Initial commit
This commit is contained in:
g-vidal
49
bootstrap.d/10-bootstrap.sh
Normal file
49
bootstrap.d/10-bootstrap.sh
Normal file
@@ -0,0 +1,49 @@
|
||||
#
|
||||
# Debootstrap basic system
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
VARIANT=""
|
||||
COMPONENTS="main"
|
||||
|
||||
# Use non-free Debian packages if needed
|
||||
# One use variable which is only needed by wifi firmware blob => reworked to use non free in /etc/apt/sources.list - we could just use ENABLE_WIRELESS here
|
||||
if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_NONFREE" = true ] ; then
|
||||
COMPONENTS="main,non-free,contrib,non-free-firmware"
|
||||
fi
|
||||
|
||||
# Use minbase bootstrap variant which only includes essential packages
|
||||
if [ "$ENABLE_MINBASE" = true ] ; then
|
||||
VARIANT="--variant=minbase"
|
||||
fi
|
||||
|
||||
|
||||
# Exclude packages if required by Debian release
|
||||
#if [ "$RELEASE" = "bookworm" ] || [ "$RELEASE" = "bullseye" ] ; then
|
||||
# APT_EXCLUDES="--exclude=init,systemd-sysv"
|
||||
#fi
|
||||
|
||||
|
||||
# Base debootstrap (unpack only)
|
||||
http_proxy=${APT_PROXY} debootstrap ${APT_EXCLUDES} --arch="${RELEASE_ARCH}" --foreign ${VARIANT} --components="${COMPONENTS}" --include="${APT_INCLUDES}" "${RELEASE}" "${R}" "http://${APT_SERVER}/debian"
|
||||
|
||||
# Copy qemu emulator binary to chroot
|
||||
install -m 755 -o root -g root "${QEMU_BINARY}" "${R}${QEMU_BINARY}"
|
||||
|
||||
# Copy debian-archive-keyring.pgp
|
||||
mkdir -p "${R}/usr/share/keyrings"
|
||||
install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "${R}/usr/share/keyrings/debian-archive-keyring.gpg"
|
||||
|
||||
# Complete the bootstrapping process
|
||||
chroot_exec /debootstrap/debootstrap --second-stage
|
||||
|
||||
# Mount required filesystems
|
||||
mount -t proc none "${R}/proc"
|
||||
mount -t sysfs none "${R}/sys"
|
||||
|
||||
# Mount pseudo terminal slave if supported by Debian release
|
||||
if [ -d "${R}/dev/pts" ] ; then
|
||||
mount --bind /dev/pts "${R}/dev/pts"
|
||||
fi
|
||||
54
bootstrap.d/11-apt.sh
Normal file
54
bootstrap.d/11-apt.sh
Normal file
@@ -0,0 +1,54 @@
|
||||
#
|
||||
# Setup APT repositories
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Install and setup APT proxy configuration
|
||||
if [ -z "$APT_PROXY" ] ; then
|
||||
install_readonly files/apt/10proxy "${ETC_DIR}/apt/apt.conf.d/10proxy"
|
||||
sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
|
||||
fi
|
||||
|
||||
# Install APT sources.list
|
||||
install_readonly files/apt/sources.list "${ETC_DIR}/apt/sources.list"
|
||||
|
||||
# Use specified APT server and release
|
||||
sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETC_DIR}/apt/sources.list"
|
||||
|
||||
#Fix for changing path for security updates in oldstable / bullseye
|
||||
if [ "$RELEASE" = "oldstable" ] || [ "$RELEASE" = "bullseye " ] ; then
|
||||
sed -i "s:bookworm-security:${RELEASE}\\/updates:" "${ETC_DIR}/apt/sources.list"
|
||||
sed -i "s:security.debian.org/debian-security:security.debian.org:" "${ETC_DIR}/apt/sources.list"
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_NONFREE" = "true" ] ; then
|
||||
sed -i "s,main contrib,main contrib non-free non-free-firmware," "${ETC_DIR}/apt/sources.list"
|
||||
fi
|
||||
|
||||
if [ "$RELEASE" != "$RELEASE" ] ; then
|
||||
# Change release in sources list
|
||||
sed -i "s/ ${HOSTRELEASE}/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
|
||||
fi
|
||||
|
||||
# Upgrade package index and update all installed packages and changed dependencies
|
||||
chroot_exec apt-get -qq -y update
|
||||
chroot_exec apt-get -qq -y -u dist-upgrade
|
||||
|
||||
# Install additional packages
|
||||
if [ "$APT_INCLUDES_LATE" ] ; then
|
||||
chroot_exec apt-get -qq -y install $(echo "$APT_INCLUDES_LATE" |tr , ' ')
|
||||
fi
|
||||
|
||||
# Install Debian custom packages
|
||||
if [ -d packages ] ; then
|
||||
for package in packages/*.deb ; do
|
||||
cp "$package" "${R}"/tmp
|
||||
chroot_exec dpkg --unpack /tmp/"$(basename "$package")"
|
||||
done
|
||||
fi
|
||||
|
||||
chroot_exec apt-get -qq -y -f install
|
||||
|
||||
chroot_exec apt-get -qq -y check
|
||||
66
bootstrap.d/12-locale.sh
Normal file
66
bootstrap.d/12-locale.sh
Normal file
@@ -0,0 +1,66 @@
|
||||
#
|
||||
# Setup Locales and keyboard settings
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Install and setup timezone
|
||||
echo "${TIMEZONE}" > "${ETC_DIR}/timezone"
|
||||
if [ -f "${ETC_DIR}/localtime" ]; then
|
||||
# 1. If 11-apt.sh upgrades the package 'tzdata', '/etc/localtime' was created
|
||||
# because 'dpkg-reconfigure -f noninteractive tzdata' was executed by apt-get.
|
||||
# 2. If '/etc/localtime' exists, our execution of 'dpkg-reconfigure -f noninteractive tzdata'
|
||||
# will ignore the our timezone set in '/etc/timezone'.
|
||||
# 3. Removing /etc/localtime will solve this.
|
||||
rm -f "${ETC_DIR}/localtime"
|
||||
fi
|
||||
chroot_exec dpkg-reconfigure -f noninteractive tzdata
|
||||
|
||||
# Install and setup default locale and keyboard configuration
|
||||
if [ "$(echo "$APT_INCLUDES" | grep ",locales")" ] ; then
|
||||
# Set locale choice in debconf db, even though dpkg-reconfigure ignores and overwrites them due to some bug
|
||||
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=685957
|
||||
# ... so we have to set locales manually
|
||||
if [ "$DEFLOCAL" = "en_US.UTF-8" ] ; then
|
||||
chroot_exec echo "locales locales/locales_to_be_generated multiselect ${DEFLOCAL} UTF-8 | debconf-set-selections"
|
||||
else
|
||||
# en_US.UTF-8 should be available anyway : https://www.debian.org/doc/manuals/debian-reference/ch08.en.html#_the_reconfiguration_of_the_locale
|
||||
chroot_exec echo "locales locales/locales_to_be_generated multiselect en_US.UTF-8 UTF-8, ${DEFLOCAL} UTF-8 | debconf-set-selections"
|
||||
sed -i "/en_US.UTF-8/s/^#//" "${ETC_DIR}/locale.gen"
|
||||
fi
|
||||
|
||||
sed -i "/${DEFLOCAL}/s/^#//" "${ETC_DIR}/locale.gen"
|
||||
chroot_exec echo "locales locales/default_environment_locale select ${DEFLOCAL} | debconf-set-selections"
|
||||
chroot_exec locale-gen
|
||||
chroot_exec update-locale LANG="${DEFLOCAL}"
|
||||
|
||||
# Install and setup default keyboard configuration
|
||||
if [ "$XKB_MODEL" != "" ] ; then
|
||||
sed -i "s/^XKBMODEL.*/XKBMODEL=\"${XKB_MODEL}\"/" "${ETC_DIR}/default/keyboard"
|
||||
fi
|
||||
if [ "$XKB_LAYOUT" != "" ] ; then
|
||||
sed -i "s/^XKBLAYOUT.*/XKBLAYOUT=\"${XKB_LAYOUT}\"/" "${ETC_DIR}/default/keyboard"
|
||||
fi
|
||||
if [ "$XKB_VARIANT" != "" ] ; then
|
||||
sed -i "s/^XKBVARIANT.*/XKBVARIANT=\"${XKB_VARIANT}\"/" "${ETC_DIR}/default/keyboard"
|
||||
fi
|
||||
if [ "$XKB_OPTIONS" != "" ] ; then
|
||||
sed -i "s/^XKBOPTIONS.*/XKBOPTIONS=\"${XKB_OPTIONS}\"/" "${ETC_DIR}/default/keyboard"
|
||||
fi
|
||||
chroot_exec dpkg-reconfigure -f noninteractive keyboard-configuration
|
||||
|
||||
# Install and setup font console
|
||||
case "${DEFLOCAL}" in
|
||||
*UTF-8)
|
||||
sed -i 's/^CHARMAP.*/CHARMAP="UTF-8"/' "${ETC_DIR}/default/console-setup"
|
||||
;;
|
||||
*)
|
||||
sed -i 's/^CHARMAP.*/CHARMAP="guess"/' "${ETC_DIR}/default/console-setup"
|
||||
;;
|
||||
esac
|
||||
chroot_exec dpkg-reconfigure -f noninteractive console-setup
|
||||
else # (no locales were installed)
|
||||
# Install POSIX default locale
|
||||
install_readonly files/locales/locale "${ETC_DIR}/default/locale"
|
||||
fi
|
||||
886
bootstrap.d/13-kernel.sh
Normal file
886
bootstrap.d/13-kernel.sh
Normal file
@@ -0,0 +1,886 @@
|
||||
#
|
||||
# Build and Setup RPi2/3/4 Kernel 4.XX 5.XX
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Need to use kali kernel src if nexmon is enabled
|
||||
if [ "$ENABLE_NEXMON" = true ] ; then
|
||||
KERNEL_URL="${KALI_KERNEL_URL}"
|
||||
# Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel
|
||||
KERNEL_BRANCH=""
|
||||
KERNELSRC_DIR=""
|
||||
fi
|
||||
|
||||
# Fetch and build latest raspberry kernel
|
||||
if [ "$BUILD_KERNEL" = true ] ; then
|
||||
# Setup source directory
|
||||
mkdir -p "${KERNEL_DIR}"
|
||||
|
||||
# Copy existing kernel sources into chroot directory
|
||||
if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
|
||||
# Copy kernel sources and include hidden files
|
||||
cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
|
||||
|
||||
# Clean the kernel sources
|
||||
if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
|
||||
fi
|
||||
else # KERNELSRC_DIR=""
|
||||
# Create temporary directory for kernel sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch current RPi2/3/4 kernel sources
|
||||
if [ -z "${KERNEL_BRANCH}" ] ; then
|
||||
as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
|
||||
else
|
||||
as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
|
||||
fi
|
||||
|
||||
# Copy downloaded kernel sources
|
||||
cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
|
||||
|
||||
# Remove temporary directory for kernel sources
|
||||
rm -fr "${temp_dir}"
|
||||
|
||||
# Set permissions of the kernel sources
|
||||
chown -R root:root "${R}/usr/src"
|
||||
fi
|
||||
|
||||
# Calculate optimal number of kernel building threads
|
||||
if [ -n "$KERNEL_THREADS" ] && [ -r /proc/cpuinfo ] ; then
|
||||
KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
|
||||
fi
|
||||
|
||||
# TODO: Check if defined Threadcount is higher than actual cores
|
||||
# if [ "$KERNEL_THREADS" > grep -c processor /proc/cpuinfo] ; then
|
||||
# echo "Defined more Threads than core assigned to this system"
|
||||
# exit 1
|
||||
# fi
|
||||
|
||||
#Copy 32bit config to 64bit
|
||||
if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then
|
||||
cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/
|
||||
fi
|
||||
|
||||
# Configure and build kernel
|
||||
if [ "$KERNELSRC_PREBUILT" = false ] ; then
|
||||
# Remove device, network and filesystem drivers from kernel configuration
|
||||
if [ "$REDUCE_KERNEL" = true ] ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
|
||||
sed -i\
|
||||
-e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
|
||||
-e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
|
||||
-e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
|
||||
-e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
|
||||
-e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
|
||||
-e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
|
||||
-e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
|
||||
"${KERNEL_DIR}/.config"
|
||||
fi
|
||||
|
||||
if [ "$KERNELSRC_CONFIG" = true ] ; then
|
||||
# Load default raspberry kernel configuration
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
|
||||
|
||||
#Switch to KERNELSRC_DIR so we can use set_kernel_config
|
||||
cd "${KERNEL_DIR}" || exit
|
||||
|
||||
# Enable RPI POE HAT fan
|
||||
if [ "$KERNEL_POEHAT" = true ]; then
|
||||
set_kernel_config CONFIG_SENSORS_RPI_POE_FAN m
|
||||
fi
|
||||
|
||||
# Enable per-interface network priority control
|
||||
# (for systemd-nspawn)
|
||||
if [ "$KERNEL_NSPAN" = true ]; then
|
||||
set_kernel_config CONFIG_CGROUP_NET_PRIO y
|
||||
fi
|
||||
|
||||
# Compile in BTRFS
|
||||
if [ "$KERNEL_BTRFS" = true ]; then
|
||||
set_kernel_config CONFIG_BTRFS_FS y
|
||||
set_kernel_config CONFIG_BTRFS_FS_POSIX_ACL y
|
||||
set_kernel_config CONFIG_BTRFS_FS_REF_VERIFY y
|
||||
fi
|
||||
|
||||
# Diffie-Hellman operations on retained keys
|
||||
# (required for >keyutils-1.6)
|
||||
if [ "$KERNEL_DHKEY" = true ]; then
|
||||
set_kernel_config CONFIG_KEY_DH_OPERATIONS y
|
||||
fi
|
||||
|
||||
if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then
|
||||
# Mask this temporarily during switch to rpi-4.19.y
|
||||
#Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config
|
||||
# use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225
|
||||
#set_kernel_config CONFIG_MMC_BCM2835 n
|
||||
#set_kernel_config CONFIG_MMC_SDHCI_IPROC n
|
||||
#set_kernel_config CONFIG_USB_DWC2 n
|
||||
#sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig
|
||||
|
||||
#VLAN got disabled without reason in arm64bit
|
||||
set_kernel_config CONFIG_IPVLAN m
|
||||
fi
|
||||
|
||||
# enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
|
||||
if [ "$KERNEL_ZSWAP" = true ] ; then
|
||||
set_kernel_config CONFIG_ZPOOL y
|
||||
set_kernel_config CONFIG_ZSWAP y
|
||||
set_kernel_config CONFIG_ZBUD y
|
||||
set_kernel_config CONFIG_Z3FOLD y
|
||||
set_kernel_config CONFIG_ZSMALLOC y
|
||||
set_kernel_config CONFIG_PGTABLE_MAPPING y
|
||||
set_kernel_config CONFIG_LZO_COMPRESS y
|
||||
fi
|
||||
|
||||
if [ "$RPI_MODEL" = 4 ] ; then
|
||||
# Following are set in current 32-bit LPAE kernel
|
||||
set_kernel_config CONFIG_CGROUP_PIDS y
|
||||
set_kernel_config CONFIG_NET_IPVTI m
|
||||
set_kernel_config CONFIG_NF_TABLES_SET m
|
||||
set_kernel_config CONFIG_NF_TABLES_INET y
|
||||
set_kernel_config CONFIG_NF_TABLES_NETDEV y
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE m
|
||||
set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
|
||||
set_kernel_config CONFIG_NFT_CONNLIMIT m
|
||||
set_kernel_config CONFIG_NFT_TUNNEL m
|
||||
set_kernel_config CONFIG_NFT_OBJREF m
|
||||
set_kernel_config CONFIG_NFT_FIB_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_FIB_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_FIB_INET m
|
||||
set_kernel_config CONFIG_NFT_SOCKET m
|
||||
set_kernel_config CONFIG_NFT_OSF m
|
||||
set_kernel_config CONFIG_NFT_TPROXY m
|
||||
set_kernel_config CONFIG_NF_DUP_NETDEV m
|
||||
set_kernel_config CONFIG_NFT_DUP_NETDEV m
|
||||
set_kernel_config CONFIG_NFT_FWD_NETDEV m
|
||||
set_kernel_config CONFIG_NFT_FIB_NETDEV m
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE m
|
||||
set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
|
||||
set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_MASQ_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_REDIR_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_REJECT_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_DUP_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_FIB_IPV6 m
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 m
|
||||
set_kernel_config CONFIG_NF_TABLES_BRIDGE m
|
||||
set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
|
||||
set_kernel_config CONFIG_NF_LOG_BRIDGE m
|
||||
set_kernel_config CONFIG_MT76_CORE m
|
||||
set_kernel_config CONFIG_MT76_LEDS m
|
||||
set_kernel_config CONFIG_MT76_USB m
|
||||
set_kernel_config CONFIG_MT76x2_COMMON m
|
||||
set_kernel_config CONFIG_MT76x0U m
|
||||
set_kernel_config CONFIG_MT76x2U m
|
||||
set_kernel_config CONFIG_TOUCHSCREEN_ILI210X m
|
||||
set_kernel_config CONFIG_BCM_VC_SM m
|
||||
set_kernel_config CONFIG_BCM2835_SMI_DEV m
|
||||
set_kernel_config CONFIG_RPIVID_MEM m
|
||||
set_kernel_config CONFIG_HW_RANDOM_BCM2835 y
|
||||
set_kernel_config CONFIG_TCG_TPM m
|
||||
set_kernel_config CONFIG_HW_RANDOM_TPM y
|
||||
set_kernel_config CONFIG_TCG_TIS m
|
||||
set_kernel_config CONFIG_TCG_TIS_SPI m
|
||||
set_kernel_config CONFIG_I2C_MUX m
|
||||
set_kernel_config CONFIG_I2C_MUX_GPMUX m
|
||||
set_kernel_config CONFIG_I2C_MUX_PCA954x m
|
||||
set_kernel_config CONFIG_SPI_GPIO m
|
||||
set_kernel_config CONFIG_BATTERY_MAX17040 m
|
||||
set_kernel_config CONFIG_SENSORS_GPIO_FAN m
|
||||
set_kernel_config CONFIG_SENSORS_RASPBERRYPI_HWMON m
|
||||
set_kernel_config CONFIG_BCM2835_THERMAL y
|
||||
set_kernel_config CONFIG_RC_CORE y
|
||||
set_kernel_config CONFIG_RC_MAP y
|
||||
set_kernel_config CONFIG_LIRC y
|
||||
set_kernel_config CONFIG_RC_DECODERS y
|
||||
set_kernel_config CONFIG_IR_NEC_DECODER m
|
||||
set_kernel_config CONFIG_IR_RC5_DECODER m
|
||||
set_kernel_config CONFIG_IR_RC6_DECODER m
|
||||
set_kernel_config CONFIG_IR_JVC_DECODER m
|
||||
set_kernel_config CONFIG_IR_SONY_DECODER m
|
||||
set_kernel_config CONFIG_IR_SANYO_DECODER m
|
||||
set_kernel_config CONFIG_IR_SHARP_DECODER m
|
||||
set_kernel_config CONFIG_IR_MCE_KBD_DECODER m
|
||||
set_kernel_config CONFIG_IR_XMP_DECODER m
|
||||
set_kernel_config CONFIG_IR_IMON_DECODER m
|
||||
set_kernel_config CONFIG_RC_DEVICES y
|
||||
set_kernel_config CONFIG_RC_ATI_REMOTE m
|
||||
set_kernel_config CONFIG_IR_IMON m
|
||||
set_kernel_config CONFIG_IR_MCEUSB m
|
||||
set_kernel_config CONFIG_IR_REDRAT3 m
|
||||
set_kernel_config CONFIG_IR_STREAMZAP m
|
||||
set_kernel_config CONFIG_IR_IGUANA m
|
||||
set_kernel_config CONFIG_IR_TTUSBIR m
|
||||
set_kernel_config CONFIG_RC_LOOPBACK m
|
||||
set_kernel_config CONFIG_IR_GPIO_CIR m
|
||||
set_kernel_config CONFIG_IR_GPIO_TX m
|
||||
set_kernel_config CONFIG_IR_PWM_TX m
|
||||
set_kernel_config CONFIG_VIDEO_V4L2_SUBDEV_API y
|
||||
set_kernel_config CONFIG_VIDEO_AU0828_RC y
|
||||
set_kernel_config CONFIG_VIDEO_CX231XX m
|
||||
set_kernel_config CONFIG_VIDEO_CX231XX_RC y
|
||||
set_kernel_config CONFIG_VIDEO_CX231XX_ALSA m
|
||||
set_kernel_config CONFIG_VIDEO_CX231XX_DVB m
|
||||
set_kernel_config CONFIG_VIDEO_TM6000 m
|
||||
set_kernel_config CONFIG_VIDEO_TM6000_ALSA m
|
||||
set_kernel_config CONFIG_VIDEO_TM6000_DVB m
|
||||
set_kernel_config CONFIG_DVB_USB m
|
||||
set_kernel_config CONFIG_DVB_USB_DIB3000MC m
|
||||
set_kernel_config CONFIG_DVB_USB_A800 m
|
||||
set_kernel_config CONFIG_DVB_USB_DIBUSB_MB m
|
||||
set_kernel_config CONFIG_DVB_USB_DIBUSB_MB_FAULTY y
|
||||
set_kernel_config CONFIG_DVB_USB_DIBUSB_MC m
|
||||
set_kernel_config CONFIG_DVB_USB_DIB0700 m
|
||||
set_kernel_config CONFIG_DVB_USB_UMT_010 m
|
||||
set_kernel_config CONFIG_DVB_USB_CXUSB m
|
||||
set_kernel_config CONFIG_DVB_USB_M920X m
|
||||
set_kernel_config CONFIG_DVB_USB_DIGITV m
|
||||
set_kernel_config CONFIG_DVB_USB_VP7045 m
|
||||
set_kernel_config CONFIG_DVB_USB_VP702X m
|
||||
set_kernel_config CONFIG_DVB_USB_GP8PSK m
|
||||
set_kernel_config CONFIG_DVB_USB_NOVA_T_USB2 m
|
||||
set_kernel_config CONFIG_DVB_USB_TTUSB2 m
|
||||
set_kernel_config CONFIG_DVB_USB_DTT200U m
|
||||
set_kernel_config CONFIG_DVB_USB_OPERA1 m
|
||||
set_kernel_config CONFIG_DVB_USB_AF9005 m
|
||||
set_kernel_config CONFIG_DVB_USB_AF9005_REMOTE m
|
||||
set_kernel_config CONFIG_DVB_USB_PCTV452E m
|
||||
set_kernel_config CONFIG_DVB_USB_DW2102 m
|
||||
set_kernel_config CONFIG_DVB_USB_CINERGY_T2 m
|
||||
set_kernel_config CONFIG_DVB_USB_DTV5100 m
|
||||
set_kernel_config CONFIG_DVB_USB_AZ6027 m
|
||||
set_kernel_config CONFIG_DVB_USB_TECHNISAT_USB2 m
|
||||
set_kernel_config CONFIG_DVB_USB_AF9015 m
|
||||
set_kernel_config CONFIG_DVB_USB_LME2510 m
|
||||
set_kernel_config CONFIG_DVB_USB_RTL28XXU m
|
||||
set_kernel_config CONFIG_VIDEO_EM28XX_RC m
|
||||
set_kernel_config CONFIG_SMS_SIANO_RC m
|
||||
set_kernel_config CONFIG_VIDEO_IR_I2C m
|
||||
set_kernel_config CONFIG_VIDEO_ADV7180 m
|
||||
set_kernel_config CONFIG_VIDEO_TC358743 m
|
||||
set_kernel_config CONFIG_VIDEO_OV5647 m
|
||||
set_kernel_config CONFIG_DVB_M88DS3103 m
|
||||
set_kernel_config CONFIG_DVB_AF9013 m
|
||||
set_kernel_config CONFIG_DVB_RTL2830 m
|
||||
set_kernel_config CONFIG_DVB_RTL2832 m
|
||||
set_kernel_config CONFIG_DVB_SI2168 m
|
||||
set_kernel_config CONFIG_DVB_GP8PSK_FE m
|
||||
set_kernel_config CONFIG_DVB_USB m
|
||||
set_kernel_config CONFIG_DVB_LGDT3306A m
|
||||
set_kernel_config CONFIG_FB_SIMPLE y
|
||||
set_kernel_config CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC m
|
||||
set_kernel_config CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M m
|
||||
set_kernel_config CONFIG_SND_AUDIOSENSE_PI m
|
||||
set_kernel_config CONFIG_SND_SOC_AD193X m
|
||||
set_kernel_config CONFIG_SND_SOC_AD193X_SPI m
|
||||
set_kernel_config CONFIG_SND_SOC_AD193X_I2C m
|
||||
set_kernel_config CONFIG_SND_SOC_CS4265 m
|
||||
set_kernel_config CONFIG_SND_SOC_DA7213 m
|
||||
set_kernel_config CONFIG_SND_SOC_ICS43432 m
|
||||
set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4 m
|
||||
set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4_I2C m
|
||||
set_kernel_config CONFIG_SND_SOC_I_SABRE_CODEC m
|
||||
set_kernel_config CONFIG_HID_BIGBEN_FF m
|
||||
#set_kernel_config CONFIG_USB_XHCI_PLATFORM y
|
||||
set_kernel_config CONFIG_USB_TMC m
|
||||
set_kernel_config CONFIG_USB_UAS y
|
||||
set_kernel_config CONFIG_USBIP_VUDC m
|
||||
set_kernel_config CONFIG_USB_CONFIGFS m
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_SERIAL y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_ACM y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_OBEX y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_NCM y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_ECM y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_ECM_SUBSET y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_RNDIS y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_EEM y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_MASS_STORAGE y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_LB_SS y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_FS y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_UAC1 y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_UAC2 y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_MIDI y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_HID y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_UVC y
|
||||
set_kernel_config CONFIG_USB_CONFIGFS_F_PRINTER y
|
||||
set_kernel_config CONFIG_LEDS_PCA963X m
|
||||
set_kernel_config CONFIG_LEDS_IS31FL32XX m
|
||||
set_kernel_config CONFIG_LEDS_TRIGGER_NETDEV m
|
||||
set_kernel_config CONFIG_RTC_DRV_RV3028 m
|
||||
set_kernel_config CONFIG_AUXDISPLAY y
|
||||
set_kernel_config CONFIG_HD44780 m
|
||||
set_kernel_config CONFIG_FB_TFT_SH1106 m
|
||||
set_kernel_config CONFIG_VIDEO_CODEC_BCM2835 m
|
||||
set_kernel_config CONFIG_BCM2835_POWER y
|
||||
set_kernel_config CONFIG_INV_MPU6050_IIO m
|
||||
set_kernel_config CONFIG_INV_MPU6050_I2C m
|
||||
set_kernel_config CONFIG_SECURITYFS y
|
||||
|
||||
# Safer to build this in
|
||||
set_kernel_config CONFIG_BINFMT_MISC y
|
||||
|
||||
# pulseaudio wants a buffer of at least this size
|
||||
set_kernel_config CONFIG_SND_HDA_PREALLOC_SIZE 2048
|
||||
|
||||
# PR#3063: enable 3D acceleration with 64-bit kernel on RPi4
|
||||
# set the appropriate kernel configs unlocked by this PR
|
||||
set_kernel_config CONFIG_ARCH_BCM y
|
||||
set_kernel_config CONFIG_ARCH_BCM2835 y
|
||||
set_kernel_config CONFIG_DRM_V3D m
|
||||
set_kernel_config CONFIG_DRM_VC4 m
|
||||
set_kernel_config CONFIG_DRM_VC4_HDMI_CEC y
|
||||
|
||||
# PR#3144: add arm64 pcie bounce buffers; enables 4GiB on RPi4
|
||||
# required by PR#3144; should already be applied, but just to be safe
|
||||
set_kernel_config CONFIG_PCIE_BRCMSTB y
|
||||
set_kernel_config CONFIG_BCM2835_MMC y
|
||||
|
||||
# Snap needs squashfs. The ubuntu eoan-preinstalled-server image at
|
||||
# http://cdimage.ubuntu.com/ubuntu-server/daily-preinstalled/current/ uses snap
|
||||
# during cloud-init setup at first boot. Without this the login accounts are not
|
||||
# created and the user can not login.
|
||||
set_kernel_config CONFIG_SQUASHFS y
|
||||
|
||||
# Ceph support for Block Device (RBD) and Filesystem (FS)
|
||||
# https://docs.ceph.com/docs/master/
|
||||
set_kernel_config CONFIG_CEPH_LIB m
|
||||
set_kernel_config CONFIG_CEPH_LIB_USE_DNS_RESOLVER y
|
||||
set_kernel_config CONFIG_CEPH_FS m
|
||||
set_kernel_config CONFIG_CEPH_FSCACHE y
|
||||
set_kernel_config CONFIG_CEPH_FS_POSIX_ACL y
|
||||
set_kernel_config CONFIG_BLK_DEV_RBD m
|
||||
fi
|
||||
|
||||
# enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
|
||||
if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then
|
||||
set_kernel_config CONFIG_HAVE_KVM y
|
||||
set_kernel_config CONFIG_HIGH_RES_TIMERS y
|
||||
set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y
|
||||
set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y
|
||||
set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y
|
||||
set_kernel_config CONFIG_HAVE_KVM_EVENTFD y
|
||||
set_kernel_config CONFIG_HAVE_KVM_IRQFD y
|
||||
set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y
|
||||
set_kernel_config CONFIG_HAVE_KVM_MSI y
|
||||
set_kernel_config CONFIG_KVM y
|
||||
set_kernel_config CONFIG_KVM_ARM_HOST y
|
||||
set_kernel_config CONFIG_KVM_ARM_PMU y
|
||||
set_kernel_config CONFIG_KVM_COMPAT y
|
||||
set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y
|
||||
set_kernel_config CONFIG_KVM_MMIO y
|
||||
set_kernel_config CONFIG_KVM_VFIO y
|
||||
set_kernel_config CONFIG_KVM_MMU_AUDIT y
|
||||
set_kernel_config CONFIG_VHOST m
|
||||
set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
|
||||
set_kernel_config CONFIG_VHOST_NET m
|
||||
set_kernel_config CONFIG_VIRTUALIZATION y
|
||||
set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y
|
||||
set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y
|
||||
set_kernel_config CONFIG_MMU_NOTIFIER y
|
||||
|
||||
# erratum
|
||||
set_kernel_config ARM64_ERRATUM_834220 y
|
||||
|
||||
# https://sourceforge.net/p/kvm/mailman/message/18440797/
|
||||
set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
|
||||
fi
|
||||
|
||||
# enable apparmor,integrity audit,
|
||||
if [ "$KERNEL_SECURITY" = true ] ; then
|
||||
|
||||
# security filesystem, security models and audit
|
||||
set_kernel_config CONFIG_SECURITYFS y
|
||||
set_kernel_config CONFIG_SECURITY y
|
||||
set_kernel_config CONFIG_AUDIT y
|
||||
|
||||
# harden strcpy and memcpy
|
||||
set_kernel_config CONFIG_HARDENED_USERCOPY y
|
||||
set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y
|
||||
set_kernel_config CONFIG_FORTIFY_SOURCE y
|
||||
|
||||
# integrity sub-system
|
||||
set_kernel_config CONFIG_INTEGRITY y
|
||||
set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y
|
||||
set_kernel_config CONFIG_INTEGRITY_AUDIT y
|
||||
set_kernel_config CONFIG_INTEGRITY_SIGNATURE y
|
||||
set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y
|
||||
|
||||
# This option provides support for retaining authentication tokens and access keys in the kernel.
|
||||
set_kernel_config CONFIG_KEYS y
|
||||
set_kernel_config CONFIG_KEYS_COMPAT y
|
||||
|
||||
# Apparmor
|
||||
set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0
|
||||
set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
|
||||
set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
|
||||
set_kernel_config CONFIG_SECURITY_APPARMOR y
|
||||
set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
|
||||
set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
|
||||
|
||||
# restrictions on unprivileged users reading the kernel
|
||||
set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y
|
||||
|
||||
# network security hooks
|
||||
set_kernel_config CONFIG_SECURITY_NETWORK y
|
||||
set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y
|
||||
set_kernel_config CONFIG_SECURITY_PATH y
|
||||
set_kernel_config CONFIG_SECURITY_YAMA n
|
||||
|
||||
set_kernel_config CONFIG_SECURITY_SELINUX n
|
||||
set_kernel_config CONFIG_SECURITY_SMACK n
|
||||
set_kernel_config CONFIG_SECURITY_TOMOYO n
|
||||
set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n
|
||||
set_kernel_config CONFIG_SECURITY_LOADPIN n
|
||||
set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n
|
||||
set_kernel_config CONFIG_IMA n
|
||||
set_kernel_config CONFIG_EVM n
|
||||
set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y
|
||||
set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y
|
||||
set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y
|
||||
set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y
|
||||
set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
|
||||
set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y
|
||||
set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n
|
||||
set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m
|
||||
set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_CRYPTFS" = true ] ; then
|
||||
set_kernel_config CONFIG_EMBEDDED y
|
||||
set_kernel_config CONFIG_EXPERT y
|
||||
set_kernel_config CONFIG_DAX y
|
||||
set_kernel_config CONFIG_MD y
|
||||
set_kernel_config CONFIG_BLK_DEV_MD y
|
||||
set_kernel_config CONFIG_MD_AUTODETECT y
|
||||
set_kernel_config CONFIG_BLK_DEV_DM y
|
||||
set_kernel_config CONFIG_BLK_DEV_DM_BUILTIN y
|
||||
set_kernel_config CONFIG_DM_CRYPT y
|
||||
set_kernel_config CONFIG_CRYPTO_BLKCIPHER y
|
||||
set_kernel_config CONFIG_CRYPTO_CBC y
|
||||
set_kernel_config CONFIG_CRYPTO_XTS y
|
||||
set_kernel_config CONFIG_CRYPTO_SHA512 y
|
||||
set_kernel_config CONFIG_CRYPTO_MANAGER y
|
||||
set_kernel_config CONFIG_ARM64_CRYPTO y
|
||||
set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m
|
||||
set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m
|
||||
set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m
|
||||
set_kernel_config CRYPTO_GHASH_ARM64_CE m
|
||||
set_kernel_config CRYPTO_SHA2_ARM64_CE m
|
||||
set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m
|
||||
set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m
|
||||
set_kernel_config CONFIG_CRYPTO_AES_ARM64 m
|
||||
set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m
|
||||
set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y
|
||||
set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y
|
||||
set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
|
||||
set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
|
||||
set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
|
||||
fi
|
||||
|
||||
# Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
|
||||
if [ "$KERNEL_NF" = true ] ; then
|
||||
set_kernel_config CONFIG_IP_NF_SECURITY m
|
||||
set_kernel_config CONFIG_NETLABEL y
|
||||
set_kernel_config CONFIG_IP6_NF_SECURITY m
|
||||
set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
|
||||
set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m
|
||||
set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
|
||||
set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
|
||||
set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
|
||||
set_kernel_config CONFIG_NFT_FIB_INET m
|
||||
set_kernel_config CONFIG_NFT_FIB_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_FIB_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_FIB_NETDEV m
|
||||
set_kernel_config CONFIG_NFT_OBJREF m
|
||||
set_kernel_config CONFIG_NFT_RT m
|
||||
set_kernel_config CONFIG_NFT_SET_BITMAP m
|
||||
set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
|
||||
set_kernel_config CONFIG_NF_LOG_ARP m
|
||||
set_kernel_config CONFIG_NF_SOCKET_IPV4 m
|
||||
set_kernel_config CONFIG_NF_SOCKET_IPV6 m
|
||||
set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
|
||||
set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
|
||||
set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
|
||||
set_kernel_config CONFIG_IP6_NF_IPTABLES m
|
||||
set_kernel_config CONFIG_IP6_NF_MATCH_AH m
|
||||
set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
|
||||
set_kernel_config CONFIG_IP6_NF_NAT m
|
||||
set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
|
||||
set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
|
||||
set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
|
||||
set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_IP m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_MAC m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_NET m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_NETNET m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
|
||||
set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
|
||||
set_kernel_config CONFIG_IP_SET_LIST_SET m
|
||||
set_kernel_config CONFIG_NETFILTER_XTABLES m
|
||||
set_kernel_config CONFIG_NETFILTER_XTABLES m
|
||||
set_kernel_config CONFIG_NFT_BRIDGE_META m
|
||||
set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
|
||||
set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_COMPAT m
|
||||
set_kernel_config CONFIG_NFT_COUNTER m
|
||||
set_kernel_config CONFIG_NFT_CT m
|
||||
set_kernel_config CONFIG_NFT_DUP_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_DUP_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_DUP_NETDEV m
|
||||
set_kernel_config CONFIG_NFT_EXTHDR m
|
||||
set_kernel_config CONFIG_NFT_FWD_NETDEV m
|
||||
set_kernel_config CONFIG_NFT_HASH m
|
||||
set_kernel_config CONFIG_NFT_LIMIT m
|
||||
set_kernel_config CONFIG_NFT_LOG m
|
||||
set_kernel_config CONFIG_NFT_MASQ m
|
||||
set_kernel_config CONFIG_NFT_MASQ_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_MASQ_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_META m
|
||||
set_kernel_config CONFIG_NFT_NAT m
|
||||
set_kernel_config CONFIG_NFT_NUMGEN m
|
||||
set_kernel_config CONFIG_NFT_QUEUE m
|
||||
set_kernel_config CONFIG_NFT_QUOTA m
|
||||
set_kernel_config CONFIG_NFT_REDIR m
|
||||
set_kernel_config CONFIG_NFT_REDIR_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_REDIR_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_REJECT m
|
||||
set_kernel_config CONFIG_NFT_REJECT_INET m
|
||||
set_kernel_config CONFIG_NFT_REJECT_IPV4 m
|
||||
set_kernel_config CONFIG_NFT_REJECT_IPV6 m
|
||||
set_kernel_config CONFIG_NFT_SET_HASH m
|
||||
set_kernel_config CONFIG_NFT_SET_RBTREE m
|
||||
set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
|
||||
set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
|
||||
set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
|
||||
set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
|
||||
set_kernel_config CONFIG_NF_DUP_IPV4 m
|
||||
set_kernel_config CONFIG_NF_DUP_IPV6 m
|
||||
set_kernel_config CONFIG_NF_DUP_NETDEV m
|
||||
set_kernel_config CONFIG_NF_LOG_BRIDGE m
|
||||
set_kernel_config CONFIG_NF_LOG_IPV4 m
|
||||
set_kernel_config CONFIG_NF_LOG_IPV6 m
|
||||
set_kernel_config CONFIG_NF_NAT_IPV4 m
|
||||
set_kernel_config CONFIG_NF_NAT_IPV6 m
|
||||
set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y
|
||||
set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y
|
||||
set_kernel_config CONFIG_NF_NAT_PPTP m
|
||||
set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
|
||||
set_kernel_config CONFIG_NF_NAT_REDIRECT y
|
||||
set_kernel_config CONFIG_NF_NAT_SIP m
|
||||
set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
|
||||
set_kernel_config CONFIG_NF_NAT_TFTP m
|
||||
set_kernel_config CONFIG_NF_REJECT_IPV4 m
|
||||
set_kernel_config CONFIG_NF_REJECT_IPV6 m
|
||||
set_kernel_config CONFIG_NF_TABLES m
|
||||
set_kernel_config CONFIG_NF_TABLES_IPV4 y
|
||||
set_kernel_config CONFIG_NF_TABLES_IPV6 y
|
||||
set_kernel_config CONFIG_NF_TABLES_SET m
|
||||
set_kernel_config CONFIG_NF_TABLES_INET y
|
||||
set_kernel_config CONFIG_NF_TABLES_NETDEV y
|
||||
set_kernel_config CONFIG_NFT_CONNLIMIT m
|
||||
set_kernel_config CONFIG_NFT_TUNNEL m
|
||||
set_kernel_config CONFIG_NFT_SOCKET m
|
||||
set_kernel_config CONFIG_NFT_TPROXY m
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE m
|
||||
set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
|
||||
set_kernel_config CONFIG_NF_TABLES_ARP y
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y
|
||||
set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y
|
||||
set_kernel_config CONFIG_NF_TABLES_BRIDGE y
|
||||
set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m
|
||||
set_kernel_config CONFIG_NFT_OSF m
|
||||
|
||||
fi
|
||||
|
||||
# Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
|
||||
if [ "$KERNEL_BPF" = true ] ; then
|
||||
set_kernel_config CONFIG_BPF_SYSCALL y
|
||||
set_kernel_config CONFIG_BPF_EVENTS y
|
||||
set_kernel_config CONFIG_BPF_STREAM_PARSER y
|
||||
set_kernel_config CONFIG_CGROUP_BPF y
|
||||
set_kernel_config CONFIG_XDP_SOCKETS y
|
||||
fi
|
||||
|
||||
# KERNEL_DEFAULT_GOV was set by user
|
||||
if [ "$KERNEL_DEFAULT_GOV" != ondemand ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then
|
||||
case "$KERNEL_DEFAULT_GOV" in
|
||||
performance)
|
||||
set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
|
||||
;;
|
||||
userspace)
|
||||
set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
|
||||
;;
|
||||
ondemand)
|
||||
set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
|
||||
;;
|
||||
conservative)
|
||||
set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
|
||||
;;
|
||||
shedutil)
|
||||
set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
|
||||
;;
|
||||
*)
|
||||
echo "error: unsupported default cpu governor"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
# unset previous default governor
|
||||
unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND
|
||||
fi
|
||||
|
||||
#Revert to previous directory
|
||||
cd "${WORKDIR}" || exit
|
||||
|
||||
# Set kernel configuration parameters to enable qemu emulation
|
||||
if [ "$ENABLE_QEMU" = true ] ; then
|
||||
echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
|
||||
echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
|
||||
fi
|
||||
|
||||
# Copy custom kernel configuration file
|
||||
if [ -n "$KERNELSRC_USRCONFIG" ] ; then
|
||||
cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
|
||||
fi
|
||||
|
||||
# Set kernel configuration parameters to their default values
|
||||
if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
|
||||
fi
|
||||
|
||||
# Start menu-driven kernel configuration (interactive)
|
||||
if [ "$KERNEL_MENUCONFIG" = true ] ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
|
||||
fi
|
||||
# end if "$KERNELSRC_CONFIG" = true
|
||||
fi
|
||||
|
||||
# Use ccache to cross compile the kernel
|
||||
if [ "$KERNEL_CCACHE" = true ] ; then
|
||||
cc="ccache ${CROSS_COMPILE}gcc"
|
||||
else
|
||||
cc="${CROSS_COMPILE}gcc"
|
||||
fi
|
||||
|
||||
# Cross compile kernel and dtbs
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
|
||||
|
||||
# Cross compile kernel modules
|
||||
if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
|
||||
fi
|
||||
# end if "$KERNELSRC_PREBUILT" = false
|
||||
fi
|
||||
|
||||
# Check if kernel compilation was successful
|
||||
if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
|
||||
echo "error: kernel compilation failed! (kernel image not found)"
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Install kernel modules
|
||||
if [ "$ENABLE_REDUCE" = true ] ; then
|
||||
if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
|
||||
fi
|
||||
else
|
||||
if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
|
||||
fi
|
||||
|
||||
# Install kernel firmware
|
||||
if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
|
||||
fi
|
||||
fi
|
||||
|
||||
# Install kernel headers
|
||||
if [ "$KERNEL_HEADERS" = true ] && [ "$REDUCE_KERNEL" = false ] ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
|
||||
fi
|
||||
|
||||
# Prepare boot (firmware) directory
|
||||
mkdir "${BOOT_DIR}"
|
||||
|
||||
# Get kernel release version
|
||||
KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
|
||||
|
||||
# Copy kernel configuration file to the boot directory
|
||||
install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
|
||||
|
||||
# Prepare device tree directory
|
||||
mkdir "${BOOT_DIR}/overlays"
|
||||
|
||||
# Ensure the proper .dtb is located
|
||||
if [ "$KERNEL_ARCH" = "arm" ] ; then
|
||||
for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
|
||||
if [ -f "${dtb}" ] ; then
|
||||
install_readonly "${dtb}" "${BOOT_DIR}/"
|
||||
fi
|
||||
done
|
||||
else
|
||||
for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
|
||||
if [ -f "${dtb}" ] ; then
|
||||
install_readonly "${dtb}" "${BOOT_DIR}/"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Copy compiled dtb device tree files
|
||||
if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
|
||||
for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do
|
||||
if [ -f "${dtb}" ] ; then
|
||||
install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
|
||||
install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_UBOOT" = false ] ; then
|
||||
# Convert and copy kernel image to the boot directory
|
||||
cp "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
|
||||
else
|
||||
# Copy kernel image to the boot directory
|
||||
install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
|
||||
fi
|
||||
|
||||
# Remove kernel sources
|
||||
if [ "$KERNEL_REMOVESRC" = true ] ; then
|
||||
rm -fr "${KERNEL_DIR}"
|
||||
else
|
||||
# Prepare compiled kernel modules
|
||||
if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
|
||||
if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
|
||||
make -j "${NB_CORES}" -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
|
||||
fi
|
||||
|
||||
# Create symlinks for kernel modules
|
||||
chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
|
||||
chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
|
||||
fi
|
||||
fi
|
||||
|
||||
else # BUILD_KERNEL=false
|
||||
if [ "$SET_ARCH" = 64 ] ; then
|
||||
if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
|
||||
# Use Sakakis modified kernel if ZSWAP is active
|
||||
if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
|
||||
RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
|
||||
fi
|
||||
|
||||
# Create temporary directory for dl
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch kernel dl
|
||||
as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
|
||||
fi
|
||||
if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then
|
||||
# Create temporary directory for dl
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch kernel dl
|
||||
as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL"
|
||||
fi
|
||||
|
||||
#extract download
|
||||
tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
|
||||
|
||||
#move extracted kernel to /boot/firmware
|
||||
mkdir "${R}/boot/firmware"
|
||||
cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
|
||||
cp -r "${temp_dir}"/lib/* "${R}"/lib/
|
||||
|
||||
# Remove temporary directory for kernel sources
|
||||
rm -fr "${temp_dir}"
|
||||
|
||||
# Set permissions of the kernel sources
|
||||
chown -R root:root "${R}/boot/firmware"
|
||||
chown -R root:root "${R}/lib/modules"
|
||||
fi
|
||||
|
||||
# Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel)
|
||||
if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then
|
||||
# Create temporary directory for dl
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch kernel
|
||||
as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
|
||||
|
||||
# Copy downloaded kernel package
|
||||
mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
|
||||
|
||||
# Set permissions
|
||||
chown -R root:root "${R}"/tmp/kernel.deb
|
||||
|
||||
# Install kernel
|
||||
chroot_exec dpkg -i /tmp/kernel.deb
|
||||
|
||||
# move /boot to /boot/firmware to fit script env.
|
||||
#mkdir "${BOOT_DIR}"
|
||||
mkdir "${temp_dir}"/firmware
|
||||
mv "${R}"/boot/* "${temp_dir}"/firmware/
|
||||
mv "${temp_dir}"/firmware "${R}"/boot/
|
||||
|
||||
#same for kernel headers
|
||||
if [ "$KERNEL_HEADERS" = true ] ; then
|
||||
# Fetch kernel header
|
||||
as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
|
||||
mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
|
||||
chown -R root:root "${R}"/tmp/kernel-header.deb
|
||||
# Install kernel header
|
||||
chroot_exec dpkg -i /tmp/kernel-header.deb
|
||||
rm -f "${R}"/tmp/kernel-header.deb
|
||||
fi
|
||||
|
||||
# Remove temporary directory and files
|
||||
rm -fr "${temp_dir}"
|
||||
rm -f "${R}"/tmp/kernel.deb
|
||||
fi
|
||||
|
||||
# Check if kernel installation was successful
|
||||
KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
|
||||
if [ -z "$KERNEL" ] ; then
|
||||
echo "error: kernel installation failed! (/boot/kernel* not found)"
|
||||
cleanup
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
120
bootstrap.d/14-fstab.sh
Normal file
120
bootstrap.d/14-fstab.sh
Normal file
@@ -0,0 +1,120 @@
|
||||
#
|
||||
# Setup fstab and initramfs
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Install and setup fstab
|
||||
install_readonly files/mount/fstab "${ETC_DIR}/fstab"
|
||||
|
||||
# Generate initramfs file
|
||||
if [ "$ENABLE_INITRAMFS" = true ] ; then
|
||||
if [ "$ENABLE_CRYPTFS" = true ] ; then
|
||||
|
||||
# Include initramfs scripts to auto expand encrypted root partition
|
||||
if [ "$EXPANDROOT" = true ] ; then
|
||||
install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
|
||||
install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
|
||||
install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
|
||||
fi
|
||||
|
||||
# Replace fstab root partition with encrypted partition mapping
|
||||
sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
|
||||
|
||||
# Add encrypted partition to crypttab and fstab
|
||||
install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
|
||||
echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
|
||||
|
||||
if [ "$ENABLE_USBBOOT" = true ] && [ "$ENABLE_SPLITFS" = false ]; then
|
||||
sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
|
||||
# Add usb/sda2 disk to crypttab
|
||||
sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/crypttab"
|
||||
fi
|
||||
|
||||
# Add encrypted root partition to fstab and crypttab
|
||||
if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_USBBOOT" = false ]; then
|
||||
# Add usb/sda1 disk to crypttab
|
||||
sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
|
||||
fi
|
||||
|
||||
if [ "$CRYPTFS_DROPBEAR" = true ] ; then
|
||||
if [ "$ENABLE_ETH_DHCP" = false ] ; then
|
||||
# Get cdir from NET_ADDRESS e.g. 24
|
||||
cdir=$(printf "%s" "${NET_ETH_ADDRESS}" | cut -d '/' -f2)
|
||||
|
||||
# Convert cdir ro netmask e.g. 24 to 255.255.255.0
|
||||
NET_MASK=$(cdr2mask "$cdir")
|
||||
|
||||
# Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
|
||||
# ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<HOSTNAME>:<device>:<autoconf>
|
||||
sed -i "\$a\nIP=${NET_ETH_ADDRESS}::${NET_ETH_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
|
||||
else
|
||||
sed -i "\$a\nIP=::::${HOSTNAME}::dhcp" "${ETC_DIR}"/initramfs-tools/initramfs.conf
|
||||
fi
|
||||
|
||||
if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
|
||||
install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
|
||||
cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
|
||||
else
|
||||
# Create key
|
||||
chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
|
||||
|
||||
# Convert dropbear key to openssh key
|
||||
chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
|
||||
|
||||
# Get Public Key Part
|
||||
chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear | chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
|
||||
|
||||
# Delete unwanted lines
|
||||
sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
|
||||
sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
|
||||
|
||||
# Trust the new key
|
||||
cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
|
||||
|
||||
# Save Keys - convert with putty from rsa/openssh to puttkey
|
||||
cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
|
||||
|
||||
# Get unlock script
|
||||
install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
|
||||
|
||||
# Enable Dropbear inside initramfs
|
||||
printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
|
||||
|
||||
# Enable Dropbear inside initramfs
|
||||
sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
|
||||
fi
|
||||
# CRYPTFSDROPBEAR=false
|
||||
else
|
||||
# Disable SSHD inside initramfs
|
||||
printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
|
||||
fi
|
||||
|
||||
# Add cryptsetup modules to initramfs
|
||||
#printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
|
||||
|
||||
# Dummy mapping required by mkinitramfs
|
||||
echo "0 1 crypt "${CRYPTFS_CIPHER}" ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
|
||||
|
||||
# Generate initramfs with encrypted root partition support
|
||||
chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
|
||||
|
||||
# Remove dummy mapping
|
||||
chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
|
||||
# CRYPTFS=false
|
||||
else
|
||||
#USB BOOT /boot on sda1 / on sda2
|
||||
if [ "$ENABLE_USBBOOT" = true ] ; then
|
||||
sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
|
||||
sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
|
||||
fi
|
||||
|
||||
# Add usb/sda disk root partition to fstab
|
||||
if [ "$ENABLE_SPLITFS" = true ] ; then
|
||||
sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
|
||||
fi
|
||||
# Generate initramfs without encrypted root partition support
|
||||
chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
|
||||
fi
|
||||
fi
|
||||
366
bootstrap.d/15-rpi-config.sh
Normal file
366
bootstrap.d/15-rpi-config.sh
Normal file
@@ -0,0 +1,366 @@
|
||||
#
|
||||
# Setup RPi2/3/4 config and cmdline
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
|
||||
# Install boot binaries from local directory
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/bootcode.bin "${BOOT_DIR}"/bootcode.bin
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup.dat "${BOOT_DIR}"/fixup.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup_cd.dat "${BOOT_DIR}"/fixup_cd.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup_x.dat "${BOOT_DIR}"/fixup_x.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start.elf "${BOOT_DIR}"/start.elf
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start_cd.elf "${BOOT_DIR}"/start_cd.elf
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start_x.elf "${BOOT_DIR}"/start_x.elf
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup4cd.dat "${BOOT_DIR}"/fixup4cd.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup4.dat "${BOOT_DIR}"/fixup4.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup4db.dat "${BOOT_DIR}"/fixup4db.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/fixup4x.dat "${BOOT_DIR}"/fixup4x.dat
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start4cd.elf "${BOOT_DIR}"/start4cd.elf
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start4db.elf "${BOOT_DIR}"/start4db.elf
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start4.elf "${BOOT_DIR}"/start4.elf
|
||||
cp "${RPI_FIRMWARE_DIR}"/boot/start4x.elf "${BOOT_DIR}"/start4x.elf
|
||||
else
|
||||
# Create temporary directory for boot binaries
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Install latest boot binaries from raspberry/firmware github
|
||||
as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
|
||||
as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
|
||||
as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup4cd.dat" "${FIRMWARE_URL}/fixup4cd.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup4.dat" "${FIRMWARE_URL}/fixup4.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup4db.dat" "${FIRMWARE_URL}/fixup4db.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/fixup4x.dat" "${FIRMWARE_URL}/fixup4x.dat"
|
||||
as_nobody wget -q -O "${temp_dir}/start4cd.elf" "${FIRMWARE_URL}/start4cd.elf"
|
||||
as_nobody wget -q -O "${temp_dir}/start4db.elf" "${FIRMWARE_URL}/start4db.elf"
|
||||
as_nobody wget -q -O "${temp_dir}/start4.elf" "${FIRMWARE_URL}/start4.elf"
|
||||
as_nobody wget -q -O "${temp_dir}/start4x.elf" "${FIRMWARE_URL}/start4x.elf"
|
||||
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2708-rpi-b.dtb" "${FIRMWARE_URL}/bcm2708-rpi-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2708-rpi-b-plus.dtb" "${FIRMWARE_URL}/bcm2708-rpi-b-plus.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2708-rpi-b-rev1.dtb" "${FIRMWARE_URL}/bcm2708-rpi-b-rev1.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2708-rpi-cm.dtb" "${FIRMWARE_URL}/bcm2708-rpi-cm.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2708-rpi-zero.dtb" "${FIRMWARE_URL}/bcm2708-rpi-zero.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2708-rpi-zero-w.dtb" "${FIRMWARE_URL}/bcm2708-rpi-zero-w.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2709-rpi-2-b.dtb" "${FIRMWARE_URL}/bcm2709-rpi-2-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2709-rpi-cm2.dtb" "${FIRMWARE_URL}/bcm2709-rpi-cm2.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2710-rpi-2-b.dtb" "${FIRMWARE_URL}/bcm2710-rpi-2-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2710-rpi-3-b.dtb" "${FIRMWARE_URL}/bcm2710-rpi-3-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2710-rpi-3-b-plus.dtb" "${FIRMWARE_URL}/bcm2710-rpi-3-b-plus.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2710-rpi-cm3.dtb" "${FIRMWARE_URL}/bcm2710-rpi-cm3.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2710-rpi-zero-2.dtb" "${FIRMWARE_URL}/bcm2710-rpi-zero-2.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2710-rpi-zero-2-w.dtb" "${FIRMWARE_URL}/bcm2710-rpi-zero-2-w.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2711-rpi-400.dtb" "${FIRMWARE_URL}/bcm2711-rpi-400.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2711-rpi-4-b.dtb" "${FIRMWARE_URL}/bcm2711-rpi-4-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2711-rpi-cm4.dtb" "${FIRMWARE_URL}/bcm2711-rpi-cm4.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2711-rpi-cm4-io.dtb" "${FIRMWARE_URL}/bcm2711-rpi-cm4-io.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2711-rpi-cm4s.dtb" "${FIRMWARE_URL}/bcm2711-rpi-cm4s.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2712d0-rpi-5-b.dtb" "${FIRMWARE_URL}/bcm2712d0-rpi-5-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2712-rpi-5-b.dtb" "${FIRMWARE_URL}/bcm2712-rpi-5-b.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2712-rpi-cm5-cm4io.dtb" "${FIRMWARE_URL}/bcm2712-rpi-cm5-cm4io.dtb"
|
||||
as_nobody wget -q -O "${temp_dir}/bcm2712-rpi-cm5-cm5io.dtb" "${FIRMWARE_URL}/bcm2712-rpi-cm5-cm5io.dtb"
|
||||
|
||||
|
||||
# Move downloaded boot binaries
|
||||
mv "${temp_dir}/"* "${BOOT_DIR}/"
|
||||
|
||||
# Remove temporary directory for boot binaries
|
||||
rm -fr "${temp_dir}"
|
||||
|
||||
# Set permissions of the boot binaries
|
||||
chown -R root:root "${BOOT_DIR}"
|
||||
chmod -R 600 "${BOOT_DIR}"
|
||||
fi
|
||||
|
||||
# Setup firmware boot cmdline
|
||||
if [ "$ENABLE_USBBOOT" = true ] ; then
|
||||
CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
|
||||
else
|
||||
if [ "$ENABLE_SPLITFS" = true ] ; then
|
||||
CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
|
||||
else
|
||||
CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add encrypted root partition to cmdline.txt
|
||||
if [ "$ENABLE_CRYPTFS" = true ] ; then
|
||||
if [ "$ENABLE_SPLITFS" = true ] ; then
|
||||
CMDLINE=$(echo "${CMDLINE}" | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
|
||||
else
|
||||
if [ "$ENABLE_USBBOOT" = true ] ; then
|
||||
CMDLINE=$(echo "${CMDLINE}" | sed "s/sda2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda2:${CRYPTFS_MAPPING}/")
|
||||
else
|
||||
CMDLINE=$(echo "${CMDLINE}" | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enable Kernel messages on standard output
|
||||
if [ "$ENABLE_PRINTK" = true ] ; then
|
||||
install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
|
||||
fi
|
||||
|
||||
# Enable Kernel messages on standard output
|
||||
if [ "$KERNEL_SECURITY" = true ] ; then
|
||||
install_readonly files/sysctl.d/84-rpi-ASLR.conf "${ETC_DIR}/sysctl.d/84-rpi-ASLR.conf"
|
||||
fi
|
||||
|
||||
# Install udev rule for serial alias - serial0 = console serial1=bluetooth
|
||||
install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
|
||||
|
||||
# Remove IPv6 networking support
|
||||
if [ "$ENABLE_IPV6" = false ] ; then
|
||||
CMDLINE="${CMDLINE} ipv6.disable=1"
|
||||
fi
|
||||
|
||||
# Automatically assign predictable network interface names
|
||||
if [ "$ENABLE_IFNAMES" = false ] ; then
|
||||
CMDLINE="${CMDLINE} net.ifnames=0"
|
||||
else
|
||||
CMDLINE="${CMDLINE} net.ifnames=1"
|
||||
fi
|
||||
|
||||
# Disable Raspberry Pi console logo
|
||||
if [ "$ENABLE_LOGO" = false ] ; then
|
||||
CMDLINE="${CMDLINE} logo.nologo"
|
||||
fi
|
||||
|
||||
# Strictly limit verbosity of boot up console messages
|
||||
if [ "$ENABLE_SILENT_BOOT" = true ] ; then
|
||||
CMDLINE="${CMDLINE} quiet loglevel=0 rd.systemd.show_status=auto rd.udev.log_priority=0"
|
||||
fi
|
||||
|
||||
# Install firmware config
|
||||
install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
|
||||
|
||||
# Disable Raspberry Pi console logo
|
||||
if [ "$ENABLE_SPLASH" = false ] ; then
|
||||
echo "disable_splash=1" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
# Locks CPU frequency at maximum
|
||||
if [ "$ENABLE_TURBO" = true ] ; then
|
||||
echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
|
||||
# helps to avoid sdcard corruption when force_turbo is enabled.
|
||||
echo "boot_delay=1" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; then
|
||||
|
||||
# Bluetooth enabled
|
||||
if [ "$ENABLE_BLUETOOTH" = true ] ; then
|
||||
# Create temporary directory for Bluetooth sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch Bluetooth sources
|
||||
as_nobody git -C "${temp_dir}" clone "${BLUETOOTH_URL}"
|
||||
|
||||
# Copy downloaded sources
|
||||
mv "${temp_dir}/pi-bluetooth" "${R}/tmp/"
|
||||
|
||||
# Set permissions
|
||||
chown -R root:root "${R}/tmp/pi-bluetooth"
|
||||
|
||||
# Bluetooth firmware from arch aur https://aur.archlinux.org/packages/pi-bluetooth/
|
||||
wget -q -O "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" https://aur.archlinux.org/cgit/aur.git/plain/LICENCE.broadcom_bcm43xx?h=pi-bluetooth
|
||||
wget -q -O "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/master/broadcom/BCM43430A1.hcd
|
||||
|
||||
# Install tools
|
||||
install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
|
||||
install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
|
||||
|
||||
# make scripts executable
|
||||
chmod +x "${R}/usr/bin/bthelper"
|
||||
chmod +x "${R}/usr/bin/btuart"
|
||||
|
||||
# Install bluetooth udev rule
|
||||
install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
|
||||
|
||||
# Install Firmware Flash file and apropiate licence
|
||||
mkdir -p "$BLUETOOTH_FIRMWARE_DIR"
|
||||
install_readonly "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
|
||||
install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/BCM43430A1.hcd"
|
||||
install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
|
||||
install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
|
||||
|
||||
# Remove temporary directories
|
||||
rm -fr "${temp_dir}"
|
||||
rm -fr "${R}"/tmp/pi-bluetooth
|
||||
|
||||
# Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
|
||||
if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
|
||||
# set overlay to swap ttyAMA0 and ttyS0
|
||||
echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
|
||||
|
||||
if [ "$ENABLE_TURBO" = false ] ; then
|
||||
echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
# Activate services
|
||||
chroot_exec systemctl enable pi-bluetooth.hciuart.service
|
||||
|
||||
else # if ENABLE_BLUETOOTH = false
|
||||
# set overlay to disable bluetooth
|
||||
echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
|
||||
fi # ENABLE_BLUETOOTH end
|
||||
fi
|
||||
|
||||
# may need sudo systemctl disable hciuart
|
||||
if [ "$ENABLE_CONSOLE" = true ] ; then
|
||||
echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
|
||||
#More debug output on early but with serial console
|
||||
echo "uart_2ndstage=1" >> "${BOOT_DIR}/config.txt"
|
||||
|
||||
# add string to cmdline
|
||||
CMDLINE="${CMDLINE} console=serial0,115200"
|
||||
|
||||
if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]|| [ "$RPI_MODEL" = 0 ]; then
|
||||
# if force_turbo didn't lock cpu at high speed, lock it at low speed (XOR logic) or miniuart will be broken
|
||||
if [ "$ENABLE_TURBO" = false ] ; then
|
||||
echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Enable serial console systemd style
|
||||
chroot_exec systemctl enable serial-getty@serial0.service
|
||||
else
|
||||
echo "enable_uart=0" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
# Disable dphys-swapfile service. Will get enabled on first boot
|
||||
if [ "$ENABLE_DPHYSSWAP" = true ] ; then
|
||||
chroot_exec systemctl disable dphys-swapfile
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_SYSTEMDSWAP" = true ] ; then
|
||||
# Create temporary directory for systemd-swap sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch systemd-swap sources
|
||||
as_nobody git -C "${temp_dir}" clone "${SYSTEMDSWAP_URL}"
|
||||
|
||||
# Copy downloaded systemd-swap sources
|
||||
mv "${temp_dir}/systemd-swap" "${R}/tmp/"
|
||||
|
||||
# Change into downloaded src dir
|
||||
cd "${R}/tmp/systemd-swap" || exit
|
||||
|
||||
# Get Verion
|
||||
VERSION=$(git tag | tail -n 1)
|
||||
#sed -i "s/DEB_NAME=.*/DEB_NAME=systemd-swap_all/g" "${R}/tmp/systemd-swap/package.sh"
|
||||
|
||||
# Build package
|
||||
bash ./package.sh debian
|
||||
|
||||
# Change back into script root dir
|
||||
cd "${WORKDIR}" || exit
|
||||
|
||||
# Set permissions of the systemd-swap sources
|
||||
chown -R root:root "${R}/tmp/systemd-swap"
|
||||
|
||||
# Install package - IMPROVE AND MAKE IT POSSIBLE WITHOUT VERSION NR.
|
||||
chroot_exec dpkg -i /tmp/systemd-swap/systemd-swap_"$VERSION"_all.deb
|
||||
|
||||
# Enable service
|
||||
chroot_exec systemctl enable systemd-swap
|
||||
|
||||
# Remove temporary directory for systemd-swap sources
|
||||
rm -fr "${temp_dir}"
|
||||
else
|
||||
# Enable ZSWAP in cmdline if systemd-swap is not used
|
||||
if [ "$KERNEL_ZSWAP" = true ] ; then
|
||||
CMDLINE="${CMDLINE} zswap.enabled=1 zswap.max_pool_percent=25 zswap.compressor=lz4"
|
||||
fi
|
||||
fi
|
||||
if [ "$KERNEL_SECURITY" = true ] ; then
|
||||
CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
|
||||
fi
|
||||
|
||||
# Install firmware boot cmdline
|
||||
echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
|
||||
|
||||
# Setup minimal GPU memory allocation size: 16MB (no X)
|
||||
if [ "$ENABLE_MINGPU" = true ] ; then
|
||||
if [ "$ENABLE_GR_ACCEL" = false ] ; then
|
||||
echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
|
||||
else
|
||||
### Cannot reduce memory if graphics acceleration is requested
|
||||
echo "gpu_mem=128" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Setup boot with initramfs
|
||||
if [ "$ENABLE_INITRAMFS" = true ] ; then
|
||||
echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
# Create firmware configuration and cmdline symlinks
|
||||
ln -sf firmware/config.txt "${R}/boot/config.txt"
|
||||
ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
|
||||
|
||||
# Install and setup kernel modules to load at boot
|
||||
mkdir -p "${LIB_DIR}/modules-load.d/"
|
||||
install_readonly files/modules/rpi2.conf "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
|
||||
# Load hardware random module at boot
|
||||
if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
|
||||
sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
fi
|
||||
|
||||
# Load sound module at boot
|
||||
if [ "$ENABLE_SOUND" = true ] ; then
|
||||
sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
else
|
||||
echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
# Enable I2C interface
|
||||
if [ "$ENABLE_I2C" = true ] ; then
|
||||
echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
|
||||
sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
sed -i "s/^# i2c-dev/i2c-dev/" "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
fi
|
||||
|
||||
# Enable SPI interface
|
||||
if [ "$ENABLE_SPI" = true ] ; then
|
||||
echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
|
||||
echo "spi-bcm2708" >> "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
|
||||
sed -i "s/spi-bcm2708/spi-bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Disable RPi2/3 under-voltage warnings
|
||||
if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
|
||||
echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
#Enable graphics acceleration for Model 4
|
||||
if [ "$RPI_MODEL" = 4 ] && [ "$ENABLE_GR_ACCEL" = true ] ; then
|
||||
echo "max_framebuffers=2" >> "${BOOT_DIR}/config.txt"
|
||||
echo "arm_64bit=1" >> "${BOOT_DIR}/config.txt"
|
||||
echo "cmdline=cmdline.txt" >> "${BOOT_DIR}/config.txt"
|
||||
echo "dtparam=audio=on" >> "${BOOT_DIR}/config.txt"
|
||||
if [ "$ENABLE_MINGPU" = false ] ; then
|
||||
echo "gpu_mem=128" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
echo "dtoverlay=vc4-fkms-v3d, cma-128" >> "${BOOT_DIR}/config.txt"
|
||||
fi
|
||||
|
||||
|
||||
# Install kernel modules blacklist
|
||||
mkdir -p "${ETC_DIR}/modprobe.d/"
|
||||
install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
|
||||
|
||||
# Install sysctl.d configuration files
|
||||
install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
|
||||
189
bootstrap.d/20-networking.sh
Normal file
189
bootstrap.d/20-networking.sh
Normal file
@@ -0,0 +1,189 @@
|
||||
#
|
||||
# Setup Networking
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Install and setup hostname
|
||||
install_readonly files/network/hostname "${ETC_DIR}/hostname"
|
||||
sed -i "s/^RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hostname"
|
||||
|
||||
# Install and setup hosts
|
||||
install_readonly files/network/hosts "${ETC_DIR}/hosts"
|
||||
sed -i "s/RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hosts"
|
||||
|
||||
# Ensure /etc/systemd/network directory is available
|
||||
mkdir -p "${ETC_DIR}/systemd/network"
|
||||
|
||||
# Setup hostname entry with static IP
|
||||
if [ "$NET_ETH_ADDRESS" != "" ] ; then
|
||||
NET_IP=$(echo "${NET_ETH_ADDRESS}" | cut -f 1 -d'/')
|
||||
sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
|
||||
fi
|
||||
|
||||
# Remove IPv6 hosts
|
||||
if [ "$ENABLE_IPV6" = false ] ; then
|
||||
sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
|
||||
fi
|
||||
|
||||
# Install hint about network configuration
|
||||
install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
|
||||
|
||||
# Install configuration for interface eth0
|
||||
install_readonly files/network/eth0.network "${ETC_DIR}/systemd/network/eth0.network"
|
||||
|
||||
if [ "$RPI_MODEL" = 3P ] ; then
|
||||
printf "\n[Link]\nGenericReceiveOffload=off\nTCPSegmentationOffload=off\nGenericSegmentationOffload=off" >> "${ETC_DIR}/systemd/network/eth0.network"
|
||||
fi
|
||||
|
||||
# Install configuration for interface wl*
|
||||
install_readonly files/network/wlan0.network "${ETC_DIR}/systemd/network/wlan0.network"
|
||||
|
||||
#always with dhcp since wpa_supplicant integration is missing
|
||||
sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan0.network"
|
||||
|
||||
if [ "$ENABLE_ETH_DHCP" = true ] ; then
|
||||
# Enable DHCP configuration for interface eth0
|
||||
sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth0.network"
|
||||
|
||||
# Set DHCP configuration to IPv4 only
|
||||
if [ "$ENABLE_IPV6" = false ] ; then
|
||||
sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth0.network"
|
||||
sed '/IPv6PrivacyExtensions=true/d' "${ETC_DIR}/systemd/network/eth0.network"
|
||||
fi
|
||||
|
||||
else # ENABLE_ETH_DHCP=false
|
||||
# Set static network configuration for interface eth0
|
||||
if [ -n NET_ETH_ADDRESS ] && [ -n NET_ETH_GATEWAY ] && [ -n NET_ETH_DNS_1 ] ; then
|
||||
sed -i\
|
||||
-e "s|DHCP=.*|DHCP=no|"\
|
||||
-e "s|Address=\$|Address=${NET_ETH_ADDRESS}|"\
|
||||
-e "s|Gateway=\$|Gateway=${NET_ETH_GATEWAY}|"\
|
||||
-e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_ETH_DNS_1}|"\
|
||||
-e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_ETH_DNS_2}|"\
|
||||
-e "s|Domains=\$|Domains=${NET_ETH_DNS_DOMAINS}|"\
|
||||
-e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_ETH_NTP_1}|"\
|
||||
-e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_ETH_NTP_2}|"\
|
||||
"${ETC_DIR}/systemd/network/eth0.network"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
if [ "$ENABLE_WIRELESS" = true ] ; then
|
||||
mkdir -p "${ETC_DIR}/wpa_supplicant"
|
||||
if [ "$ENABLE_WIFI_DHCP" = true ] ; then
|
||||
# Enable DHCP configuration for interface eth0
|
||||
sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan0.network"
|
||||
|
||||
# Set DHCP configuration to IPv4 only
|
||||
if [ "$ENABLE_IPV6" = false ] ; then
|
||||
sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/wlan0.network"
|
||||
sed '/IPv6PrivacyExtensions=true/d' "${ETC_DIR}/systemd/network/wlan0.network"
|
||||
fi
|
||||
|
||||
else # ENABLE_WIFI_DHCP=false
|
||||
# Set static network configuration for interface eth0
|
||||
if [ -n NET_WIFI_ADDRESS ] && [ -n NET_WIFI_GATEWAY ] && [ -n NET_WIFI_DNS_1 ] ; then
|
||||
sed -i\
|
||||
-e "s|DHCP=.*|DHCP=no|"\
|
||||
-e "s|Address=\$|Address=${NET_WIFI_ADDRESS}|"\
|
||||
-e "s|Gateway=\$|Gateway=${NET_WIFI_GATEWAY}|"\
|
||||
-e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_WIFI_DNS_1}|"\
|
||||
-e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_WIFI_DNS_2}|"\
|
||||
-e "s|Domains=\$|Domains=${NET_WIFI_DNS_DOMAINS}|"\
|
||||
-e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_WIFI_NTP_1}|"\
|
||||
-e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_WIFI_NTP_2}|"\
|
||||
"${ETC_DIR}/systemd/network/wlan0.network"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ! -z "$NET_WIFI_SSID" ] && [ ! -z "$NET_WIFI_PSK" ] ; then
|
||||
chroot_exec printf "
|
||||
ctrl_interface=/run/wpa_supplicant
|
||||
update_config=1
|
||||
eapol_version=1
|
||||
ap_scan=1
|
||||
fast_reauth=1
|
||||
|
||||
" > "${ETC_DIR}/wpa_supplicant/wpa_supplicant-wlan0.conf"
|
||||
|
||||
#Configure WPA_supplicant
|
||||
chroot_exec wpa_passphrase "$NET_WIFI_SSID" "$NET_WIFI_PSK" >> "${ETC_DIR}/wpa_supplicant/wpa_supplicant-wlan0.conf"
|
||||
|
||||
chroot_exec systemctl enable wpa_supplicant.service
|
||||
chroot_exec systemctl enable wpa_supplicant@wlan0.service
|
||||
fi
|
||||
# Remove empty settings from wlan configuration
|
||||
sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan0.network"
|
||||
# If WLAN is enabled copy wlan configuration too
|
||||
mv -v "${ETC_DIR}/systemd/network/wlan0.network" "${LIB_DIR}/systemd/network/11-wlan0.network"
|
||||
fi
|
||||
|
||||
# Remove empty settings from network configuration
|
||||
sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth0.network"
|
||||
|
||||
# Move systemd network configuration if required by Debian release
|
||||
mv -v "${ETC_DIR}/systemd/network/eth0.network" "${LIB_DIR}/systemd/network/10-eth0.network"
|
||||
|
||||
#Clean up
|
||||
rm -fr "${ETC_DIR}/systemd/network"
|
||||
|
||||
# Enable systemd-networkd service
|
||||
chroot_exec systemctl enable systemd-networkd
|
||||
|
||||
# Install host.conf resolver configuration
|
||||
install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
|
||||
|
||||
# Enable network stack hardening
|
||||
if [ "$ENABLE_HARDNET" = true ] ; then
|
||||
# Install sysctl.d configuration files
|
||||
install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
|
||||
|
||||
# Setup resolver warnings about spoofed addresses
|
||||
sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
|
||||
fi
|
||||
|
||||
# Enable time sync
|
||||
if [ "$NET_NTP_1" != "" ] ; then
|
||||
chroot_exec systemctl enable systemd-timesyncd.service
|
||||
fi
|
||||
|
||||
# Download the firmware binary blob required to use the RPi3 wireless interface
|
||||
if [ "$ENABLE_WIRELESS" = true ] ; then
|
||||
if [ ! -d "${WLAN_FIRMWARE_DIR}" ] ; then
|
||||
mkdir -p "${WLAN_FIRMWARE_DIR}"
|
||||
fi
|
||||
|
||||
# Create temporary directory for firmware binary blob
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch firmware binary blob for RPI3B+ or Pi4
|
||||
if [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
|
||||
# Fetch firmware binary blob for RPi3P
|
||||
as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin?raw=true"
|
||||
as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt?raw=true"
|
||||
as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob?raw=true"
|
||||
|
||||
# Move downloaded firmware binary blob
|
||||
mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
|
||||
|
||||
# Set permissions of the firmware binary blob
|
||||
chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
|
||||
chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
|
||||
elif [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 0 ] ; then
|
||||
# Fetch firmware binary blob for RPi3
|
||||
as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin?raw=true"
|
||||
as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt?raw=true"
|
||||
|
||||
# Move downloaded firmware binary blob
|
||||
mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
|
||||
|
||||
# Set permissions of the firmware binary blob
|
||||
chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
|
||||
chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
|
||||
fi
|
||||
|
||||
# Remove temporary directory for firmware binary blob
|
||||
rm -fr "${temp_dir}"
|
||||
fi
|
||||
54
bootstrap.d/21-firewall.sh
Normal file
54
bootstrap.d/21-firewall.sh
Normal file
@@ -0,0 +1,54 @@
|
||||
#
|
||||
# Setup Firewall
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ "$ENABLE_IPTABLES" = true ] ; then
|
||||
# Create iptables configuration directory
|
||||
mkdir -p "${ETC_DIR}/iptables"
|
||||
|
||||
if [ "$KERNEL_NF" = false ] ; then
|
||||
# iptables-save and -restore are slaves of iptables and thus are set accordingly
|
||||
chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy
|
||||
fi
|
||||
|
||||
# Install iptables systemd service
|
||||
install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
|
||||
|
||||
# Install flush-table script called by iptables service
|
||||
install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
|
||||
|
||||
# Install iptables rule file
|
||||
install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
|
||||
|
||||
# Reload systemd configuration and enable iptables service
|
||||
chroot_exec systemctl daemon-reload
|
||||
chroot_exec systemctl enable iptables.service
|
||||
|
||||
if [ "$ENABLE_IPV6" = true ] ; then
|
||||
if [ "$KERNEL_NF" = false ] ; then
|
||||
# iptables-save and -restore are slaves of iptables and thus are set accordingly
|
||||
chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
|
||||
fi
|
||||
|
||||
# Install ip6tables systemd service
|
||||
install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
|
||||
|
||||
# Install ip6tables file
|
||||
install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
|
||||
|
||||
install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
|
||||
|
||||
# Reload systemd configuration and enable iptables service
|
||||
chroot_exec systemctl daemon-reload
|
||||
chroot_exec systemctl enable ip6tables.service
|
||||
fi
|
||||
|
||||
if [ "$SSH_ENABLE" = false ] ; then
|
||||
# Remove SSHD related iptables rules
|
||||
sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
|
||||
sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
|
||||
fi
|
||||
fi
|
||||
24
bootstrap.d/30-security.sh
Normal file
24
bootstrap.d/30-security.sh
Normal file
@@ -0,0 +1,24 @@
|
||||
#
|
||||
# Setup users and security settings
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Generate crypt(3) password string
|
||||
ENCRYPTED_PASSWORD=$(mkpasswd -m sha-512 "${ROOT_PASSWORD}")
|
||||
ENCRYPTED_USER_PASSWORD=$(mkpasswd -m sha-512 "${USER_PASSWORD}")
|
||||
|
||||
# Setup default user
|
||||
if [ "$ENABLE_USER" = true ] ; then
|
||||
chroot_exec adduser --gecos "$USER_NAME" --add_extra_groups --disabled-password "$USER_NAME"
|
||||
chroot_exec usermod -a -G sudo -p "${ENCRYPTED_USER_PASSWORD}" "$USER_NAME"
|
||||
fi
|
||||
|
||||
# Setup root password or not
|
||||
if [ "$ENABLE_ROOT" = true ] ; then
|
||||
chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
|
||||
else
|
||||
# Set no root password to disable root login
|
||||
chroot_exec usermod -p \'!\' root
|
||||
fi
|
||||
13
bootstrap.d/31-logging.sh
Normal file
13
bootstrap.d/31-logging.sh
Normal file
@@ -0,0 +1,13 @@
|
||||
#
|
||||
# Setup Logging
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Disable rsyslog
|
||||
if [ "$ENABLE_RSYSLOG" = false ] ; then
|
||||
sed -i "s|[#]*ForwardToSyslog=yes|ForwardToSyslog=no|g" "${ETC_DIR}/systemd/journald.conf"
|
||||
chroot_exec systemctl disable rsyslog
|
||||
chroot_exec apt-get -qq -y purge rsyslog
|
||||
fi
|
||||
116
bootstrap.d/32-sshd.sh
Normal file
116
bootstrap.d/32-sshd.sh
Normal file
@@ -0,0 +1,116 @@
|
||||
#
|
||||
# Setup SSH settings and public keys
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ "$SSH_ENABLE" = true ] ; then
|
||||
DROPBEAR_ARGS=""
|
||||
|
||||
if [ "$SSH_ENABLE_ROOT" = false ] ; then
|
||||
if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
|
||||
# User root is not allowed to log in
|
||||
sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin no|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
else
|
||||
# User root is not allowed to log in
|
||||
DROPBEAR_ARGS="-w"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
|
||||
if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
|
||||
# Permit SSH root login
|
||||
sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin yes|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
else
|
||||
# Permit SSH root login
|
||||
DROPBEAR_ARGS=""
|
||||
fi
|
||||
|
||||
# Add SSH (v2) public key for user root
|
||||
if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
|
||||
# Create root SSH config directory
|
||||
mkdir -p "${R}/root/.ssh"
|
||||
|
||||
# Set permissions of root SSH config directory
|
||||
chroot_exec chmod 700 "/root/.ssh"
|
||||
chroot_exec chown root:root "/root/.ssh"
|
||||
|
||||
# Add SSH (v2) public key(s) to authorized_keys file
|
||||
cat "$SSH_ROOT_PUB_KEY" >> "${R}/root/.ssh/authorized_keys"
|
||||
|
||||
# Set permissions of root SSH authorized_keys file
|
||||
chroot_exec chmod 600 "/root/.ssh/authorized_keys"
|
||||
chroot_exec chown root:root "/root/.ssh/authorized_keys"
|
||||
|
||||
if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
|
||||
# Allow SSH public key authentication
|
||||
sed -i "s|[#]*PubkeyAuthentication.*|PubkeyAuthentication yes|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_USER" = true ] ; then
|
||||
# Add SSH (v2) public key for user $USER_NAME
|
||||
if [ -n "$SSH_USER_PUB_KEY" ] ; then
|
||||
# Create $USER_NAME SSH config directory
|
||||
mkdir -p "${R}/home/${USER_NAME}/.ssh"
|
||||
|
||||
# Set permissions of $USER_NAME SSH config directory
|
||||
chroot_exec chmod 700 "/home/${USER_NAME}/.ssh"
|
||||
chroot_exec chown "${USER_NAME}":"${USER_NAME}" "/home/${USER_NAME}/.ssh"
|
||||
|
||||
# Add SSH (v2) public key(s) to authorized_keys file
|
||||
cat "$SSH_USER_PUB_KEY" >> "${R}/home/${USER_NAME}/.ssh/authorized_keys"
|
||||
|
||||
# Set permissions of $USER_NAME SSH config directory
|
||||
chroot_exec chmod 600 "/home/${USER_NAME}/.ssh/authorized_keys"
|
||||
chroot_exec chown "${USER_NAME}":"${USER_NAME}" "/home/${USER_NAME}/.ssh/authorized_keys"
|
||||
|
||||
if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
|
||||
# Allow SSH public key authentication
|
||||
sed -i "s|[#]*PubkeyAuthentication.*|PubkeyAuthentication yes|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Limit the users that are allowed to login via SSH
|
||||
if [ "$SSH_LIMIT_USERS" = true ] && [ "$ENABLE_REDUCE" = false ] ; then
|
||||
allowed_users=""
|
||||
if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
|
||||
allowed_users="root"
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_USER" = true ] ; then
|
||||
allowed_users="${allowed_users} ${USER_NAME}"
|
||||
fi
|
||||
|
||||
if [ -n "$allowed_users" ] ; then
|
||||
echo "AllowUsers ${allowed_users}" >> "${ETC_DIR}/ssh/sshd_config"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Disable password-based authentication
|
||||
if [ "$SSH_DISABLE_PASSWORD_AUTH" = true ] ; then
|
||||
if [ "$ENABLE_ROOT" = true ] && [ "$SSH_ENABLE_ROOT" = true ] ; then
|
||||
if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
|
||||
sed -i "s|[#]*PermitRootLogin.*|PermitRootLogin without-password|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
else
|
||||
DROPBEAR_ARGS="-g"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_REDUCE" = false ] || [ "$REDUCE_SSHD" = false ] ; then
|
||||
sed -i "s|[#]*PasswordAuthentication.*|PasswordAuthentication no|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
sed -i "s|[#]*ChallengeResponseAuthentication no.*|ChallengeResponseAuthentication no|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
sed -i "s|[#]*UsePAM.*|UsePAM no|g" "${ETC_DIR}/ssh/sshd_config"
|
||||
else
|
||||
DROPBEAR_ARGS="${DROPBEAR_ARGS} -s"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Update dropbear SSH configuration
|
||||
if [ "$ENABLE_REDUCE" = true ] && [ "$REDUCE_SSHD" = true ] ; then
|
||||
sed "s|^DROPBEAR_EXTRA_ARGS=.*|DROPBEAR_EXTRA_ARGS=\"${DROPBEAR_ARGS}\"|g" "${ETC_DIR}/default/dropbear"
|
||||
fi
|
||||
fi
|
||||
105
bootstrap.d/41-uboot.sh
Normal file
105
bootstrap.d/41-uboot.sh
Normal file
@@ -0,0 +1,105 @@
|
||||
#
|
||||
# Build and Setup U-Boot
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Fetch and build U-Boot bootloader
|
||||
if [ "$ENABLE_UBOOT" = true ] ; then
|
||||
# Install c/c++ build environment inside the chroot
|
||||
chroot_install_cc
|
||||
|
||||
# Copy existing U-Boot sources into chroot directory
|
||||
if [ -n "$UBOOTSRC_DIR" ] && [ -d "$UBOOTSRC_DIR" ] ; then
|
||||
# Copy local U-Boot sources
|
||||
cp -r "${UBOOTSRC_DIR}" "${R}/tmp"
|
||||
else
|
||||
# Create temporary directory for U-Boot sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch U-Boot sources
|
||||
as_nobody git -C "${temp_dir}" clone "${UBOOT_URL}"
|
||||
|
||||
# Copy downloaded U-Boot sources
|
||||
mv "${temp_dir}/u-boot" "${R}/tmp/"
|
||||
|
||||
# Set permissions of the U-Boot sources
|
||||
chown -R root:root "${R}/tmp/u-boot"
|
||||
|
||||
# Remove temporary directory for U-Boot sources
|
||||
rm -fr "${temp_dir}"
|
||||
fi
|
||||
|
||||
# Build and install U-Boot inside chroot
|
||||
chroot_exec make -j"${KERNEL_THREADS}" -C /tmp/u-boot/ "${UBOOT_CONFIG}" all
|
||||
|
||||
# Copy compiled bootloader binary and set config.txt to load it
|
||||
install_exec "${R}/tmp/u-boot/tools/mkimage" "${R}/usr/sbin/mkimage"
|
||||
install_readonly "${R}/tmp/u-boot/u-boot.bin" "${BOOT_DIR}/u-boot.bin"
|
||||
printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "${BOOT_DIR}/config.txt"
|
||||
|
||||
# Install and setup U-Boot command file
|
||||
install_readonly files/boot/uboot.mkimage "${BOOT_DIR}/uboot.mkimage"
|
||||
printf "# Set the kernel boot command line\nsetenv bootargs \"earlyprintk ${CMDLINE}\"\n\n$(cat "${BOOT_DIR}"/uboot.mkimage)" > "${BOOT_DIR}/uboot.mkimage"
|
||||
|
||||
if [ "$ENABLE_INITRAMFS" = true ] ; then
|
||||
# Convert generated initramfs for U-Boot using mkimage
|
||||
chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "/boot/firmware/initramfs-${KERNEL_VERSION}" "/boot/firmware/initramfs-${KERNEL_VERSION}.uboot"
|
||||
|
||||
# Remove original initramfs file
|
||||
rm -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}"
|
||||
|
||||
# Configure U-Boot to load generated initramfs
|
||||
printf "# Set initramfs file\nsetenv initramfs initramfs-${KERNEL_VERSION}.uboot\n\n$(cat "${BOOT_DIR}"/uboot.mkimage)" > "${BOOT_DIR}/uboot.mkimage"
|
||||
printf "\nbootz \${kernel_addr_r} \${ramdisk_addr_r} \${fdt_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
|
||||
else # ENABLE_INITRAMFS=false
|
||||
# Remove initramfs from U-Boot mkfile
|
||||
sed -i '/.*initramfs.*/d' "${BOOT_DIR}/uboot.mkimage"
|
||||
|
||||
if [ "$BUILD_KERNEL" = false ] ; then
|
||||
# Remove dtbfile from U-Boot mkfile
|
||||
sed -i '/.*dtbfile.*/d' "${BOOT_DIR}/uboot.mkimage"
|
||||
printf "\nbootz \${kernel_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
|
||||
else
|
||||
printf "\nbootz \${kernel_addr_r} - \${fdt_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$SET_ARCH" = 64 ] ; then
|
||||
echo "Setting up config.txt to boot 64bit uboot"
|
||||
{
|
||||
printf "\n# 64bit-mode"
|
||||
printf "\n# arm_control=0x200 is deprecated https://www.raspberrypi.org/documentation/configuration/config-txt/misc.md"
|
||||
printf "\narm_64bit=1"
|
||||
} >> "${BOOT_DIR}/config.txt"
|
||||
|
||||
#in 64bit uboot booti is used instead of bootz [like in KERNEL_BIN_IMAGE=zImage (armv7)|| Image(armv8)]
|
||||
sed -i "s|bootz|booti|g" "${BOOT_DIR}/uboot.mkimage"
|
||||
fi
|
||||
|
||||
# instead of sd, boot from usb device
|
||||
if [ "$ENABLE_USBBOOT" = true ] ; then
|
||||
sed -i "s|mmc|usb|g" "${BOOT_DIR}/uboot.mkimage"
|
||||
fi
|
||||
|
||||
# Set mkfile to use the correct dtb file
|
||||
sed -i "s|bcm2709-rpi-2-b.dtb|${DTB_FILE}|" "${BOOT_DIR}/uboot.mkimage"
|
||||
|
||||
# Set mkfile to use the correct mach id
|
||||
if [ "$ENABLE_QEMU" = true ] ; then
|
||||
sed -i "s/^\(setenv machid \).*/\10x000008e0/" "${BOOT_DIR}/uboot.mkimage"
|
||||
fi
|
||||
|
||||
# Set mkfile to use kernel image
|
||||
sed -i "s|kernel7.img|${KERNEL_IMAGE}|" "${BOOT_DIR}/uboot.mkimage"
|
||||
|
||||
# Remove all leading blank lines
|
||||
sed -i "/./,\$!d" "${BOOT_DIR}/uboot.mkimage"
|
||||
|
||||
# Generate U-Boot bootloader image
|
||||
chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi${RPI_MODEL}" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
|
||||
|
||||
# Remove U-Boot sources
|
||||
rm -fr "${R}/tmp/u-boot"
|
||||
fi
|
||||
47
bootstrap.d/42-fbturbo.sh
Normal file
47
bootstrap.d/42-fbturbo.sh
Normal file
@@ -0,0 +1,47 @@
|
||||
#
|
||||
# Build and Setup fbturbo Xorg driver
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ "$ENABLE_FBTURBO" = true ] && [ "$ENABLE_GR_ACCEL" = false ] ; then
|
||||
# Install c/c++ build environment inside the chroot
|
||||
chroot_install_cc
|
||||
|
||||
# Copy existing fbturbo sources into chroot directory
|
||||
if [ -n "$FBTURBOSRC_DIR" ] && [ -d "$FBTURBOSRC_DIR" ] ; then
|
||||
# Copy local fbturbo sources
|
||||
cp -r "${FBTURBOSRC_DIR}" "${R}/tmp"
|
||||
else
|
||||
# Create temporary directory for fbturbo sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch fbturbo sources
|
||||
as_nobody git -C "${temp_dir}" clone "${FBTURBO_URL}"
|
||||
|
||||
# Move downloaded fbturbo sources
|
||||
mv "${temp_dir}/xf86-video-fbturbo" "${R}/tmp/"
|
||||
|
||||
# Remove temporary directory for fbturbo sources
|
||||
rm -fr "${temp_dir}"
|
||||
fi
|
||||
|
||||
# Install Xorg build dependencies
|
||||
chroot_exec apt-get -q -y --no-install-recommends --allow-unauthenticated install xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
|
||||
|
||||
# Build and install fbturbo driver inside chroot
|
||||
chroot_exec /bin/bash -x <<'EOF'
|
||||
cd /tmp/xf86-video-fbturbo
|
||||
autoreconf -vi
|
||||
./configure --prefix=/usr
|
||||
make
|
||||
make install
|
||||
EOF
|
||||
|
||||
# Install fbturbo driver Xorg configuration
|
||||
install_readonly files/xorg/99-fbturbo.conf "${R}/usr/share/X11/xorg.conf.d/99-fbturbo.conf"
|
||||
|
||||
# Remove Xorg build dependencies
|
||||
chroot_exec apt-get -qq -y --auto-remove purge xorg-dev xutils-dev x11proto-dri2-dev libltdl-dev libtool automake libdrm-dev
|
||||
fi
|
||||
56
bootstrap.d/43-videocore.sh
Normal file
56
bootstrap.d/43-videocore.sh
Normal file
@@ -0,0 +1,56 @@
|
||||
#
|
||||
# Setup videocore - Raspberry Userland
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ "$ENABLE_VIDEOCORE" = true ] ; then
|
||||
# Copy existing videocore sources into chroot directory
|
||||
if [ -n "$VIDEOCORESRC_DIR" ] && [ -d "$VIDEOCORESRC_DIR" ] ; then
|
||||
# Copy local videocore sources
|
||||
cp -r "${VIDEOCORESRC_DIR}" "${R}/tmp/userland"
|
||||
else
|
||||
# Create temporary directory for videocore sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch videocore sources
|
||||
as_nobody git -C "${temp_dir}" clone "${VIDEOCORE_URL}"
|
||||
|
||||
# Copy downloaded videocore sources
|
||||
mv "${temp_dir}/userland" "${R}/tmp/"
|
||||
|
||||
# Set permissions of the U-Boot sources
|
||||
chown -R root:root "${R}/tmp/userland"
|
||||
|
||||
# Remove temporary directory for U-Boot sources
|
||||
rm -fr "${temp_dir}"
|
||||
fi
|
||||
|
||||
# Create build dir
|
||||
mkdir "${R}"/tmp/userland/build
|
||||
|
||||
# push us to build directory
|
||||
cd "${R}"/tmp/userland/build
|
||||
|
||||
if [ "$RELEASE_ARCH" = "arm64" ] ; then
|
||||
cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_TOOLCHAIN_FILE="${R}"/tmp/userland/makefiles/cmake/toolchains/aarch64-linux-gnu.cmake -DARM64=ON -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ -DCMAKE_ASM_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_C_FLAGS="${CMAKE_C_FLAGS} -U_FORTIFY_SOURCE" -DCMAKE_ASM_FLAGS="${CMAKE_ASM_FLAGS} -c" -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
|
||||
fi
|
||||
|
||||
if [ "$RELEASE_ARCH" = "armel" ] ; then
|
||||
cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_TOOLCHAIN_FILE="${R}"/tmp/userland/makefiles/cmake/toolchains/arm-linux-gnueabihf.cmake -DCMAKE_C_COMPILER=arm-linux-gnueabi-gcc -DCMAKE_CXX_COMPILER=arm-linux-gnueabi-g++ -DCMAKE_ASM_COMPILER=arm-linux-gnueabi-gcc -DCMAKE_C_FLAGS="${CMAKE_C_FLAGS} -U_FORTIFY_SOURCE" -DCMAKE_ASM_FLAGS="${CMAKE_ASM_FLAGS} -c" -DCMAKE_SYSTEM_PROCESSOR="arm" -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
|
||||
fi
|
||||
|
||||
if [ "$RELEASE_ARCH" = "armhf" ] ; then
|
||||
cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_TOOLCHAIN_FILE="${R}"/tmp/userland/makefiles/cmake/toolchains/arm-linux-gnueabihf.cmake -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
|
||||
fi
|
||||
|
||||
#build userland
|
||||
make -j "$(nproc)"
|
||||
|
||||
#back to root of scriptdir
|
||||
cd "${WORKDIR}"
|
||||
|
||||
# Remove videocore sources
|
||||
rm -fr "${R}"/tmp/userland/
|
||||
fi
|
||||
97
bootstrap.d/44-nexmon_monitor_patch.sh
Normal file
97
bootstrap.d/44-nexmon_monitor_patch.sh
Normal file
@@ -0,0 +1,97 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Build and Setup nexmon with monitor mode patch
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ "$ENABLE_NEXMON" = true ] && [ "$ENABLE_WIRELESS" = true ]; then
|
||||
# Copy existing nexmon sources into chroot directory
|
||||
if [ -n "$NEXMONSRC_DIR" ] && [ -d "$NEXMONSRC_DIR" ] ; then
|
||||
# Copy local U-Boot sources
|
||||
cp -r "${NEXMONSRC_DIR}" "${R}/tmp"
|
||||
else
|
||||
# Create temporary directory for nexmon sources
|
||||
temp_dir=$(as_nobody mktemp -d)
|
||||
|
||||
# Fetch nexmon sources
|
||||
as_nobody git -C "${temp_dir}" clone "${NEXMON_URL}"
|
||||
|
||||
# Copy downloaded nexmon sources
|
||||
mv "${temp_dir}/nexmon" "${R}"/tmp/
|
||||
|
||||
# Set permissions of the nexmon sources
|
||||
chown -R root:root "${R}"/tmp/nexmon
|
||||
|
||||
# Remove temporary directory for nexmon sources
|
||||
rm -fr "${temp_dir}"
|
||||
fi
|
||||
|
||||
# Set script Root
|
||||
export NEXMON_ROOT="${R}"/tmp/nexmon
|
||||
|
||||
# Build nexmon firmware outside the build system, if we can.
|
||||
cd "${NEXMON_ROOT}" || exit
|
||||
|
||||
# Make ancient isl build
|
||||
cd buildtools/isl-0.10 || exit
|
||||
./configure
|
||||
make
|
||||
cd ../.. || exit
|
||||
|
||||
# Disable statistics
|
||||
touch DISABLE_STATISTICS
|
||||
|
||||
# Setup Enviroment: see https://github.com/NoobieDog/nexmon/blob/master/setup_env.sh
|
||||
export KERNEL="${KERNEL_IMAGE}"
|
||||
export ARCH=arm
|
||||
export SUBARCH=arm
|
||||
export CC="${NEXMON_ROOT}"/buildtools/gcc-arm-none-eabi-5_4-2016q2-linux-x86/bin/arm-none-eabi-
|
||||
export CC="${CC}"gcc
|
||||
export CCPLUGIN="${NEXMON_ROOT}"/buildtools/gcc-nexmon-plugin/nexmon.so
|
||||
export ZLIBFLATE="zlib-flate -compress"
|
||||
export Q=@
|
||||
export NEXMON_SETUP_ENV=1
|
||||
export HOSTUNAME=$(uname -s)
|
||||
export PLATFORMUNAME=$(uname -m)
|
||||
|
||||
# Make nexmon
|
||||
make
|
||||
|
||||
# build patches
|
||||
if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] ; then
|
||||
cd "${NEXMON_ROOT}"/patches/bcm43430a1/7_45_41_46/nexmon || exit
|
||||
sed -i -e 's/all:.*/all: $(RAM_FILE)/g' ${NEXMON_ROOT}/patches/bcm43430a1/7_45_41_46/nexmon/Makefile
|
||||
make clean
|
||||
|
||||
# We do this so we don't have to install the ancient isl version into /usr/local/lib on systems.
|
||||
LD_LIBRARY_PATH="${NEXMON_ROOT}"/buildtools/isl-0.10/.libs make ARCH="${KERNEL_ARCH}" CC="${NEXMON_ROOT}"/buildtools/gcc-arm-none-eabi-5_4-2016q2-linux-x86/bin/arm-none-eabi-
|
||||
|
||||
# copy RPi0W & RPi3 firmware
|
||||
mv "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.org.bin
|
||||
cp "${NEXMON_ROOT}"/patches/bcm43430a1/7_45_41_46/nexmon/brcmfmac43430-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.nexmon.bin
|
||||
cp -f "${NEXMON_ROOT}"/patches/bcm43430a1/7_45_41_46/nexmon/brcmfmac43430-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.bin
|
||||
fi
|
||||
|
||||
if [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
|
||||
cd "${NEXMON_ROOT}"/patches/bcm43455c0/7_45_154/nexmon || exit
|
||||
sed -i -e 's/all:.*/all: $(RAM_FILE)/g' ${NEXMON_ROOT}/patches/bcm43455c0/7_45_154/nexmon/Makefile
|
||||
make clean
|
||||
|
||||
# We do this so we don't have to install the ancient isl version into /usr/local/lib on systems.
|
||||
LD_LIBRARY_PATH=${NEXMON_ROOT}/buildtools/isl-0.10/.libs make ARCH="${KERNEL_ARCH}" CC="${NEXMON_ROOT}"/buildtools/gcc-arm-none-eabi-5_4-2016q2-linux-x86/bin/arm-none-eabi-
|
||||
|
||||
# RPi3B+ firmware
|
||||
mv "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.org.bin
|
||||
cp "${NEXMON_ROOT}"/patches/bcm43455c0/7_45_154/nexmon/brcmfmac43455-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.nexmon.bin
|
||||
cp -f "${NEXMON_ROOT}"/patches/bcm43455c0/7_45_154/nexmon/brcmfmac43455-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.bin
|
||||
fi
|
||||
|
||||
#Revert to previous directory
|
||||
cd "${WORKDIR}" || exit
|
||||
|
||||
# Remove nexmon sources
|
||||
rm -fr "${NEXMON_ROOT}"
|
||||
|
||||
fi
|
||||
63
bootstrap.d/50-firstboot.sh
Normal file
63
bootstrap.d/50-firstboot.sh
Normal file
@@ -0,0 +1,63 @@
|
||||
#
|
||||
# First boot actions
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
# Prepare rc.firstboot script
|
||||
cat files/firstboot/10-begin.sh > "${ETC_DIR}/rc.firstboot"
|
||||
|
||||
# Prepare filesystem auto expand
|
||||
if [ "$EXPANDROOT" = true ] ; then
|
||||
if [ "$ENABLE_CRYPTFS" = false ] ; then
|
||||
cat files/firstboot/20-expandroot.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
else
|
||||
# Regenerate initramfs to remove encrypted root partition auto expand
|
||||
cat files/firstboot/21-regenerate-initramfs.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
fi
|
||||
|
||||
# Restart dphys-swapfile so the size of the swap file is relative to the resized root partition
|
||||
if [ "$ENABLE_DPHYSSWAP" = true ] ; then
|
||||
cat files/firstboot/23-restart-dphys-swapfile.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Ensure openssh server host keys are regenerated on first boot
|
||||
if [ "$SSH_ENABLE" = true ] ; then
|
||||
cat files/firstboot/30-generate-ssh-keys.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
fi
|
||||
|
||||
if [ "$ENABLE_DBUS" = true ] ; then
|
||||
# Ensure that dbus machine-id exists
|
||||
cat files/firstboot/40-generate-machineid.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
fi
|
||||
|
||||
# Create /etc/resolv.conf symlink
|
||||
cat files/firstboot/41-create-resolv-symlink.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
|
||||
# Configure automatic network interface names
|
||||
if [ "$ENABLE_IFNAMES" = true ] ; then
|
||||
cat files/firstboot/42-config-ifnames.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
fi
|
||||
|
||||
# Execute custom firstboot scripts
|
||||
if [ -d "custom.d/firstboot" ] ; then
|
||||
for SCRIPT in custom.d/firstboot/*.sh; do
|
||||
. "$SCRIPT"
|
||||
done
|
||||
fi
|
||||
|
||||
# Finalize rc.firstboot script
|
||||
cat files/firstboot/99-finish.sh >> "${ETC_DIR}/rc.firstboot"
|
||||
chmod +x "${ETC_DIR}/rc.firstboot"
|
||||
|
||||
# Install default rc.local if it does not exist
|
||||
if [ ! -f "${ETC_DIR}/rc.local" ] ; then
|
||||
install_exec files/etc/rc.local "${ETC_DIR}/rc.local"
|
||||
fi
|
||||
|
||||
# Add rc.firstboot script to rc.local
|
||||
sed -i '/exit 0/d' "${ETC_DIR}/rc.local"
|
||||
echo /etc/rc.firstboot >> "${ETC_DIR}/rc.local"
|
||||
echo exit 0 >> "${ETC_DIR}/rc.local"
|
||||
105
bootstrap.d/99-reduce.sh
Normal file
105
bootstrap.d/99-reduce.sh
Normal file
@@ -0,0 +1,105 @@
|
||||
#
|
||||
# Reduce system disk usage
|
||||
#
|
||||
|
||||
# Load utility functions
|
||||
. ./functions.sh
|
||||
|
||||
if [ "$ENABLE_IPV6" = false ] ; then
|
||||
"$LIB_DIR"/xtables/libip6t_ah.so
|
||||
"$LIB_DIR"/xtables/libip6t_dst.so
|
||||
"$LIB_DIR"/xtables/libip6t_eui64.so
|
||||
"$LIB_DIR"/xtables/libip6t_frag.so
|
||||
"$LIB_DIR"/xtables/libip6t_hbh.so
|
||||
"$LIB_DIR"/xtables/libip6t_hl.so
|
||||
"$LIB_DIR"/xtables/libip6t_HL.so
|
||||
"$LIB_DIR"/xtables/libip6t_icmp6.so
|
||||
"$LIB_DIR"/xtables/libip6t_ipv6header.so
|
||||
"$LIB_DIR"/xtables/libip6t_LOG.so
|
||||
"$LIB_DIR"/xtables/libip6t_mh.so
|
||||
"$LIB_DIR"/xtables/libip6t_REJECT.so
|
||||
"$LIB_DIR"/xtables/libip6t_rt.so
|
||||
"$LIB_DIR"/xtables/libip6t_DNAT.so
|
||||
"$LIB_DIR"/xtables/libip6t_DNPT.so
|
||||
"$LIB_DIR"/xtables/libip6t_MASQUERADE.so
|
||||
"$LIB_DIR"/xtables/libip6t_NETMAP.so
|
||||
"$LIB_DIR"/xtables/libip6t_REDIRECT.so
|
||||
"$LIB_DIR"/xtables/libip6t_SNAT.so
|
||||
"$LIB_DIR"/xtables/libip6t_SNPT.so
|
||||
fi
|
||||
# Reduce the image size by various operations
|
||||
if [ "$ENABLE_REDUCE" = true ] ; then
|
||||
if [ "$REDUCE_APT" = true ] ; then
|
||||
# Install dpkg configuration file
|
||||
if [ "$REDUCE_DOC" = true ] || [ "$REDUCE_MAN" = true ] ; then
|
||||
install_readonly files/dpkg/01nodoc "${ETC_DIR}/dpkg/dpkg.cfg.d/01nodoc"
|
||||
fi
|
||||
|
||||
# Install APT configuration files
|
||||
install_readonly files/apt/02nocache "${ETC_DIR}/apt/apt.conf.d/02nocache"
|
||||
install_readonly files/apt/03compress "${ETC_DIR}/apt/apt.conf.d/03compress"
|
||||
install_readonly files/apt/04norecommends "${ETC_DIR}/apt/apt.conf.d/04norecommends"
|
||||
|
||||
# Remove APT cache files
|
||||
rm -fr "${R}/var/cache/apt/pkgcache.bin"
|
||||
rm -fr "${R}/var/cache/apt/srcpkgcache.bin"
|
||||
fi
|
||||
|
||||
# Remove all doc files
|
||||
if [ "$REDUCE_DOC" = true ] ; then
|
||||
find "${R}/usr/share/doc" -depth -type f ! -name copyright -print0 | xargs -0 rm || true
|
||||
find "${R}/usr/share/doc" -empty -print0 | xargs -0 rmdir || true
|
||||
fi
|
||||
|
||||
# Remove all man pages and info files
|
||||
if [ "$REDUCE_MAN" = true ] ; then
|
||||
rm -rf "${R}/usr/share/man" "${R}/usr/share/groff" "${R}/usr/share/info" "${R}/usr/share/lintian" "${R}/usr/share/linda" "${R}/var/cache/man"
|
||||
fi
|
||||
|
||||
# Remove all locale translation files
|
||||
if [ "$REDUCE_LOCALE" = true ] ; then
|
||||
find "${R}/usr/share/locale" -mindepth 1 -maxdepth 1 ! -name 'en' -print0 | xargs -0 rm -r
|
||||
fi
|
||||
|
||||
# Remove hwdb PCI device classes (experimental)
|
||||
if [ "$REDUCE_HWDB" = true ] ; then
|
||||
rm -fr "/lib/udev/hwdb.d/20-pci-*"
|
||||
fi
|
||||
|
||||
# Replace bash shell by dash shell (experimental)
|
||||
if [ "$REDUCE_BASH" = true ] ; then
|
||||
# Purge bash and update alternatives
|
||||
echo "Yes, do as I say!" | chroot_exec apt-get purge -qq -y --allow-remove-essential bash
|
||||
chroot_exec update-alternatives --install /bin/bash bash /bin/dash 100
|
||||
fi
|
||||
|
||||
# Remove sound utils and libraries
|
||||
if [ "$ENABLE_SOUND" = false ] ; then
|
||||
if [ "$ENABLE_BLUETOOTH" = false ] ; then
|
||||
chroot_exec apt-get -qq -y purge alsa-utils libsamplerate0 libasound2 libasound2-data
|
||||
else
|
||||
chroot_exec apt-get -qq -y purge alsa-utils libsamplerate0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Remove GPU kernels
|
||||
if [ "$ENABLE_MINGPU" = true ] ; then
|
||||
rm -f "${BOOT_DIR}/start.elf"
|
||||
rm -f "${BOOT_DIR}/fixup.dat"
|
||||
rm -f "${BOOT_DIR}/start_x.elf"
|
||||
rm -f "${BOOT_DIR}/fixup_x.dat"
|
||||
fi
|
||||
|
||||
# Remove kernel and initrd from /boot (already in /boot/firmware)
|
||||
if [ "$BUILD_KERNEL" = false ] ; then
|
||||
rm -f "${R}/boot/vmlinuz-*"
|
||||
rm -f "${R}/boot/initrd.img-*"
|
||||
fi
|
||||
|
||||
#Reduce BOOT
|
||||
#Only necessary files for my gen pi
|
||||
|
||||
# Clean APT list of repositories
|
||||
rm -fr "${R}/var/lib/apt/lists/*"
|
||||
chroot_exec apt-get -qq -y update
|
||||
fi
|
||||
Reference in New Issue
Block a user