]
492 WantedBy=multi-user.target
492 WantedBy=multi-user.target
493 EOM
493 EOM
494
494
495 # Create flush-table script called by iptables service
495 # Create flush-table script called by iptables service
496 cat <<EOM >$R/etc/iptables/flush-iptables.sh
496 cat <<EOM >$R/etc/iptables/flush-iptables.sh
497 #!/bin/sh
497 #!/bin/sh
498 iptables -F
498 iptables -F
499 iptables -X
499 iptables -X
500 iptables -t nat -F
500 iptables -t nat -F
501 iptables -t nat -X
501 iptables -t nat -X
502 iptables -t mangle -F
502 iptables -t mangle -F
503 iptables -t mangle -X
503 iptables -t mangle -X
504 iptables -P INPUT ACCEPT
504 iptables -P INPUT ACCEPT
505 iptables -P FORWARD ACCEPT
505 iptables -P FORWARD ACCEPT
506 iptables -P OUTPUT ACCEPT
506 iptables -P OUTPUT ACCEPT
507 EOM
507 EOM
508
508
509 # Create iptables rule file
509 # Create iptables rule file
510 cat <<EOM >$R/etc/iptables/iptables.rules
510 cat <<EOM >$R/etc/iptables/iptables.rules
511 *filter
511 *filter
512 :INPUT DROP [0:0]
512 :INPUT DROP [0:0]
513 :FORWARD DROP [0:0]
513 :FORWARD DROP [0:0]
514 :OUTPUT ACCEPT [0:0]
514 :OUTPUT ACCEPT [0:0]
515 :TCP - [0:0]
515 :TCP - [0:0]
516 :UDP - [0:0]
516 :UDP - [0:0]
517 :SSH - [0:0]
517 :SSH - [0:0]
518
518
519 # Rate limit ping requests
519 # Rate limit ping requests
520 -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
520 -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
521 -A INPUT -p icmp --icmp-type echo-request -j DROP
521 -A INPUT -p icmp --icmp-type echo-request -j DROP
522
522
523 # Accept established connections
523 # Accept established connections
524 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
524 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
525
525
526 # Accept all traffic on loopback interface
526 # Accept all traffic on loopback interface
527 -A INPUT -i lo -j ACCEPT
527 -A INPUT -i lo -j ACCEPT
528
528
529 # Drop packets declared invalid
529 # Drop packets declared invalid
530 -A INPUT -m conntrack --ctstate INVALID -j DROP
530 -A INPUT -m conntrack --ctstate INVALID -j DROP
531
531
532 # SSH rate limiting
532 # SSH rate limiting
533 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
533 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
534 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
534 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
535 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
535 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
536 -A SSH -m recent --name sshbf --set -j ACCEPT
536 -A SSH -m recent --name sshbf --set -j ACCEPT
537
537
538 # Send TCP and UDP connections to their respective rules chain
538 # Send TCP and UDP connections to their respective rules chain
539 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
539 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
540 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
540 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
541
541
542 # Reject dropped packets with a RFC compliant responce
542 # Reject dropped packets with a RFC compliant responce
543 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
543 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
544 -A INPUT -p tcp -j REJECT --reject-with tcp-rst
544 -A INPUT -p tcp -j REJECT --reject-with tcp-rst
545 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
545 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
546
546
547 ## TCP PORT RULES
547 ## TCP PORT RULES
548 # -A TCP -p tcp -j LOG
548 # -A TCP -p tcp -j LOG
549
549
550 ## UDP PORT RULES
550 ## UDP PORT RULES
551 # -A UDP -p udp -j LOG
551 # -A UDP -p udp -j LOG
552
552
553 COMMIT
553 COMMIT
554 EOM
554 EOM
555
555
556 # Reload systemd configuration and enable iptables service
556 # Reload systemd configuration and enable iptables service
557 LANG=C chroot $R systemctl daemon-reload
557 LANG=C chroot $R systemctl daemon-reload
558 LANG=C chroot $R systemctl enable iptables.service
558 LANG=C chroot $R systemctl enable iptables.service
559
559
560 if [ "$ENABLE_IPV6" = true ] ; then
560 if [ "$ENABLE_IPV6" = true ] ; then
561 # Create ip6tables systemd service
561 # Create ip6tables systemd service
562 cat <<EOM >$R/etc/systemd/system/ip6tables.service
562 cat <<EOM >$R/etc/systemd/system/ip6tables.service
563 [Unit]
563 [Unit]
564 Description=Packet Filtering Framework
564 Description=Packet Filtering Framework
565 DefaultDependencies=no
565 DefaultDependencies=no
566 After=systemd-sysctl.service
566 After=systemd-sysctl.service
567 Before=sysinit.target
567 Before=sysinit.target
568 [Service]
568 [Service]
569 Type=oneshot
569 Type=oneshot
570 ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
570 ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
571 ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
571 ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
572 ExecStop=/etc/iptables/flush-ip6tables.sh
572 ExecStop=/etc/iptables/flush-ip6tables.sh
573 RemainAfterExit=yes
573 RemainAfterExit=yes
574 [Install]
574 [Install]
575 WantedBy=multi-user.target
575 WantedBy=multi-user.target
576 EOM
576 EOM
577
577
578 # Create ip6tables file
578 # Create ip6tables file
579 cat <<EOM >$R/etc/iptables/flush-ip6tables.sh
579 cat <<EOM >$R/etc/iptables/flush-ip6tables.sh
580 #!/bin/sh
580 #!/bin/sh
581 ip6tables -F
581 ip6tables -F
582 ip6tables -X
582 ip6tables -X
583 ip6tables -Z
583 ip6tables -Z
584 for table in $(</proc/net/ip6_tables_names)
584 for table in $(</proc/net/ip6_tables_names)
585 do
585 do
586 ip6tables -t \$table -F
586 ip6tables -t \$table -F
587 ip6tables -t \$table -X
587 ip6tables -t \$table -X
588 ip6tables -t \$table -Z
588 ip6tables -t \$table -Z
589 done
589 done
590 ip6tables -P INPUT ACCEPT
590 ip6tables -P INPUT ACCEPT
591 ip6tables -P OUTPUT ACCEPT
591 ip6tables -P OUTPUT ACCEPT
592 ip6tables -P FORWARD ACCEPT
592 ip6tables -P FORWARD ACCEPT
593 EOM
593 EOM
594
594
595 # Create ip6tables rule file
595 # Create ip6tables rule file
596 cat <<EOM >$R/etc/iptables/ip6tables.rules
596 cat <<EOM >$R/etc/iptables/ip6tables.rules
597 *filter
597 *filter
598 :INPUT DROP [0:0]
598 :INPUT DROP [0:0]
599 :FORWARD DROP [0:0]
599 :FORWARD DROP [0:0]
600 :OUTPUT ACCEPT [0:0]
600 :OUTPUT ACCEPT [0:0]
601 :TCP - [0:0]
601 :TCP - [0:0]
602 :UDP - [0:0]
602 :UDP - [0:0]
603 :SSH - [0:0]
603 :SSH - [0:0]
604
604
605 # Drop packets with RH0 headers
605 # Drop packets with RH0 headers
606 -A INPUT -m rt --rt-type 0 -j DROP
606 -A INPUT -m rt --rt-type 0 -j DROP
607 -A OUTPUT -m rt --rt-type 0 -j DROP
607 -A OUTPUT -m rt --rt-type 0 -j DROP
608 -A FORWARD -m rt --rt-type 0 -j DROP
608 -A FORWARD -m rt --rt-type 0 -j DROP
609
609
610 # Rate limit ping requests
610 # Rate limit ping requests
611 -A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
611 -A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
612 -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
612 -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
613
613
614 # Accept established connections
614 # Accept established connections
615 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
615 -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
616
616
617 # Accept all traffic on loopback interface
617 # Accept all traffic on loopback interface
618 -A INPUT -i lo -j ACCEPT
618 -A INPUT -i lo -j ACCEPT
619
619
620 # Drop packets declared invalid
620 # Drop packets declared invalid
621 -A INPUT -m conntrack --ctstate INVALID -j DROP
621 -A INPUT -m conntrack --ctstate INVALID -j DROP
622
622
623 # SSH rate limiting
623 # SSH rate limiting
624 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
624 -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
625 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
625 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
626 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
626 -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
627 -A SSH -m recent --name sshbf --set -j ACCEPT
627 -A SSH -m recent --name sshbf --set -j ACCEPT
628
628
629 # Send TCP and UDP connections to their respective rules chain
629 # Send TCP and UDP connections to their respective rules chain
630 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
630 -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
631 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
631 -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
632
632
633 # Reject dropped packets with a RFC compliant responce
633 # Reject dropped packets with a RFC compliant responce
634 -A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited
634 -A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited
635 -A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited
635 -A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited
636 -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
636 -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
637
637
638 ## TCP PORT RULES
638 ## TCP PORT RULES
639 # -A TCP -p tcp -j LOG
639 # -A TCP -p tcp -j LOG
640
640
641 ## UDP PORT RULES
641 ## UDP PORT RULES
642 # -A UDP -p udp -j LOG
642 # -A UDP -p udp -j LOG
643
643
644 COMMIT
644 COMMIT
645 EOM
645 EOM
646
646
647 # Reload systemd configuration and enable iptables service
647 # Reload systemd configuration and enable iptables service
648 LANG=C chroot $R systemctl daemon-reload
648 LANG=C chroot $R systemctl daemon-reload
649 LANG=C chroot $R systemctl enable ip6tables.service
649 LANG=C chroot $R systemctl enable ip6tables.service
650
650
651 fi
651 fi
652 fi
652 fi
653
653
654 if [ "$ENABLE_UBOOT" = true ] ; then
654 if [ "$ENABLE_UBOOT" = true ] ; then
655 # Fetch u-boot github
655 # Fetch u-boot github
656 git -C $R/tmp clone git://git.denx.de/u-boot.git
656 git -C $R/tmp clone git://git.denx.de/u-boot.git
657
657
658 # Install minimal gcc/g++ build environment and build u-boot inside chroot
658 # Install minimal gcc/g++ build environment and build u-boot inside chroot
659 LANG=C chroot $R apt-get install -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
659 LANG=C chroot $R apt-get install -qq -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
660 LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all
660 LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all
661
661
662 # Copy compiled bootloader binary and set config.txt to load it
662 # Copy compiled bootloader binary and set config.txt to load it
663 cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
663 cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
664 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
664 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
665
665
666 # Set u-boot command file
666 # Set u-boot command file
667 cat <<EOM >$R/boot/firmware/uboot.mkimage
667 cat <<EOM >$R/boot/firmware/uboot.mkimage
668 # Tell Linux that it is booting on a Raspberry Pi2
668 # Tell Linux that it is booting on a Raspberry Pi2
669 setenv machid 0x00000c42
669 setenv machid 0x00000c42
670
670
671 # Set the kernel boot command line
671 # Set the kernel boot command line
672 setenv bootargs "earlyprintk ${CMDLINE}"
672 setenv bootargs "earlyprintk ${CMDLINE}"
673
673
674 # Save these changes to u-boot's environment
674 # Save these changes to u-boot's environment
675 saveenv
675 saveenv
676
676
677 # Load the existing Linux kernel into RAM
677 # Load the existing Linux kernel into RAM
678 fatload mmc 0:1 \${kernel_addr_r} kernel7.img
678 fatload mmc 0:1 \${kernel_addr_r} kernel7.img
679
679
680 # Boot the kernel we have just loaded
680 # Boot the kernel we have just loaded
681 bootz \${kernel_addr_r}
681 bootz \${kernel_addr_r}
682 EOM
682 EOM
683
683
684 # Generate u-boot image from command file
684 # Generate u-boot image from command file
685 LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
685 LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
686
686
687 # Remove gcc/c++ build enviroment
687 # Remove gcc/c++ build enviroment
688 LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
688 LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
689 fi
689 fi
690
690
691 # Clean cached downloads
691 # Clean cached downloads
692 LANG=C chroot $R apt-get -y clean
692 LANG=C chroot $R apt-get -y clean
693 LANG=C chroot $R apt-get -y autoclean
693 LANG=C chroot $R apt-get -y autoclean
694 LANG=C chroot $R apt-get -y autoremove
694 LANG=C chroot $R apt-get -y autoremove
695
695
696 # Unmount mounted filesystems
696 # Unmount mounted filesystems
697 umount -l $R/proc
697 umount -l $R/proc
698 umount -l $R/sys
698 umount -l $R/sys
699
699
700 # Clean up files
700 # Clean up files
701 rm -f $R/etc/apt/sources.list.save
701 rm -f $R/etc/apt/sources.list.save
702 rm -f $R/etc/resolvconf/resolv.conf.d/original
702 rm -f $R/etc/resolvconf/resolv.conf.d/original
703 rm -rf $R/run
703 rm -rf $R/run
704 mkdir -p $R/run
704 mkdir -p $R/run
705 rm -f $R/etc/*-
705 rm -f $R/etc/*-
706 rm -f $R/root/.bash_history
706 rm -f $R/root/.bash_history
707 rm -rf $R/tmp/*
707 rm -rf $R/tmp/*
708 rm -f $R/var/lib/urandom/random-seed
708 rm -f $R/var/lib/urandom/random-seed
709 [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
709 [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
710 rm -f $R/etc/machine-id
710 rm -f $R/etc/machine-id
711
711
712 # Calculate size of the chroot directory
712 # Calculate size of the chroot directory
713 CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)
713 CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)
714
714
715 # Calculate required image size
715 # Calculate required image size
716 IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`
716 IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`
717
717
718 # Calculate number of sectors for the partition
718 # Calculate number of sectors for the partition
719 IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`
719 IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`
720
720
721 # Prepare date string for image file name
721 # Prepare date string for image file name
722 DATE="$(date +%Y-%m-%d)"
722 DATE="$(date +%Y-%m-%d)"
723
723
724 # Prepare image file
724 # Prepare image file
725 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1
725 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1
726 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}
726 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}
727
727
728 # Write partition table
728 # Write partition table
729 sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
729 sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
730 unit: sectors
730 unit: sectors
731
731
732 1 : start= 2048, size= 131072, Id= c, bootable
732 1 : start= 2048, size= 131072, Id= c, bootable
733 2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83
733 2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83
734 3 : start= 0, size= 0, Id= 0
734 3 : start= 0, size= 0, Id= 0
735 4 : start= 0, size= 0, Id= 0
735 4 : start= 0, size= 0, Id= 0
736 EOM
736 EOM
737
737
738 # Set up temporary loop devices and build filesystems
738 # Set up temporary loop devices and build filesystems
739 VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
739 VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
740 EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
740 EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
741 mkfs.vfat "$VFAT_LOOP"
741 mkfs.vfat "$VFAT_LOOP"
742 mkfs.ext4 "$EXT4_LOOP"
742 mkfs.ext4 "$EXT4_LOOP"
743
743
744 # Mount the temporary loop devices
744 # Mount the temporary loop devices
745 mkdir -p "$BUILDDIR/mount"
745 mkdir -p "$BUILDDIR/mount"
746 mount "$EXT4_LOOP" "$BUILDDIR/mount"
746 mount "$EXT4_LOOP" "$BUILDDIR/mount"
747
747
748 mkdir -p "$BUILDDIR/mount/boot/firmware"
748 mkdir -p "$BUILDDIR/mount/boot/firmware"
749 mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
749 mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
750
750
751 # Copy all files from the chroot to the loop device mount point directory
751 # Copy all files from the chroot to the loop device mount point directory
752 rsync -a "$R/" "$BUILDDIR/mount/"
752 rsync -a "$R/" "$BUILDDIR/mount/"
753
753
754 # Unmount all temporary loop devices and mount points
754 # Unmount all temporary loop devices and mount points
755 cleanup
755 cleanup
756
756
757 # (optinal) create block map file for "bmaptool"
757 # (optinal) create block map file for "bmaptool"
758 bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
758 bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
759
759
760 # Image was successfully created
760 # Image was successfully created
761 echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"
761 echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant