Raspi2-3_GenImage Commit - r11:be69a54e1e9d · Collaboration Tremplin des Sciences

1

#!/bin/sh

1

#!/bin/sh

2

3

########################################################################

3

########################################################################

4

# rpi2-gen-image.sh ver2a 12/2015

4

# rpi2-gen-image.sh ver2a 12/2015

5

#

5

#

6

# Advanced debian "jessie" bootstrap script for RPi2

6

# Advanced debian "jessie" bootstrap script for RPi2

7

#

7

#

8

# This program is free software; you can redistribute it and/or

8

# This program is free software; you can redistribute it and/or

9

# modify it under the terms of the GNU General Public License

9

# modify it under the terms of the GNU General Public License

10

# as published by the Free Software Foundation; either version 2

10

# as published by the Free Software Foundation; either version 2

11

# of the License, or (at your option) any later version.

11

# of the License, or (at your option) any later version.

12

#

12

#

13

# some parts based on rpi2-build-image:

13

# some parts based on rpi2-build-image:

14

15

16

########################################################################

16

########################################################################

17

18

cleanup (){

18

cleanup (){

19

set +x

19

set +x

20

set +e

20

set +e

21

echo "removing temporary mount points ..."

21

echo "removing temporary mount points ..."

22

umount -l $R/proc 2> /dev/null

22

umount -l $R/proc 2> /dev/null

23

umount -l $R/sys 2> /dev/null

23

umount -l $R/sys 2> /dev/null

24

umount -l $R/dev/pts 2> /dev/null

24

umount -l $R/dev/pts 2> /dev/null

25

umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null

25

umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null

26

umount "$BUILDDIR/mount" 2> /dev/null

26

umount "$BUILDDIR/mount" 2> /dev/null

27

losetup -d "$EXT4_LOOP" 2> /dev/null

27

losetup -d "$EXT4_LOOP" 2> /dev/null

28

losetup -d "$VFAT_LOOP" 2> /dev/null

28

losetup -d "$VFAT_LOOP" 2> /dev/null

29

trap - 0 1 2 3 6

29

trap - 0 1 2 3 6

30

}

30

}

31

32

set -e

32

set -e

33

set -x

33

set -x

34

35

RELEASE=${RELEASE:=jessie}

35

RELEASE=${RELEASE:=jessie}

36

37

# Build settings

37

# Build settings

38

BASEDIR=./images/${RELEASE}

38

BASEDIR=./images/${RELEASE}

39

BUILDDIR=${BASEDIR}/build

39

BUILDDIR=${BASEDIR}/build

40

41

# General settings

41

# General settings

42

HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}

42

HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}

43

PASSWORD=${PASSWORD:=raspberry}

43

PASSWORD=${PASSWORD:=raspberry}

44

DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}

44

DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}

45

TIMEZONE=${TIMEZONE:="Europe/Berlin"}

45

TIMEZONE=${TIMEZONE:="Europe/Berlin"}

46

47

# APT settings

47

# APT settings

48

APT_PROXY=${APT_PROXY:=""}

48

APT_PROXY=${APT_PROXY:=""}

49

APT_SERVER=${APT_SERVER:="ftp.debian.org"}

49

APT_SERVER=${APT_SERVER:="ftp.debian.org"}

50

51

# Feature settings

51

# Feature settings

52

ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}

52

ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}

53

ENABLE_IPV6=${ENABLE_IPV6:=true}

53

ENABLE_IPV6=${ENABLE_IPV6:=true}

54

ENABLE_SSHD=${ENABLE_SSHD:=true}

54

ENABLE_SSHD=${ENABLE_SSHD:=true}

55

ENABLE_SOUND=${ENABLE_SOUND:=true}

55

ENABLE_SOUND=${ENABLE_SOUND:=true}

56

ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}

56

ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}

57

ENABLE_DBUS=${ENABLE_DBUS:=true}

57

ENABLE_DBUS=${ENABLE_DBUS:=true}

58

ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}

58

ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}

59

ENABLE_MINGPU=${ENABLE_MINGPU:=false}

59

ENABLE_MINGPU=${ENABLE_MINGPU:=false}

60

ENABLE_XORG=${ENABLE_XORG:=false}

60

ENABLE_XORG=${ENABLE_XORG:=false}

61

ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}

61

ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}

62

63

# Advanced settings

63

# Advanced settings

64

ENABLE_UBOOT=${ENABLE_UBOOT:=false}

64

ENABLE_UBOOT=${ENABLE_UBOOT:=false}

65

ENABLE_HARDNET=${ENABLE_HARDNET:=false}

65

ENABLE_HARDNET=${ENABLE_HARDNET:=false}

66

ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}

66

ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}

67

68

# Image chroot path

68

# Image chroot path

69

R=${BUILDDIR}/chroot

69

R=${BUILDDIR}/chroot

70

71

# Packages required for bootstrapping

71

# Packages required for bootstrapping

72

REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"

72

REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"

73

74

# Missing packages that need to be installed

74

# Missing packages that need to be installed

75

MISSING_PACKAGES=""

75

MISSING_PACKAGES=""

76

77

# Packages required in the chroot build enviroment

77

# Packages required in the chroot build enviroment

78

APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"

78

APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"

79

80

set +x

80

set +x

81

82

# Are we running as root?

82

# Are we running as root?

83

if [ "$(id -u)" -ne "0" ] ; then

83

if [ "$(id -u)" -ne "0" ] ; then

84

echo "this script must be executed with root privileges"

84

echo "this script must be executed with root privileges"

85

exit 1

85

exit 1

86

fi

86

fi

87

88

# Check if all required packages are installed

88

# Check if all required packages are installed

89

for package in $REQUIRED_PACKAGES ; do

89

for package in $REQUIRED_PACKAGES ; do

90

if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then

90

if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then

91

MISSING_PACKAGES="$MISSING_PACKAGES $package"

91

MISSING_PACKAGES="$MISSING_PACKAGES $package"

92

fi

92

fi

93

done

93

done

94

95

# Ask if missing packages should get installed right now

95

# Ask if missing packages should get installed right now

96

if [ -n "$MISSING_PACKAGES" ] ; then

96

if [ -n "$MISSING_PACKAGES" ] ; then

97

echo "the following packages needed by this script are not installed:"

97

echo "the following packages needed by this script are not installed:"

98

echo "$MISSING_PACKAGES"

98

echo "$MISSING_PACKAGES"

99

100

echo -n "\ndo you want to install the missing packages right now? [y/n] "

100

echo -n "\ndo you want to install the missing packages right now? [y/n] "

101

read confirm

101

read confirm

102

if [ "$confirm" != "y" ] ; then

102

if [ "$confirm" != "y" ] ; then

103

exit 1

103

exit 1

104

fi

104

fi

105

fi

105

fi

106

107

# Make sure all required packages are installed

107

# Make sure all required packages are installed

108

apt-get -qq -y install ${REQUIRED_PACKAGES}

108

apt-get -qq -y install ${REQUIRED_PACKAGES}

109

110

# Don't clobber an old build

110

# Don't clobber an old build

111

if [ -e "$BUILDDIR" ]; then

111

if [ -e "$BUILDDIR" ]; then

112

echo "directory $BUILDDIR already exists, not proceeding"

112

echo "directory $BUILDDIR already exists, not proceeding"

113

exit 1

113

exit 1

114

fi

114

fi

115

116

set -x

116

set -x

117

118

# Call "cleanup" function on various signals and errors

118

# Call "cleanup" function on various signals and errors

119

trap cleanup 0 1 2 3 6

119

trap cleanup 0 1 2 3 6

120

121

# Set up chroot directory

121

# Set up chroot directory

122

mkdir -p $R

122

mkdir -p $R

123

124

# Use traditional SystemV init instead of systemd services

124

# Use traditional SystemV init instead of systemd services

125

if [ "$ENABLE_SYSTEMD" = false ] ; then

125

if [ "$ENABLE_SYSTEMD" = false ] ; then

126

APT_INCLUDES="${APT_INCLUDES},sysvinit-core"

126

APT_INCLUDES="${APT_INCLUDES},sysvinit-core"

127

fi

127

fi

128

129

# Add dbus package, recommended if using systemd

129

# Add dbus package, recommended if using systemd

130

if [ "$ENABLE_DBUS" = true ] ; then

130

if [ "$ENABLE_DBUS" = true ] ; then

131

APT_INCLUDES="${APT_INCLUDES},dbus"

131

APT_INCLUDES="${APT_INCLUDES},dbus"

132

fi

132

fi

133

134

# Add openssh server package

134

# Add openssh server package

135

if [ "$ENABLE_SSHD" = true ] ; then

135

if [ "$ENABLE_SSHD" = true ] ; then

136

APT_INCLUDES="${APT_INCLUDES},openssh-server"

136

APT_INCLUDES="${APT_INCLUDES},openssh-server"

137

fi

137

fi

138

139

# Add rng-tools package

139

# Add rng-tools package

140

if [ "$ENABLE_HWRANDOM" = true ] ; then

140

if [ "$ENABLE_HWRANDOM" = true ] ; then

141

APT_INCLUDES="${APT_INCLUDES},rng-tools"

141

APT_INCLUDES="${APT_INCLUDES},rng-tools"

142

fi

142

fi

143

144

# Add xorg package

144

# Add xorg package

145

if [ "$ENABLE_XORG" = true ] ; then

145

if [ "$ENABLE_XORG" = true ] ; then

146

APT_INCLUDES="${APT_INCLUDES},xorg"

146

APT_INCLUDES="${APT_INCLUDES},xorg"

147

fi

147

fi

148

149

# Add fluxbox package with eterm

149

# Add fluxbox package with eterm

150

if [ "$ENABLE_FLUXBOX" = true ] ; then

150

if [ "$ENABLE_FLUXBOX" = true ] ; then

151

APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"

151

APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"

152

fi

152

fi

153

154

if [ -z "$APT_PROXY" ] ; then

154

if [ -z "$APT_PROXY" ] ; then

155

APT_PROXY="http://"

155

APT_PROXY="http://"

156

fi

156

fi

157

158

# Base debootstrap (unpack only)

158

# Base debootstrap (unpack only)

159

debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian

159

debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian

160

cp /usr/bin/qemu-arm-static $R/usr/bin

160

cp /usr/bin/qemu-arm-static $R/usr/bin

161

162

# Remove systemd related packages from list of packages to be bootstrapped

162

# Remove systemd related packages from list of packages to be bootstrapped

163

if [ "$ENABLE_SYSTEMD" = false ] ; then

163

if [ "$ENABLE_SYSTEMD" = false ] ; then

164

chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required

164

chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required

165

fi

165

fi

166

167

# Copy debian-archive-keyring.pgp

167

# Copy debian-archive-keyring.pgp

168

chroot $R mkdir -p /usr/share/keyrings

168

chroot $R mkdir -p /usr/share/keyrings

169

cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg

169

cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg

170

171

# Complete the bootstrapping proccess

171

# Complete the bootstrapping proccess

172

chroot $R /debootstrap/debootstrap --second-stage

172

chroot $R /debootstrap/debootstrap --second-stage

173

174

# Mount required filesystems

174

# Mount required filesystems

175

mount -t proc none $R/proc

175

mount -t proc none $R/proc

176

mount -t sysfs none $R/sys

176

mount -t sysfs none $R/sys

177

mount --bind /dev/pts $R/dev/pts

177

mount --bind /dev/pts $R/dev/pts

178

179

# Use proxy inside chroot

180

if [ -z "$APT_PROXY" ] ; then

181

echo "Acquire::http::Proxy \"$APT_PROXY\"" >> $R/etc/apt/apt.conf.d/10proxy

182

fi

183

179

# Pin package flash-kernel to repositories.collabora.co.uk

184

# Pin package flash-kernel to repositories.collabora.co.uk

180

cat <<EOM >$R/etc/apt/preferences.d/flash-kernel

185

cat <<EOM >$R/etc/apt/preferences.d/flash-kernel

181

Package: flash-kernel

186

Package: flash-kernel

182

Pin: origin repositories.collabora.co.uk

187

Pin: origin repositories.collabora.co.uk

183

Pin-Priority: 1000

188

Pin-Priority: 1000

184

EOM

189

EOM

185

190

186

# Set up timezone

191

# Set up timezone

187

echo ${TIMEZONE} >$R/etc/timezone

192

echo ${TIMEZONE} >$R/etc/timezone

188

LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata

193

LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata

189

194

190

# Set up default locales to "en_US.UTF-8" default

195

# Set up default locales to "en_US.UTF-8" default

191

LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen

196

LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen

192

LANG=C chroot $R locale-gen ${DEFLOCAL}

197

LANG=C chroot $R locale-gen ${DEFLOCAL}

193

198

194

# Upgrade collabora package index and install collabora keyring

199

# Upgrade collabora package index and install collabora keyring

195

echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list

200

echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list

196

LANG=C chroot $R apt-get -qq -y update

201

LANG=C chroot $R apt-get -qq -y update

197

LANG=C chroot $R apt-get -qq -y --force-yes install collabora-obs-archive-keyring

202

LANG=C chroot $R apt-get -qq -y --force-yes install collabora-obs-archive-keyring

198

203

199

# Set up initial sources.list

204

# Set up initial sources.list

200

cat <<EOM >$R/etc/apt/sources.list

205

cat <<EOM >$R/etc/apt/sources.list

201

deb http://${APT_SERVER}/debian ${RELEASE} main contrib

206

deb http://${APT_SERVER}/debian ${RELEASE} main contrib

202

#deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib

207

#deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib

203

208

204

deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

209

deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

205

#deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

210

#deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib

206

211

207

deb http://security.debian.org/ ${RELEASE}/updates main contrib

212

deb http://security.debian.org/ ${RELEASE}/updates main contrib

208

#deb-src http://security.debian.org/ ${RELEASE}/updates main contrib

213

#deb-src http://security.debian.org/ ${RELEASE}/updates main contrib

209

214

210

deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2

215

deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2

211

EOM

216

EOM

212

217

213

# Upgrade package index and update all installed packages and changed dependencies

218

# Upgrade package index and update all installed packages and changed dependencies

214

LANG=C chroot $R apt-get -qq -y update

219

LANG=C chroot $R apt-get -qq -y update

215

LANG=C chroot $R apt-get -qq -y -u dist-upgrade

220

LANG=C chroot $R apt-get -qq -y -u dist-upgrade

216

221

217

# Kernel installation

222

# Kernel installation

218

# Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot

223

# Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot

219

LANG=C chroot $R apt-get -qq -y --no-install-recommends install linux-image-3.18.0-trunk-rpi2

224

LANG=C chroot $R apt-get -qq -y --no-install-recommends install linux-image-3.18.0-trunk-rpi2

220

LANG=C chroot $R apt-get -qq -y install flash-kernel

225

LANG=C chroot $R apt-get -qq -y install flash-kernel

221

226

222

VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"

227

VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"

223

[ -z "$VMLINUZ" ] && exit 1

228

[ -z "$VMLINUZ" ] && exit 1

224

mkdir -p $R/boot/firmware

229

mkdir -p $R/boot/firmware

225

230

226

# required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")

231

# required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")

227

wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin

232

wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin

228

wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat

233

wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat

229

wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat

234

wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat

230

wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat

235

wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat

231

wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf

236

wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf

232

wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf

237

wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf

233

wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf

238

wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf

234

cp $VMLINUZ $R/boot/firmware/kernel7.img

239

cp $VMLINUZ $R/boot/firmware/kernel7.img

235

240

236

# Set up hosts

241

# Set up hosts

237

echo ${HOSTNAME} >$R/etc/hostname

242

echo ${HOSTNAME} >$R/etc/hostname

238

cat <<EOM >$R/etc/hosts

243

cat <<EOM >$R/etc/hosts

239

127.0.0.1 localhost

244

127.0.0.1 localhost

240

127.0.1.1 ${HOSTNAME}

245

127.0.1.1 ${HOSTNAME}

241

EOM

246

EOM

242

247

243

if [ "$ENABLE_IPV6" = true ] ; then

248

if [ "$ENABLE_IPV6" = true ] ; then

244

cat <<EOM >>$R/etc/hosts

249

cat <<EOM >>$R/etc/hosts

245

250

246

::1 localhost ip6-localhost ip6-loopback

251

::1 localhost ip6-localhost ip6-loopback

247

ff02::1 ip6-allnodes

252

ff02::1 ip6-allnodes

248

ff02::2 ip6-allrouters

253

ff02::2 ip6-allrouters

249

EOM

254

EOM

250

fi

255

fi

251

256

252

# Generate crypt(3) password string

257

# Generate crypt(3) password string

253

ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`

258

ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`

254

259

255

# Set up default user

260

# Set up default user

256

LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi

261

LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi

257

LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi

262

LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi

258

263

259

# Set up root password

264

# Set up root password

260

LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root

265

LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root

261

266

262

# Set up interfaces

267

# Set up interfaces

263

cat <<EOM >$R/etc/network/interfaces

268

cat <<EOM >$R/etc/network/interfaces

264

# interfaces(5) file used by ifup(8) and ifdown(8)

269

# interfaces(5) file used by ifup(8) and ifdown(8)

265

# Include files from /etc/network/interfaces.d:

270

# Include files from /etc/network/interfaces.d:

266

source-directory /etc/network/interfaces.d

271

source-directory /etc/network/interfaces.d

267

272

268

# The loopback network interface

273

# The loopback network interface

269

auto lo

274

auto lo

270

iface lo inet loopback

275

iface lo inet loopback

271

276

272

# The primary network interface

277

# The primary network interface

273

allow-hotplug eth0

278

allow-hotplug eth0

274

iface eth0 inet dhcp

279

iface eth0 inet dhcp

275

EOM

280

EOM

276

281

277

# Set up firmware boot cmdline

282

# Set up firmware boot cmdline

278

CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"

283

CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"

279

284

280

# Set up serial console support (if requested)

285

# Set up serial console support (if requested)

281

if [ "$ENABLE_CONSOLE" = true ] ; then

286

if [ "$ENABLE_CONSOLE" = true ] ; then

282

CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"

287

CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"

283

fi

288

fi

284

289

285

# Set up ipv6 support (if requested)

290

# Set up ipv6 support (if requested)

286

if [ "$ENABLE_IPV6" = false ] ; then

291

if [ "$ENABLE_IPV6" = false ] ; then

287

CMDLINE="${CMDLINE} ipv6.disable=1"

292

CMDLINE="${CMDLINE} ipv6.disable=1"

288

fi

293

fi

289

294

290

echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt

295

echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt

291

296

292

# Set up firmware config

297

# Set up firmware config

293

cat <<EOM >$R/boot/firmware/config.txt

298

cat <<EOM >$R/boot/firmware/config.txt

294

# For more options and information see

299

# For more options and information see

295

# http://www.raspberrypi.org/documentation/configuration/config-txt.md

300

# http://www.raspberrypi.org/documentation/configuration/config-txt.md

296

# Some settings may impact device functionality. See link above for details

301

# Some settings may impact device functionality. See link above for details

297

302

298

# uncomment if you get no picture on HDMI for a default "safe" mode

303

# uncomment if you get no picture on HDMI for a default "safe" mode

299

#hdmi_safe=1

304

#hdmi_safe=1

300

305

301

# uncomment this if your display has a black border of unused pixels visible

306

# uncomment this if your display has a black border of unused pixels visible

302

# and your display can output without overscan

307

# and your display can output without overscan

303

#disable_overscan=1

308

#disable_overscan=1

304

309

305

# uncomment the following to adjust overscan. Use positive numbers if console

310

# uncomment the following to adjust overscan. Use positive numbers if console

306

# goes off screen, and negative if there is too much border

311

# goes off screen, and negative if there is too much border

307

#overscan_left=16

312

#overscan_left=16

308

#overscan_right=16

313

#overscan_right=16

309

#overscan_top=16

314

#overscan_top=16

310

#overscan_bottom=16

315

#overscan_bottom=16

311

316

312

# uncomment to force a console size. By default it will be display's size minus

317

# uncomment to force a console size. By default it will be display's size minus

313

# overscan.

318

# overscan.

314

#framebuffer_width=1280

319

#framebuffer_width=1280

315

#framebuffer_height=720

320

#framebuffer_height=720

316

321

317

# uncomment if hdmi display is not detected and composite is being output

322

# uncomment if hdmi display is not detected and composite is being output

318

#hdmi_force_hotplug=1

323

#hdmi_force_hotplug=1

319

324

320

# uncomment to force a specific HDMI mode (this will force VGA)

325

# uncomment to force a specific HDMI mode (this will force VGA)

321

#hdmi_group=1

326

#hdmi_group=1

322

#hdmi_mode=1

327

#hdmi_mode=1

323

328

324

# uncomment to force a HDMI mode rather than DVI. This can make audio work in

329

# uncomment to force a HDMI mode rather than DVI. This can make audio work in

325

# DMT (computer monitor) modes

330

# DMT (computer monitor) modes

326

#hdmi_drive=2

331

#hdmi_drive=2

327

332

328

# uncomment to increase signal to HDMI, if you have interference, blanking, or

333

# uncomment to increase signal to HDMI, if you have interference, blanking, or

329

# no display

334

# no display

330

#config_hdmi_boost=4

335

#config_hdmi_boost=4

331

336

332

# uncomment for composite PAL

337

# uncomment for composite PAL

333

#sdtv_mode=2

338

#sdtv_mode=2

334

339

335

# uncomment to overclock the arm. 700 MHz is the default.

340

# uncomment to overclock the arm. 700 MHz is the default.

336

#arm_freq=800

341

#arm_freq=800

337

EOM

342

EOM

338

343

339

# Set smallest possible GPU memory allocation size: 16MB (no X)

344

# Set smallest possible GPU memory allocation size: 16MB (no X)

340

if [ "$ENABLE_MINGPU" = true ] ; then

345

if [ "$ENABLE_MINGPU" = true ] ; then

341

echo "gpu_mem=16" >>$R/boot/firmware/config.txt

346

echo "gpu_mem=16" >>$R/boot/firmware/config.txt

342

fi

347

fi

343

348

344

# Create symlinks

349

# Create symlinks

345

ln -sf firmware/config.txt $R/boot/config.txt

350

ln -sf firmware/config.txt $R/boot/config.txt

346

ln -sf firmware/cmdline.txt $R/boot/cmdline.txt

351

ln -sf firmware/cmdline.txt $R/boot/cmdline.txt

347

352

348

# Prepare modules-load.d directory

353

# Prepare modules-load.d directory

349

mkdir -p $R/lib/modules-load.d/

354

mkdir -p $R/lib/modules-load.d/

350

355

351

# Load random module on boot

356

# Load random module on boot

352

if [ "$ENABLE_HWRANDOM" = true ] ; then

357

if [ "$ENABLE_HWRANDOM" = true ] ; then

353

cat <<EOM >$R/lib/modules-load.d/rpi2.conf

358

cat <<EOM >$R/lib/modules-load.d/rpi2.conf

354

bcm2708_rng

359

bcm2708_rng

355

EOM

360

EOM

356

fi

361

fi

357

362

358

# Prepare modprobe.d directory

363

# Prepare modprobe.d directory

359

mkdir -p $R/etc/modprobe.d/

364

mkdir -p $R/etc/modprobe.d/

360

365

361

# Blacklist sound modules

366

# Blacklist sound modules

362

cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf

367

cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf

363

blacklist snd_soc_core

368

blacklist snd_soc_core

364

blacklist snd_pcm

369

blacklist snd_pcm

365

blacklist snd_pcm_dmaengine

370

blacklist snd_pcm_dmaengine

366

blacklist snd_timer

371

blacklist snd_timer

367

blacklist snd_compress

372

blacklist snd_compress

368

blacklist snd_soc_pcm512x_i2c

373

blacklist snd_soc_pcm512x_i2c

369

blacklist snd_soc_pcm512x

374

blacklist snd_soc_pcm512x

370

blacklist snd_soc_tas5713

375

blacklist snd_soc_tas5713

371

blacklist snd_soc_wm8804

376

blacklist snd_soc_wm8804

372

EOM

377

EOM

373

378

374

# Create default fstab

379

# Create default fstab

375

cat <<EOM >$R/etc/fstab

380

cat <<EOM >$R/etc/fstab

376

/dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1

381

/dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1

377

/dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2

382

/dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2

378

EOM

383

EOM

379

384

380

# Avoid swapping and increase cache sizes

385

# Avoid swapping and increase cache sizes

381

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

386

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

382

387

383

# Avoid swapping and increase cache sizes

388

# Avoid swapping and increase cache sizes

384

vm.swappiness=1

389

vm.swappiness=1

385

vm.dirty_background_ratio=20

390

vm.dirty_background_ratio=20

386

vm.dirty_ratio=40

391

vm.dirty_ratio=40

387

vm.dirty_writeback_centisecs=500

392

vm.dirty_writeback_centisecs=500

388

vm.dirty_expire_centisecs=6000

393

vm.dirty_expire_centisecs=6000

389

EOM

394

EOM

390

395

391

# Enable network stack hardening

396

# Enable network stack hardening

392

if [ "$ENABLE_HARDNET" = true ] ; then

397

if [ "$ENABLE_HARDNET" = true ] ; then

393

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

398

cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf

394

399

395

# Enable network stack hardening

400

# Enable network stack hardening

396

net.ipv4.tcp_timestamps=0

401

net.ipv4.tcp_timestamps=0

397

net.ipv4.tcp_syncookies=1

402

net.ipv4.tcp_syncookies=1

398

net.ipv4.conf.all.rp_filter=1

403

net.ipv4.conf.all.rp_filter=1

399

net.ipv4.conf.all.accept_redirects=0

404

net.ipv4.conf.all.accept_redirects=0

400

net.ipv4.conf.all.send_redirects=0

405

net.ipv4.conf.all.send_redirects=0

401

net.ipv4.conf.all.accept_source_route=0

406

net.ipv4.conf.all.accept_source_route=0

402

net.ipv4.conf.default.rp_filter=1

407

net.ipv4.conf.default.rp_filter=1

403

net.ipv4.conf.default.accept_redirects=0

408

net.ipv4.conf.default.accept_redirects=0

404

net.ipv4.conf.default.send_redirects=0

409

net.ipv4.conf.default.send_redirects=0

405

net.ipv4.conf.default.accept_source_route=0

410

net.ipv4.conf.default.accept_source_route=0

406

net.ipv4.conf.lo.accept_redirects=0

411

net.ipv4.conf.lo.accept_redirects=0

407

net.ipv4.conf.lo.send_redirects=0

412

net.ipv4.conf.lo.send_redirects=0

408

net.ipv4.conf.lo.accept_source_route=0

413

net.ipv4.conf.lo.accept_source_route=0

409

net.ipv4.conf.eth0.accept_redirects=0

414

net.ipv4.conf.eth0.accept_redirects=0

410

net.ipv4.conf.eth0.send_redirects=0

415

net.ipv4.conf.eth0.send_redirects=0

411

net.ipv4.conf.eth0.accept_source_route=0

416

net.ipv4.conf.eth0.accept_source_route=0

412

net.ipv4.icmp_echo_ignore_broadcasts=1

417

net.ipv4.icmp_echo_ignore_broadcasts=1

413

net.ipv4.icmp_ignore_bogus_error_responses=1

418

net.ipv4.icmp_ignore_bogus_error_responses=1

414

419

415

net.ipv6.conf.all.accept_redirects=0

420

net.ipv6.conf.all.accept_redirects=0

416

net.ipv6.conf.all.accept_source_route=0

421

net.ipv6.conf.all.accept_source_route=0

417

net.ipv6.conf.all.router_solicitations=0

422

net.ipv6.conf.all.router_solicitations=0

418

net.ipv6.conf.all.accept_ra_rtr_pref=0

423

net.ipv6.conf.all.accept_ra_rtr_pref=0

419

net.ipv6.conf.all.accept_ra_pinfo=0

424

net.ipv6.conf.all.accept_ra_pinfo=0

420

net.ipv6.conf.all.accept_ra_defrtr=0

425

net.ipv6.conf.all.accept_ra_defrtr=0

421

net.ipv6.conf.all.autoconf=0

426

net.ipv6.conf.all.autoconf=0

422

net.ipv6.conf.all.dad_transmits=0

427

net.ipv6.conf.all.dad_transmits=0

423

net.ipv6.conf.all.max_addresses=1

428

net.ipv6.conf.all.max_addresses=1

424

429

425

net.ipv6.conf.default.accept_redirects=0

430

net.ipv6.conf.default.accept_redirects=0

426

net.ipv6.conf.default.accept_source_route=0

431

net.ipv6.conf.default.accept_source_route=0

427

net.ipv6.conf.default.router_solicitations=0

432

net.ipv6.conf.default.router_solicitations=0

428

net.ipv6.conf.default.accept_ra_rtr_pref=0

433

net.ipv6.conf.default.accept_ra_rtr_pref=0

429

net.ipv6.conf.default.accept_ra_pinfo=0

434

net.ipv6.conf.default.accept_ra_pinfo=0

430

net.ipv6.conf.default.accept_ra_defrtr=0

435

net.ipv6.conf.default.accept_ra_defrtr=0

431

net.ipv6.conf.default.autoconf=0

436

net.ipv6.conf.default.autoconf=0

432

net.ipv6.conf.default.dad_transmits=0

437

net.ipv6.conf.default.dad_transmits=0

433

net.ipv6.conf.default.max_addresses=1

438

net.ipv6.conf.default.max_addresses=1

434

439

435

net.ipv6.conf.lo.accept_redirects=0

440

net.ipv6.conf.lo.accept_redirects=0

436

net.ipv6.conf.lo.accept_source_route=0

441

net.ipv6.conf.lo.accept_source_route=0

437

net.ipv6.conf.lo.router_solicitations=0

442

net.ipv6.conf.lo.router_solicitations=0

438

net.ipv6.conf.lo.accept_ra_rtr_pref=0

443

net.ipv6.conf.lo.accept_ra_rtr_pref=0

439

net.ipv6.conf.lo.accept_ra_pinfo=0

444

net.ipv6.conf.lo.accept_ra_pinfo=0

440

net.ipv6.conf.lo.accept_ra_defrtr=0

445

net.ipv6.conf.lo.accept_ra_defrtr=0

441

net.ipv6.conf.lo.autoconf=0

446

net.ipv6.conf.lo.autoconf=0

442

net.ipv6.conf.lo.dad_transmits=0

447

net.ipv6.conf.lo.dad_transmits=0

443

net.ipv6.conf.lo.max_addresses=1

448

net.ipv6.conf.lo.max_addresses=1

444

449

445

net.ipv6.conf.eth0.accept_redirects=0

450

net.ipv6.conf.eth0.accept_redirects=0

446

net.ipv6.conf.eth0.accept_source_route=0

451

net.ipv6.conf.eth0.accept_source_route=0

447

net.ipv6.conf.eth0.router_solicitations=0

452

net.ipv6.conf.eth0.router_solicitations=0

448

net.ipv6.conf.eth0.accept_ra_rtr_pref=0

453

net.ipv6.conf.eth0.accept_ra_rtr_pref=0

449

net.ipv6.conf.eth0.accept_ra_pinfo=0

454

net.ipv6.conf.eth0.accept_ra_pinfo=0

450

net.ipv6.conf.eth0.accept_ra_defrtr=0

455

net.ipv6.conf.eth0.accept_ra_defrtr=0

451

net.ipv6.conf.eth0.autoconf=0

456

net.ipv6.conf.eth0.autoconf=0

452

net.ipv6.conf.eth0.dad_transmits=0

457

net.ipv6.conf.eth0.dad_transmits=0

453

net.ipv6.conf.eth0.max_addresses=1

458

net.ipv6.conf.eth0.max_addresses=1

454

EOM

459

EOM

455

460

456

# Enable resolver warnings about spoofed addresses

461

# Enable resolver warnings about spoofed addresses

457

cat <<EOM >>$R/etc/host.conf

462

cat <<EOM >>$R/etc/host.conf

458

spoof warn

463

spoof warn

459

EOM

464

EOM

460

fi

465

fi

461

466

462

# Regenerate openssh server host keys

467

# Regenerate openssh server host keys

463

if [ "$ENABLE_SSHD" = true ] ; then

468

if [ "$ENABLE_SSHD" = true ] ; then

464

rm -fr $R/etc/ssh/ssh_host_*

469

rm -fr $R/etc/ssh/ssh_host_*

465

LANG=C chroot $R dpkg-reconfigure openssh-server

470

LANG=C chroot $R dpkg-reconfigure openssh-server

466

fi

471

fi

467

472

468

# Enable serial console systemd style

473

# Enable serial console systemd style

469

if [ "$ENABLE_CONSOLE" = true ] ; then

474

if [ "$ENABLE_CONSOLE" = true ] ; then

470

LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service

475

LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service

471

fi

476

fi

472

477

473

# Enable firewall based on iptables started by systemd service

478

# Enable firewall based on iptables started by systemd service

474

if [ "$ENABLE_IPTABLES" = true ] ; then

479

if [ "$ENABLE_IPTABLES" = true ] ; then

475

# Create iptables configuration directory

480

# Create iptables configuration directory

476

mkdir -p "$R/etc/iptables"

481

mkdir -p "$R/etc/iptables"

477

482

478

# Create iptables systemd service

483

# Create iptables systemd service

479

cat <<EOM >$R/etc/systemd/system/iptables.service

484

cat <<EOM >$R/etc/systemd/system/iptables.service

480

[Unit]

485

[Unit]

481

Description=Packet Filtering Framework

486

Description=Packet Filtering Framework

482

DefaultDependencies=no

487

DefaultDependencies=no

483

After=systemd-sysctl.service

488

After=systemd-sysctl.service

484

Before=sysinit.target

489

Before=sysinit.target

485

[Service]

490

[Service]

486

Type=oneshot

491

Type=oneshot

487

ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules

492

ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules

488

ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules

493

ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules

489

ExecStop=/etc/iptables/flush-iptables.sh

494

ExecStop=/etc/iptables/flush-iptables.sh

490

RemainAfterExit=yes

495

RemainAfterExit=yes

491

[Install]

496

[Install]

492

WantedBy=multi-user.target

497

WantedBy=multi-user.target

493

EOM

498

EOM

494

499

495

# Create flush-table script called by iptables service

500

# Create flush-table script called by iptables service

496

cat <<EOM >$R/etc/iptables/flush-iptables.sh

501

cat <<EOM >$R/etc/iptables/flush-iptables.sh

497

#!/bin/sh

502

#!/bin/sh

498

iptables -F

503

iptables -F

499

iptables -X

504

iptables -X

500

iptables -t nat -F

505

iptables -t nat -F

501

iptables -t nat -X

506

iptables -t nat -X

502

iptables -t mangle -F

507

iptables -t mangle -F

503

iptables -t mangle -X

508

iptables -t mangle -X

504

iptables -P INPUT ACCEPT

509

iptables -P INPUT ACCEPT

505

iptables -P FORWARD ACCEPT

510

iptables -P FORWARD ACCEPT

506

iptables -P OUTPUT ACCEPT

511

iptables -P OUTPUT ACCEPT

507

EOM

512

EOM

508

513

509

# Create iptables rule file

514

# Create iptables rule file

510

cat <<EOM >$R/etc/iptables/iptables.rules

515

cat <<EOM >$R/etc/iptables/iptables.rules

511

*filter

516

*filter

512

:INPUT DROP [0:0]

517

:INPUT DROP [0:0]

513

:FORWARD DROP [0:0]

518

:FORWARD DROP [0:0]

514

:OUTPUT ACCEPT [0:0]

519

:OUTPUT ACCEPT [0:0]

515

:TCP - [0:0]

520

:TCP - [0:0]

516

:UDP - [0:0]

521

:UDP - [0:0]

517

:SSH - [0:0]

522

:SSH - [0:0]

518

523

519

# Rate limit ping requests

524

# Rate limit ping requests

520

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

525

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

521

-A INPUT -p icmp --icmp-type echo-request -j DROP

526

-A INPUT -p icmp --icmp-type echo-request -j DROP

522

527

523

# Accept established connections

528

# Accept established connections

524

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

529

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

525

530

526

# Accept all traffic on loopback interface

531

# Accept all traffic on loopback interface

527

-A INPUT -i lo -j ACCEPT

532

-A INPUT -i lo -j ACCEPT

528

533

529

# Drop packets declared invalid

534

# Drop packets declared invalid

530

-A INPUT -m conntrack --ctstate INVALID -j DROP

535

-A INPUT -m conntrack --ctstate INVALID -j DROP

531

536

532

# SSH rate limiting

537

# SSH rate limiting

533

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

538

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

534

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

539

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

535

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

540

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

536

-A SSH -m recent --name sshbf --set -j ACCEPT

541

-A SSH -m recent --name sshbf --set -j ACCEPT

537

542

538

# Send TCP and UDP connections to their respective rules chain

543

# Send TCP and UDP connections to their respective rules chain

539

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

544

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

540

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

545

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

541

546

542

# Reject dropped packets with a RFC compliant responce

547

# Reject dropped packets with a RFC compliant responce

543

-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable

548

-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable

544

-A INPUT -p tcp -j REJECT --reject-with tcp-rst

549

-A INPUT -p tcp -j REJECT --reject-with tcp-rst

545

-A INPUT -j REJECT --reject-with icmp-proto-unreachable

550

-A INPUT -j REJECT --reject-with icmp-proto-unreachable

546

551

547

## TCP PORT RULES

552

## TCP PORT RULES

548

# -A TCP -p tcp -j LOG

553

# -A TCP -p tcp -j LOG

549

554

550

## UDP PORT RULES

555

## UDP PORT RULES

551

# -A UDP -p udp -j LOG

556

# -A UDP -p udp -j LOG

552

557

553

COMMIT

558

COMMIT

554

EOM

559

EOM

555

560

556

# Reload systemd configuration and enable iptables service

561

# Reload systemd configuration and enable iptables service

557

LANG=C chroot $R systemctl daemon-reload

562

LANG=C chroot $R systemctl daemon-reload

558

LANG=C chroot $R systemctl enable iptables.service

563

LANG=C chroot $R systemctl enable iptables.service

559

564

560

if [ "$ENABLE_IPV6" = true ] ; then

565

if [ "$ENABLE_IPV6" = true ] ; then

561

# Create ip6tables systemd service

566

# Create ip6tables systemd service

562

cat <<EOM >$R/etc/systemd/system/ip6tables.service

567

cat <<EOM >$R/etc/systemd/system/ip6tables.service

563

[Unit]

568

[Unit]

564

Description=Packet Filtering Framework

569

Description=Packet Filtering Framework

565

DefaultDependencies=no

570

DefaultDependencies=no

566

After=systemd-sysctl.service

571

After=systemd-sysctl.service

567

Before=sysinit.target

572

Before=sysinit.target

568

[Service]

573

[Service]

569

Type=oneshot

574

Type=oneshot

570

ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

575

ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

571

ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

576

ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules

572

ExecStop=/etc/iptables/flush-ip6tables.sh

577

ExecStop=/etc/iptables/flush-ip6tables.sh

573

RemainAfterExit=yes

578

RemainAfterExit=yes

574

[Install]

579

[Install]

575

WantedBy=multi-user.target

580

WantedBy=multi-user.target

576

EOM

581

EOM

577

582

578

# Create ip6tables file

583

# Create ip6tables file

579

cat <<EOM >$R/etc/iptables/flush-ip6tables.sh

584

cat <<EOM >$R/etc/iptables/flush-ip6tables.sh

580

#!/bin/sh

585

#!/bin/sh

581

ip6tables -F

586

ip6tables -F

582

ip6tables -X

587

ip6tables -X

583

ip6tables -Z

588

ip6tables -Z

584

for table in $(</proc/net/ip6_tables_names)

589

for table in $(</proc/net/ip6_tables_names)

585

do

590

do

586

ip6tables -t \$table -F

591

ip6tables -t \$table -F

587

ip6tables -t \$table -X

592

ip6tables -t \$table -X

588

ip6tables -t \$table -Z

593

ip6tables -t \$table -Z

589

done

594

done

590

ip6tables -P INPUT ACCEPT

595

ip6tables -P INPUT ACCEPT

591

ip6tables -P OUTPUT ACCEPT

596

ip6tables -P OUTPUT ACCEPT

592

ip6tables -P FORWARD ACCEPT

597

ip6tables -P FORWARD ACCEPT

593

EOM

598

EOM

594

599

595

# Create ip6tables rule file

600

# Create ip6tables rule file

596

cat <<EOM >$R/etc/iptables/ip6tables.rules

601

cat <<EOM >$R/etc/iptables/ip6tables.rules

597

*filter

602

*filter

598

:INPUT DROP [0:0]

603

:INPUT DROP [0:0]

599

:FORWARD DROP [0:0]

604

:FORWARD DROP [0:0]

600

:OUTPUT ACCEPT [0:0]

605

:OUTPUT ACCEPT [0:0]

601

:TCP - [0:0]

606

:TCP - [0:0]

602

:UDP - [0:0]

607

:UDP - [0:0]

603

:SSH - [0:0]

608

:SSH - [0:0]

604

609

605

# Drop packets with RH0 headers

610

# Drop packets with RH0 headers

606

-A INPUT -m rt --rt-type 0 -j DROP

611

-A INPUT -m rt --rt-type 0 -j DROP

607

-A OUTPUT -m rt --rt-type 0 -j DROP

612

-A OUTPUT -m rt --rt-type 0 -j DROP

608

-A FORWARD -m rt --rt-type 0 -j DROP

613

-A FORWARD -m rt --rt-type 0 -j DROP

609

614

610

# Rate limit ping requests

615

# Rate limit ping requests

611

-A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

616

-A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT

612

-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP

617

-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP

613

618

614

# Accept established connections

619

# Accept established connections

615

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

620

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

616

621

617

# Accept all traffic on loopback interface

622

# Accept all traffic on loopback interface

618

-A INPUT -i lo -j ACCEPT

623

-A INPUT -i lo -j ACCEPT

619

624

620

# Drop packets declared invalid

625

# Drop packets declared invalid

621

-A INPUT -m conntrack --ctstate INVALID -j DROP

626

-A INPUT -m conntrack --ctstate INVALID -j DROP

622

627

623

# SSH rate limiting

628

# SSH rate limiting

624

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

629

-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH

625

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

630

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP

626

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

631

-A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP

627

-A SSH -m recent --name sshbf --set -j ACCEPT

632

-A SSH -m recent --name sshbf --set -j ACCEPT

628

633

629

# Send TCP and UDP connections to their respective rules chain

634

# Send TCP and UDP connections to their respective rules chain

630

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

635

-A INPUT -p udp -m conntrack --ctstate NEW -j UDP

631

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

636

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP

632

637

633

# Reject dropped packets with a RFC compliant responce

638

# Reject dropped packets with a RFC compliant responce

634

-A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited

639

-A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited

635

-A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited

640

-A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited

636

-A INPUT -j REJECT --reject-with icmp6-adm-prohibited

641

-A INPUT -j REJECT --reject-with icmp6-adm-prohibited

637

642

638

## TCP PORT RULES

643

## TCP PORT RULES

639

# -A TCP -p tcp -j LOG

644

# -A TCP -p tcp -j LOG

640

645

641

## UDP PORT RULES

646

## UDP PORT RULES

642

# -A UDP -p udp -j LOG

647

# -A UDP -p udp -j LOG

643

648

644

COMMIT

649

COMMIT

645

EOM

650

EOM

646

651

647

# Reload systemd configuration and enable iptables service

652

# Reload systemd configuration and enable iptables service

648

LANG=C chroot $R systemctl daemon-reload

653

LANG=C chroot $R systemctl daemon-reload

649

LANG=C chroot $R systemctl enable ip6tables.service

654

LANG=C chroot $R systemctl enable ip6tables.service

650

655

651

fi

656

fi

652

fi

657

fi

653

658

654

if [ "$ENABLE_UBOOT" = true ] ; then

659

if [ "$ENABLE_UBOOT" = true ] ; then

655

# Fetch u-boot github

660

# Fetch u-boot github

656

git -C $R/tmp clone git://git.denx.de/u-boot.git

661

git -C $R/tmp clone git://git.denx.de/u-boot.git

657

662

658

# Install minimal gcc/g++ build environment and build u-boot inside chroot

663

# Install minimal gcc/g++ build environment and build u-boot inside chroot

659

LANG=C chroot $R apt-get install -qq -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc

664

LANG=C chroot $R apt-get install -qq -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc

660

LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all

665

LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all

661

666

662

# Copy compiled bootloader binary and set config.txt to load it

667

# Copy compiled bootloader binary and set config.txt to load it

663

cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/

668

cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/

664

printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt

669

printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt

665

670

666

# Set u-boot command file

671

# Set u-boot command file

667

cat <<EOM >$R/boot/firmware/uboot.mkimage

672

cat <<EOM >$R/boot/firmware/uboot.mkimage

668

# Tell Linux that it is booting on a Raspberry Pi2

673

# Tell Linux that it is booting on a Raspberry Pi2

669

setenv machid 0x00000c42

674

setenv machid 0x00000c42

670

675

671

# Set the kernel boot command line

676

# Set the kernel boot command line

672

setenv bootargs "earlyprintk ${CMDLINE}"

677

setenv bootargs "earlyprintk ${CMDLINE}"

673

678

674

# Save these changes to u-boot's environment

679

# Save these changes to u-boot's environment

675

saveenv

680

saveenv

676

681

677

# Load the existing Linux kernel into RAM

682

# Load the existing Linux kernel into RAM

678

fatload mmc 0:1 \${kernel_addr_r} kernel7.img

683

fatload mmc 0:1 \${kernel_addr_r} kernel7.img

679

684

680

# Boot the kernel we have just loaded

685

# Boot the kernel we have just loaded

681

bootz \${kernel_addr_r}

686

bootz \${kernel_addr_r}

682

EOM

687

EOM

683

688

684

# Generate u-boot image from command file

689

# Generate u-boot image from command file

685

LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr

690

LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr

686

691

687

# Remove gcc/c++ build enviroment

692

# Remove gcc/c++ build enviroment

688

LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make

693

LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make

689

fi

694

fi

690

695

691

# Clean cached downloads

696

# Clean cached downloads

692

LANG=C chroot $R apt-get -y clean

697

LANG=C chroot $R apt-get -y clean

693

LANG=C chroot $R apt-get -y autoclean

698

LANG=C chroot $R apt-get -y autoclean

694

LANG=C chroot $R apt-get -y autoremove

699

LANG=C chroot $R apt-get -y autoremove

695

700

696

# Unmount mounted filesystems

701

# Unmount mounted filesystems

697

umount -l $R/proc

702

umount -l $R/proc

698

umount -l $R/sys

703

umount -l $R/sys

699

704

700

# Clean up files

705

# Clean up files

701

rm -f $R/etc/apt/sources.list.save

706

rm -f $R/etc/apt/sources.list.save

702

rm -f $R/etc/resolvconf/resolv.conf.d/original

707

rm -f $R/etc/resolvconf/resolv.conf.d/original

703

rm -rf $R/run

708

rm -rf $R/run

704

mkdir -p $R/run

709

mkdir -p $R/run

705

rm -f $R/etc/*-

710

rm -f $R/etc/*-

706

rm -f $R/root/.bash_history

711

rm -f $R/root/.bash_history

707

rm -rf $R/tmp/*

712

rm -rf $R/tmp/*

708

rm -f $R/var/lib/urandom/random-seed

713

rm -f $R/var/lib/urandom/random-seed

709

[ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id

714

[ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id

710

rm -f $R/etc/machine-id

715

rm -f $R/etc/machine-id

716

rm -fr $R/etc/apt/apt.conf.d/10proxy

711

717

712

# Calculate size of the chroot directory

718

# Calculate size of the chroot directory

713

CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)

719

CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)

714

720

715

# Calculate required image size

721

# Calculate required image size

716

IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`

722

IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`

717

723

718

# Calculate number of sectors for the partition

724

# Calculate number of sectors for the partition

719

IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`

725

IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`

720

726

721

# Prepare date string for image file name

727

# Prepare date string for image file name

722

DATE="$(date +%Y-%m-%d)"

728

DATE="$(date +%Y-%m-%d)"

723

729

724

# Prepare image file

730

# Prepare image file

725

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1

731

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1

726

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}

732

dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}

727

733

728

# Write partition table

734

# Write partition table

729

sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM

735

sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM

730

unit: sectors

736

unit: sectors

731

737

732

1 : start= 2048, size= 131072, Id= c, bootable

738

1 : start= 2048, size= 131072, Id= c, bootable

733

2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83

739

2 : start= 133120, size= ${IMAGE_SECTORS}, Id=83

734

3 : start= 0, size= 0, Id= 0

740

3 : start= 0, size= 0, Id= 0

735

4 : start= 0, size= 0, Id= 0

741

4 : start= 0, size= 0, Id= 0

736

EOM

742

EOM

737

743

738

# Set up temporary loop devices and build filesystems

744

# Set up temporary loop devices and build filesystems

739

VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

745

VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

740

EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

746

EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"

741

mkfs.vfat "$VFAT_LOOP"

747

mkfs.vfat "$VFAT_LOOP"

742

mkfs.ext4 "$EXT4_LOOP"

748

mkfs.ext4 "$EXT4_LOOP"

743

749

744

# Mount the temporary loop devices

750

# Mount the temporary loop devices

745

mkdir -p "$BUILDDIR/mount"

751

mkdir -p "$BUILDDIR/mount"

746

mount "$EXT4_LOOP" "$BUILDDIR/mount"

752

mount "$EXT4_LOOP" "$BUILDDIR/mount"

747

753

748

mkdir -p "$BUILDDIR/mount/boot/firmware"

754

mkdir -p "$BUILDDIR/mount/boot/firmware"

749

mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"

755

mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"

750

756

751

# Copy all files from the chroot to the loop device mount point directory

757

# Copy all files from the chroot to the loop device mount point directory

752

rsync -a "$R/" "$BUILDDIR/mount/"

758

rsync -a "$R/" "$BUILDDIR/mount/"

753

759

754

# Unmount all temporary loop devices and mount points

760

# Unmount all temporary loop devices and mount points

755

cleanup

761

cleanup

756

762

757

# (optinal) create block map file for "bmaptool"

763

# (optinal) create block map file for "bmaptool"

758

bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"

764

bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"

759

765

760

# Image was successfully created

766

# Image was successfully created

761

echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"

767

echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

             #!/bin/sh
             ########################################################################
             # rpi2-gen-image.sh					   ver2a 12/2015
             #
             # Advanced debian "jessie" bootstrap script for RPi2
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # some parts based on rpi2-build-image:
             # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
             # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
             ########################################################################
             cleanup (){
               set +x
               set +e
               echo "removing temporary mount points ..."
               umount -l $R/proc 2> /dev/null
               umount -l $R/sys 2> /dev/null
               umount -l $R/dev/pts 2> /dev/null
               umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
               umount "$BUILDDIR/mount" 2> /dev/null
               losetup -d "$EXT4_LOOP" 2> /dev/null
               losetup -d "$VFAT_LOOP" 2> /dev/null
               trap - 0 1 2 3 6
             }
             set -e
             set -x
             RELEASE=${RELEASE:=jessie}
             # Build settings
             BASEDIR=./images/${RELEASE}
             BUILDDIR=${BASEDIR}/build
             # General settings
             HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
             PASSWORD=${PASSWORD:=raspberry}
             DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
             TIMEZONE=${TIMEZONE:="Europe/Berlin"}
             # APT settings
             APT_PROXY=${APT_PROXY:=""}
             APT_SERVER=${APT_SERVER:="ftp.debian.org"}
             # Feature settings
             ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
             ENABLE_IPV6=${ENABLE_IPV6:=true}
             ENABLE_SSHD=${ENABLE_SSHD:=true}
             ENABLE_SOUND=${ENABLE_SOUND:=true}
             ENABLE_SYSTEMD=${ENABLE_SYSTEMD:=true}
             ENABLE_DBUS=${ENABLE_DBUS:=true}
             ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
             ENABLE_MINGPU=${ENABLE_MINGPU:=false}
             ENABLE_XORG=${ENABLE_XORG:=false}
             ENABLE_FLUXBOX=${ENABLE_FLUXBOX:=false}
             # Advanced settings
             ENABLE_UBOOT=${ENABLE_UBOOT:=false}
             ENABLE_HARDNET=${ENABLE_HARDNET:=false}
             ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
             # Image chroot path
             R=${BUILDDIR}/chroot
             # Packages required for bootstrapping
             REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core"
             # Missing packages that need to be installed
             MISSING_PACKAGES=""
             # Packages required in the chroot build enviroment
             APT_INCLUDES="apt-transport-https,ca-certificates,debian-archive-keyring,dialog,locales,apt-utils,vim-tiny"
             set +x
             # Are we running as root?
             if [ "$(id -u)" -ne "0" ] ; then
               echo "this script must be executed with root privileges"
               exit 1
             fi
             # Check if all required packages are installed
             for package in $REQUIRED_PACKAGES ; do
               if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
                 MISSING_PACKAGES="$MISSING_PACKAGES $package"
               fi
             done
             # Ask if missing packages should get installed right now
             if [ -n "$MISSING_PACKAGES" ] ; then
               echo "the following packages needed by this script are not installed:"
               echo "$MISSING_PACKAGES"
               echo -n "\ndo you want to install the missing packages right now? [y/n] "
               read confirm
               if [ "$confirm" != "y" ] ; then
                 exit 1
               fi
             fi
             # Make sure all required packages are installed
             apt-get -qq -y install ${REQUIRED_PACKAGES}
             # Don't clobber an old build
             if [ -e "$BUILDDIR" ]; then
               echo "directory $BUILDDIR already exists, not proceeding"
               exit 1
             fi
             set -x
             # Call "cleanup" function on various signals and errors
             trap cleanup 0 1 2 3 6
             # Set up chroot directory
             mkdir -p $R
             # Use traditional SystemV init instead of systemd services
             if [ "$ENABLE_SYSTEMD" = false ] ; then
               APT_INCLUDES="${APT_INCLUDES},sysvinit-core"
             fi
             # Add dbus package, recommended if using systemd
             if [ "$ENABLE_DBUS" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},dbus"
             fi
             # Add openssh server package
             if [ "$ENABLE_SSHD" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},openssh-server"
             fi
             # Add rng-tools package
             if [ "$ENABLE_HWRANDOM" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},rng-tools"
             fi
             # Add xorg package
             if [ "$ENABLE_XORG" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},xorg"
             fi
             # Add fluxbox package with eterm
             if [ "$ENABLE_FLUXBOX" = true ] ; then
               APT_INCLUDES="${APT_INCLUDES},fluxbox,eterm"
             fi
             if [ -z "$APT_PROXY" ] ; then
               APT_PROXY="http://"
             fi
             # Base debootstrap (unpack only)
             debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R ${APT_PROXY}${APT_SERVER}/debian
             cp /usr/bin/qemu-arm-static $R/usr/bin
             # Remove systemd related packages from list of packages to be bootstrapped
             if [ "$ENABLE_SYSTEMD" = false ] ; then
               chroot $R sed -i -e 's/systemd systemd-sysv //g' /debootstrap/required
             fi
             # Copy debian-archive-keyring.pgp
             chroot $R mkdir -p /usr/share/keyrings
             cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
             # Complete the bootstrapping proccess
             chroot $R /debootstrap/debootstrap --second-stage
             # Mount required filesystems
             mount -t proc none $R/proc
             mount -t sysfs none $R/sys
             mount --bind /dev/pts $R/dev/pts
+            # Use proxy inside chroot
+            if [ -z "$APT_PROXY" ] ; then
+              echo "Acquire::http::Proxy \"$APT_PROXY\"" >> $R/etc/apt/apt.conf.d/10proxy
+            fi
             # Pin package flash-kernel to repositories.collabora.co.uk
             cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
             Package: flash-kernel
             Pin: origin repositories.collabora.co.uk
             Pin-Priority: 1000
             EOM
             # Set up timezone
             echo ${TIMEZONE} >$R/etc/timezone
             LANG=C chroot $R dpkg-reconfigure -f noninteractive tzdata
             # Set up default locales to "en_US.UTF-8" default
             LANG=C chroot $R sed -i '/${DEFLOCAL}/s/^#//' /etc/locale.gen
             LANG=C chroot $R locale-gen ${DEFLOCAL}
             # Upgrade collabora package index and install collabora keyring
             echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
             LANG=C chroot $R apt-get -qq -y update
             LANG=C chroot $R apt-get -qq -y --force-yes install collabora-obs-archive-keyring
             # Set up initial sources.list
             cat <<EOM >$R/etc/apt/sources.list
             deb http://${APT_SERVER}/debian ${RELEASE} main contrib
             #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
             deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
             #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
             deb http://security.debian.org/ ${RELEASE}/updates main contrib
             #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
             deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
             EOM
             # Upgrade package index and update all installed packages and changed dependencies
             LANG=C chroot $R apt-get -qq -y update
             LANG=C chroot $R apt-get -qq -y -u dist-upgrade
             # Kernel installation
             # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
             LANG=C chroot $R apt-get -qq -y --no-install-recommends install linux-image-3.18.0-trunk-rpi2
             LANG=C chroot $R apt-get -qq -y install flash-kernel
             VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
             [ -z "$VMLINUZ" ] && exit 1
             mkdir -p $R/boot/firmware
             # required boot binaries from raspberry/firmware github (commit: "kernel: Bump to 3.18.10")
             wget -q -O $R/boot/firmware/bootcode.bin https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/bootcode.bin
             wget -q -O $R/boot/firmware/fixup_cd.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_cd.dat
             wget -q -O $R/boot/firmware/fixup.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup.dat
             wget -q -O $R/boot/firmware/fixup_x.dat https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/fixup_x.dat
             wget -q -O $R/boot/firmware/start_cd.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_cd.elf
             wget -q -O $R/boot/firmware/start.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start.elf
             wget -q -O $R/boot/firmware/start_x.elf https://github.com/raspberrypi/firmware/raw/cd355a9dd4f1f4de2e79b0c8e102840885cdf1de/boot/start_x.elf
             cp $VMLINUZ $R/boot/firmware/kernel7.img
             # Set up hosts
             echo ${HOSTNAME} >$R/etc/hostname
             cat <<EOM >$R/etc/hosts
 .0.0.1       localhost
 .0.1.1       ${HOSTNAME}
             EOM
             if [ "$ENABLE_IPV6" = true ] ; then
             cat <<EOM >>$R/etc/hosts
             ::1             localhost ip6-localhost ip6-loopback
             ff02::1         ip6-allnodes
             ff02::2         ip6-allrouters
             EOM
             fi
             # Generate crypt(3) password string
             ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
             # Set up default user
             LANG=C chroot $R adduser --gecos "Raspberry PI user" --add_extra_groups --disabled-password pi
             LANG=C chroot $R usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
             # Set up root password
             LANG=C chroot $R usermod -p "${ENCRYPTED_PASSWORD}" root
             # Set up interfaces
             cat <<EOM >$R/etc/network/interfaces
             # interfaces(5) file used by ifup(8) and ifdown(8)
             # Include files from /etc/network/interfaces.d:
             source-directory /etc/network/interfaces.d
             # The loopback network interface
             auto lo
             iface lo inet loopback
             # The primary network interface
             allow-hotplug eth0
             iface eth0 inet dhcp
             EOM
             # Set up firmware boot cmdline
             CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
             # Set up serial console support (if requested)
             if [ "$ENABLE_CONSOLE" = true ] ; then
               CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
             fi
             # Set up ipv6 support (if requested)
             if [ "$ENABLE_IPV6" = false ] ; then
               CMDLINE="${CMDLINE} ipv6.disable=1"
             fi
             echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
             # Set up firmware config
             cat <<EOM >$R/boot/firmware/config.txt
             # For more options and information see
             # http://www.raspberrypi.org/documentation/configuration/config-txt.md
             # Some settings may impact device functionality. See link above for details
             # uncomment if you get no picture on HDMI for a default "safe" mode
             #hdmi_safe=1
             # uncomment this if your display has a black border of unused pixels visible
             # and your display can output without overscan
             #disable_overscan=1
             # uncomment the following to adjust overscan. Use positive numbers if console
             # goes off screen, and negative if there is too much border
             #overscan_left=16
             #overscan_right=16
             #overscan_top=16
             #overscan_bottom=16
             # uncomment to force a console size. By default it will be display's size minus
             # overscan.
             #framebuffer_width=1280
             #framebuffer_height=720
             # uncomment if hdmi display is not detected and composite is being output
             #hdmi_force_hotplug=1
             # uncomment to force a specific HDMI mode (this will force VGA)
             #hdmi_group=1
             #hdmi_mode=1
             # uncomment to force a HDMI mode rather than DVI. This can make audio work in
             # DMT (computer monitor) modes
             #hdmi_drive=2
             # uncomment to increase signal to HDMI, if you have interference, blanking, or
             # no display
             #config_hdmi_boost=4
             # uncomment for composite PAL
             #sdtv_mode=2
             # uncomment to overclock the arm. 700 MHz is the default.
             #arm_freq=800
             EOM
             # Set smallest possible GPU memory allocation size: 16MB (no X)
             if [ "$ENABLE_MINGPU" = true ] ; then
               echo "gpu_mem=16" >>$R/boot/firmware/config.txt
             fi
             # Create symlinks
             ln -sf firmware/config.txt $R/boot/config.txt
             ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
             # Prepare modules-load.d directory
             mkdir -p $R/lib/modules-load.d/
             # Load random module on boot
             if [ "$ENABLE_HWRANDOM" = true ] ; then
               cat <<EOM >$R/lib/modules-load.d/rpi2.conf
             bcm2708_rng
             EOM
             fi
             # Prepare modprobe.d directory
             mkdir -p $R/etc/modprobe.d/
             # Blacklist sound modules
             cat <<EOM >$R/etc/modprobe.d/raspi-blacklist.conf
             blacklist snd_soc_core
             blacklist snd_pcm
             blacklist snd_pcm_dmaengine
             blacklist snd_timer
             blacklist snd_compress
             blacklist snd_soc_pcm512x_i2c
             blacklist snd_soc_pcm512x
             blacklist snd_soc_tas5713
             blacklist snd_soc_wm8804
             EOM
             # Create default fstab
             cat <<EOM >$R/etc/fstab
             /dev/mmcblk0p2 / ext4 noatime,nodiratime,errors=remount-ro,discard,data=writeback,commit=100 0 1
             /dev/mmcblk0p1 /boot/firmware vfat defaults,noatime,nodiratime 0 2
             EOM
             # Avoid swapping and increase cache sizes
             cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
             # Avoid swapping and increase cache sizes
             vm.swappiness=1
             vm.dirty_background_ratio=20
             vm.dirty_ratio=40
             vm.dirty_writeback_centisecs=500
             vm.dirty_expire_centisecs=6000
             EOM
             # Enable network stack hardening
             if [ "$ENABLE_HARDNET" = true ] ; then
               cat <<EOM >>$R/etc/sysctl.d/99-sysctl.conf
             # Enable network stack hardening
             net.ipv4.tcp_timestamps=0
             net.ipv4.tcp_syncookies=1
             net.ipv4.conf.all.rp_filter=1
             net.ipv4.conf.all.accept_redirects=0
             net.ipv4.conf.all.send_redirects=0
             net.ipv4.conf.all.accept_source_route=0
             net.ipv4.conf.default.rp_filter=1
             net.ipv4.conf.default.accept_redirects=0
             net.ipv4.conf.default.send_redirects=0
             net.ipv4.conf.default.accept_source_route=0
             net.ipv4.conf.lo.accept_redirects=0
             net.ipv4.conf.lo.send_redirects=0
             net.ipv4.conf.lo.accept_source_route=0
             net.ipv4.conf.eth0.accept_redirects=0
             net.ipv4.conf.eth0.send_redirects=0
             net.ipv4.conf.eth0.accept_source_route=0
             net.ipv4.icmp_echo_ignore_broadcasts=1
             net.ipv4.icmp_ignore_bogus_error_responses=1
             net.ipv6.conf.all.accept_redirects=0
             net.ipv6.conf.all.accept_source_route=0
             net.ipv6.conf.all.router_solicitations=0
             net.ipv6.conf.all.accept_ra_rtr_pref=0
             net.ipv6.conf.all.accept_ra_pinfo=0
             net.ipv6.conf.all.accept_ra_defrtr=0
             net.ipv6.conf.all.autoconf=0
             net.ipv6.conf.all.dad_transmits=0
             net.ipv6.conf.all.max_addresses=1
             net.ipv6.conf.default.accept_redirects=0
             net.ipv6.conf.default.accept_source_route=0
             net.ipv6.conf.default.router_solicitations=0
             net.ipv6.conf.default.accept_ra_rtr_pref=0
             net.ipv6.conf.default.accept_ra_pinfo=0
             net.ipv6.conf.default.accept_ra_defrtr=0
             net.ipv6.conf.default.autoconf=0
             net.ipv6.conf.default.dad_transmits=0
             net.ipv6.conf.default.max_addresses=1
             net.ipv6.conf.lo.accept_redirects=0
             net.ipv6.conf.lo.accept_source_route=0
             net.ipv6.conf.lo.router_solicitations=0
             net.ipv6.conf.lo.accept_ra_rtr_pref=0
             net.ipv6.conf.lo.accept_ra_pinfo=0
             net.ipv6.conf.lo.accept_ra_defrtr=0
             net.ipv6.conf.lo.autoconf=0
             net.ipv6.conf.lo.dad_transmits=0
             net.ipv6.conf.lo.max_addresses=1
             net.ipv6.conf.eth0.accept_redirects=0
             net.ipv6.conf.eth0.accept_source_route=0
             net.ipv6.conf.eth0.router_solicitations=0
             net.ipv6.conf.eth0.accept_ra_rtr_pref=0
             net.ipv6.conf.eth0.accept_ra_pinfo=0
             net.ipv6.conf.eth0.accept_ra_defrtr=0
             net.ipv6.conf.eth0.autoconf=0
             net.ipv6.conf.eth0.dad_transmits=0
             net.ipv6.conf.eth0.max_addresses=1
             EOM
             # Enable resolver warnings about spoofed addresses
               cat <<EOM >>$R/etc/host.conf
             spoof warn
             EOM
             fi
             # Regenerate openssh server host keys
             if [ "$ENABLE_SSHD" = true ] ; then
               rm -fr $R/etc/ssh/ssh_host_*
               LANG=C chroot $R dpkg-reconfigure openssh-server
             fi
             # Enable serial console systemd style
             if [ "$ENABLE_CONSOLE" = true ] ; then
               LANG=C chroot $R systemctl enable serial-getty\@ttyAMA0.service
             fi
             # Enable firewall based on iptables started by systemd service
             if [ "$ENABLE_IPTABLES" = true ] ; then
               # Create iptables configuration directory
               mkdir -p "$R/etc/iptables"
               # Create iptables systemd service
               cat <<EOM >$R/etc/systemd/system/iptables.service
             [Unit]
             Description=Packet Filtering Framework
             DefaultDependencies=no
             After=systemd-sysctl.service
             Before=sysinit.target
             [Service]
             Type=oneshot
             ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules
             ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
             ExecStop=/etc/iptables/flush-iptables.sh
             RemainAfterExit=yes
             [Install]
             WantedBy=multi-user.target
             EOM
               # Create flush-table script called by iptables service
               cat <<EOM >$R/etc/iptables/flush-iptables.sh
             #!/bin/sh
             iptables -F
             iptables -X
             iptables -t nat -F
             iptables -t nat -X
             iptables -t mangle -F
             iptables -t mangle -X
             iptables -P INPUT ACCEPT
             iptables -P FORWARD ACCEPT
             iptables -P OUTPUT ACCEPT
             EOM
               # Create iptables rule file
               cat <<EOM >$R/etc/iptables/iptables.rules
             *filter
             :INPUT DROP [0:0]
             :FORWARD DROP [0:0]
             :OUTPUT ACCEPT [0:0]
             :TCP - [0:0]
             :UDP - [0:0]
             :SSH - [0:0]
             # Rate limit ping requests
             -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
             -A INPUT -p icmp --icmp-type echo-request -j DROP
             # Accept established connections
             -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
             # Accept all traffic on loopback interface
             -A INPUT -i lo -j ACCEPT
             # Drop packets declared invalid
             -A INPUT -m conntrack --ctstate INVALID -j DROP
             # SSH rate limiting
             -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
             -A SSH -m recent --name sshbf --set -j ACCEPT
             # Send TCP and UDP connections to their respective rules chain
             -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
             -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
             # Reject dropped packets with a RFC compliant responce
             -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
             -A INPUT -p tcp -j REJECT --reject-with tcp-rst
             -A INPUT -j REJECT --reject-with icmp-proto-unreachable
             ## TCP PORT RULES
             # -A TCP -p tcp -j LOG
             ## UDP PORT RULES
             # -A UDP -p udp -j LOG
             COMMIT
             EOM
               # Reload systemd configuration and enable iptables service
               LANG=C chroot $R systemctl daemon-reload
               LANG=C chroot $R systemctl enable iptables.service
               if [ "$ENABLE_IPV6" = true ] ; then
                 # Create ip6tables systemd service
                 cat <<EOM >$R/etc/systemd/system/ip6tables.service
             [Unit]
             Description=Packet Filtering Framework
             DefaultDependencies=no
             After=systemd-sysctl.service
             Before=sysinit.target
             [Service]
             Type=oneshot
             ExecStart=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
             ExecReload=/sbin/ip6tables-restore /etc/iptables/ip6tables.rules
             ExecStop=/etc/iptables/flush-ip6tables.sh
             RemainAfterExit=yes
             [Install]
             WantedBy=multi-user.target
             EOM
                 # Create ip6tables file
                 cat <<EOM >$R/etc/iptables/flush-ip6tables.sh
             #!/bin/sh
             ip6tables -F
             ip6tables -X
             ip6tables -Z
             for table in $(</proc/net/ip6_tables_names)
             do
                     ip6tables -t \$table -F
                     ip6tables -t \$table -X
                     ip6tables -t \$table -Z
             done
             ip6tables -P INPUT ACCEPT
             ip6tables -P OUTPUT ACCEPT
             ip6tables -P FORWARD ACCEPT
             EOM
                 # Create ip6tables rule file
                 cat <<EOM >$R/etc/iptables/ip6tables.rules
             *filter
             :INPUT DROP [0:0]
             :FORWARD DROP [0:0]
             :OUTPUT ACCEPT [0:0]
             :TCP - [0:0]
             :UDP - [0:0]
             :SSH - [0:0]
             # Drop packets with RH0 headers
             -A INPUT -m rt --rt-type 0 -j DROP
             -A OUTPUT -m rt --rt-type 0 -j DROP
             -A FORWARD -m rt --rt-type 0 -j DROP
             # Rate limit ping requests
             -A INPUT -p icmpv6 --icmpv6-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT
             -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
             # Accept established connections
             -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
             # Accept all traffic on loopback interface
             -A INPUT -i lo -j ACCEPT
             # Drop packets declared invalid
             -A INPUT -m conntrack --ctstate INVALID -j DROP
             # SSH rate limiting
             -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j SSH
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP
             -A SSH -m recent --name sshbf --rttl --rcheck --hitcount 20 --seconds 1800 -j DROP
             -A SSH -m recent --name sshbf --set -j ACCEPT
             # Send TCP and UDP connections to their respective rules chain
             -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
             -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
             # Reject dropped packets with a RFC compliant responce
             -A INPUT -p udp -j REJECT --reject-with icmp6-adm-prohibited
             -A INPUT -p tcp -j REJECT --reject-with icmp6-adm-prohibited
             -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
             ## TCP PORT RULES
             # -A TCP -p tcp -j LOG
             ## UDP PORT RULES
             # -A UDP -p udp -j LOG
             COMMIT
             EOM
               # Reload systemd configuration and enable iptables service
               LANG=C chroot $R systemctl daemon-reload
               LANG=C chroot $R systemctl enable ip6tables.service
               fi
             fi
             if [ "$ENABLE_UBOOT" = true ] ; then
               # Fetch u-boot github
               git -C $R/tmp clone git://git.denx.de/u-boot.git
               # Install minimal gcc/g++ build environment and build u-boot inside chroot
               LANG=C chroot $R apt-get install -qq -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
               LANG=C chroot $R make -C /tmp/u-boot/ rpi_2_defconfig all
               # Copy compiled bootloader binary and set config.txt to load it
               cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
               printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
               # Set u-boot command file
               cat <<EOM >$R/boot/firmware/uboot.mkimage
             # Tell Linux that it is booting on a Raspberry Pi2
             setenv machid 0x00000c42
             # Set the kernel boot command line
             setenv bootargs "earlyprintk ${CMDLINE}"
             # Save these changes to u-boot's environment
             saveenv
             # Load the existing Linux kernel into RAM
             fatload mmc 0:1 \${kernel_addr_r} kernel7.img
             # Boot the kernel we have just loaded
             bootz \${kernel_addr_r}
             EOM
               # Generate u-boot image from command file
               LANG=C chroot $R mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
               # Remove gcc/c++ build enviroment
               LANG=C chroot $R apt-get purge -y bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
             fi
             # Clean cached downloads
             LANG=C chroot $R apt-get -y clean
             LANG=C chroot $R apt-get -y autoclean
             LANG=C chroot $R apt-get -y autoremove
             # Unmount mounted filesystems
             umount -l $R/proc
             umount -l $R/sys
             # Clean up files
             rm -f $R/etc/apt/sources.list.save
             rm -f $R/etc/resolvconf/resolv.conf.d/original
             rm -rf $R/run
             mkdir -p $R/run
             rm -f $R/etc/*-
             rm -f $R/root/.bash_history
             rm -rf $R/tmp/*
             rm -f $R/var/lib/urandom/random-seed
             [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
             rm -f $R/etc/machine-id
+            rm -fr $R/etc/apt/apt.conf.d/10proxy
             # Calculate size of the chroot directory
             CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'` / 1024)
             # Calculate required image size
             IMAGE_SIZE=`expr $(expr ${CHROOT_SIZE} / 1024 + 1) \* 1024`
             # Calculate number of sectors for the partition
             IMAGE_SECTORS=`expr $(expr ${IMAGE_SIZE} \* 1048576) / 512 - 133120`
             # Prepare date string for image file name
             DATE="$(date +%Y-%m-%d)"
             # Prepare image file
             dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=1
             dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=1M count=0 seek=${IMAGE_SIZE}
             # Write partition table
             sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
             unit: sectors
 : start=     2048, size=   131072, Id= c, bootable
 : start=   133120, size=  ${IMAGE_SECTORS}, Id=83
 : start=        0, size=        0, Id= 0
 : start=        0, size=        0, Id= 0
             EOM
             # Set up temporary loop devices and build filesystems
             VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
             EXT4_LOOP="$(losetup -o 65M --sizelimit `expr ${IMAGE_SIZE} - 64`M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
             mkfs.vfat "$VFAT_LOOP"
             mkfs.ext4 "$EXT4_LOOP"
             # Mount the temporary loop devices
             mkdir -p "$BUILDDIR/mount"
             mount "$EXT4_LOOP" "$BUILDDIR/mount"
             mkdir -p "$BUILDDIR/mount/boot/firmware"
             mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
             # Copy all files from the chroot to the loop device mount point directory
             rsync -a "$R/" "$BUILDDIR/mount/"
             # Unmount all temporary loop devices and mount points
             cleanup
             # (optinal) create block map file for "bmaptool"
             bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
             # Image was successfully created
             echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"