Raspi2-3_GenImage Commit - r9:b95e309600c1 · Collaboration Tremplin des Sciences

1

#!/bin/sh

1

#!/bin/sh

2

3

########################################################################

3

########################################################################

4

# rpi2-gen-image.sh ver2a 12/2015

4

# rpi2-gen-image.sh ver2a 12/2015

5

#

5

#

6

# Advanced debian "jessie" bootstrap script for RPi2

6

# Advanced debian "jessie" bootstrap script for RPi2

7

#

7

#

8

# This program is free software; you can redistribute it and/or

8

# This program is free software; you can redistribute it and/or

9

# modify it under the terms of the GNU General Public License

9

# modify it under the terms of the GNU General Public License

10

# as published by the Free Software Foundation; either version 2

10

# as published by the Free Software Foundation; either version 2

11

# of the License, or (at your option) any later version.

11

# of the License, or (at your option) any later version.

12

#

12

#

13

# some parts based on rpi2-build-image:

13

# some parts based on rpi2-build-image:

14

15

16

########################################################################

16

########################################################################

17

18

cleanup (){

18

cleanup (){

19

set +x

19

set +x

20

set +e

20

set +e

21

echo "removing temporary mount points ..."

21

echo "removing temporary mount points ..."

22

umount -l $R/proc 2> /dev/null

22

umount -l $R/proc 2> /dev/null

23

umount -l $R/sys 2> /dev/null

23

umount -l $R/sys 2> /dev/null

24

umount -l $R/dev/pts 2> /dev/null

24

umount -l $R/dev/pts 2> /dev/null

25

umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null

25

umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null

26

umount "$BUILDDIR/mount" 2> /dev/null

26

umount "$BUILDDIR/mount" 2> /dev/null

27

losetup -d "$EXT4_LOOP" 2> /dev/null

27

losetup -d "$EXT4_LOOP" 2> /dev/null

28

losetup -d "$VFAT_LOOP" 2> /dev/null

28

losetup -d "$VFAT_LOOP" 2> /dev/null

29

trap - 0 1 2 3 6

29

trap - 0 1 2 3 6

30

}

30

}

31

32

set -e

32

set -e

33

set -x

33

set -x

34

35

RELEASE=${RELEASE:=jessie}

35

RELEASE=${RELEASE:=jessie}

36

37

# Build settings

37

# Build settings

38

BASEDIR=./images/${RELEASE}

38

BASEDIR=./images/${RELEASE}

39

BUILDDIR=${BASEDIR}/build

39

BUILDDIR=${BASEDIR}/build

40

41

# General settings

41

# General settings

42

HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}

42

HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}

43

PASSWORD=${PASSWORD:=raspberry}

43

PASSWORD=${PASSWORD:=raspberry}

44

DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}

44

DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}

45

TIMEZONE=${TIMEZONE:="Europe/Berlin"}

45

TIMEZONE=${TIMEZONE:="Europe/Berlin"}

46

47

# APT settings

47

# APT settings

48

APT_PROXY=${APT_PROXY:=""}

48

APT_PROXY=${APT_PROXY:=""}

49

APT_SERVER=${APT_SERVER:="ftp.debian.org"}

49

APT_SERVER=${APT_SERVER:="ftp.debian.org"}

50

51

# Feature settings

51

# Feature settings

52

ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}

52

ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}

53

ENABLE_IPV6=${ENABLE_IPV6:=true}

53

ENABLE_IPV6=${ENABLE_IPV6:=true}

54

ENABLE_SSHD=${ENABLE_SSHD:=true}

54

ENABLE_SSHD=${ENABLE_SSHD:=true}

55

ENABLE_SOUND=${ENABLE_SOUND:=true}

55

ENABLE_SOUND=${ENABLE_SOUND:=true}

56

ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}

56

ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}

57

ENABLE_DBUS=${ENABLE_DBUS:=true}

57

ENABLE_DBUS=${ENABLE_DBUS:=true}

58

ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}

58

ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}

59

ENABLE_MINGPU=${ENABLE_MINGPU:=false}

59

ENABLE_MINGPU=${ENABLE_MINGPU:=false}

60

ENABLE_XORG=${ENABLE_XORG:=false}

60

ENABLE_XORG=${ENABLE_XORG:=false}

61

ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}

61

ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}

62

63

# Advanced settings

63

# Advanced settings

64

ENABLE_UBOOT=${ENABLE_UBOOT:=false}

64

ENABLE_UBOOT=${ENABLE_UBOOT:=false}

65

ENABLE_HARDNET=${ENABLE_HARDNET:=false}

65

ENABLE_HARDNET=${ENABLE_HARDNET:=false}

66

ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}

66

ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}

67

68

# Image chroot path

68

# Image chroot path

69

R=${BUILDDIR}/chroot

69

R=${BUILDDIR}/chroot

70

71

# Packages required for bootstrapping

71

# Packages required for bootstrapping

72

REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"

72

REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"

73

74

# Missing packages that need to be installed

74

# Missing packages that need to be installed

75

MISSING_PACKAGES=""

75

MISSING_PACKAGES=""

76

77

# Packages required in the chroot build enviroment

77

# Packages required in the chroot build enviroment

78

APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"

78

APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"

79

80

set +x

80

set +x

81

82

# Are we running as root?

82

# Are we running as root?

83

if [ "$(id -u)" -ne "0" ] ; then

83

if [ "$(id -u)" -ne "0" ] ; then

84

echo "this script must be executed with root privileges"

84

echo "this script must be executed with root privileges"

85

exit 1

85

exit 1

86

fi

86

fi

87

88

# Check if all required packages are installed

88

# Check if all required packages are installed

89

for package in $REQUIRED_PACKAGES ; do

89

for package in $REQUIRED_PACKAGES ; do

90

if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then

90

if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then

91

MISSING_PACKAGES="$MISSING_PACKAGES $package"

91

MISSING_PACKAGES="$MISSING_PACKAGES $package"

92

fi

92

fi

93

done

93

done

94

95

# Ask if missing packages should get installed right now

95

# Ask if missing packages should get installed right now

96

if [ -n "$MISSING_PACKAGES" ] ; then

96

if [ -n "$MISSING_PACKAGES" ] ; then

97

echo "the following packages needed by this script are not installed:"

97

echo "the following packages needed by this script are not installed:"

98

echo "$MISSING_PACKAGES"

98

echo "$MISSING_PACKAGES"

99

100

echo -n "\ndo you want to install the missing packages right now? [y/n] "

100

echo -n "\ndo you want to install the missing packages right now? [y/n] "

101

read confirm

101

read confirm

102

if [ "$confirm" != "y" ] ; then

102

if [ "$confirm" != "y" ] ; then

103

exit 1

103

exit 1

104

fi

104

fi

105

fi

105

fi

106

107

# Make sure all required packages are installed

107

# Make sure all required packages are installed

108

apt-get -qq -y install ${REQUIRED_PACKAGES}

108

apt-get -qq -y install ${REQUIRED_PACKAGES}

109

exit

110

109

111

# Don't clobber an old build

110

# Don't clobber an old build

112

if [ -e "$BUILDDIR" ]; then

111

if [ -e "$BUILDDIR" ]; then

113

echo "directory $BUILDDIR already exists, not proceeding"

112

echo "directory $BUILDDIR already exists, not proceeding"

114

exit 1

113

exit 1

115

fi

114

fi

116

115

117

set -x

116

set -x

118

117

119

# Call "cleanup" function on various signals and errors

118

# Call "cleanup" function on various signals and errors

120

trap cleanup 0 1 2 3 6

119

trap cleanup 0 1 2 3 6

121

120

122

# Set up chroot directory

121

# Set up chroot directory

123

mkdir -p $R

122

mkdir -p $R

124

123

125

# Use traditional SystemV init instead of systemd services

124

# Use traditional SystemV init instead of systemd services

126

if [ "$ENABLE_SYSTEMD" = false ] ; then

125

if [ "$ENABLE_SYSTEMD" = false ] ; then

127

APT_INCLUDES="${APT_INCLUDES},sysvinit-core"

126

APT_INCLUDES="${APT_INCLUDES},sysvinit-core"

128

fi

127

fi

129

128

130

# Add dbus package, recommended if using systemd

129

# Add dbus package, recommended if using systemd

131

if [ "$ENABLE_DBUS" = true ] ; then

130

if [ "$ENABLE_DBUS" = true ] ; then

132

APT_INCLUDES="${APT_INCLUDES},dbus"

131

APT_INCLUDES="${APT_INCLUDES},dbus"

133

fi

132

fi

134

133

135

# Add openssh server package

134

# Add openssh server package

136

if [ "$ENABLE_SSHD" = true ] ; then

135

if [ "$ENABLE_SSHD" = true ] ; then

137

APT_INCLUDES="${APT_INCLUDES},openssh-server"

136

APT_INCLUDES="${APT_INCLUDES},openssh-server"

138

fi

137

fi

139

138

140

# Add rng-tools package

139

# Add rng-tools package

141

if [ "$ENABLE_HWRANDOM" = true ] ; then

140

if [ "$ENABLE_HWRANDOM" = true ] ; then

142

APT_INCLUDES="${APT_INCLUDES},rng-tools"

141

APT_INCLUDES="${APT_INCLUDES},rng-tools"

143

fi

142

fi

144

143

145

# Add xorg package

144

# Add xorg package

146

if [ "$ENABLE_XORG" = true ] ; then

145

if [ "$ENABLE_XORG" = true ] ; then

147

APT_INCLUDES="${APT_INCLUDES},xorg"

146

APT_INCLUDES="${APT_INCLUDES},xorg"

148

fi

147

fi

149

148

150

# Add fluxbox package with eterm

149

# Add fluxbox package with eterm

151

if [ "$ENABLE_FLUXBOX" = true ] ; then

150

if [ "$ENABLE_FLUXBOX" = true ] ; then

152

APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"

151

APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"

153

fi

152

fi

154

153

155

if [ -z "$APT_PROXY" ] ; then

154

if [ -z "$APT_PROXY" ] ; then

156

APT_PROXY="http://"

155

APT_PROXY="http://"

157

fi

156

fi

158

157

159

# Base debootstrap (unpack only)

158

# Base debootstrap (unpack only)

160

debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian

159

debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian

161

cp /usr/bin/qemu-arm-static $R/usr/bin

160

cp /usr/bin/qemu-arm-static $R/usr/bin

162

161

163

# Remove systemd related packages from list of packages to be bootstrapped

162

# Remove systemd related packages from list of packages to be bootstrapped

164

if [ "$ENABLE_SYSTEMD" = false ] ; then

163

if [ "$ENABLE_SYSTEMD" = false ] ; then

165

chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required

164

chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required

166

fi

165

fi

167

166

168

# Copy debian-archive-keyring.pgp

167

# Copy debian-archive-keyring.pgp

169

chroot $R mkdir -p /usr/share/keyrings

168

chroot $R mkdir -p /usr/share/keyrings

170

cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg

169

cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg

171

170

172

# Complete the bootstrapping proccess

171

# Complete the bootstrapping proccess

173

chroot $R /debootstrap/debootstrap --second-stage

172

chroot $R /debootstrap/debootstrap --second-stage

174

173

175

# Mount required filesystems

174

# Mount required filesystems

176

mount -t proc none $R/proc

175

mount -t proc none $R/proc

177

mount -t sysfs none $R/sys

176

mount -t sysfs none $R/sys

178

mount --bind /dev/pts $R/dev/pts

177

mount --bind /dev/pts $R/dev/pts

179

178

180

# Set up initial sources.list

179

# Set up initial sources.list

181

cat <<EOM >$R/etc/apt/sources.list

180

cat <<EOM >$R/etc/apt/sources.list

182

deb http://${APT_SERVER}/debian ${RELEASE} main contrib

181

deb http://${APT_SERVER}/debian ${RELEASE} main contrib

183

#deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib

182

#deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib

184

183

185

deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

184

deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

186

#deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

185

#deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

187

186

188

deb http://security.debian.org/ ${RELEASE}/updates main contrib

187

deb http://security.debian.org/ ${RELEASE}/updates main contrib

189

#deb-src http://security.debian.org/ ${RELEASE}/updates main contrib

188

#deb-src http://security.debian.org/ ${RELEASE}/updates main contrib

190

189

191

deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2

190

deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2

192

EOM

191

EOM

193

192

194

# Pin package flash-kernel to repositories.collabora.co.uk

193

# Pin package flash-kernel to repositories.collabora.co.uk

195

cat <<EOM >$R/etc/apt/preferences.d/flash-kernel

194

cat <<EOM >$R/etc/apt/preferences.d/flash-kernel

196

Package: flash-kernel

195

Package: flash-kernel

197

Pin: origin repositories.collabora.co.uk

196

Pin: origin repositories.collabora.co.uk

198

Pin-Priority: 1000

197

Pin-Priority: 1000

199

EOM

198

EOM

200

199

201

# Set up timezone

200

# Set up timezone

202

echo ${TIMEZONE} >$R/etc/timezone

201

echo ${TIMEZONE} >$R/etc/timezone

203

LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata

202

LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata

204

203

205

# Set up default locales to "en_US.UTF-8" default

204

# Set up default locales to "en_US.UTF-8" default

206

LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen

205

LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen

207

LANG=C chroot $R locale-gen ${DEFLOCAL}

206

LANG=C chroot $R locale-gen ${DEFLOCAL}

208

207

209

# Fetch APT public key "Collabora Raspbian Archive Signing Key <daniels@collabora.com>"

208

# Fetch APT public key "Collabora Raspbian Archive Signing Key <daniels@collabora.com>"

210

LANG=C chroot $R apt-key adv --keyserver hkp://pool.sks-keyservers.net --recv-keys ED4BF9140C50B1C5

209

LANG=C chroot $R apt-key adv --keyserver hkp://pool.sks-keyservers.net --recv-keys ED4BF9140C50B1C5

211

210

212

# Upgrade package index and update all installed packages and changed dependencies

211

# Upgrade package index and update all installed packages and changed dependencies

213

LANG=C chroot $R apt-get -q -y update

212

LANG=C chroot $R apt-get -q -y update

214

LANG=C chroot $R apt-get -q -y -u dist-upgrade

213

LANG=C chroot $R apt-get -q -y -u dist-upgrade

215

214

216

# Kernel installation

215

# Kernel installation

217

# Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot

216

# Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot

218

217

219

LANG=C chroot $R apt-get -q -y --force-yes --no-install-recommends install linux-image-3.18.0-trunk-rpi2

218

LANG=C chroot $R apt-get -q -y --force-yes --no-install-recommends install linux-image-3.18.0-trunk-rpi2

220

LANG=C chroot $R apt-get -q -y --force-yes install flash-kernel

219

LANG=C chroot $R apt-get -q -y --force-yes install flash-kernel

221

220

222

VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"

221

VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"

223

[ -z "$VMLINUZ" ] && exit 1

222

[ -z "$VMLINUZ" ] && exit 1

224

mkdir -p $R/boot/firmware

223

mkdir -p $R/boot/firmware

225

224

226

# required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")

225

# required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")

227

wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin

226

wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin

228

wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat

227

wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat

229

wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat

228

wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat

230

wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat

229

wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat

231

wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf

230

wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf

232

wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf

231

wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf

233

wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf

232

wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf

234

cp $VMLINUZ $R/boot/firmware/kernel7.img

233

cp $VMLINUZ $R/boot/firmware/kernel7.img

235

234

236

# Set up hosts

235

# Set up hosts

237

echo ${HOSTNAME} >$R/etc/hostname

236

echo ${HOSTNAME} >$R/etc/hostname

238

cat <<EOM >$R/etc/hosts

237

cat <<EOM >$R/etc/hosts

239

127.0.0.1 localhost

238

127.0.0.1 localhost

240

127.0.1.1 ${HOSTNAME}

239

127.0.1.1 ${HOSTNAME}

241

EOM

240

EOM

242

241

243

if [ "$ENABLE_IPV6" = true ] ; then

242

if [ "$ENABLE_IPV6" = true ] ; then

244

cat <<EOM >>$R/etc/hosts

243

cat <<EOM >>$R/etc/hosts

245

244

246

::1 localhost ip6-localhost ip6-loopback

245

::1 localhost ip6-localhost ip6-loopback

247

ff02::1 ip6-allnodes

246

ff02::1 ip6-allnodes

248

ff02::2 ip6-allrouters

247

ff02::2 ip6-allrouters

249

EOM

248

EOM

250

fi

249

fi

251

250

252

# Generate crypt(3) password string

251

# Generate crypt(3) password string

253

ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`

252

ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`

254

253

255

# Set up default user

254

# Set up default user

256

LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi

255

LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi

257

LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi

256

LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi

258

257

259

# Set up root password

258

# Set up root password

260

LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root

259

LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root

261

260

262

261

263

# Set up interfaces

262

# Set up interfaces

264

cat <<EOM >$R/etc/network/interfaces

263

cat <<EOM >$R/etc/network/interfaces

265

# interfaces(5) file used by ifup(8) and ifdown(8)

264

# interfaces(5) file used by ifup(8) and ifdown(8)

266

# Include files from /etc/network/interfaces.d:

265

# Include files from /etc/network/interfaces.d:

267

source-directory /etc/network/interfaces.d

266

source-directory /etc/network/interfaces.d

268

267

269

# The loopback network interface

268

# The loopback network interface

270

auto lo

269

auto lo

271

iface lo inet loopback

270

iface lo inet loopback

272

271

273

# The primary network interface

272

# The primary network interface

274

allow-hotplug eth0

273

allow-hotplug eth0

275

iface eth0 inet dhcp

274

iface eth0 inet dhcp

276

EOM

275

EOM

277

276

278

# Set up firmware boot cmdline

277

# Set up firmware boot cmdline

279

CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"

278

CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"

280

279

281

# Set up serial console support (if requested)

280

# Set up serial console support (if requested)

282

if [ "$ENABLE_CONSOLE" = true ] ; then

281

if [ "$ENABLE_CONSOLE" = true ] ; then

283

CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"

282

CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"

284

fi

283

fi

285

284

286

# Set up ipv6 support (if requested)

285

# Set up ipv6 support (if requested)

287

if [ "$ENABLE_IPV6" = false ] ; then

286

if [ "$ENABLE_IPV6" = false ] ; then

288

CMDLINE="${CMDLINE} ipv6.disable=1"

287

CMDLINE="${CMDLINE} ipv6.disable=1"

289

fi

288

fi

290

289

291

echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt

290

echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt

292

291

293

# Set up firmware config

292

# Set up firmware config

294

cat <<EOM >$R/boot/firmware/config.txt

293

cat <<EOM >$R/boot/firmware/config.txt

295

# For more options and information see

294

# For more options and information see

296

# http://www.raspberrypi.org/documentation/configuration/config-txt.md

295

# http://www.raspberrypi.org/documentation/configuration/config-txt.md

297

# Some settings may impact device functionality. See link above for details

296

# Some settings may impact device functionality. See link above for details

298

297

299

# uncomment if you get no picture on HDMI for a default "safe" mode

298

# uncomment if you get no picture on HDMI for a default "safe" mode

300

#hdmi_safe=1

299

#hdmi_safe=1

301

300

302

# uncomment this if your display has a black border of unused pixels visible

301

# uncomment this if your display has a black border of unused pixels visible

303

# and your display can output without overscan

302

# and your display can output without overscan

304

#disable_overscan=1

303

#disable_overscan=1

305

304

306

# uncomment the following to adjust overscan. Use positive numbers if console

305

# uncomment the following to adjust overscan. Use positive numbers if console

307

# goes off screen, and negative if there is too much border

306

# goes off screen, and negative if there is too much border

308

#overscan_left=16

307

#overscan_left=16

309

#overscan_right=16

308

#overscan_right=16

310

#overscan_top=16

309

#overscan_top=16

311

#overscan_bottom=16

310

#overscan_bottom=16

312

311

313

# uncomment to force a console size. By default it will be display's size minus

312

# uncomment to force a console size. By default it will be display's size minus

314

# overscan.

313

# overscan.

315

#framebuffer_width=1280

314

#framebuffer_width=1280

316

#framebuffer_height=720

315

#framebuffer_height=720

317

316

318

# uncomment if hdmi display is not detected and composite is being output

317

# uncomment if hdmi display is not detected and composite is being output

319

#hdmi_force_hotplug=1

318

#hdmi_force_hotplug=1

320

319

321

# uncomment to force a specific HDMI mode (this will force VGA)

320

# uncomment to force a specific HDMI mode (this will force VGA)

322

#hdmi_group=1

321

#hdmi_group=1

323

#hdmi_mode=1

322

#hdmi_mode=1

324

323

325

# uncomment to force a HDMI mode rather than DVI. This can make audio work in

324

# uncomment to force a HDMI mode rather than DVI. This can make audio work in

326

# DMT (computer monitor) modes

325

# DMT (computer monitor) modes

327

#hdmi_drive=2

326

#hdmi_drive=2

328

327

329

# uncomment to increase signal to HDMI, if you have interference, blanking, or

328

# uncomment to increase signal to HDMI, if you have interference, blanking, or

330

# no display

329

# no display

331

#config_hdmi_boost=4

330

#config_hdmi_boost=4

332

331

333

# uncomment for composite PAL

332

# uncomment for composite PAL

334

#sdtv_mode=2

333

#sdtv_mode=2

335

334

336

# uncomment to overclock the arm. 700 MHz is the default.

335

# uncomment to overclock the arm. 700 MHz is the default.

337

#arm_freq=800

336

#arm_freq=800

338

EOM

337

EOM

339

338

340

# Set smallest possible GPU memory allocation size: 16MB (no X)

339

# Set smallest possible GPU memory allocation size: 16MB (no X)

341

if [ "$ENABLE_MINGPU" = true ] ; then

340

if [ "$ENABLE_MINGPU" = true ] ; then

342

echo "gpu_mem=16" >>$R/boot/firmware/config.txt

341

echo "gpu_mem=16" >>$R/boot/firmware/config.txt

343

fi

342

fi

344

343

345

# Create symlinks

344

# Create symlinks

346

ln -sf firmware/config.txt $R/boot/config.txt

345

ln -sf firmware/config.txt $R/boot/config.txt

347

ln -sf firmware/cmdline.txt $R/boot/cmdline.txt

346

ln -sf firmware/cmdline.txt $R/boot/cmdline.txt

348

347

349

# Prepare modules-load.d directory

348

# Prepare modules-load.d directory

350

mkdir -p $R/lib/modules-load.d/

349

mkdir -p $R/lib/modules-load.d/

351

350

352

# Load random module on boot

351

# Load random module on boot

353

if [ "$ENABLE_HWRANDOM" = true ] ; then

352

if [ "$ENABLE_HWRANDOM" = true ] ; then

354

cat <<EOM >$R/lib/modules-load.d/rpi2.conf

353

cat <<EOM >$R/lib/modules-load.d/rpi2.conf

355

bcm2708_rng

354

bcm2708_rng

356

EOM

355

EOM

357

fi

356

fi

358

357

359

# Prepare modprobe.d directory

358

# Prepare modprobe.d directory

360

mkdir -p $R/etc/modprobe.d/

359

mkdir -p $R/etc/modprobe.d/

361

360

362

# Blacklist sound modules

361

# Blacklist sound modules

363

cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf

362

cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf

364

blacklist snd_soc_core

363

blacklist snd_soc_core

365

blacklist snd_pcm

364

blacklist snd_pcm

366

blacklist snd_pcm_dmaengine

365

blacklist snd_pcm_dmaengine

367

blacklist snd_timer

366

blacklist snd_timer

368

blacklist snd_compress

367

blacklist snd_compress

369

blacklist snd_soc_pcm512x_i2c

368

blacklist snd_soc_pcm512x_i2c

370

blacklist snd_soc_pcm512x

369

blacklist snd_soc_pcm512x

371

blacklist snd_soc_tas5713

370

blacklist snd_soc_tas5713

372

blacklist snd_soc_wm8804

371

blacklist snd_soc_wm8804

373

EOM

372

EOM

374

373

375

# Create default fstab

374

# Create default fstab

376

cat <<EOM >$R/etc/fstab

375

cat <<EOM >$R/etc/fstab

377

/dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1

376

/dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1

378

/dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2

377

/dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2

379

EOM

378

EOM

380

379

381

# Avoid swapping and increase cache sizes

380

# Avoid swapping and increase cache sizes

382

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

381

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

383

382

384

# Avoid swapping and increase cache sizes

383

# Avoid swapping and increase cache sizes

385

vm.swappiness=1

384

vm.swappiness=1

386

vm.dirty_background_ratio=20

385

vm.dirty_background_ratio=20

387

vm.dirty_ratio=40

386

vm.dirty_ratio=40

388

vm.dirty_writeback_centisecs=500

387

vm.dirty_writeback_centisecs=500

389

vm.dirty_expire_centisecs=6000

388

vm.dirty_expire_centisecs=6000

390

EOM

389

EOM

391

390

392

# Enable network stack hardening

391

# Enable network stack hardening

393

if [ "$ENABLE_HARDNET" = true ] ; then

392

if [ "$ENABLE_HARDNET" = true ] ; then

394

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

393

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

395

394

396

# Enable network stack hardening

395

# Enable network stack hardening

397

net.ipv4.tcp_timestamps=0

396

net.ipv4.tcp_timestamps=0

398

net.ipv4.tcp_syncookies=1

397

net.ipv4.tcp_syncookies=1

399

net.ipv4.conf.all.rp_filter=1

398

net.ipv4.conf.all.rp_filter=1

400

net.ipv4.conf.all.accept_redirects=0

399

net.ipv4.conf.all.accept_redirects=0

401

net.ipv4.conf.all.send_redirects=0

400

net.ipv4.conf.all.send_redirects=0

402

net.ipv4.conf.all.accept_source_route=0

401

net.ipv4.conf.all.accept_source_route=0

403

net.ipv4.conf.default.rp_filter=1

402

net.ipv4.conf.default.rp_filter=1

404

net.ipv4.conf.default.accept_redirects=0

403

net.ipv4.conf.default.accept_redirects=0

405

net.ipv4.conf.default.send_redirects=0

404

net.ipv4.conf.default.send_redirects=0

406

net.ipv4.conf.default.accept_source_route=0

405

net.ipv4.conf.default.accept_source_route=0

407

net.ipv4.conf.lo.accept_redirects=0

406

net.ipv4.conf.lo.accept_redirects=0

408

net.ipv4.conf.lo.send_redirects=0

407

net.ipv4.conf.lo.send_redirects=0

409

net.ipv4.conf.lo.accept_source_route=0

408

net.ipv4.conf.lo.accept_source_route=0

410

net.ipv4.conf.eth0.accept_redirects=0

409

net.ipv4.conf.eth0.accept_redirects=0

411

net.ipv4.conf.eth0.send_redirects=0

410

net.ipv4.conf.eth0.send_redirects=0

412

net.ipv4.conf.eth0.accept_source_route=0

411

net.ipv4.conf.eth0.accept_source_route=0

413

net.ipv4.icmp_echo_ignore_broadcasts=1

412

net.ipv4.icmp_echo_ignore_broadcasts=1

414

net.ipv4.icmp_ignore_bogus_error_responses=1

413

net.ipv4.icmp_ignore_bogus_error_responses=1

415

414

416

net.ipv6.conf.all.accept_redirects=0

415

net.ipv6.conf.all.accept_redirects=0

417

net.ipv6.conf.all.accept_source_route=0

416

net.ipv6.conf.all.accept_source_route=0

418

net.ipv6.conf.all.router_solicitations=0

417

net.ipv6.conf.all.router_solicitations=0

419

net.ipv6.conf.all.accept_ra_rtr_pref=0

418

net.ipv6.conf.all.accept_ra_rtr_pref=0

420

net.ipv6.conf.all.accept_ra_pinfo=0

419

net.ipv6.conf.all.accept_ra_pinfo=0

421

net.ipv6.conf.all.accept_ra_defrtr=0

420

net.ipv6.conf.all.accept_ra_defrtr=0

422

net.ipv6.conf.all.autoconf=0

421

net.ipv6.conf.all.autoconf=0

423

net.ipv6.conf.all.dad_transmits=0

422

net.ipv6.conf.all.dad_transmits=0

424

net.ipv6.conf.all.max_addresses=1

423

net.ipv6.conf.all.max_addresses=1

425

424

426

net.ipv6.conf.default.accept_redirects=0

425

net.ipv6.conf.default.accept_redirects=0

427

net.ipv6.conf.default.accept_source_route=0

426

net.ipv6.conf.default.accept_source_route=0

428

net.ipv6.conf.default.router_solicitations=0

427

net.ipv6.conf.default.router_solicitations=0

429

net.ipv6.conf.default.accept_ra_rtr_pref=0

428

net.ipv6.conf.default.accept_ra_rtr_pref=0

430

net.ipv6.conf.default.accept_ra_pinfo=0

429

net.ipv6.conf.default.accept_ra_pinfo=0

431

net.ipv6.conf.default.accept_ra_defrtr=0

430

net.ipv6.conf.default.accept_ra_defrtr=0

432

net.ipv6.conf.default.autoconf=0

431

net.ipv6.conf.default.autoconf=0

433

net.ipv6.conf.default.dad_transmits=0

432

net.ipv6.conf.default.dad_transmits=0

434

net.ipv6.conf.default.max_addresses=1

433

net.ipv6.conf.default.max_addresses=1

435

434

436

net.ipv6.conf.lo.accept_redirects=0

435

net.ipv6.conf.lo.accept_redirects=0

437

net.ipv6.conf.lo.accept_source_route=0

436

net.ipv6.conf.lo.accept_source_route=0

438

net.ipv6.conf.lo.router_solicitations=0

437

net.ipv6.conf.lo.router_solicitations=0

439

net.ipv6.conf.lo.accept_ra_rtr_pref=0

438

net.ipv6.conf.lo.accept_ra_rtr_pref=0

440

net.ipv6.conf.lo.accept_ra_pinfo=0

439

net.ipv6.conf.lo.accept_ra_pinfo=0

441

net.ipv6.conf.lo.accept_ra_defrtr=0

440

net.ipv6.conf.lo.accept_ra_defrtr=0

442

net.ipv6.conf.lo.autoconf=0

441

net.ipv6.conf.lo.autoconf=0

443

net.ipv6.conf.lo.dad_transmits=0

442

net.ipv6.conf.lo.dad_transmits=0

444

net.ipv6.conf.lo.max_addresses=1

443

net.ipv6.conf.lo.max_addresses=1

445

444

446

net.ipv6.conf.eth0.accept_redirects=0

445

net.ipv6.conf.eth0.accept_redirects=0

447

net.ipv6.conf.eth0.accept_source_route=0

446

net.ipv6.conf.eth0.accept_source_route=0

448

net.ipv6.conf.eth0.router_solicitations=0

447

net.ipv6.conf.eth0.router_solicitations=0

449

net.ipv6.conf.eth0.accept_ra_rtr_pref=0

448

net.ipv6.conf.eth0.accept_ra_rtr_pref=0

450

net.ipv6.conf.eth0.accept_ra_pinfo=0

449

net.ipv6.conf.eth0.accept_ra_pinfo=0

451

net.ipv6.conf.eth0.accept_ra_defrtr=0

450

net.ipv6.conf.eth0.accept_ra_defrtr=0

452

net.ipv6.conf.eth0.autoconf=0

451

net.ipv6.conf.eth0.autoconf=0

453

net.ipv6.conf.eth0.dad_transmits=0

452

net.ipv6.conf.eth0.dad_transmits=0

454

net.ipv6.conf.eth0.max_addresses=1

453

net.ipv6.conf.eth0.max_addresses=1

455

EOM

454

EOM

456

455

457

# Enable resolver warnings about spoofed addresses

456

# Enable resolver warnings about spoofed addresses

458

cat <<EOM >>$R/etc/host.conf

457

cat <<EOM >>$R/etc/host.conf

459

spoof warn

458

spoof warn

460

EOM

459

EOM

461

fi

460

fi

462

461

463

# Regenerate openssh server host keys

462

# Regenerate openssh server host keys

464

if [ "$ENABLE_SSHD" = true ] ; then

463

if [ "$ENABLE_SSHD" = true ] ; then

465

rm -fr $R/etc/ssh/ssh_host_*

464

rm -fr $R/etc/ssh/ssh_host_*

466

LANG=C chroot $R dpkg-reconfigure openssh-server

465

LANG=C chroot $R dpkg-reconfigure openssh-server

467

fi

466

fi

468

467

469

# Enable serial console systemd style

468

# Enable serial console systemd style

470

if [ "$ENABLE_CONSOLE" = true ] ; then

469

if [ "$ENABLE_CONSOLE" = true ] ; then

471

LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service

470

LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service

472

fi

471

fi

473

472

474

# Enable firewall based on iptables started by systemd service

473

# Enable firewall based on iptables started by systemd service

475

if [ "$ENABLE_IPTABLES" = true ] ; then

474

if [ "$ENABLE_IPTABLES" = true ] ; then

476

# Create iptables configuration directory

475

# Create iptables configuration directory

477

mkdir -p "$R/etc/iptables"

476

mkdir -p "$R/etc/iptables"

478

477

479

# Create iptables systemd service

478

# Create iptables systemd service

480

cat <<EOM >$R/etc/systemd/system/iptables.service

479

cat <<EOM >$R/etc/systemd/system/iptables.service

481

[Unit]

480

[Unit]

482

Description=Packet Filtering Framework

481

Description=Packet Filtering Framework

483

DefaultDependencies=no

482

DefaultDependencies=no

484

After=systemd-sysctl.service

483

After=systemd-sysctl.service

485

Before=sysinit.target

484

Before=sysinit.target

486

[Service]

485

[Service]

487

Type=oneshot

486

Type=oneshot

488

ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules

487

ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules

489

ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules

488

ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules

490

ExecStop=/etc/iptables/flush-iptables.sh

489

ExecStop=/etc/iptables/flush-iptables.sh

491

RemainAfterExit=yes

490

RemainAfterExit=yes

492

[Install]

491

[Install]

493

WantedBy=multi-user.target

492

WantedBy=multi-user.target

494

EOM

493

EOM

495

494

496

# Create flush-table script called by iptables service

495

# Create flush-table script called by iptables service

497

cat <<EOM >$R/etc/iptables/flush-iptables.sh

496

cat <<EOM >$R/etc/iptables/flush-iptables.sh

498

#!/bin/sh

497

#!/bin/sh

499

iptables -F

498

iptables -F

500

iptables -X

499

iptables -X

501

iptables -t nat -F

500

iptables -t nat -F

502

iptables -t nat -X

501

iptables -t nat -X

503

iptables -t mangle -F

502

iptables -t mangle -F

504

iptables -t mangle -X

503

iptables -t mangle -X

505

iptables -P INPUT ACCEPT

504

iptables -P INPUT ACCEPT

506

iptables -P FORWARD ACCEPT

505

iptables -P FORWARD ACCEPT

507

iptables -P OUTPUT ACCEPT

506

iptables -P OUTPUT ACCEPT

508

EOM

507

EOM

509

508

510

# Create iptables rule file

509

# Create iptables rule file

511

cat <<EOM >$R/etc/iptables/iptables.rules

510

cat <<EOM >$R/etc/iptables/iptables.rules

512

*filter

511

*filter

513

:INPUT DROP [0:0]

512

:INPUT DROP [0:0]

514

:FORWARD DROP [0:0]

513

:FORWARD DROP [0:0]

515

:OUTPUT ACCEPT [0:0]

514

:OUTPUT ACCEPT [0:0]

516

:TCP - [0:0]

515

:TCP - [0:0]

517

:UDP - [0:0]

516

:UDP - [0:0]

518

:SSH - [0:0]

517

:SSH - [0:0]

519

518

520

# Rate limit ping requests

519

# Rate limit ping requests

521

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

520

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

522

-A INPUT -p icmp --icmp-type echo-request -j DROP

521

-A INPUT -p icmp --icmp-type echo-request -j DROP

523

522

524

# Accept established connections

523

# Accept established connections

525

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

524

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

526

525

527

# Accept all traffic on loopback interface

526

# Accept all traffic on loopback interface

528

-A INPUT -i lo -j ACCEPT

527

-A INPUT -i lo -j ACCEPT

529

528

530

# Drop packets declared invalid

529

# Drop packets declared invalid

531

-A INPUT -m conntrack --ctstate INVALID -j DROP

530

-A INPUT -m conntrack --ctstate INVALID -j DROP

532

531

533

# SSH rate limiting

532

# SSH rate limiting

534

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

533

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

535

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

534

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

536

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

535

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

537

-A SSH -m recent --name sshbf --set -j ACCEPT

536

-A SSH -m recent --name sshbf --set -j ACCEPT

538

537

539

# Send TCP and UDP connections to their respective rules chain

538

# Send TCP and UDP connections to their respective rules chain

540

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

539

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

541

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

540

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

542

541

543

# Reject dropped packets with a RFC compliant responce

542

# Reject dropped packets with a RFC compliant responce

544

-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable

543

-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable

545

-A INPUT -p tcp -j REJECT --reject-with tcp-rst

544

-A INPUT -p tcp -j REJECT --reject-with tcp-rst

546

-A INPUT -j REJECT --reject-with icmp-proto-unreachable

545

-A INPUT -j REJECT --reject-with icmp-proto-unreachable

547

546

548

## TCP PORT RULES

547

## TCP PORT RULES

549

# -A TCP -p tcp -j LOG

548

# -A TCP -p tcp -j LOG

550

549

551

## UDP PORT RULES

550

## UDP PORT RULES

552

# -A UDP -p udp -j LOG

551

# -A UDP -p udp -j LOG

553

552

554

COMMIT

553

COMMIT

555

EOM

554

EOM

556

555

557

# Reload systemd configuration and enable iptables service

556

# Reload systemd configuration and enable iptables service

558

LANG=C chroot $R systemctl daemon-reload

557

LANG=C chroot $R systemctl daemon-reload

559

LANG=C chroot $R systemctl enable iptables.service

558

LANG=C chroot $R systemctl enable iptables.service

560

559

561

if [ "$ENABLE_IPV6" = true ] ; then

560

if [ "$ENABLE_IPV6" = true ] ; then

562

# Create ip6tables systemd service

561

# Create ip6tables systemd service

563

cat <<EOM >$R/etc/systemd/system/ip6tables.service

562

cat <<EOM >$R/etc/systemd/system/ip6tables.service

564

[Unit]

563

[Unit]

565

Description=Packet Filtering Framework

564

Description=Packet Filtering Framework

566

DefaultDependencies=no

565

DefaultDependencies=no

567

After=systemd-sysctl.service

566

After=systemd-sysctl.service

568

Before=sysinit.target

567

Before=sysinit.target

569

[Service]

568

[Service]

570

Type=oneshot

569

Type=oneshot

571

ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

570

ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

572

ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

571

ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

573

ExecStop=/etc/iptables/flush-ip6tables.sh

572

ExecStop=/etc/iptables/flush-ip6tables.sh

574

RemainAfterExit=yes

573

RemainAfterExit=yes

575

[Install]

574

[Install]

576

WantedBy=multi-user.target

575

WantedBy=multi-user.target

577

EOM

576

EOM

578

577

579

# Create ip6tables file

578

# Create ip6tables file

580

cat <<EOM >$R/etc/iptables/flush-ip6tables.sh

579

cat <<EOM >$R/etc/iptables/flush-ip6tables.sh

581

#!/bin/sh

580

#!/bin/sh

582

ip6tables -F

581

ip6tables -F

583

ip6tables -X

582

ip6tables -X

584

ip6tables -Z

583

ip6tables -Z

585

for table in $(</proc/net/ip6_tables_names)

584

for table in $(</proc/net/ip6_tables_names)

586

do

585

do

587

ip6tables -t \$table -F

586

ip6tables -t \$table -F

588

ip6tables -t \$table -X

587

ip6tables -t \$table -X

589

ip6tables -t \$table -Z

588

ip6tables -t \$table -Z

590

done

589

done

591

ip6tables -P INPUT ACCEPT

590

ip6tables -P INPUT ACCEPT

592

ip6tables -P OUTPUT ACCEPT

591

ip6tables -P OUTPUT ACCEPT

593

ip6tables -P FORWARD ACCEPT

592

ip6tables -P FORWARD ACCEPT

594

EOM

593

EOM

595

594

596

# Create ip6tables rule file

595

# Create ip6tables rule file

597

cat <<EOM >$R/etc/iptables/ip6tables.rules

596

cat <<EOM >$R/etc/iptables/ip6tables.rules

598

*filter

597

*filter

599

:INPUT DROP [0:0]

598

:INPUT DROP [0:0]

600

:FORWARD DROP [0:0]

599

:FORWARD DROP [0:0]

601

:OUTPUT ACCEPT [0:0]

600

:OUTPUT ACCEPT [0:0]

602

:TCP - [0:0]

601

:TCP - [0:0]

603

:UDP - [0:0]

602

:UDP - [0:0]

604

:SSH - [0:0]

603

:SSH - [0:0]

605

604

606

# Drop packets with RH0 headers

605

# Drop packets with RH0 headers

607

-A INPUT -m rt --rt-type 0 -j DROP

606

-A INPUT -m rt --rt-type 0 -j DROP

608

-A OUTPUT -m rt --rt-type 0 -j DROP

607

-A OUTPUT -m rt --rt-type 0 -j DROP

609

-A FORWARD -m rt --rt-type 0 -j DROP

608

-A FORWARD -m rt --rt-type 0 -j DROP

610

609

611

# Rate limit ping requests

610

# Rate limit ping requests

612

-A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

611

-A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

613

-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP

612

-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP

614

613

615

# Accept established connections

614

# Accept established connections

616

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

615

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

617

616

618

# Accept all traffic on loopback interface

617

# Accept all traffic on loopback interface

619

-A INPUT -i lo -j ACCEPT

618

-A INPUT -i lo -j ACCEPT

620

619

621

# Drop packets declared invalid

620

# Drop packets declared invalid

622

-A INPUT -m conntrack --ctstate INVALID -j DROP

621

-A INPUT -m conntrack --ctstate INVALID -j DROP

623

622

624

# SSH rate limiting

623

# SSH rate limiting

625

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

624

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

626

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

625

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

627

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

626

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

628

-A SSH -m recent --name sshbf --set -j ACCEPT

627

-A SSH -m recent --name sshbf --set -j ACCEPT

629

628

630

# Send TCP and UDP connections to their respective rules chain

629

# Send TCP and UDP connections to their respective rules chain

631

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

630

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

632

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

631

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

633

632

634

# Reject dropped packets with a RFC compliant responce

633

# Reject dropped packets with a RFC compliant responce

635

-A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited

634

-A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited

636

-A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited

635

-A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited

637

-A INPUT -j REJECT --reject-with icmp6-adm-prohibited

636

-A INPUT -j REJECT --reject-with icmp6-adm-prohibited

638

637

639

## TCP PORT RULES

638

## TCP PORT RULES

640

# -A TCP -p tcp -j LOG

639

# -A TCP -p tcp -j LOG

641

640

642

## UDP PORT RULES

641

## UDP PORT RULES

643

# -A UDP -p udp -j LOG

642

# -A UDP -p udp -j LOG

644

643

645

COMMIT

644

COMMIT

646

EOM

645

EOM

647

646

648

# Reload systemd configuration and enable iptables service

647

# Reload systemd configuration and enable iptables service

649

LANG=C chroot $R systemctl daemon-reload

648

LANG=C chroot $R systemctl daemon-reload

650

LANG=C chroot $R systemctl enable ip6tables.service

649

LANG=C chroot $R systemctl enable ip6tables.service

651

650

652

fi

651

fi

653

fi

652

fi

654

653

655

if [ "$ENABLE_UBOOT" = true ] ; then

654

if [ "$ENABLE_UBOOT" = true ] ; then

656

# Fetch u-boot github

655

# Fetch u-boot github

657

git -C $R/tmp clone git://git.denx.de/u-boot.git

656

git -C $R/tmp clone git://git.denx.de/u-boot.git

658

657

659

# Install minimal gcc/g++ build environment and build u-boot inside chroot

658

# Install minimal gcc/g++ build environment and build u-boot inside chroot

660

LANG=C chroot $R apt-get install -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc

659

LANG=C chroot $R apt-get install -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc

661

LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all

660

LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all

662

661

663

# Copy compiled bootloader binary and set config.txt to load it

662

# Copy compiled bootloader binary and set config.txt to load it

664

cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/

663

cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/

665

printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt

664

printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt

666

665

667

# Set u-boot command file

666

# Set u-boot command file

668

cat <<EOM >$R/boot/firmware/uboot.mkimage

667

cat <<EOM >$R/boot/firmware/uboot.mkimage

669

# Tell Linux that it is booting on a Raspberry Pi2

668

# Tell Linux that it is booting on a Raspberry Pi2

670

setenv machid 0x00000c42

669

setenv machid 0x00000c42

671

670

672

# Set the kernel boot command line

671

# Set the kernel boot command line

673

setenv bootargs "earlyprintk ${CMDLINE}"

672

setenv bootargs "earlyprintk ${CMDLINE}"

674

673

675

# Save these changes to u-boot's environment

674

# Save these changes to u-boot's environment

676

saveenv

675

saveenv

677

676

678

# Load the existing Linux kernel into RAM

677

# Load the existing Linux kernel into RAM

679

fatload mmc 0:1 \${kernel_addr_r} kernel7.img

678

fatload mmc 0:1 \${kernel_addr_r} kernel7.img

680

679

681

# Boot the kernel we have just loaded

680

# Boot the kernel we have just loaded

682

bootz \${kernel_addr_r}

681

bootz \${kernel_addr_r}

683

EOM

682

EOM

684

683

685

# Generate u-boot image from command file

684

# Generate u-boot image from command file

686

LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr

685

LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr

687

686

688

# Remove gcc/c++ build enviroment

687

# Remove gcc/c++ build enviroment

689

LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make

688

LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make

690

fi

689

fi

691

690

692

# Clean cached downloads

691

# Clean cached downloads

693

LANG=C chroot $R apt-get -y clean

692

LANG=C chroot $R apt-get -y clean

694

LANG=C chroot $R apt-get -y autoclean

693

LANG=C chroot $R apt-get -y autoclean

695

LANG=C chroot $R apt-get -y autoremove

694

LANG=C chroot $R apt-get -y autoremove

696

695

697

# Unmount mounted filesystems

696

# Unmount mounted filesystems

698

umount -l $R/proc

697

umount -l $R/proc

699

umount -l $R/sys

698

umount -l $R/sys

700

699

701

# Clean up files

700

# Clean up files

702

rm -f $R/etc/apt/sources.list.save

701

rm -f $R/etc/apt/sources.list.save

703

rm -f $R/etc/resolvconf/resolv.conf.d/original

702

rm -f $R/etc/resolvconf/resolv.conf.d/original

704

rm -rf $R/run

703

rm -rf $R/run

705

mkdir -p $R/run

704

mkdir -p $R/run

706

rm -f $R/etc/*-

705

rm -f $R/etc/*-

707

rm -f $R/root/.bash_history

706

rm -f $R/root/.bash_history

708

rm -rf $R/tmp/*

707

rm -rf $R/tmp/*

709

rm -f $R/var/lib/urandom/random-seed

708

rm -f $R/var/lib/urandom/random-seed

710

[ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id

709

[ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id

711

rm -f $R/etc/machine-id

710

rm -f $R/etc/machine-id

712

711

713

# Calculate size of the chroot directory

712

# Calculate size of the chroot directory

714

CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)

713

CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)

715

714

716

# Calculate required image size

715

# Calculate required image size

717

IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`

716

IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`

718

717

719

# Calculate number of sectors for the partition

718

# Calculate number of sectors for the partition

720

IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`

719

IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`

721

720

722

# Prepare date string for image file name

721

# Prepare date string for image file name

723

DATE="$(date +%Y-%m-%d)"

722

DATE="$(date +%Y-%m-%d)"

724

723

725

# Prepare image file

724

# Prepare image file

726

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1

725

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1

727

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}

726

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}

728

727

729

# Write partition table

728

# Write partition table

730

sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM

729

sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM

731

unit: sectors

730

unit: sectors

732

731

733

1 : start= 2048, size= 131072, Id= c, bootable

732

1 : start= 2048, size= 131072, Id= c, bootable

734

2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83

733

2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83

735

3 : start= 0, size= 0, Id= 0

734

3 : start= 0, size= 0, Id= 0

736

4 : start= 0, size= 0, Id= 0

735

4 : start= 0, size= 0, Id= 0

737

EOM

736

EOM

738

737

739

# Set up temporary loop devices and build filesystems

738

# Set up temporary loop devices and build filesystems

740

VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

739

VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

741

EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

740

EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

742

mkfs.vfat "$VFAT_LOOP"

741

mkfs.vfat "$VFAT_LOOP"

743

mkfs.ext4 "$EXT4_LOOP"

742

mkfs.ext4 "$EXT4_LOOP"

744

743

745

# Mount the temporary loop devices

744

# Mount the temporary loop devices

746

mkdir -p "$BUILDDIR/mount"

745

mkdir -p "$BUILDDIR/mount"

747

mount "$EXT4_LOOP" "$BUILDDIR/mount"

746

mount "$EXT4_LOOP" "$BUILDDIR/mount"

748

747

749

mkdir -p "$BUILDDIR/mount/boot/firmware"

748

mkdir -p "$BUILDDIR/mount/boot/firmware"

750

mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"

749

mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"

751

750

752

# Copy all files from the chroot to the loop device mount point directory

751

# Copy all files from the chroot to the loop device mount point directory

753

rsync -a "$R/" "$BUILDDIR/mount/"

752

rsync -a "$R/" "$BUILDDIR/mount/"

754

753

755

# Unmount all temporary loop devices and mount points

754

# Unmount all temporary loop devices and mount points

756

cleanup

755

cleanup

757

756

758

# (optinal) create block map file for "bmaptool"

757

# (optinal) create block map file for "bmaptool"

759

bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"

758

bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"

760

759

761

# Image was successfully created

760

# Image was successfully created

762

echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"

761

echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

             #!/bin/sh
             ########################################################################
             # rpi2-gen-image.sh					   ver2a 12/2015
             #
             # Advanced debian "jessie" bootstrap script for RPi2
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # some parts based on rpi2-build-image:
             # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
             # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
             ########################################################################
             cleanup (){
               set +x
               set +e
               echo "removing temporary mount points ..."
               umount -l $R/proc 2> /dev/null
               umount -l $R/sys 2> /dev/null
               umount -l $R/dev/pts 2> /dev/null
               umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
               umount "$BUILDDIR/mount" 2> /dev/null
               losetup -d "$EXT4_LOOP" 2> /dev/null
               losetup -d "$VFAT_LOOP" 2> /dev/null
               trap - 0 1 2 3 6
             }
             set -e
             set -x
             RELEASE=${RELEASE:=jessie}
             # Build settings
             BASEDIR=./images/${RELEASE}
             BUILDDIR=${BASEDIR}/build
             # General settings
             HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
             PASSWORD=${PASSWORD:=raspberry}
             DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
             TIMEZONE=${TIMEZONE:="Europe/Berlin"}
             # APT settings
             APT_PROXY=${APT_PROXY:=""}
             APT_SERVER=${APT_SERVER:="ftp.debian.org"}
             # Feature settings
             ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
             ENABLE_IPV6=${ENABLE_IPV6:=true}
             ENABLE_SSHD=${ENABLE_SSHD:=true}
             ENABLE_SOUND=${ENABLE_SOUND:=true}
             ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}
             ENABLE_DBUS=${ENABLE_DBUS:=true}
             ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
             ENABLE_MINGPU=${ENABLE_MINGPU:=false}
             ENABLE_XORG=${ENABLE_XORG:=false}
             ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
             # Advanced settings
             ENABLE_UBOOT=${ENABLE_UBOOT:=false}
             ENABLE_HARDNET=${ENABLE_HARDNET:=false}
             ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
             # Image chroot path
             R=${BUILDDIR}/chroot
             # Packages required for bootstrapping
             REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"
             # Missing packages that need to be installed
             MISSING_PACKAGES=""
             # Packages required in the chroot build enviroment
             APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"
             set +x
             # Are we running as root?
             if [ "$(id -u)" -ne "0" ] ; then
               echo "this script must be executed with root privileges"
               exit 1
             fi
             # Check if all required packages are installed
             for package in $REQUIRED_PACKAGES ; do
               if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
                 MISSING_PACKAGES="$MISSING_PACKAGES $package"
               fi
             done
             # Ask if missing packages should get installed right now
             if [ -n "$MISSING_PACKAGES" ] ; then
               echo "the following packages needed by this script are not installed:"
               echo "$MISSING_PACKAGES"
               echo -n "\ndo you want to install the missing packages right now? [y/n] "
               read confirm
               if [ "$confirm" != "y" ] ; then
                 exit 1
               fi
             fi
             # Make sure all required packages are installed
             apt-get -qq -y install ${REQUIRED_PACKAGES}
-            exit
             # Don't clobber an old build
             if [ -e "$BUILDDIR" ]; then
               echo "directory $BUILDDIR already exists, not proceeding"
               exit 1
             fi
             set -x
             # Call "cleanup" function on various signals and errors
             trap cleanup 0 1 2 3 6
             # Set up chroot directory
             mkdir -p $R
             # Use traditional SystemV init instead of systemd services
             if [ "$ENABLE_SYSTEMD" = false ] ; then
               APT_INCLUDES="${APT_INCLUDES},sysvinit-core"
             fi
             # Add dbus package, recommended if using systemd
             if [ "$ENABLE_DBUS" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},dbus"
             fi
             # Add openssh server package
             if [ "$ENABLE_SSHD" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},openssh-server"
             fi
             # Add rng-tools package
             if [ "$ENABLE_HWRANDOM" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},rng-tools"
             fi
             # Add xorg package
             if [ "$ENABLE_XORG" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},xorg"
             fi
             # Add fluxbox package with eterm
             if [ "$ENABLE_FLUXBOX" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
             fi
             if [ -z "$APT_PROXY" ] ; then
               APT_PROXY="http://"
             fi
             # Base debootstrap (unpack only)
             debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
             cp /usr/bin/qemu-arm-static $R/usr/bin
             # Remove systemd related packages from list of packages to be bootstrapped
             if [ "$ENABLE_SYSTEMD" = false ] ; then
               chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required
             fi
             # Copy debian-archive-keyring.pgp
             chroot $R mkdir -p /usr/share/keyrings
             cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
             # Complete the bootstrapping proccess
             chroot $R /debootstrap/debootstrap --second-stage
             # Mount required filesystems
             mount -t proc none $R/proc
             mount -t sysfs none $R/sys
             mount --bind /dev/pts $R/dev/pts
             # Set up initial sources.list
             cat <<EOM >$R/etc/apt/sources.list
             deb http://${APT_SERVER}/debian ${RELEASE} main contrib
             #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
             deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
             #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
             deb http://security.debian.org/ ${RELEASE}/updates main contrib
             #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
             deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
             EOM
             # Pin package flash-kernel to repositories.collabora.co.uk
             cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
             Package: flash-kernel
             Pin: origin repositories.collabora.co.uk
             Pin-Priority: 1000
             EOM
             # Set up timezone
             echo ${TIMEZONE} >$R/etc/timezone
             LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
             # Set up default locales to "en_US.UTF-8" default
             LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
             LANG=C chroot $R locale-gen ${DEFLOCAL}
             # Fetch APT public key "Collabora Raspbian Archive Signing Key <daniels@collabora.com>"
             LANG=C chroot $R apt-key adv --keyserver hkp://pool.sks-keyservers.net --recv-keys ED4BF9140C50B1C5
             # Upgrade package index and update all installed packages and changed dependencies
             LANG=C chroot $R apt-get -q -y update
             LANG=C chroot $R apt-get -q -y -u dist-upgrade
             # Kernel installation
             # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
             LANG=C chroot $R apt-get -q -y --force-yes --no-install-recommends install linux-image-3.18.0-trunk-rpi2
             LANG=C chroot $R apt-get -q -y --force-yes install flash-kernel
             VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
             [ -z "$VMLINUZ" ] && exit 1
             mkdir -p $R/boot/firmware
             # required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")
             wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin
             wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat
             wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat
             wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat
             wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf
             wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf
             wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf
             cp $VMLINUZ $R/boot/firmware/kernel7.img
             # Set up hosts
             echo ${HOSTNAME} >$R/etc/hostname
             cat <<EOM >$R/etc/hosts
 .0.0.1       localhost
 .0.1.1       ${HOSTNAME}
             EOM
             if [ "$ENABLE_IPV6" = true ] ; then
             cat <<EOM >>$R/etc/hosts
             ::1             localhost ip6-localhost ip6-loopback
             ff02::1         ip6-allnodes
             ff02::2         ip6-allrouters
             EOM
             fi
             # Generate crypt(3) password string
             ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
             # Set up default user
             LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi
             LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
             # Set up root password
             LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root
             # Set up interfaces
             cat <<EOM >$R/etc/network/interfaces
             # interfaces(5) file used by ifup(8) and ifdown(8)
             # Include files from /etc/network/interfaces.d:
             source-directory /etc/network/interfaces.d
             # The loopback network interface
             auto lo
             iface lo inet loopback
             # The primary network interface
             allow-hotplug eth0
             iface eth0 inet dhcp
             EOM
             # Set up firmware boot cmdline
             CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
             # Set up serial console support (if requested)
             if [ "$ENABLE_CONSOLE" = true ] ; then
               CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
             fi
             # Set up ipv6 support (if requested)
             if [ "$ENABLE_IPV6" = false ] ; then
               CMDLINE="${CMDLINE} ipv6.disable=1"
             fi
             echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
             # Set up firmware config
             cat <<EOM >$R/boot/firmware/config.txt
             # For more options and information see
             # http://www.raspberrypi.org/documentation/configuration/config-txt.md
             # Some settings may impact device functionality. See link above for details
             # uncomment if you get no picture on HDMI for a default "safe" mode
             #hdmi_safe=1
             # uncomment this if your display has a black border of unused pixels visible
             # and your display can output without overscan
             #disable_overscan=1
             # uncomment the following to adjust overscan. Use positive numbers if console
             # goes off screen, and negative if there is too much border
             #overscan_left=16
             #overscan_right=16
             #overscan_top=16
             #overscan_bottom=16
             # uncomment to force a console size. By default it will be display's size minus
             # overscan.
             #framebuffer_width=1280
             #framebuffer_height=720
             # uncomment if hdmi display is not detected and composite is being output
             #hdmi_force_hotplug=1
             # uncomment to force a specific HDMI mode (this will force VGA)
             #hdmi_group=1
             #hdmi_mode=1
             # uncomment to force a HDMI mode rather than DVI. This can make audio work in
             # DMT (computer monitor) modes
             #hdmi_drive=2
             # uncomment to increase signal to HDMI, if you have interference, blanking, or
             # no display
             #config_hdmi_boost=4
             # uncomment for composite PAL
             #sdtv_mode=2
             # uncomment to overclock the arm. 700 MHz is the default.
             #arm_freq=800
             EOM
             # Set smallest possible GPU memory allocation size: 16MB (no X)
             if [ "$ENABLE_MINGPU" = true ] ; then
               echo "gpu_mem=16" >>$R/boot/firmware/config.txt
             fi
             # Create symlinks
             ln -sf firmware/config.txt $R/boot/config.txt
             ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
             # Prepare modules-load.d directory
             mkdir -p $R/lib/modules-load.d/
             # Load random module on boot
             if [ "$ENABLE_HWRANDOM" = true ] ; then
               cat <<EOM >$R/lib/modules-load.d/rpi2.conf
             bcm2708_rng
             EOM
             fi
             # Prepare modprobe.d directory
             mkdir -p $R/etc/modprobe.d/
             # Blacklist sound modules
             cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf
             blacklist snd_soc_core
             blacklist snd_pcm
             blacklist snd_pcm_dmaengine
             blacklist snd_timer
             blacklist snd_compress
             blacklist snd_soc_pcm512x_i2c
             blacklist snd_soc_pcm512x
             blacklist snd_soc_tas5713
             blacklist snd_soc_wm8804
             EOM
             # Create default fstab
             cat <<EOM >$R/etc/fstab
             /dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1
             /dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2
             EOM
             # Avoid swapping and increase cache sizes
             cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
             # Avoid swapping and increase cache sizes
             vm.swappiness=1
             vm.dirty_background_ratio=20
             vm.dirty_ratio=40
             vm.dirty_writeback_centisecs=500
             vm.dirty_expire_centisecs=6000
             EOM
             # Enable network stack hardening
             if [ "$ENABLE_HARDNET" = true ] ; then
               cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
             # Enable network stack hardening
             net.ipv4.tcp_timestamps=0
             net.ipv4.tcp_syncookies=1
             net.ipv4.conf.all.rp_filter=1
             net.ipv4.conf.all.accept_redirects=0
             net.ipv4.conf.all.send_redirects=0
             net.ipv4.conf.all.accept_source_route=0
             net.ipv4.conf.default.rp_filter=1
             net.ipv4.conf.default.accept_redirects=0
             net.ipv4.conf.default.send_redirects=0
             net.ipv4.conf.default.accept_source_route=0
             net.ipv4.conf.lo.accept_redirects=0
             net.ipv4.conf.lo.send_redirects=0
             net.ipv4.conf.lo.accept_source_route=0
             net.ipv4.conf.eth0.accept_redirects=0
             net.ipv4.conf.eth0.send_redirects=0
             net.ipv4.conf.eth0.accept_source_route=0
             net.ipv4.icmp_echo_ignore_broadcasts=1
             net.ipv4.icmp_ignore_bogus_error_responses=1
             net.ipv6.conf.all.accept_redirects=0
             net.ipv6.conf.all.accept_source_route=0
             net.ipv6.conf.all.router_solicitations=0
             net.ipv6.conf.all.accept_ra_rtr_pref=0
             net.ipv6.conf.all.accept_ra_pinfo=0
             net.ipv6.conf.all.accept_ra_defrtr=0
             net.ipv6.conf.all.autoconf=0
             net.ipv6.conf.all.dad_transmits=0
             net.ipv6.conf.all.max_addresses=1
             net.ipv6.conf.default.accept_redirects=0
             net.ipv6.conf.default.accept_source_route=0
             net.ipv6.conf.default.router_solicitations=0
             net.ipv6.conf.default.accept_ra_rtr_pref=0
             net.ipv6.conf.default.accept_ra_pinfo=0
             net.ipv6.conf.default.accept_ra_defrtr=0
             net.ipv6.conf.default.autoconf=0
             net.ipv6.conf.default.dad_transmits=0
             net.ipv6.conf.default.max_addresses=1
             net.ipv6.conf.lo.accept_redirects=0
             net.ipv6.conf.lo.accept_source_route=0
             net.ipv6.conf.lo.router_solicitations=0
             net.ipv6.conf.lo.accept_ra_rtr_pref=0
             net.ipv6.conf.lo.accept_ra_pinfo=0
             net.ipv6.conf.lo.accept_ra_defrtr=0
             net.ipv6.conf.lo.autoconf=0
             net.ipv6.conf.lo.dad_transmits=0
             net.ipv6.conf.lo.max_addresses=1
             net.ipv6.conf.eth0.accept_redirects=0
             net.ipv6.conf.eth0.accept_source_route=0
             net.ipv6.conf.eth0.router_solicitations=0
             net.ipv6.conf.eth0.accept_ra_rtr_pref=0
             net.ipv6.conf.eth0.accept_ra_pinfo=0
             net.ipv6.conf.eth0.accept_ra_defrtr=0
             net.ipv6.conf.eth0.autoconf=0
             net.ipv6.conf.eth0.dad_transmits=0
             net.ipv6.conf.eth0.max_addresses=1
             EOM
             # Enable resolver warnings about spoofed addresses
               cat <<EOM >>$R/etc/host.conf
             spoof warn
             EOM
             fi
             # Regenerate openssh server host keys
             if [ "$ENABLE_SSHD" = true ] ; then
               rm -fr $R/etc/ssh/ssh_host_*
               LANG=C chroot $R dpkg-reconfigure openssh-server
             fi
             # Enable serial console systemd style
             if [ "$ENABLE_CONSOLE" = true ] ; then
               LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service
             fi
             # Enable firewall based on iptables started by systemd service
             if [ "$ENABLE_IPTABLES" = true ] ; then
               # Create iptables configuration directory
               mkdir -p "$R/etc/iptables"
               # Create iptables systemd service
               cat <<EOM >$R/etc/systemd/system/iptables.service
             [Unit]
             Description=Packet Filtering Framework
             DefaultDependencies=no
             After=systemd-sysctl.service
             Before=sysinit.target
             [Service]
             Type=oneshot
             ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
             ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
             ExecStop=/etc/iptables/flush-iptables.sh
             RemainAfterExit=yes
             [Install]
             WantedBy=multi-user.target
             EOM
               # Create flush-table script called by iptables service
               cat <<EOM >$R/etc/iptables/flush-iptables.sh
             #!/bin/sh
             iptables -F
             iptables -X
             iptables -t nat -F
             iptables -t nat -X
             iptables -t mangle -F
             iptables -t mangle -X
             iptables -P INPUT ACCEPT
             iptables -P FORWARD ACCEPT
             iptables -P OUTPUT ACCEPT
             EOM
               # Create iptables rule file
               cat <<EOM >$R/etc/iptables/iptables.rules
             *filter
             :INPUT DROP [0:0]
             :FORWARD DROP [0:0]
             :OUTPUT ACCEPT [0:0]
             :TCP - [0:0]
             :UDP - [0:0]
             :SSH - [0:0]
             # Rate limit ping requests
             -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
             -A INPUT -p icmp --icmp-type echo-request -j DROP
             # Accept established connections
             -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
             # Accept all traffic on loopback interface
             -A INPUT -i lo -j ACCEPT
             # Drop packets declared invalid
             -A INPUT -m conntrack --ctstate INVALID -j DROP
             # SSH rate limiting
             -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
             -A SSH -m recent --name sshbf --set -j ACCEPT
             # Send TCP and UDP connections to their respective rules chain
             -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
             -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
             # Reject dropped packets with a RFC compliant responce
             -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
             -A INPUT -p tcp -j REJECT --reject-with tcp-rst
             -A INPUT -j REJECT --reject-with icmp-proto-unreachable
             ## TCP PORT RULES
             # -A TCP -p tcp -j LOG
             ## UDP PORT RULES
             # -A UDP -p udp -j LOG
             COMMIT
             EOM
               # Reload systemd configuration and enable iptables service
               LANG=C chroot $R systemctl daemon-reload
               LANG=C chroot $R systemctl enable iptables.service
               if [ "$ENABLE_IPV6" = true ] ; then
                 # Create ip6tables systemd service
                 cat <<EOM >$R/etc/systemd/system/ip6tables.service
             [Unit]
             Description=Packet Filtering Framework
             DefaultDependencies=no
             After=systemd-sysctl.service
             Before=sysinit.target
             [Service]
             Type=oneshot
             ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
             ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
             ExecStop=/etc/iptables/flush-ip6tables.sh
             RemainAfterExit=yes
             [Install]
             WantedBy=multi-user.target
             EOM
                 # Create ip6tables file
                 cat <<EOM >$R/etc/iptables/flush-ip6tables.sh
             #!/bin/sh
             ip6tables -F
             ip6tables -X
             ip6tables -Z
             for table in $(</proc/net/ip6_tables_names)
             do
                     ip6tables -t \$table -F
                     ip6tables -t \$table -X
                     ip6tables -t \$table -Z
             done
             ip6tables -P INPUT ACCEPT
             ip6tables -P OUTPUT ACCEPT
             ip6tables -P FORWARD ACCEPT
             EOM
                 # Create ip6tables rule file
                 cat <<EOM >$R/etc/iptables/ip6tables.rules
             *filter
             :INPUT DROP [0:0]
             :FORWARD DROP [0:0]
             :OUTPUT ACCEPT [0:0]
             :TCP - [0:0]
             :UDP - [0:0]
             :SSH - [0:0]
             # Drop packets with RH0 headers
             -A INPUT -m rt --rt-type 0 -j DROP
             -A OUTPUT -m rt --rt-type 0 -j DROP
             -A FORWARD -m rt --rt-type 0 -j DROP
             # Rate limit ping requests
             -A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
             -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
             # Accept established connections
             -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
             # Accept all traffic on loopback interface
             -A INPUT -i lo -j ACCEPT
             # Drop packets declared invalid
             -A INPUT -m conntrack --ctstate INVALID -j DROP
             # SSH rate limiting
             -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
             -A SSH -m recent --name sshbf --set -j ACCEPT
             # Send TCP and UDP connections to their respective rules chain
             -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
             -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
             # Reject dropped packets with a RFC compliant responce
             -A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited
             -A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited
             -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
             ## TCP PORT RULES
             # -A TCP -p tcp -j LOG
             ## UDP PORT RULES
             # -A UDP -p udp -j LOG
             COMMIT
             EOM
               # Reload systemd configuration and enable iptables service
               LANG=C chroot $R systemctl daemon-reload
               LANG=C chroot $R systemctl enable ip6tables.service
               fi
             fi
             if [ "$ENABLE_UBOOT" = true ] ; then
               # Fetch u-boot github
               git -C $R/tmp clone git://git.denx.de/u-boot.git
               # Install minimal gcc/g++ build environment and build u-boot inside chroot
               LANG=C chroot $R apt-get install -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
               LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all
               # Copy compiled bootloader binary and set config.txt to load it
               cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
               printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
               # Set u-boot command file
               cat <<EOM >$R/boot/firmware/uboot.mkimage
             # Tell Linux that it is booting on a Raspberry Pi2
             setenv machid 0x00000c42
             # Set the kernel boot command line
             setenv bootargs "earlyprintk ${CMDLINE}"
             # Save these changes to u-boot's environment
             saveenv
             # Load the existing Linux kernel into RAM
             fatload mmc 0:1 \${kernel_addr_r} kernel7.img
             # Boot the kernel we have just loaded
             bootz \${kernel_addr_r}
             EOM
               # Generate u-boot image from command file
               LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
               # Remove gcc/c++ build enviroment
               LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
             fi
             # Clean cached downloads
             LANG=C chroot $R apt-get -y clean
             LANG=C chroot $R apt-get -y autoclean
             LANG=C chroot $R apt-get -y autoremove
             # Unmount mounted filesystems
             umount -l $R/proc
             umount -l $R/sys
             # Clean up files
             rm -f $R/etc/apt/sources.list.save
             rm -f $R/etc/resolvconf/resolv.conf.d/original
             rm -rf $R/run
             mkdir -p $R/run
             rm -f $R/etc/*-
             rm -f $R/root/.bash_history
             rm -rf $R/tmp/*
             rm -f $R/var/lib/urandom/random-seed
             [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
             rm -f $R/etc/machine-id
             # Calculate size of the chroot directory
             CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)
             # Calculate required image size
             IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`
             # Calculate number of sectors for the partition
             IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`
             # Prepare date string for image file name
             DATE="$(date +%Y-%m-%d)"
             # Prepare image file
             dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1
             dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}
             # Write partition table
             sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
             unit: sectors
 : start=     2048, size=   131072, Id= c, bootable
 : start=   133120, size=  ${IMAGE_SECTORS}, Id=83
 : start=        0, size=        0, Id= 0
 : start=        0, size=        0, Id= 0
             EOM
             # Set up temporary loop devices and build filesystems
             VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
             EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
             mkfs.vfat "$VFAT_LOOP"
             mkfs.ext4 "$EXT4_LOOP"
             # Mount the temporary loop devices
             mkdir -p "$BUILDDIR/mount"
             mount "$EXT4_LOOP" "$BUILDDIR/mount"
             mkdir -p "$BUILDDIR/mount/boot/firmware"
             mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
             # Copy all files from the chroot to the loop device mount point directory
             rsync -a "$R/" "$BUILDDIR/mount/"
             # Unmount all temporary loop devices and mount points
             cleanup
             # (optinal) create block map file for "bmaptool"
             bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
             # Image was successfully created
             echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"