Raspi2-3_GenImage Commit - r531:f2b59207efa6 · Collaboration Tremplin des Sciences

Merge pull request #169 from burnbabyburn/dropbear...

drtyhlpr -

r531:f2b59207efa6

parent child

Context file:

r531:f2b59207efa6

Collapse all files

files/initramfs/crypt_unlock.sh created 644 +45 0

@@ -0,0 +1,45
	1	#!/bin/sh
	2
	3	PREREQ="dropbear"
	4
	5	prereqs() {
	6	echo "$PREREQ"
	7	}
	8
	9	case "$1" in
	10	prereqs)
	11	prereqs
	12	exit 0
	13	;;
	14	esac
	15
	16	. "${CONFDIR}/initramfs.conf"
	17	. /usr/share/initramfs-tools/hook-functions
	18
	19	if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
	20	cat > "${DESTDIR}/bin/unlock" << EOF
	21	#!/bin/sh
	22	if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
	23	kill \`ps \| grep cryptroot \| grep -v "grep" \| awk '{print \$1}'\`
	24	# following line kill the remote shell right after the passphrase has
	25	# been entered.
	26	kill -9 \`ps \| grep "\-sh" \| grep -v "grep" \| awk '{print \$1}'\`
	27	exit 0
	28	fi
	29	exit 1
	30	EOF
	31
	32	chmod 755 "${DESTDIR}/bin/unlock"
	33
	34	mkdir -p "${DESTDIR}/lib/unlock"
	35	cat > "${DESTDIR}/lib/unlock/plymouth" << EOF
	36	#!/bin/sh
	37	[ "\$1" == "--ping" ] && exit 1
	38	/bin/plymouth "\$@"
	39	EOF
	40
	41	chmod 755 "${DESTDIR}/lib/unlock/plymouth"
	42
	43	echo To unlock root-partition run "unlock" >> ${DESTDIR}/etc/motd
	44
	45	fi No newline at end of file

README.md +6 0

             ##### `CRYPTFS_XTSKEYSIZE`=512
             Sets key size in bits. The argument has to be a multiple of 8.
+            ##### `CRYPTFS_DROPBEAR`=false
+            Enable Dropbear Initramfs support
+            ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
+            Provide path to dropbear Public RSA-OpenSSH Key
             ---
             #### Build settings:

bootstrap.d/14-fstab.sh +37 -2

@@ -43,8 +43,43 if [ "$ENABLE_INITRAMFS" = true ] ; then
43	install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"	43	install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
44	fi	44	fi
45		45
46	# Disable SSHD inside initramfs	46	if [ "$CRYPTFS_DROPBEAR" = true ]; then
47	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"	47	if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
		48	install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		49	cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
		50	else
		51	# Create key
		52	chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
		53
		54	# Convert dropbear key to openssh key
		55	chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
		56
		57	# Get Public Key Part
		58	chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear \| chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
		59
		60	# Delete unwanted lines
		61	sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		62	sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
		63
		64	# Trust the new key
		65	cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
		66
		67	# Save Keys - convert with putty from rsa/openssh to puttkey
		68	cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
		69
		70	# Get unlock script
		71	install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
		72
		73	# Enable Dropbear inside initramfs
		74	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
		75
		76	# Enable Dropbear inside initramfs
		77	sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
		78	fi
		79	else
		80	# Disable SSHD inside initramfs
		81	printf "#\n# DROPBEAR: [ y \| n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
		82	fi
48		83
49	# Add cryptsetup modules to initramfs	84	# Add cryptsetup modules to initramfs
50	printf "#\n# CRYPTSETUP: [ y \| n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"	85	printf "#\n# CRYPTSETUP: [ y \| n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"

bootstrap.d/15-rpi-config.sh +20 -25

             fi
             if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
-              # RPI0,3,3P Use default ttyS0 (mini-UART)as serial interface
-              SET_SERIAL="ttyS0"
               # Bluetooth enabled
               if [ "$ENABLE_BLUETOOTH" = true ] ; then
                 # Create temporary directory for Bluetooth sources
                 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
                 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
+            	# make scripts executable
+            	chmod +x "${R}/usr/bin/bthelper"
+            	chmod +x "${R}/usr/bin/btuart"
                 # Install bluetooth udev rule
                 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
                 install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
                 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
                 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
-                # Remove temporary directory
+                # Remove temporary directories
                 rm -fr "${temp_dir}"
+            	rm -fr "${R}"/tmp/pi-bluetooth
                 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
                 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
-            	  SET_SERIAL="ttyAMA0"
             	  # set overlay to swap ttyAMA0 and ttyS0
                   echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
             	  if [ "$ENABLE_TURBO" = false ] ; then
             	    echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
             	  fi
-            	  # Activate services
-            	  chroot_exec systemctl enable pi-bluetooth.hciuart.service
-            	  #chroot_exec systemctl enable pi-bluetooth.bthelper@.service
-            	else
-            	  chroot_exec systemctl enable pi-bluetooth.hciuart.service
-            	  #chroot_exec systemctl enable pi-bluetooth.bthelper@.service
             	fi
+            	# Activate services
+            	chroot_exec systemctl enable pi-bluetooth.hciuart.service
               else # if ENABLE_BLUETOOTH = false
               	# set overlay to disable bluetooth
                 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
               fi # ENABLE_BLUETOOTH end
-            else
-              # RPI1,1P,2 Use default ttyAMA0 (full UART) as serial interface
-              SET_SERIAL="ttyAMA0"
             fi
             # may need sudo systemctl disable hciuart
               echo "enable_uart=1"  >> "${BOOT_DIR}/config.txt"
               # add string to cmdline
               CMDLINE="${CMDLINE} console=serial0,115200"
               # Enable serial console systemd style
-              chroot_exec systemctl enable serial-getty\@"$SET_SERIAL".service
+              chroot_exec systemctl enable serial-getty\@serial0.service
             else
               echo "enable_uart=0"  >> "${BOOT_DIR}/config.txt"
               # disable serial console systemd style
               chroot_exec systemctl disable serial-getty\@"$SET_SERIAL".service
             fi
                 CMDLINE="${CMDLINE} zswap.enabled=1 zswap.max_pool_percent=25 zswap.compressor=lz4"
               fi
             fi
-              if [ "$KERNEL_SECURITY" = true ] ; then
-                CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
+            if [ "$KERNEL_SECURITY" = true ] ; then
-              fi
+              CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
+            fi
             # Install firmware boot cmdline
             echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"

bootstrap.d/20-networking.sh +14 0

@@ -57,6 +57,20 else # ENABLE_DHCP=false
57	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_1}\|"\	57	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_1}\|"\
58	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_2}\|"\	58	-e "0,/NTP=\$/ s\|NTP=\$\|NTP=${NET_NTP_2}\|"\
59	"${ETC_DIR}/systemd/network/eth.network"	59	"${ETC_DIR}/systemd/network/eth.network"
		60
		61	if [ "$CRYPTFS_DROPBEAR" = true ] ; then
		62	# Get cdir from NET_ADDRESS e.g. 24
		63	cdir=$(${NET_ADDRESS} \| cut -d '/' -f2)
		64
		65	# Convert cdir ro netmask e.g. 24 to 255.255.255.0
		66	NET_MASK=$(cdr2mask "$cdir")
		67
		68	# Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
		69	sed -i "\$aIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
		70
		71	# Regenerate initramfs
		72	chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
		73	fi
60	fi	74	fi
61		75
62	# Remove empty settings from network configuration	76	# Remove empty settings from network configuration

bootstrap.d/21-firewall.sh +4 -3

               if [ "$ENABLE_IPV6" = true ] ; then
                 if [ "$KERNEL_NF" = false ] ; then
-                #iptables-save and -restore are slaves of iptables and thus are set accordingly
+                  #iptables-save and -restore are slaves of iptables and thus are set accordingly
-                chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
+                  chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
-            	fi
+            	  fi
                 # Install ip6tables systemd service
                 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"

bootstrap.d/30-security.sh 0 -5

@@ -22,8 +22,3 else
22	# Set no root password to disable root login	22	# Set no root password to disable root login
23	chroot_exec usermod -p \'!\' root	23	chroot_exec usermod -p \'!\' root
24	fi	24	fi
25
26	# Enable serial console systemd style
27	if [ "$ENABLE_CONSOLE" = true ] ; then
28	chroot_exec systemctl enable serial-getty\@ttyAMA0.service
29	fi

bootstrap.d/43-videocore.sh +3 0

               #back to root of scriptdir
               cd "${WORKDIR}"
+              # Remove videocore sources
+              rm -fr "${R}"/tmp/userland/
             fi

files/firstboot/23-regenerate-initramfs.sh +1 0

             # Extract kernel arch
             case "${KERNEL_ARCH}" in
               arm*) KERNEL_ARCH=arm ;;
+              aarch64) KERNEL_ARCH=arm64 ;;
             esac
             # Regenerate initramfs

functions.sh +14 -3

               # Install c/c++ build environment inside the chroot
               if [ -z "${COMPILER_PACKAGES}" ] ; then
                 COMPILER_PACKAGES=$(chroot_exec apt-get -s install g++ make bc | grep "^Inst " | awk -v ORS=" " '{ print $2 }')
-            	# Install COMPILER_PACKAGES in chroot
+            	# Install COMPILER_PACKAGES in chroot - NEVER do "${COMPILER_PACKAGES}" -> breaks uboot
-                chroot_exec apt-get -q -y --allow-unauthenticated --no-install-recommends install "${COMPILER_PACKAGES}"
+                chroot_exec apt-get -q -y --allow-unauthenticated --no-install-recommends install ${COMPILER_PACKAGES}
               fi
             }
             chroot_remove_cc() {
               # Remove c/c++ build environment from the chroot
               if [ -n "${COMPILER_PACKAGES}" ] ; then
-                chroot_exec apt-get -qq -y --auto-remove purge "${COMPILER_PACKAGES}"
+                chroot_exec apt-get -qq -y --auto-remove purge ${COMPILER_PACKAGES}
                 COMPILER_PACKAGES=""
               fi
             }
+            # https://serverfault.com/a/682849 - converts e.g. /24 to 255.255.255.0
+            cdr2mask ()
+            {
+               # Number of args to shift, 255..255, first non-255 byte, zeroes
+               set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0
+               [ $1 -gt 1 ] && shift $1 || shift
+               echo ${1-0}.${2-0}.${3-0}.${4-0}
+            }
             # GPL v2.0 - #https://github.com/sakaki-/bcmrpi3-kernel-bis/blob/master/conform_config.sh
             set_kernel_config() {
               # flag as $1, value to set as $2, config must exist at "./.config"
                 echo "${TGT}"="${2}" >> .config
               fi
             }
             # unset kernel config parameter
             unset_kernel_config() {
               # unsets flag with the value of $1, config must exist at "./.config"

rpi23-gen-image.sh +12 -5

             CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
             CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
             CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
+            #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
+            CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
+            #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
+            CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
             # Chroot scripts directory
             CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
             # Packages installed for c/c++ build environment in chroot (keep empty)
             COMPILER_PACKAGES=""
-            set +x
+            # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
+            APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
-            #Check if apt-cacher-ng has port 3142 open and set APT_PROXY
+            if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
-            APT_CACHER_RUNNING=$(lsof -i :3142 | grep apt-cacher-ng |  cut -d ' ' -f3 | uniq)
-            if [ -n "${APT_CACHER_RUNNING}" ] ; then
               APT_PROXY=http://127.0.0.1:3142/
             fi
               REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
               APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
+              # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
+              if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
+                APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
+              fi
               if [ -z "$CRYPTFS_PASSWORD" ] ; then
                 echo "error: no password defined (CRYPTFS_PASSWORD)!"
                 exit 1

General Comments 0

Écrire
Preview

Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Dépôts
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages