##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

Merge pull request #28 from stylesuxx/run-scripts-in-chroot...
drtyhlpr -
r54:f6d8c17fbf01 Fusion
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,166 +1,169
1 1 # rpi2-gen-image
2 2 ## Introduction
3 3 `rpi2-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for the Raspberry 2 (RPi2) computer. The script at this time only supports the bootstrapping of the current stable Debian 8 "jessie" release.
4 4
5 5 ## Build dependencies
6 6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 7
8 8 ```debootstrap debian-archive-keyring qemu-user-static dosfstools rsync bmap-tools whois git-core```
9 9
10 10 ## Command-line parameters
11 11 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi2-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi2-gen-image.sh` script.
12 12
13 13 #####Command-line examples:
14 14 ```shell
15 15 ENABLE_UBOOT=true ./rpi2-gen-image.sh
16 16 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi2-gen-image.sh
17 17 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi2-gen-image.sh
18 18 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi2-gen-image.sh
19 19 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi2-gen-image.sh
20 20 ENABLE_MINBASE=true ./rpi2-gen-image.sh
21 21 ```
22 22
23 23 #### APT settings:
24 24 ##### `APT_SERVER`="ftp.debian.org"
25 25 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
26 26
27 27 ##### `APT_PROXY`=""
28 28 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once.
29 29
30 30 ##### `APT_INCLUDES`=""
31 31 A comma seperated list of additional packages to be installed during bootstrapping.
32 32
33 33 #### General system settings:
34 34 ##### `HOSTNAME`="rpi2-jessie"
35 35 Set system host name. It's recommended that the host name is unique in the corresponding subnet.
36 36
37 37 ##### `PASSWORD`="raspberry"
38 38 Set system `root` password. The same password is used for the created user `pi`. It's **STRONGLY** recommended that you choose a custom password.
39 39
40 40 ##### `DEFLOCAL`="en_US.UTF-8"
41 41 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. The script variant `minbase` (ENABLE_MINBASE=true) doesn't install `locales`.
42 42
43 43 ##### `TIMEZONE`="Europe/Berlin"
44 44 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
45 45
46 46 ##### `EXPANDROOT`=true
47 47 Expand the root partition and filesystem automatically on first boot.
48 48
49 49 #### Keyboard settings:
50 50 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
51 51
52 52 ##### `XKBMODEL`=""
53 53 Set the name of the model of your keyboard type.
54 54
55 55 ##### `XKBLAYOUT`=""
56 56 Set the supported keyboard layout(s).
57 57
58 58 ##### `XKBVARIANT`=""
59 59 Set the supported variant(s) of the keyboard layout(s).
60 60
61 61 ##### `XKBOPTIONS`=""
62 62 Set extra xkb configuration options.
63 63
64 64 #### Networking settings (DHCP)
65 65 This setting is used to set up networking auto configuration in `/etc/systemd/network/eth.network`.
66 66
67 67 #####`ENABLE_DHCP`=true
68 68 Set the system to use DHCP. This requires an DHCP server.
69 69
70 70 #### Networking settings (static)
71 71 These settings are used to set up a static networking configuration in /etc/systemd/network/eth.network. The following static networking settings are only supported if `ENABLE_DHCP` was set to `false`.
72 72
73 73 #####`NET_ADDRESS`=""
74 74 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
75 75
76 76 #####`NET_GATEWAY`=""
77 77 Set the IP address for the default gateway.
78 78
79 79 #####`NET_DNS_1`=""
80 80 Set the IP address for the first DNS server.
81 81
82 82 #####`NET_DNS_2`=""
83 83 Set the IP address for the second DNS server.
84 84
85 85 #####`NET_DNS_DOMAINS`=""
86 86 Set the default DNS search domains to use for non fully qualified host names.
87 87
88 88 #####`NET_NTP_1`=""
89 89 Set the IP address for the first NTP server.
90 90
91 91 #####`NET_NTP_2`=""
92 92 Set the IP address for the second NTP server.
93 93
94 94 #### Basic system features:
95 95 ##### `ENABLE_CONSOLE`=true
96 96 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system.
97 97
98 98 ##### `ENABLE_IPV6`=true
99 99 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
100 100
101 101 ##### `ENABLE_SSHD`=true
102 102 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
103 103
104 104 ##### `ENABLE_RSYSLOG`=true
105 105 If set to false, disable and uninstall rsyslog (so logs will be available only
106 106 in journal files)
107 107
108 108 ##### `ENABLE_SOUND`=true
109 109 Enable sound hardware and install Advanced Linux Sound Architecture.
110 110
111 111 ##### `ENABLE_HWRANDOM`=true
112 112 Enable Hardware Random Number Generator. Strong random numbers are important for most network based communications that use encryption. It's recommended to be enabled.
113 113
114 114 ##### `ENABLE_MINGPU`=false
115 115 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
116 116
117 117 ##### `ENABLE_DBUS`=true
118 118 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
119 119
120 120 ##### `ENABLE_XORG`=false
121 121 Install Xorg open-source X Window System.
122 122
123 123 ##### `ENABLE_WM`=""
124 124 Install a user defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi2-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
125 125
126 126 #### Advanced sytem features:
127 127 ##### `ENABLE_MINBASE`=false
128 128 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
129 129
130 130 ##### `ENABLE_UBOOT`=false
131 131 Replace default RPi2 second stage bootloader (bootcode.bin) with U-Boot bootloader. U-Boot can boot images via the network using the BOOTP/TFTP protocol.
132 132
133 133 ##### `ENABLE_FBTURBO`=false
134 134 Install and enable the hardware accelerated Xorg video driver `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
135 135
136 136 ##### `ENABLE_IPTABLES`=false
137 137 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
138 138
139 139 ##### `ENABLE_USER`=true
140 140 Create pi user with password raspberry
141 141
142 142 ##### `ENABLE_ROOT`=true
143 143 Set root user password so root login will be enabled
144 144
145 145 ##### `ENABLE_ROOT_SSH`=true
146 146 Enable password root login via SSH. May be a security risk with default
147 147 password, use only in trusted environments.
148 148
149 149 ##### `ENABLE_HARDNET`=false
150 150 Enable IPv4/IPv6 network stack hardening settings.
151 151
152 ##### `CHROOT_SCRIPTS`=""
153 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this direcory is run in lexicographical order.
154
152 155 ## Logging of the bootstrapping process
153 156 All information related to the bootstrapping process and the commands executed by the `rpi2-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
154 157
155 158 ```shell
156 159 script -c 'APT_SERVER=ftp.de.debian.org ./rpi2-gen-image.sh' ./build.log
157 160 ```
158 161
159 162 ## Flashing the image file
160 163 After the image file was successfully created by the `rpi2-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi2 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
161 164
162 165 #####Flashing examples:
163 166 ```shell
164 167 bmaptool copy ./images/jessie/2015-12-13-debian-jessie.img /dev/mmcblk0
165 168 dd bs=4M if=./images/jessie/2015-12-13-debian-jessie.img of=/dev/mmcblk0
166 169 ```
Show file before | Show file after | Hide comments
@@ -1,691 +1,699
1 1 #!/bin/sh
2 2
3 3 ########################################################################
4 4 # rpi2-gen-image.sh ver2a 12/2015
5 5 #
6 6 # Advanced debian "jessie" bootstrap script for RPi2
7 7 #
8 8 # This program is free software; you can redistribute it and/or
9 9 # modify it under the terms of the GNU General Public License
10 10 # as published by the Free Software Foundation; either version 2
11 11 # of the License, or (at your option) any later version.
12 12 #
13 13 # some parts based on rpi2-build-image:
14 14 # Copyright (C) 2015 Ryan Finnie <ryan@finnie.org>
15 15 # Copyright (C) 2015 Luca Falavigna <dktrkranz@debian.org>
16 16 ########################################################################
17 17
18 18 # Clean up all temporary mount points
19 19 cleanup (){
20 20 set +x
21 21 set +e
22 22 echo "removing temporary mount points ..."
23 23 umount -l $R/proc 2> /dev/null
24 24 umount -l $R/sys 2> /dev/null
25 25 umount -l $R/dev/pts 2> /dev/null
26 26 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
27 27 umount "$BUILDDIR/mount" 2> /dev/null
28 28 losetup -d "$EXT4_LOOP" 2> /dev/null
29 29 losetup -d "$VFAT_LOOP" 2> /dev/null
30 30 trap - 0 1 2 3 6
31 31 }
32 32
33 33 # Exec command in chroot
34 34 chroot_exec() {
35 35 LANG=C LC_ALL=C chroot $R $*
36 36 }
37 37
38 38 set -e
39 39 set -x
40 40
41 41 # Debian release
42 42 RELEASE=${RELEASE:=jessie}
43 43 KERNEL=${KERNEL:=3.18.0-trunk-rpi2}
44 44
45 45 # Build settings
46 46 BASEDIR=./images/${RELEASE}
47 47 BUILDDIR=${BASEDIR}/build
48 48
49 49 # General settings
50 50 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
51 51 PASSWORD=${PASSWORD:=raspberry}
52 52 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
53 53 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
54 54 XKBMODEL=${XKBMODEL:=""}
55 55 XKBLAYOUT=${XKBLAYOUT:=""}
56 56 XKBVARIANT=${XKBVARIANT:=""}
57 57 XKBOPTIONS=${XKBOPTIONS:=""}
58 58 EXPANDROOT=${EXPANDROOT:=true}
59 59
60 60 # Network settings
61 61 ENABLE_DHCP=${ENABLE_DHCP:=true}
62 62 # NET_* settings are ignored when ENABLE_DHCP=true
63 63 # NET_ADDRESS is an IPv4 or IPv6 address and its prefix, separated by "/"
64 64 NET_ADDRESS=${NET_ADDRESS:=""}
65 65 NET_GATEWAY=${NET_GATEWAY:=""}
66 66 NET_DNS_1=${NET_DNS_1:=""}
67 67 NET_DNS_2=${NET_DNS_2:=""}
68 68 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
69 69 NET_NTP_1=${NET_NTP_1:=""}
70 70 NET_NTP_2=${NET_NTP_2:=""}
71 71
72 72 # APT settings
73 73 APT_PROXY=${APT_PROXY:=""}
74 74 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
75 75
76 76 # Feature settings
77 77 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
78 78 ENABLE_IPV6=${ENABLE_IPV6:=true}
79 79 ENABLE_SSHD=${ENABLE_SSHD:=true}
80 80 ENABLE_SOUND=${ENABLE_SOUND:=true}
81 81 ENABLE_DBUS=${ENABLE_DBUS:=true}
82 82 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
83 83 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
84 84 ENABLE_XORG=${ENABLE_XORG:=false}
85 85 ENABLE_WM=${ENABLE_WM:=""}
86 86 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
87 87 ENABLE_USER=${ENABLE_USER:=true}
88 88 ENABLE_ROOT=${ENABLE_ROOT:=false}
89 89 ENABLE_ROOT_SSH=${ENABLE_ROOT_SSH:=false}
90 90
91 91 # Advanced settings
92 92 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
93 93 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
94 94 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
95 95 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
96 96 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
97 97
98 98 # Image chroot path
99 99 R=${BUILDDIR}/chroot
100 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
100 101
101 102 # Packages required for bootstrapping
102 103 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git-core"
103 104
104 105 # Missing packages that need to be installed
105 106 MISSING_PACKAGES=""
106 107
107 108 # Packages required in the chroot build environment
108 109 APT_INCLUDES=${APT_INCLUDES:=""}
109 110 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,ca-certificates,debian-archive-keyring,dialog,sudo"
110 111
111 112 set +x
112 113
113 114 # Are we running as root?
114 115 if [ "$(id -u)" -ne "0" ] ; then
115 116 echo "this script must be executed with root privileges"
116 117 exit 1
117 118 fi
118 119
119 120 # Check if all required packages are installed
120 121 for package in $REQUIRED_PACKAGES ; do
121 122 if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
122 123 MISSING_PACKAGES="$MISSING_PACKAGES $package"
123 124 fi
124 125 done
125 126
126 127 # Ask if missing packages should get installed right now
127 128 if [ -n "$MISSING_PACKAGES" ] ; then
128 129 echo "the following packages needed by this script are not installed:"
129 130 echo "$MISSING_PACKAGES"
130 131
131 132 echo -n "\ndo you want to install the missing packages right now? [y/n] "
132 133 read confirm
133 134 if [ "$confirm" != "y" ] ; then
134 135 exit 1
135 136 fi
136 137 fi
137 138
138 139 # Make sure all required packages are installed
139 140 apt-get -qq -y install ${REQUIRED_PACKAGES}
140 141
141 142 # Don't clobber an old build
142 143 if [ -e "$BUILDDIR" ]; then
143 144 echo "directory $BUILDDIR already exists, not proceeding"
144 145 exit 1
145 146 fi
146 147
147 148 set -x
148 149
149 150 # Call "cleanup" function on various signals and errors
150 151 trap cleanup 0 1 2 3 6
151 152
152 153 # Set up chroot directory
153 154 mkdir -p $R
154 155
155 156 # Add required packages for the minbase installation
156 157 if [ "$ENABLE_MINBASE" = true ] ; then
157 158 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools"
158 159 else
159 160 APT_INCLUDES="${APT_INCLUDES},locales,keyboard-configuration,console-setup"
160 161 fi
161 162
162 163 # Add parted package, required to get partprobe utility
163 164 if [ "$EXPANDROOT" = true ] ; then
164 165 APT_INCLUDES="${APT_INCLUDES},parted"
165 166 fi
166 167
167 168 # Add dbus package, recommended if using systemd
168 169 if [ "$ENABLE_DBUS" = true ] ; then
169 170 APT_INCLUDES="${APT_INCLUDES},dbus"
170 171 fi
171 172
172 173 # Add iptables IPv4/IPv6 package
173 174 if [ "$ENABLE_IPTABLES" = true ] ; then
174 175 APT_INCLUDES="${APT_INCLUDES},iptables"
175 176 fi
176 177
177 178 # Add openssh server package
178 179 if [ "$ENABLE_SSHD" = true ] ; then
179 180 APT_INCLUDES="${APT_INCLUDES},openssh-server"
180 181 fi
181 182
182 183 # Add alsa-utils package
183 184 if [ "$ENABLE_SOUND" = true ] ; then
184 185 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
185 186 fi
186 187
187 188 # Add rng-tools package
188 189 if [ "$ENABLE_HWRANDOM" = true ] ; then
189 190 APT_INCLUDES="${APT_INCLUDES},rng-tools"
190 191 fi
191 192
192 193 if [ "$ENABLE_USER" = true ]; then
193 194 APT_INCLUDES="${APT_INCLUDES},sudo"
194 195 fi
195 196
196 197 # Add fbturbo video driver
197 198 if [ "$ENABLE_FBTURBO" = true ] ; then
198 199 # Enable xorg package dependencies
199 200 ENABLE_XORG=true
200 201 fi
201 202
202 203 # Add user defined window manager package
203 204 if [ -n "$ENABLE_WM" ] ; then
204 205 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
205 206
206 207 # Enable xorg package dependencies
207 208 ENABLE_XORG=true
208 209 fi
209 210
210 211 # Add xorg package
211 212 if [ "$ENABLE_XORG" = true ] ; then
212 213 APT_INCLUDES="${APT_INCLUDES},xorg"
213 214 fi
214 215
215 216 # Base debootstrap (unpack only)
216 217 if [ "$ENABLE_MINBASE" = true ] ; then
217 218 http_proxy=${APT_PROXY} debootstrap --arch=armhf --variant=minbase --foreign --include=${APT_INCLUDES} $RELEASE $R http://${APT_SERVER}/debian
218 219 else
219 220 http_proxy=${APT_PROXY} debootstrap --arch=armhf --foreign --include=${APT_INCLUDES} $RELEASE $R http://${APT_SERVER}/debian
220 221 fi
221 222
222 223 # Copy qemu emulator binary to chroot
223 224 cp /usr/bin/qemu-arm-static $R/usr/bin
224 225
225 226 # Copy debian-archive-keyring.pgp
226 227 chroot $R mkdir -p /usr/share/keyrings
227 228 cp /usr/share/keyrings/debian-archive-keyring.gpg $R/usr/share/keyrings/debian-archive-keyring.gpg
228 229
229 230 # Complete the bootstrapping process
230 231 chroot $R /debootstrap/debootstrap --second-stage
231 232
232 233 # Mount required filesystems
233 234 mount -t proc none $R/proc
234 235 mount -t sysfs none $R/sys
235 236 mount --bind /dev/pts $R/dev/pts
236 237
237 238 # Use proxy inside chroot
238 239 if [ -z "$APT_PROXY" ] ; then
239 240 echo "Acquire::http::Proxy \"$APT_PROXY\";" >> $R/etc/apt/apt.conf.d/10proxy
240 241 fi
241 242
242 243 # Pin package flash-kernel to repositories.collabora.co.uk
243 244 cat <<EOM >$R/etc/apt/preferences.d/flash-kernel
244 245 Package: flash-kernel
245 246 Pin: origin repositories.collabora.co.uk
246 247 Pin-Priority: 1000
247 248 EOM
248 249
249 250 # Set up timezone
250 251 echo ${TIMEZONE} >$R/etc/timezone
251 252 chroot_exec dpkg-reconfigure -f noninteractive tzdata
252 253
253 254 # Upgrade collabora package index and install collabora keyring
254 255 echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >$R/etc/apt/sources.list
255 256 chroot_exec apt-get -qq -y update
256 257 chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring
257 258
258 259 # Set up initial sources.list
259 260 cat <<EOM >$R/etc/apt/sources.list
260 261 deb http://${APT_SERVER}/debian ${RELEASE} main contrib
261 262 #deb-src http://${APT_SERVER}/debian ${RELEASE} main contrib
262 263
263 264 deb http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
264 265 #deb-src http://${APT_SERVER}/debian/ ${RELEASE}-updates main contrib
265 266
266 267 deb http://security.debian.org/ ${RELEASE}/updates main contrib
267 268 #deb-src http://security.debian.org/ ${RELEASE}/updates main contrib
268 269
269 270 deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2
270 271 EOM
271 272
272 273 # Upgrade package index and update all installed packages and changed dependencies
273 274 chroot_exec apt-get -qq -y update
274 275 chroot_exec apt-get -qq -y -u dist-upgrade
275 276
276 277 # Set up default locale and keyboard configuration
277 278 if [ "$ENABLE_MINBASE" = false ] ; then
278 279 # Set locale choice in debconf db, even though dpkg-reconfigure ignores and overwrites them due to some bug
279 280 # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685957
280 281 # ... so we have to set locales manually
281 282 if [ "$DEFLOCAL" = "en_US.UTF-8" ] ; then
282 283 chroot_exec echo "locales locales/locales_to_be_generated multiselect ${DEFLOCAL} UTF-8" | debconf-set-selections
283 284 else
284 285 # en_US.UTF-8 should be available anyway : https://www.debian.org/doc/manuals/debian-reference/ch08.en.html#_the_reconfiguration_of_the_locale
285 286 chroot_exec echo "locales locales/locales_to_be_generated multiselect en_US.UTF-8 UTF-8, ${DEFLOCAL} UTF-8" | debconf-set-selections
286 287 chroot_exec sed -i "/en_US.UTF-8/s/^#//" /etc/locale.gen
287 288 fi
288 289 chroot_exec sed -i "/${DEFLOCAL}/s/^#//" /etc/locale.gen
289 290 chroot_exec echo "locales locales/default_environment_locale select ${DEFLOCAL}" | debconf-set-selections
290 291 chroot_exec locale-gen
291 292 chroot_exec update-locale LANG=${DEFLOCAL}
292 293
293 294 # Keyboard configuration, if requested
294 295 if [ "$XKBMODEL" != "" ] ; then
295 296 chroot_exec sed -i "s/^XKBMODEL.*/XKBMODEL=\"${XKBMODEL}\"/" /etc/default/keyboard
296 297 fi
297 298 if [ "$XKBLAYOUT" != "" ] ; then
298 299 chroot_exec sed -i "s/^XKBLAYOUT.*/XKBLAYOUT=\"${XKBLAYOUT}\"/" /etc/default/keyboard
299 300 fi
300 301 if [ "$XKBVARIANT" != "" ] ; then
301 302 chroot_exec sed -i "s/^XKBVARIANT.*/XKBVARIANT=\"${XKBVARIANT}\"/" /etc/default/keyboard
302 303 fi
303 304 if [ "$XKBOPTIONS" != "" ] ; then
304 305 chroot_exec sed -i "s/^XKBOPTIONS.*/XKBOPTIONS=\"${XKBOPTIONS}\"/" /etc/default/keyboard
305 306 fi
306 307 chroot_exec dpkg-reconfigure -f noninteractive keyboard-configuration
307 308 # Set up font console
308 309 case "${DEFLOCAL}" in
309 310 *UTF-8)
310 311 chroot_exec sed -i 's/^CHARMAP.*/CHARMAP="UTF-8"/' /etc/default/console-setup
311 312 ;;
312 313 *)
313 314 chroot_exec sed -i 's/^CHARMAP.*/CHARMAP="guess"/' /etc/default/console-setup
314 315 ;;
315 316 esac
316 317 chroot_exec dpkg-reconfigure -f noninteractive console-setup
317 318 fi
318 319
319 320 # Kernel installation
320 321 # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
321 322 chroot_exec apt-get -qq -y --no-install-recommends install linux-image-${KERNEL} raspberrypi-bootloader-nokernel
322 323 chroot_exec apt-get -qq -y install flash-kernel
323 324
324 325 VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
325 326 [ -z "$VMLINUZ" ] && exit 1
326 327 cp $VMLINUZ $R/boot/firmware/kernel7.img
327 328
328 329 # Set up IPv4 hosts
329 330 echo ${HOSTNAME} >$R/etc/hostname
330 331 cat <<EOM >$R/etc/hosts
331 332 127.0.0.1 localhost
332 333 127.0.1.1 ${HOSTNAME}
333 334 EOM
334 335 if [ "$NET_ADDRESS" != "" ] ; then
335 336 NET_IP=$(echo ${NET_ADDRESS} | cut -f 1 -d'/')
336 337 sed -i "s/^127.0.1.1/${NET_IP}/" $R/etc/hosts
337 338 fi
338 339
339 340 # Set up IPv6 hosts
340 341 if [ "$ENABLE_IPV6" = true ] ; then
341 342 cat <<EOM >>$R/etc/hosts
342 343
343 344 ::1 localhost ip6-localhost ip6-loopback
344 345 ff02::1 ip6-allnodes
345 346 ff02::2 ip6-allrouters
346 347 EOM
347 348 fi
348 349
349 350 # Place hint about network configuration
350 351 cat <<EOM >$R/etc/network/interfaces
351 352 # Debian switched to systemd-networkd configuration files.
352 353 # please configure your networks in '/etc/systemd/network/'
353 354 EOM
354 355
355 356 if [ "$ENABLE_DHCP" = true ] ; then
356 357 # Enable systemd-networkd DHCP configuration for interface eth0
357 358 cat <<EOM >$R/etc/systemd/network/eth.network
358 359 [Match]
359 360 Name=eth0
360 361
361 362 [Network]
362 363 DHCP=yes
363 364 EOM
364 365
365 366 # Set DHCP configuration to IPv4 only
366 367 if [ "$ENABLE_IPV6" = false ] ; then
367 368 sed -i "s/^DHCP=yes/DHCP=v4/" $R/etc/systemd/network/eth.network
368 369 fi
369 370 else # ENABLE_DHCP=false
370 371 cat <<EOM >$R/etc/systemd/network/eth.network
371 372 [Match]
372 373 Name=eth0
373 374
374 375 [Network]
375 376 DHCP=no
376 377 Address=${NET_ADDRESS}
377 378 Gateway=${NET_GATEWAY}
378 379 DNS=${NET_DNS_1}
379 380 DNS=${NET_DNS_2}
380 381 Domains=${NET_DNS_DOMAINS}
381 382 NTP=${NET_NTP_1}
382 383 NTP=${NET_NTP_2}
383 384 EOM
384 385 fi
385 386
386 387 # Enable systemd-networkd service
387 388 chroot_exec systemctl enable systemd-networkd
388 389
389 390 # Generate crypt(3) password string
390 391 ENCRYPTED_PASSWORD=`mkpasswd -m sha-512 ${PASSWORD}`
391 392
392 393 # Set up default user
393 394 if [ "$ENABLE_USER" = true ] ; then
394 395 chroot_exec adduser --gecos pi --add_extra_groups --disabled-password pi
395 396 chroot_exec usermod -a -G sudo -p "${ENCRYPTED_PASSWORD}" pi
396 397 fi
397 398
398 399 # Set up root password or not
399 400 if [ "$ENABLE_ROOT" = true ]; then
400 401 chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
401 402
402 403 if [ "$ENABLE_ROOT_SSH" = true ]; then
403 404 sed -i 's|[#]*PermitRootLogin.*|PermitRootLogin yes|g' $R/etc/ssh/sshd_config
404 405 fi
405 406 else
406 407 chroot_exec usermod -p \'!\' root
407 408 fi
408 409
409 410 # Set up firmware boot cmdline
410 411 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait net.ifnames=1 console=tty1"
411 412
412 413 # Set up serial console support (if requested)
413 414 if [ "$ENABLE_CONSOLE" = true ] ; then
414 415 CMDLINE="${CMDLINE} console=ttyAMA0,115200 kgdboc=ttyAMA0,115200"
415 416 fi
416 417
417 418 # Set up IPv6 networking support
418 419 if [ "$ENABLE_IPV6" = false ] ; then
419 420 CMDLINE="${CMDLINE} ipv6.disable=1"
420 421 fi
421 422
422 423 echo "${CMDLINE}" >$R/boot/firmware/cmdline.txt
423 424
424 425 # Set up firmware config
425 426 install -o root -g root -m 644 files/config.txt $R/boot/firmware/config.txt
426 427
427 428 # Load snd_bcm2835 kernel module at boot time
428 429 if [ "$ENABLE_SOUND" = true ] ; then
429 430 echo "snd_bcm2835" >>$R/etc/modules
430 431 fi
431 432
432 433 # Set smallest possible GPU memory allocation size: 16MB (no X)
433 434 if [ "$ENABLE_MINGPU" = true ] ; then
434 435 echo "gpu_mem=16" >>$R/boot/firmware/config.txt
435 436 fi
436 437
437 438 # Create symlinks
438 439 ln -sf firmware/config.txt $R/boot/config.txt
439 440 ln -sf firmware/cmdline.txt $R/boot/cmdline.txt
440 441
441 442 # Prepare modules-load.d directory
442 443 mkdir -p $R/lib/modules-load.d/
443 444
444 445 # Load random module on boot
445 446 if [ "$ENABLE_HWRANDOM" = true ] ; then
446 447 cat <<EOM >$R/lib/modules-load.d/rpi2.conf
447 448 bcm2708_rng
448 449 EOM
449 450 fi
450 451
451 452 # Prepare modprobe.d directory
452 453 mkdir -p $R/etc/modprobe.d/
453 454
454 455 # Blacklist sound modules
455 456 install -o root -g root -m 644 files/modprobe.d/raspi-blacklist.conf $R/etc/modprobe.d/raspi-blacklist.conf
456 457
457 458 # Create default fstab
458 459 install -o root -g root -m 644 files/fstab $R/etc/fstab
459 460
460 461 # Avoid swapping and increase cache sizes
461 462 install -o root -g root -m 644 files/sysctl.d/81-rpi-vm.conf $R/etc/sysctl.d/81-rpi-vm.conf
462 463
463 464 # Enable network stack hardening
464 465 if [ "$ENABLE_HARDNET" = true ] ; then
465 466 install -o root -g root -m 644 files/sysctl.d/81-rpi-net-hardening.conf $R/etc/sysctl.d/81-rpi-net-hardening.conf
466 467
467 468 # Enable resolver warnings about spoofed addresses
468 469 cat <<EOM >>$R/etc/host.conf
469 470 spoof warn
470 471 EOM
471 472 fi
472 473
473 474 # First boot actions
474 475 cat files/firstboot/10-begin.sh > $R/etc/rc.firstboot
475 476
476 477 # Ensure openssh server host keys are regenerated on first boot
477 478 if [ "$ENABLE_SSHD" = true ] ; then
478 479 cat files/firstboot/21-generate-ssh-keys.sh >> $R/etc/rc.firstboot
479 480 rm -f $R/etc/ssh/ssh_host_*
480 481 fi
481 482
482 483 if [ "$EXPANDROOT" = true ] ; then
483 484 cat files/firstboot/22-expandroot.sh >> $R/etc/rc.firstboot
484 485 fi
485 486
486 487 cat files/firstboot/99-finish.sh >> $R/etc/rc.firstboot
487 488 chmod +x $R/etc/rc.firstboot
488 489
489 490 sed -i '/exit 0/d' $R/etc/rc.local
490 491 echo /etc/rc.firstboot >> $R/etc/rc.local
491 492 echo exit 0 >> $R/etc/rc.local
492 493
493 494 # Disable rsyslog
494 495 if [ "$ENABLE_RSYSLOG" = false ]; then
495 496 sed -i 's|[#]*ForwardToSyslog=yes|ForwardToSyslog=no|g' $R/etc/systemd/journald.conf
496 497 chroot_exec systemctl disable rsyslog
497 498 chroot_exec apt-get purge -q -y --force-yes rsyslog
498 499 fi
499 500
500 501 # Enable serial console systemd style
501 502 if [ "$ENABLE_CONSOLE" = true ] ; then
502 503 chroot_exec systemctl enable serial-getty\@ttyAMA0.service
503 504 fi
504 505
505 506 # Enable firewall based on iptables started by systemd service
506 507 if [ "$ENABLE_IPTABLES" = true ] ; then
507 508 # Create iptables configuration directory
508 509 mkdir -p "$R/etc/iptables"
509 510
510 511 # Create iptables systemd service
511 512 install -o root -g root -m 644 files/iptables/iptables.service $R/etc/systemd/system/iptables.service
512 513
513 514 # Create flush-table script called by iptables service
514 515 install -o root -g root -m 755 files/iptables/flush-iptables.sh $R/etc/iptables/flush-iptables.sh
515 516
516 517 # Create iptables rule file
517 518 install -o root -g root -m 644 files/iptables/iptables.rules $R/etc/iptables/iptables.rules
518 519
519 520 # Reload systemd configuration and enable iptables service
520 521 chroot_exec systemctl daemon-reload
521 522 chroot_exec systemctl enable iptables.service
522 523
523 524 if [ "$ENABLE_IPV6" = true ] ; then
524 525 # Create ip6tables systemd service
525 526 install -o root -g root -m 644 files/iptables/ip6tables.service $R/etc/systemd/system/ip6tables.service
526 527
527 528 # Create ip6tables file
528 529 install -o root -g root -m 755 files/iptables/flush-ip6tables.sh $R/etc/iptables/flush-ip6tables.sh
529 530
530 531 install -o root -g root -m 644 files/iptables/ip6tables.rules $R/etc/iptables/ip6tables.rules
531 532
532 533 # Reload systemd configuration and enable iptables service
533 534 chroot_exec systemctl daemon-reload
534 535 chroot_exec systemctl enable ip6tables.service
535 536 fi
536 537 fi
537 538
538 539 # Remove SSHD related iptables rules
539 540 if [ "$ENABLE_SSHD" = false ] ; then
540 541 sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/iptables.rules 2> /dev/null
541 542 sed -e '/^#/! {/SSH/ s/^/# /}' -i $R/etc/iptables/ip6tables.rules 2> /dev/null
542 543 fi
543 544
544 545 # Install gcc/c++ build environment inside the chroot
545 546 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ]; then
546 547 chroot_exec apt-get install -q -y --force-yes --no-install-recommends linux-compiler-gcc-4.9-arm g++ make bc
547 548 fi
548 549
549 550 # Fetch and build U-Boot bootloader
550 551 if [ "$ENABLE_UBOOT" = true ] ; then
551 552 # Fetch U-Boot bootloader sources
552 553 git -C $R/tmp clone git://git.denx.de/u-boot.git
553 554
554 555 # Build and install U-Boot inside chroot
555 556 chroot_exec make -C /tmp/u-boot/ rpi_2_defconfig all
556 557
557 558 # Copy compiled bootloader binary and set config.txt to load it
558 559 cp $R/tmp/u-boot/u-boot.bin $R/boot/firmware/
559 560 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> $R/boot/firmware/config.txt
560 561
561 562 # Set U-Boot command file
562 563 cat <<EOM >$R/boot/firmware/uboot.mkimage
563 564 # Tell Linux that it is booting on a Raspberry Pi2
564 565 setenv machid 0x00000c42
565 566
566 567 # Set the kernel boot command line
567 568 setenv bootargs "earlyprintk ${CMDLINE}"
568 569
569 570 # Save these changes to u-boot's environment
570 571 saveenv
571 572
572 573 # Load the existing Linux kernel into RAM
573 574 fatload mmc 0:1 \${kernel_addr_r} kernel7.img
574 575
575 576 # Boot the kernel we have just loaded
576 577 bootz \${kernel_addr_r}
577 578 EOM
578 579
579 580 # Generate U-Boot image from command file
580 581 chroot_exec mkimage -A arm -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi2 Boot Script" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
581 582 fi
582 583
583 584 # Fetch and build fbturbo Xorg driver
584 585 if [ "$ENABLE_FBTURBO" = true ] ; then
585 586 # Fetch fbturbo driver sources
586 587 git -C $R/tmp clone https://github.com/ssvb/xf86-video-fbturbo.git
587 588
588 589 # Install Xorg build dependencies
589 590 chroot_exec apt-get install -q -y --no-install-recommends xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
590 591
591 592 # Build and install fbturbo driver inside chroot
592 593 chroot_exec /bin/bash -c "cd /tmp/xf86-video-fbturbo; autoreconf -vi; ./configure --prefix=/usr; make; make install"
593 594
594 595 # Add fbturbo driver to Xorg configuration
595 596 cat <<EOM >$R/usr/share/X11/xorg.conf.d/99-fbturbo.conf
596 597 Section "Device"
597 598 Identifier "Allwinner A10/A13 FBDEV"
598 599 Driver "fbturbo"
599 600 Option "fbdev" "/dev/fb0"
600 601 Option "SwapbuffersWait" "true"
601 602 EndSection
602 603 EOM
603 604
604 605 # Remove Xorg build dependencies
605 606 chroot_exec apt-get -q -y purge --auto-remove xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
606 607 fi
607 608
608 609 # Remove gcc/c++ build environment from the chroot
609 610 if [ "$ENABLE_UBOOT" = true ] || [ "$ENABLE_FBTURBO" = true ]; then
610 611 chroot_exec apt-get -y -q purge --auto-remove bc binutils cpp cpp-4.9 g++ g++-4.9 gcc gcc-4.9 libasan1 libatomic1 libc-dev-bin libc6-dev libcloog-isl4 libgcc-4.9-dev libgomp1 libisl10 libmpc3 libmpfr4 libstdc++-4.9-dev libubsan0 linux-compiler-gcc-4.9-arm linux-libc-dev make
611 612 fi
612 613
613 614 # Clean cached downloads
614 615 chroot_exec apt-get -y clean
615 616 chroot_exec apt-get -y autoclean
616 617 chroot_exec apt-get -y autoremove
617 618
619 # Invoke custom scripts
620 if [ -n "${CHROOT_SCRIPTS}" ]; then
621 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
622 LANG=C chroot $R bash -c 'for SCRIPT in /chroot_scripts/*; do if [ -f $SCRIPT -a -x $SCRIPT ]; then $SCRIPT; fi done;'
623 rm -rf "${R}/chroot_scripts"
624 fi
625
618 626 # Unmount mounted filesystems
619 627 umount -l $R/proc
620 628 umount -l $R/sys
621 629
622 630 # Clean up files
623 631 rm -f $R/etc/apt/sources.list.save
624 632 rm -f $R/etc/resolvconf/resolv.conf.d/original
625 633 rm -rf $R/run
626 634 mkdir -p $R/run
627 635 rm -f $R/etc/*-
628 636 rm -f $R/root/.bash_history
629 637 rm -rf $R/tmp/*
630 638 rm -f $R/var/lib/urandom/random-seed
631 639 [ -L $R/var/lib/dbus/machine-id ] || rm -f $R/var/lib/dbus/machine-id
632 640 rm -f $R/etc/machine-id
633 641 rm -fr $R/etc/apt/apt.conf.d/10proxy
634 642
635 643 # Calculate size of the chroot directory in KB
636 644 CHROOT_SIZE=$(expr `du -s $R | awk '{ print $1 }'`)
637 645
638 646 # Calculate the amount of needed 512 Byte sectors
639 647 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
640 648 BOOT_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
641 649 ROOT_OFFSET=$(expr ${TABLE_SECTORS} + ${BOOT_SECTORS})
642 650
643 651 # The root partition is EXT4
644 652 # This means more space than the actual used space of the chroot is used.
645 653 # As overhead for journaling and reserved blocks 20% are added.
646 654 ROOT_SECTORS=$(expr $(expr ${CHROOT_SIZE} + ${CHROOT_SIZE} \/ 100 \* 20) \* 1024 \/ 512)
647 655
648 656 # Calculate required image size in 512 Byte sectors
649 657 IMAGE_SECTORS=$(expr ${TABLE_SECTORS} + ${BOOT_SECTORS} + ${ROOT_SECTORS})
650 658
651 659 # Prepare date string for image file name
652 660 DATE="$(date +%Y-%m-%d)"
653 661
654 662 # Prepare image file
655 663 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=512 count=${TABLE_SECTORS}
656 664 dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=512 count=0 seek=${IMAGE_SECTORS}
657 665
658 666 # Write partition table
659 667 sfdisk -q -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
660 668 unit: sectors
661 669
662 670 1 : start= ${TABLE_SECTORS}, size= ${BOOT_SECTORS}, Id= c, bootable
663 671 2 : start= ${ROOT_OFFSET}, size= ${ROOT_SECTORS}, Id=83
664 672 3 : start= 0, size= 0, Id= 0
665 673 4 : start= 0, size= 0, Id= 0
666 674 EOM
667 675
668 676 # Set up temporary loop devices and build filesystems
669 677 VFAT_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
670 678 EXT4_LOOP="$(losetup -o 65M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
671 679 mkfs.vfat "$VFAT_LOOP"
672 680 mkfs.ext4 "$EXT4_LOOP"
673 681
674 682 # Mount the temporary loop devices
675 683 mkdir -p "$BUILDDIR/mount"
676 684 mount "$EXT4_LOOP" "$BUILDDIR/mount"
677 685
678 686 mkdir -p "$BUILDDIR/mount/boot/firmware"
679 687 mount "$VFAT_LOOP" "$BUILDDIR/mount/boot/firmware"
680 688
681 689 # Copy all files from the chroot to the loop device mount point directory
682 690 rsync -a "$R/" "$BUILDDIR/mount/"
683 691
684 692 # Unmount all temporary loop devices and mount points
685 693 cleanup
686 694
687 695 # (optinal) create block map file for "bmaptool"
688 696 bmaptool create -o "$BASEDIR/${DATE}-debian-${RELEASE}.bmap" "$BASEDIR/${DATE}-debian-${RELEASE}.img"
689 697
690 698 # Image was successfully created
691 699 echo "$BASEDIR/${DATE}-debian-${RELEASE}.img (${IMAGE_SIZE})" ": successfully created"
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant