initial commit
This commit is contained in:
Harald Hoyer
commit
a80e32c538
37
README.md
Normal file
37
README.md
Normal file
|
|
@ -0,0 +1,37 @@
|
||||||
|
# FedoraBook
|
||||||
|
|
||||||
|
WIP
|
||||||
|
|
||||||
|
## Create
|
||||||
|
|
||||||
|
```bash
|
||||||
|
$ sudo ./prepare-root.sh \
|
||||||
|
--pkglist pkglist.txt \
|
||||||
|
--excludelist excludelist.txt \
|
||||||
|
--logo logo.bmp --name FEDORABOOK \
|
||||||
|
--outdir <IMGDIR>
|
||||||
|
```
|
||||||
|
|
||||||
|
## QEMU disk image
|
||||||
|
```bash
|
||||||
|
$ sudo ./mkimage.sh <IMGDIR> image.raw
|
||||||
|
```
|
||||||
|
|
||||||
|
## USB stick
|
||||||
|
```bash
|
||||||
|
$ sudo ./mkimage.sh <IMGDIR> /dev/disk/by-path/pci-…-usb…
|
||||||
|
```
|
||||||
|
|
||||||
|
## Install from USB stick
|
||||||
|
|
||||||
|
- Enter BIOS
|
||||||
|
- turn on UEFI boot
|
||||||
|
- turn on TPM2
|
||||||
|
- Enter BIOS boot menu
|
||||||
|
- Select USB stick
|
||||||
|
- Login (user: admin, pw: admin)
|
||||||
|
- Start gnome-terminal
|
||||||
|
- sudo
|
||||||
|
- ```clonedisk <usb stick device> <harddisk device>```
|
||||||
|
- reboot
|
||||||
|
- remove stick
|
||||||
78
clonedisk.sh
Executable file
78
clonedisk.sh
Executable file
|
|
@ -0,0 +1,78 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
set -ex
|
||||||
|
|
||||||
|
[[ $TMPDIR ]] || TMPDIR=/var/tmp
|
||||||
|
readonly TMPDIR="$(realpath -e "$TMPDIR")"
|
||||||
|
[ -d "$TMPDIR" ] || {
|
||||||
|
printf "%s\n" "${PROGNAME}: Invalid tmpdir '$tmpdir'." >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
readonly MY_TMPDIR="$(mktemp -p "$TMPDIR/" -d -t ${PROGNAME}.XXXXXX)"
|
||||||
|
[ -d "$MY_TMPDIR" ] || {
|
||||||
|
printf "%s\n" "${PROGNAME}: mktemp -p '$TMPDIR/' -d -t ${PROGNAME}.XXXXXX failed." >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# clean up after ourselves no matter how we die.
|
||||||
|
trap '
|
||||||
|
ret=$?;
|
||||||
|
[[ $MY_TMPDIR ]] && mountpoint "$MY_TMPDIR"/data && umount "$MY_TMPDIR"/data
|
||||||
|
[[ $MY_TMPDIR ]] && rm -rf --one-file-system -- "$MY_TMPDIR"
|
||||||
|
exit $ret;
|
||||||
|
' EXIT
|
||||||
|
|
||||||
|
# clean up after ourselves no matter how we die.
|
||||||
|
trap 'exit 1;' SIGINT
|
||||||
|
|
||||||
|
mem=$(cat /proc/meminfo | { read a b a; echo $b; } )
|
||||||
|
mem=$(((mem-1)/1024/1024 + 1))
|
||||||
|
mem=${3:-$mem}
|
||||||
|
|
||||||
|
IN=$(readlink -e "$1")
|
||||||
|
OUT=$(readlink -e "$2")
|
||||||
|
|
||||||
|
[[ -b ${IN} ]]
|
||||||
|
[[ -b ${OUT} ]]
|
||||||
|
|
||||||
|
for i in ${OUT}*; do
|
||||||
|
umount "$i" || :
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ ${IN#/dev/loop} != $IN ]]; then
|
||||||
|
IN="${IN}p"
|
||||||
|
fi
|
||||||
|
|
||||||
|
wipefs --all "$OUT"
|
||||||
|
|
||||||
|
sfdisk -W always -w always "$OUT" << EOF
|
||||||
|
label: gpt
|
||||||
|
size=512MiB, type=c12a7328-f81f-11d2-ba4b-00a0c93ec93b, name="ESP System Partition"
|
||||||
|
size=256M, type=2c7357ed-ebd2-46d9-aec1-23d437ec2bf5, name="ver1", uuid=$(blkid -o value -s PARTUUID ${IN}2)
|
||||||
|
size=4GiB, type=4F68BCE3-E8CD-4DB1-96E7-FBCAF984B709, name="root1", uuid=$(blkid -o value -s PARTUUID ${IN}3)
|
||||||
|
size=256M, type=2c7357ed-ebd2-46d9-aec1-23d437ec2bf5, name="ver2"
|
||||||
|
size=4GiB, type=4F68BCE3-E8CD-4DB1-96E7-FBCAF984B709, name="root2"
|
||||||
|
size=${mem}GiB, type=0657fd6d-a4ab-43c4-84e5-0933c84b4f4f, name="swap"
|
||||||
|
type=3b8f8425-20e0-4f3b-907f-1a25a76f98e9, name="data"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
if [[ ${OUT#/dev/loop} != $OUT ]]; then
|
||||||
|
OUT="${OUT}p"
|
||||||
|
fi
|
||||||
|
if [[ ${OUT#/dev/nvme} != $OUT ]]; then
|
||||||
|
OUT="${OUT}p"
|
||||||
|
fi
|
||||||
|
|
||||||
|
for i in 1 2 3; do
|
||||||
|
dd if=${IN}${i} of=${OUT}${i} status=progress
|
||||||
|
done
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# swap
|
||||||
|
mkswap -L swap ${OUT}6
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# data
|
||||||
|
echo -n "zero key" \
|
||||||
|
| cryptsetup luksFormat --type luks2 ${OUT}7 /dev/stdin
|
||||||
10
excludelist.txt
Normal file
10
excludelist.txt
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
trousers
|
||||||
|
systemd-bootchart
|
||||||
|
grubby
|
||||||
|
grub*
|
||||||
|
plymouth
|
||||||
|
device-mapper-multipath
|
||||||
|
libvirt-daemon
|
||||||
|
selinux-policy-targeted
|
||||||
|
libselinux-utils
|
||||||
|
|
||||||
171
mkimage.sh
Executable file
171
mkimage.sh
Executable file
|
|
@ -0,0 +1,171 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
#===================================
|
||||||
|
FEDORA_VERSION=${FEDORA_VERSION:-28}
|
||||||
|
#===================================
|
||||||
|
|
||||||
|
set -ex
|
||||||
|
|
||||||
|
CURDIR=$(pwd)
|
||||||
|
PROGNAME=${0##*/}
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat << EOF
|
||||||
|
Usage: $PROGNAME [OPTION]
|
||||||
|
|
||||||
|
-h, --help Display this help
|
||||||
|
--crypt Use Luks2 to encrypt the data partition (default PW: 1)
|
||||||
|
--crypttpm2 as --crypt, but additionally auto-open with the use of a TPM2
|
||||||
|
--simple do not use dual-boot layout (e.g. for USB install media)
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
TEMP=$(
|
||||||
|
getopt -o '' \
|
||||||
|
--long crypt \
|
||||||
|
--long crypttpm2 \
|
||||||
|
--long help \
|
||||||
|
-- "$@"
|
||||||
|
)
|
||||||
|
|
||||||
|
if (( $? != 0 )); then
|
||||||
|
usage >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
eval set -- "$TEMP"
|
||||||
|
unset TEMP
|
||||||
|
. /etc/os-release
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
case "$1" in
|
||||||
|
'--crypt')
|
||||||
|
USE_CRYPT="y"
|
||||||
|
shift 1; continue
|
||||||
|
;;
|
||||||
|
'--crypttpm2')
|
||||||
|
USE_TPM="y"
|
||||||
|
shift 1; continue
|
||||||
|
;;
|
||||||
|
'--help')
|
||||||
|
usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
'--')
|
||||||
|
shift
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo 'Internal error!' >&2
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
SOURCE=$(readlink -e "$1")
|
||||||
|
IMAGE=$(readlink -e "$2")
|
||||||
|
|
||||||
|
if ! [[ -d $SOURCE ]] || ! [[ $IMAGE ]]; then
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
[[ $TMPDIR ]] || TMPDIR=/var/tmp
|
||||||
|
readonly TMPDIR="$(realpath -e "$TMPDIR")"
|
||||||
|
[ -d "$TMPDIR" ] || {
|
||||||
|
printf "%s\n" "${PROGNAME}: Invalid tmpdir '$tmpdir'." >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
readonly MY_TMPDIR="$(mktemp -p "$TMPDIR/" -d -t ${PROGNAME}.XXXXXX)"
|
||||||
|
[ -d "$MY_TMPDIR" ] || {
|
||||||
|
printf "%s\n" "${PROGNAME}: mktemp -p '$TMPDIR/' -d -t ${PROGNAME}.XXXXXX failed." >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# clean up after ourselves no matter how we die.
|
||||||
|
trap '
|
||||||
|
ret=$?;
|
||||||
|
for i in "$MY_TMPDIR"/boot "$MY_TMPDIR"/data; do
|
||||||
|
[[ -d "$i" ]] && mountpoint -q "$i" && umount "$i"
|
||||||
|
done
|
||||||
|
[[ $DEV ]] && losetup -d $DEV 2>/dev/null || :
|
||||||
|
[[ $MY_TMPDIR ]] && rm -rf --one-file-system -- "$MY_TMPDIR"
|
||||||
|
exit $ret;
|
||||||
|
' EXIT
|
||||||
|
|
||||||
|
# clean up after ourselves no matter how we die.
|
||||||
|
trap 'exit 1;' SIGINT
|
||||||
|
|
||||||
|
ROOT_HASH=$(<"$SOURCE"/root-hash.txt)
|
||||||
|
|
||||||
|
ROOT_UUID=${ROOT_HASH:32:8}-${ROOT_HASH:40:4}-${ROOT_HASH:44:4}-${ROOT_HASH:48:4}-${ROOT_HASH:52:12}
|
||||||
|
HASH_UUID=${ROOT_HASH:0:8}-${ROOT_HASH:8:4}-${ROOT_HASH:12:4}-${ROOT_HASH:16:4}-${ROOT_HASH:20:12}
|
||||||
|
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# Testdisk
|
||||||
|
|
||||||
|
# create GPT table with EFI System Partition
|
||||||
|
if ! [[ -b "${IMAGE}" ]]; then
|
||||||
|
rm -f "${IMAGE}"
|
||||||
|
dd if=/dev/null of="${IMAGE}" bs=1MiB seek=$((15*1024)) count=1
|
||||||
|
readonly DEV=$(losetup --show -f -P "${IMAGE}")
|
||||||
|
readonly DEV_PART=${DEV}p
|
||||||
|
else
|
||||||
|
for i in ${IMAGE}*; do
|
||||||
|
umount "$i" || :
|
||||||
|
done
|
||||||
|
|
||||||
|
wipefs --force --all "${IMAGE}"
|
||||||
|
readonly DEV="${IMAGE}"
|
||||||
|
readonly DEV_PART="${IMAGE}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
udevadm settle
|
||||||
|
sfdisk "${DEV}" << EOF
|
||||||
|
label: gpt
|
||||||
|
size=512MiB, type=c12a7328-f81f-11d2-ba4b-00a0c93ec93b, name="ESP System Partition"
|
||||||
|
size=64MiB, type=2c7357ed-ebd2-46d9-aec1-23d437ec2bf5, name="ver1", uuid=$HASH_UUID
|
||||||
|
size=4GiB, type=4F68BCE3-E8CD-4DB1-96E7-FBCAF984B709, name="root1", uuid=$ROOT_UUID
|
||||||
|
type=3b8f8425-20e0-4f3b-907f-1a25a76f98e9, name="data"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
udevadm settle
|
||||||
|
for i in 1 2 3 4; do
|
||||||
|
wipefs --force --all ${DEV_PART}${i}
|
||||||
|
done
|
||||||
|
udevadm settle
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# ESP
|
||||||
|
mkfs.fat -nEFI -F32 ${DEV_PART}1
|
||||||
|
mkdir "$MY_TMPDIR"/boot
|
||||||
|
mount ${DEV_PART}1 "$MY_TMPDIR"/boot
|
||||||
|
|
||||||
|
mkdir -p "$MY_TMPDIR"/boot/EFI/Boot
|
||||||
|
cp "$SOURCE"/bootx64.efi "$MY_TMPDIR"/boot/EFI/Boot/bootx64.efi
|
||||||
|
umount "$MY_TMPDIR"/boot
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# ver1
|
||||||
|
dd if="$SOURCE"/root.verity.img of=${DEV_PART}2 status=progress
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# root1
|
||||||
|
dd if="$SOURCE"/root.squashfs.img of=${DEV_PART}3 status=progress
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# data
|
||||||
|
echo -n "zero key" \
|
||||||
|
| cryptsetup luksFormat --type luks2 ${DEV_PART}4 /dev/stdin
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# DONE
|
||||||
|
|
||||||
|
sync
|
||||||
|
losetup -d $DEV || :
|
||||||
|
eject "$DEV" || :
|
||||||
|
sync
|
||||||
|
|
||||||
19
pkglist-min.txt
Normal file
19
pkglist-min.txt
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
dracut
|
||||||
|
passwd
|
||||||
|
rootfiles
|
||||||
|
systemd
|
||||||
|
systemd-udev
|
||||||
|
kernel
|
||||||
|
kernel-core
|
||||||
|
bash
|
||||||
|
sudo
|
||||||
|
openssh-server
|
||||||
|
strace
|
||||||
|
xfsprogs
|
||||||
|
pciutils
|
||||||
|
microcode_ctl
|
||||||
|
nss_db
|
||||||
|
keyutils
|
||||||
|
make
|
||||||
|
less
|
||||||
|
|
||||||
76
pkglist-sssd.txt
Normal file
76
pkglist-sssd.txt
Normal file
|
|
@ -0,0 +1,76 @@
|
||||||
|
@GNOME
|
||||||
|
@Fonts
|
||||||
|
dracut
|
||||||
|
passwd
|
||||||
|
rootfiles
|
||||||
|
systemd
|
||||||
|
systemd-udev
|
||||||
|
kernel
|
||||||
|
kernel-core
|
||||||
|
bash
|
||||||
|
gnome-software
|
||||||
|
gdm
|
||||||
|
NetworkManager
|
||||||
|
NetworkManager-openvpn
|
||||||
|
NetworkManager-openvpn-gnome
|
||||||
|
NetworkManager-ssh
|
||||||
|
NetworkManager-ssh-gnome
|
||||||
|
NetworkManager-vpnc
|
||||||
|
NetworkManager-vpnc-gnome
|
||||||
|
NetworkManager-wifi
|
||||||
|
firefox
|
||||||
|
emacs
|
||||||
|
vim-enhanced
|
||||||
|
pigz
|
||||||
|
flatpak
|
||||||
|
virt-manager
|
||||||
|
gnome-desktop3
|
||||||
|
less
|
||||||
|
bash-completion
|
||||||
|
sudo
|
||||||
|
openssh-server
|
||||||
|
gnome-terminal
|
||||||
|
strace
|
||||||
|
libselinux-utils
|
||||||
|
selinux-policy-targeted
|
||||||
|
xfsprogs
|
||||||
|
pciutils
|
||||||
|
alsa-firmware
|
||||||
|
alsa-tools-firmware.x86_64
|
||||||
|
atmel-firmware
|
||||||
|
bfa-firmware
|
||||||
|
ipw2100-firmware
|
||||||
|
ipw2200-firmware
|
||||||
|
iscan-firmware
|
||||||
|
iwl1000-firmware
|
||||||
|
iwl100-firmware
|
||||||
|
iwl105-firmware
|
||||||
|
iwl135-firmware
|
||||||
|
iwl2000-firmware
|
||||||
|
iwl2030-firmware
|
||||||
|
iwl3160-firmware
|
||||||
|
iwl3945-firmware
|
||||||
|
iwl4965-firmware
|
||||||
|
iwl5000-firmware
|
||||||
|
iwl5150-firmware
|
||||||
|
iwl6000-firmware
|
||||||
|
iwl6000g2a-firmware
|
||||||
|
iwl6000g2b-firmware
|
||||||
|
iwl6050-firmware
|
||||||
|
iwl7260-firmware
|
||||||
|
libertas-sd8686-firmware
|
||||||
|
libertas-sd8787-firmware
|
||||||
|
libertas-usb8388-firmware
|
||||||
|
linux-firmware
|
||||||
|
midisport-firmware
|
||||||
|
microcode_ctl
|
||||||
|
nss_db
|
||||||
|
psmisc
|
||||||
|
authselect
|
||||||
|
keyutils
|
||||||
|
oddjob
|
||||||
|
oddjob-mkhomedir
|
||||||
|
sssd-client
|
||||||
|
sssd-ldap
|
||||||
|
sssd-krb5
|
||||||
|
sssd-tools
|
||||||
65
pkglist.txt
Normal file
65
pkglist.txt
Normal file
|
|
@ -0,0 +1,65 @@
|
||||||
|
@GNOME
|
||||||
|
gnome-initial-setup
|
||||||
|
@Fonts
|
||||||
|
NetworkManager
|
||||||
|
NetworkManager-openvpn
|
||||||
|
NetworkManager-openvpn-gnome
|
||||||
|
NetworkManager-ssh
|
||||||
|
NetworkManager-ssh-gnome
|
||||||
|
NetworkManager-vpnc
|
||||||
|
NetworkManager-vpnc-gnome
|
||||||
|
NetworkManager-wifi
|
||||||
|
firefox
|
||||||
|
emacs
|
||||||
|
vim-enhanced
|
||||||
|
pigz
|
||||||
|
flatpak
|
||||||
|
virt-manager
|
||||||
|
alsa-firmware
|
||||||
|
alsa-tools-firmware.x86_64
|
||||||
|
atmel-firmware
|
||||||
|
bfa-firmware
|
||||||
|
ipw2100-firmware
|
||||||
|
ipw2200-firmware
|
||||||
|
iscan-firmware
|
||||||
|
iwl1000-firmware
|
||||||
|
iwl100-firmware
|
||||||
|
iwl105-firmware
|
||||||
|
iwl135-firmware
|
||||||
|
iwl2000-firmware
|
||||||
|
iwl2030-firmware
|
||||||
|
iwl3160-firmware
|
||||||
|
iwl3945-firmware
|
||||||
|
iwl4965-firmware
|
||||||
|
iwl5000-firmware
|
||||||
|
iwl5150-firmware
|
||||||
|
iwl6000-firmware
|
||||||
|
iwl6000g2a-firmware
|
||||||
|
iwl6000g2b-firmware
|
||||||
|
iwl6050-firmware
|
||||||
|
iwl7260-firmware
|
||||||
|
libertas-sd8686-firmware
|
||||||
|
libertas-sd8787-firmware
|
||||||
|
libertas-usb8388-firmware
|
||||||
|
linux-firmware
|
||||||
|
midisport-firmware
|
||||||
|
psmisc
|
||||||
|
authselect
|
||||||
|
openssh-server
|
||||||
|
b43-openfwwf
|
||||||
|
zd1211-firmware
|
||||||
|
gnome-remote-desktop
|
||||||
|
geolite2-country
|
||||||
|
geolite2-city
|
||||||
|
GeoIP-GeoLite-data
|
||||||
|
adwaita-cursor-theme
|
||||||
|
adwaita-icon-theme
|
||||||
|
adwaita-gtk2-theme
|
||||||
|
adwaita-qt5
|
||||||
|
adwaita-qt
|
||||||
|
adwaita-qt4
|
||||||
|
ca-certificates
|
||||||
|
fedora-gpg-keys
|
||||||
|
bind-utils
|
||||||
|
bash-completion
|
||||||
|
|
||||||
95
pre-pivot.sh
Normal file
95
pre-pivot.sh
Normal file
|
|
@ -0,0 +1,95 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
root=$(getarg systemd.verity_root_hash)
|
||||||
|
|
||||||
|
case "$root" in
|
||||||
|
block:LABEL=*|LABEL=*)
|
||||||
|
root="${root#block:}"
|
||||||
|
root="$(echo $root | sed 's,/,\\x2f,g')"
|
||||||
|
root="/dev/disk/by-label/${root#LABEL=}"
|
||||||
|
rootok=1 ;;
|
||||||
|
block:UUID=*|UUID=*)
|
||||||
|
root="${root#block:}"
|
||||||
|
root="${root#UUID=}"
|
||||||
|
root="$(echo $root | tr "[:upper:]" "[:lower:]")"
|
||||||
|
root="/dev/disk/by-uuid/${root#UUID=}"
|
||||||
|
rootok=1 ;;
|
||||||
|
block:PARTUUID=*|PARTUUID=*)
|
||||||
|
root="${root#block:}"
|
||||||
|
root="${root#PARTUUID=}"
|
||||||
|
root="$(echo $root | tr "[:upper:]" "[:lower:]")"
|
||||||
|
root="/dev/disk/by-partuuid/${root}"
|
||||||
|
rootok=1 ;;
|
||||||
|
block:PARTLABEL=*|PARTLABEL=*)
|
||||||
|
root="${root#block:}"
|
||||||
|
root="/dev/disk/by-partlabel/${root#PARTLABEL=}"
|
||||||
|
rootok=1 ;;
|
||||||
|
/dev/*)
|
||||||
|
rootok=1 ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
udevadm settle --exit-if-exists=/dev/tpmrm0
|
||||||
|
udevadm settle --exit-if-exists="$root"
|
||||||
|
|
||||||
|
unset FOUND
|
||||||
|
for d in /dev/disk/by-path/*; do
|
||||||
|
[[ $d -ef $root ]] || continue
|
||||||
|
FOUND=1
|
||||||
|
break
|
||||||
|
done
|
||||||
|
|
||||||
|
[[ $FOUND ]] || die "No boot disk found"
|
||||||
|
|
||||||
|
disk=${d%-part*}
|
||||||
|
|
||||||
|
unset FOUND
|
||||||
|
for datadev in $disk*; do
|
||||||
|
[[ $(blkid -o value -s PARTLABEL "$datadev") == "data" ]] || continue
|
||||||
|
FOUND=1
|
||||||
|
break
|
||||||
|
done
|
||||||
|
|
||||||
|
if cryptsetup isLuks --type luks2 "$datadev"; then
|
||||||
|
export TPM2TOOLS_TCTI_NAME=device
|
||||||
|
export TPM2TOOLS_DEVICE_FILE=/dev/tpmrm0
|
||||||
|
luksname=luks-$(blkid -o value -s UUID "$datadev")
|
||||||
|
mapdev=/dev/mapper/$luksname
|
||||||
|
|
||||||
|
if ! [[ -b $mapdev ]]; then
|
||||||
|
if ! cryptsetup luksDump "$datadev" | grep -F -q clevis ; then
|
||||||
|
if echo -n "zero key" | clevis-luks-bind -f -k - -d "$datadev" tpm2 '{"pcr_ids":"7"}'; then
|
||||||
|
echo -n "zero key" | cryptsetup luksRemoveKey "$datadev" /dev/stdin || die "Failed to remove key from LUKS"
|
||||||
|
clevis-luks-unlock -d "$datadev" || die "Failed to unlock $datadev"
|
||||||
|
elif echo -n "zero key" | clevis-luks-bind -f -k - -d "$datadev" tpm2 '{"pcr_ids":"7","key":"rsa"}'; then
|
||||||
|
echo -n "zero key" | cryptsetup luksRemoveKey "$datadev" /dev/stdin || die "Failed to remove key from LUKS"
|
||||||
|
clevis-luks-unlock -d "$datadev" || die "Failed to unlock $datadev"
|
||||||
|
else
|
||||||
|
warn "Failed to bind disk to TPM2"
|
||||||
|
echo -n "zero key" | cryptsetup open --type luks2 "$datadev" $luksname --key-file /dev/stdin
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
clevis-luks-unlock -d "$datadev" || die "Failed to unlock $datadev"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
mapdev="$datadev"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ $(blkid -o value -s TYPE "$mapdev") != "xfs" ]]; then
|
||||||
|
mkfs.xfs -f -L data "$mapdev"
|
||||||
|
fi
|
||||||
|
|
||||||
|
mount $mapdev /sysroot/data || die "Failed to mount $mapdev"
|
||||||
|
|
||||||
|
[[ -d /sysroot/data/var ]] || mkdir /sysroot/data/var
|
||||||
|
[[ -d /sysroot/data/home ]] || mkdir /sysroot/data/home
|
||||||
|
|
||||||
|
mount -o bind /sysroot/data/var /sysroot/var
|
||||||
|
mount -o bind /sysroot/data/home /sysroot/home
|
||||||
|
|
||||||
|
for i in passwd shadow group gshadow subuid subgid; do
|
||||||
|
[[ -f /sysroot/data/var/$i ]] && continue
|
||||||
|
cp -a /sysroot/usr/share/factory/data/var/$i /sysroot/data/var/$i
|
||||||
|
done
|
||||||
|
|
||||||
|
chroot /sysroot /usr/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev --exclude-prefix=/run --exclude-prefix=/tmp --exclude-prefix=/etc 2>&1 | vinfo
|
||||||
368
prepare-root.sh
Executable file
368
prepare-root.sh
Executable file
|
|
@ -0,0 +1,368 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -ex
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat << EOF
|
||||||
|
Usage: $PROGNAME [OPTION]
|
||||||
|
|
||||||
|
Creates a directory with a readonly root on squashfs, a dm_verity file and an EFI executable
|
||||||
|
|
||||||
|
-h, --help Display this help
|
||||||
|
-p, --pkglist FILE The packages to install read from FILE (default: pkglist.txt)
|
||||||
|
-e, --excludelist FILE The packages to install read from FILE (default: excludelist.txt)
|
||||||
|
-r, --releasever NUM Used Fedora release version NUM (default: $VERSION_ID)
|
||||||
|
-o, --outdir DIR Creates DIR and puts all files in there (default: NAME-NUM-DATE)
|
||||||
|
-n, --name NAME The NAME of the product (default: FedoraBook)
|
||||||
|
-l, --logo FILE Uses the .bmp FILE to display as a splash screen (default: logo.bmp)
|
||||||
|
--noupdate Do not install from Fedora Updates
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
CURDIR=$(pwd)
|
||||||
|
|
||||||
|
PROGNAME=${0##*/}
|
||||||
|
BASEDIR=${0%/*}
|
||||||
|
WITH_UPDATES=1
|
||||||
|
|
||||||
|
TEMP=$(
|
||||||
|
getopt -o 'p:o:n:r:l:e:' \
|
||||||
|
--long pkglist: \
|
||||||
|
--long excludelist: \
|
||||||
|
--long outdir: \
|
||||||
|
--long name: \
|
||||||
|
--long releasever: \
|
||||||
|
--long logo: \
|
||||||
|
--long noupdates \
|
||||||
|
-- "$@"
|
||||||
|
)
|
||||||
|
|
||||||
|
if (( $? != 0 )); then
|
||||||
|
usage >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
eval set -- "$TEMP"
|
||||||
|
unset TEMP
|
||||||
|
. /etc/os-release
|
||||||
|
|
||||||
|
while true; do
|
||||||
|
case "$1" in
|
||||||
|
'-p'|'--pkglist')
|
||||||
|
if [[ -f $2 ]]; then
|
||||||
|
PKGLIST=$(<$2)
|
||||||
|
else
|
||||||
|
PKGLIST="$2"
|
||||||
|
fi
|
||||||
|
shift 2; continue
|
||||||
|
;;
|
||||||
|
'-e'|'--excludelist')
|
||||||
|
if [[ -f $2 ]]; then
|
||||||
|
EXCLUDELIST=$(<$2)
|
||||||
|
else
|
||||||
|
EXCLUDELIST="$2"
|
||||||
|
fi
|
||||||
|
shift 2; continue
|
||||||
|
;;
|
||||||
|
'-o'|'--outdir')
|
||||||
|
OUTDIR="$2"
|
||||||
|
shift 2; continue
|
||||||
|
;;
|
||||||
|
'-n'|'--name')
|
||||||
|
NAME="$2"
|
||||||
|
shift 2; continue
|
||||||
|
;;
|
||||||
|
'-r'|'--releasever')
|
||||||
|
RELEASEVER="$2"
|
||||||
|
shift 2; continue
|
||||||
|
;;
|
||||||
|
'-l'|'--logo')
|
||||||
|
LOGO="$2"
|
||||||
|
shift 2; continue
|
||||||
|
;;
|
||||||
|
'--noupdates')
|
||||||
|
unset WITH_UPDATES
|
||||||
|
shift 1; continue
|
||||||
|
;;
|
||||||
|
'--')
|
||||||
|
shift
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo 'Internal error!' >&2
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
[[ $EXCLUDELIST ]] || [[ -f excludelist.txt ]] && EXCLUDELIST=$(<excludelist.txt)
|
||||||
|
NAME=${NAME:-"FedoraBook"}
|
||||||
|
RELEASEVER=${RELEASEVER:-$VERSION_ID}
|
||||||
|
OUTDIR=${OUTDIR:-"${CURDIR}/${NAME}-${VERSION_ID}"}
|
||||||
|
VERSION_ID="${RELEASEVER}.$(date -u +'%Y%m%d%H%M%S')"
|
||||||
|
|
||||||
|
[[ $TMPDIR ]] || TMPDIR=/var/tmp
|
||||||
|
readonly TMPDIR="$(realpath -e "$TMPDIR")"
|
||||||
|
[ -d "$TMPDIR" ] || {
|
||||||
|
printf "%s\n" "${PROGNAME}: Invalid tmpdir '$tmpdir'." >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
readonly MY_TMPDIR="$(mktemp -p "$TMPDIR/" -d -t ${PROGNAME}.XXXXXX)"
|
||||||
|
[ -d "$MY_TMPDIR" ] || {
|
||||||
|
printf "%s\n" "${PROGNAME}: mktemp -p '$TMPDIR/' -d -t ${PROGNAME}.XXXXXX failed." >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# clean up after ourselves no matter how we die.
|
||||||
|
trap '
|
||||||
|
ret=$?;
|
||||||
|
mountpoint -q "$sysroot"/var/cache/dnf && umount "$sysroot"/var/cache/dnf
|
||||||
|
for i in "$sysroot"/{dev,sys,proc,run}; do
|
||||||
|
[[ -d "$i" ]] && mountpoint -q "$i" && umount "$i"
|
||||||
|
done
|
||||||
|
[[ $MY_TMPDIR ]] && rm -rf --one-file-system -- "$MY_TMPDIR"
|
||||||
|
exit $ret;
|
||||||
|
' EXIT
|
||||||
|
|
||||||
|
# clean up after ourselves no matter how we die.
|
||||||
|
trap 'exit 1;' SIGINT
|
||||||
|
|
||||||
|
readonly sysroot="${MY_TMPDIR}/sysroot"
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/{dev,proc,sys,run}
|
||||||
|
mount --bind /proc "$sysroot/proc"
|
||||||
|
#mount --bind /run "$sysroot/run"
|
||||||
|
mount --bind /sys "$sysroot/sys"
|
||||||
|
mount -t devtmpfs devtmpfs "$sysroot/dev"
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/var/cache/dnf
|
||||||
|
mount --bind /var/cache/dnf "$sysroot"/var/cache/dnf
|
||||||
|
|
||||||
|
dnf -v --nogpgcheck --installroot "$sysroot"/ --releasever "$RELEASEVER" --disablerepo='*' \
|
||||||
|
--enablerepo=fedora \
|
||||||
|
${WITH_UPDATES:+--enablerepo=updates} \
|
||||||
|
--exclude="$EXCLUDELIST" \
|
||||||
|
--setopt=keepcache=True \
|
||||||
|
install -y \
|
||||||
|
dracut \
|
||||||
|
passwd \
|
||||||
|
rootfiles \
|
||||||
|
systemd \
|
||||||
|
systemd-udev \
|
||||||
|
kernel \
|
||||||
|
bash \
|
||||||
|
sudo \
|
||||||
|
strace \
|
||||||
|
xfsprogs \
|
||||||
|
pciutils \
|
||||||
|
microcode_ctl \
|
||||||
|
nss_db \
|
||||||
|
keyutils \
|
||||||
|
make \
|
||||||
|
less \
|
||||||
|
polkit \
|
||||||
|
util-linux \
|
||||||
|
rng-tools \
|
||||||
|
openssl \
|
||||||
|
cryptsetup \
|
||||||
|
clevis \
|
||||||
|
clevis-luks \
|
||||||
|
clevis-systemd \
|
||||||
|
jose \
|
||||||
|
tpm2-tools \
|
||||||
|
coreutils \
|
||||||
|
libpwquality \
|
||||||
|
tpm2-tss \
|
||||||
|
ncurses-base \
|
||||||
|
dbus-broker \
|
||||||
|
$PKGLIST
|
||||||
|
|
||||||
|
cp "$CURDIR/clonedisk.sh" "$sysroot"/usr/bin/clonedisk
|
||||||
|
|
||||||
|
rpm --root "$sysroot" -qa | sort > "$sysroot"/usr/rpm-list.txt
|
||||||
|
mkdir -p "$sysroot"/overlay/efi
|
||||||
|
|
||||||
|
cp "${BASEDIR}"/pre-pivot.sh "$sysroot"/pre-pivot.sh
|
||||||
|
chmod 0755 "$sysroot"/pre-pivot.sh
|
||||||
|
|
||||||
|
KVER=$(cd "$sysroot"/lib/modules/; ls -1d ??* | tail -1)
|
||||||
|
|
||||||
|
sed -ie 's#\(tpm2_[^ ]*\) #\1 -T device:${TPM2TOOLS_DEVICE_FILE[0]} #g' "$sysroot"/usr/bin/clevis-*-tpm2
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# rngd
|
||||||
|
ln -fsnr "$sysroot"/usr/lib/systemd/system/rngd.service "$sysroot"/usr/lib/systemd/system/basic.target.wants/rngd.service
|
||||||
|
|
||||||
|
chroot "$sysroot" \
|
||||||
|
dracut -N --kver $KVER --force \
|
||||||
|
--filesystems "squashfs vfat xfs" \
|
||||||
|
--add-drivers "=drivers/char/tpm" \
|
||||||
|
-m "bash systemd systemd-initrd modsign crypt dm kernel-modules qemu rootfs-block udev-rules dracut-systemd base fs-lib shutdown terminfo" \
|
||||||
|
--install /usr/lib/systemd/systemd-veritysetup \
|
||||||
|
--install /usr/lib/systemd/system-generators/systemd-veritysetup-generator \
|
||||||
|
--install "clonedisk wipefs sfdisk dd mkfs.xfs mkswap chroot mountpoint mkdir stat openssl" \
|
||||||
|
--install "clevis clevis-luks-bind jose clevis-encrypt-tpm2 clevis-decrypt clevis-luks-unlock clevis-decrypt-tpm2" \
|
||||||
|
--install "cryptsetup tail sort pwmake mktemp " \
|
||||||
|
--install "tpm2_createprimary tpm2_pcrlist tpm2_createpolicy tpm2_create tpm2_load tpm2_unseal tpm2_takeownership" \
|
||||||
|
--install "strace" \
|
||||||
|
--include /pre-pivot.sh /lib/dracut/hooks/pre-pivot/pre-pivot.sh \
|
||||||
|
--include /overlay / \
|
||||||
|
--install /usr/lib/systemd/system/clevis-luks-askpass.path \
|
||||||
|
--install /usr/lib/systemd/system/clevis-luks-askpass.service \
|
||||||
|
--install /usr/libexec/clevis-luks-askpass \
|
||||||
|
--include /usr/share/cracklib/ /usr/share/cracklib/ \
|
||||||
|
--install /usr/lib64/libtss2-esys.so.0 \
|
||||||
|
--install /usr/lib64/libtss2-tcti-device.so.0 \
|
||||||
|
--install /sbin/rngd \
|
||||||
|
--install /usr/lib/systemd/system/basic.target.wants/rngd.service
|
||||||
|
|
||||||
|
rm "$sysroot"/pre-pivot.sh
|
||||||
|
#bash -i
|
||||||
|
|
||||||
|
umount "$sysroot"/var/cache/dnf
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/data/{var/etc,home}
|
||||||
|
ln -sfnr "$sysroot"/usr/share/factory/data/var "$sysroot"/usr/share/factory/var
|
||||||
|
ln -sfnr "$sysroot"/usr/share/factory/data/home "$sysroot"/usr/share/factory/home
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# timesync
|
||||||
|
ln -fsnr "$sysroot"/usr/lib/systemd/system/systemd-timesyncd.service "$sysroot"/usr/lib/systemd/system/sysinit.target.wants/systemd-timesyncd.service
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# dbus-broker
|
||||||
|
ln -fsnr "$sysroot"/usr/lib/systemd/system/dbus-broker.service "$sysroot"/etc/systemd/system/dbus.service
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# ssh
|
||||||
|
if [[ -d "$sysroot"/etc/ssh ]]; then
|
||||||
|
mv "$sysroot"/etc/ssh "$sysroot"/usr/share/factory/var/etc/ssh
|
||||||
|
ln -sfnr "$sysroot"/var/etc/ssh "$sysroot"/etc/ssh
|
||||||
|
fi
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# tpm2-tss
|
||||||
|
if [[ -f "$sysroot"/usr/lib/udev/rules.d/60-tpm-udev.rules ]]; then
|
||||||
|
echo 'tss:x:59:59:tpm user:/dev/null:/sbin/nologin' >> "$sysroot"/etc/passwd
|
||||||
|
echo 'tss:!!:15587::::::' >> "$sysroot"/etc/shadow
|
||||||
|
echo 'tss:x:59:' >> "$sysroot"/etc/group
|
||||||
|
echo 'tss:!::' >> "$sysroot"/etc/gshadow
|
||||||
|
fi
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# NetworkManager
|
||||||
|
if [[ -d "$sysroot"/etc/NetworkManager ]]; then
|
||||||
|
mv "$sysroot"/etc/NetworkManager "$sysroot"/usr/share/factory/var/etc/
|
||||||
|
ln -fsnr "$sysroot"/var/etc/NetworkManager "$sysroot"/etc/NetworkManager
|
||||||
|
cat >> "$sysroot"/usr/lib/tmpfiles.d/NetworkManager.conf <<EOF
|
||||||
|
d /var/lib/NetworkManager 0755 root root - -
|
||||||
|
d /run/NetworkManager 0755 root root - -
|
||||||
|
EOF
|
||||||
|
rm -fr "$sysroot"/etc/sysconfig/network-scripts
|
||||||
|
rm -fr "$sysroot"/usr/lib64/NetworkManager/*/libnm-settings-plugin-ifcfg-rh.so
|
||||||
|
fi
|
||||||
|
|
||||||
|
. "${BASEDIR}"/quirks/nss_db.sh
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# resolv.conf
|
||||||
|
ln -fsrn "$sysroot"/run/NetworkManager/resolv.conf "$sysroot"/etc/resolv.conf
|
||||||
|
echo 'f /run/NetworkManager/resolv.conf 0755 root root - ' >> "$sysroot"/usr/lib/tmpfiles.d/resolv.conf
|
||||||
|
ln -sfrn "$sysroot"/var/etc/hostname "$sysroot"/etc/hostname
|
||||||
|
echo "FedoraBook" > "$sysroot"/usr/share/factory/var/etc/hostname
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# vconsole.conf
|
||||||
|
ln -fsnr "$sysroot"/var/etc/vconsole.conf "$sysroot"/etc/vconsole.conf
|
||||||
|
echo -e 'FONT=latarcyrheb-sun16\nKEYMAP=us' > "$sysroot"/usr/share/factory/var/etc/vconsole.conf
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# locale.conf
|
||||||
|
ln -fsnr "$sysroot"/var/etc/locale.conf "$sysroot"/etc/locale.conf
|
||||||
|
echo 'LANG=en_US.UTF-8' > "$sysroot"/usr/share/factory/var/etc/locale.conf
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# udev dri/card0
|
||||||
|
cp "${BASEDIR}"/systemd-udev-settle-dri.service "$sysroot"/usr/lib/systemd/system/
|
||||||
|
ln -fsnr "$sysroot"/usr/lib/systemd/system/systemd-udev-settle-dri.service \
|
||||||
|
"$sysroot"/usr/lib/systemd/system/multi-user.target.wants/systemd-udev-settle-dri.service
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# Flathub
|
||||||
|
if [[ -d "$sysroot"/usr/share/flatpak ]]; then
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/var/lib/
|
||||||
|
curl https://flathub.org/repo/flathub.flatpakrepo -o "$sysroot"/usr/share/flatpak/flathub.flatpakrepo
|
||||||
|
chroot "$sysroot" bash -c '/usr/bin/flatpak remote-add --if-not-exists flathub /usr/share/flatpak/flathub.flatpakrepo'
|
||||||
|
fi
|
||||||
|
|
||||||
|
#---------------
|
||||||
|
# var
|
||||||
|
rm -fr "$sysroot"/var/lib/rpm
|
||||||
|
rm -fr "$sysroot"/var/lib/selinux
|
||||||
|
rm -fr "$sysroot"/var/log/dnf*
|
||||||
|
rm -fr "$sysroot"/var/cache/*/*
|
||||||
|
rm -fr "$sysroot"/var/tmp/*
|
||||||
|
rm -fr "$sysroot"/etc/systemd/system/network-online.target.wants
|
||||||
|
mv "$sysroot"/lib/tmpfiles.d/var.conf "$sysroot"/lib/tmpfiles.d-var.conf
|
||||||
|
chroot "$sysroot" bash -c 'for i in $(find -H /var -xdev -type d); do grep " $i " -r -q /lib/tmpfiles.d && ! grep " $i " -q /lib/tmpfiles.d-var.conf && rm -vfr --one-file-system "$i" ; done; :'
|
||||||
|
cp -avxr "$sysroot"/var/* "$sysroot"/usr/share/factory/data/var/
|
||||||
|
rm -fr "$sysroot"/usr/share/factory/var/{run,lock}
|
||||||
|
|
||||||
|
chroot "$sysroot" bash -c 'for i in $(find -H /var -xdev -type d); do echo "C /data$i - - - - -"; done > /usr/lib/tmpfiles.d/var-quirk.conf; :'
|
||||||
|
mv "$sysroot"/lib/tmpfiles.d-var.conf "$sysroot"/lib/tmpfiles.d/var.conf
|
||||||
|
|
||||||
|
sed -i -e "s#VERSION_ID=.*#VERSION_ID=$VERSION_ID#" "$sysroot"/etc/os-release
|
||||||
|
|
||||||
|
mv -v "$sysroot"/boot/*/*/initrd "$MY_TMPDIR"/
|
||||||
|
mv -v "$sysroot"/lib/modules/*/vmlinuz "$MY_TMPDIR"/linux
|
||||||
|
rm -fr "$sysroot"/{boot,root}
|
||||||
|
ln -sfnr "$sysroot"/data/root "$sysroot"/root
|
||||||
|
rm -fr "$sysroot"/etc/yum.repos.d/*
|
||||||
|
mkdir "$sysroot"/efi
|
||||||
|
rm -fr "$sysroot"/var/*
|
||||||
|
rm -fr "$sysroot"/home/*
|
||||||
|
rm -fr "$sysroot"/etc/selinux
|
||||||
|
mkdir "$sysroot"/data
|
||||||
|
|
||||||
|
for i in "$sysroot"/{dev,sys,proc,run}; do
|
||||||
|
[[ -d "$i" ]] && mountpoint -q "$i" && umount "$i"
|
||||||
|
done
|
||||||
|
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# sysroot
|
||||||
|
mksquashfs "$MY_TMPDIR"/sysroot "$MY_TMPDIR"/root.squashfs.img \
|
||||||
|
-noDataCompression -noFragmentCompression -noXattrCompression -noInodeCompression
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# verity
|
||||||
|
ROOT_HASH=$(veritysetup format "$MY_TMPDIR"/root.squashfs.img "$MY_TMPDIR"/root.verity.img |& tail -1 | { read a b c; echo $c; } )
|
||||||
|
|
||||||
|
echo "$ROOT_HASH" > "$MY_TMPDIR"/root-hash.txt
|
||||||
|
|
||||||
|
ROOT_UUID=${ROOT_HASH:32:8}-${ROOT_HASH:40:4}-${ROOT_HASH:44:4}-${ROOT_HASH:48:4}-${ROOT_HASH:52:12}
|
||||||
|
HASH_UUID=${ROOT_HASH:0:8}-${ROOT_HASH:8:4}-${ROOT_HASH:12:4}-${ROOT_HASH:16:4}-${ROOT_HASH:20:12}
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------------------
|
||||||
|
# make bootx64.efi
|
||||||
|
echo -n "rd.shell=0 quiet video=efifb:nobgrt audit=0 selinux=0 roothash=$ROOT_HASH systemd.verity_root_data=PARTUUID=$ROOT_UUID systemd.verity_root_hash=PARTUUID=$HASH_UUID resume=PARTLABEL=swap raid=noautodetect" > "$MY_TMPDIR"/options.txt
|
||||||
|
echo -n "$NAME $VERSION_ID" > "$MY_TMPDIR"/release.txt
|
||||||
|
objcopy \
|
||||||
|
--add-section .release="$MY_TMPDIR"/release.txt --change-section-vma .release=0x20000 \
|
||||||
|
--add-section .cmdline="$MY_TMPDIR"/options.txt --change-section-vma .cmdline=0x30000 \
|
||||||
|
${LOGO:+--add-section .splash="$LOGO" --change-section-vma .splash=0x40000} \
|
||||||
|
--add-section .linux="$MY_TMPDIR"/linux --change-section-vma .linux=0x2000000 \
|
||||||
|
--add-section .initrd="$MY_TMPDIR"/initrd --change-section-vma .initrd=0x3000000 \
|
||||||
|
"${BASEDIR}"/linuxx64.efi.stub "$MY_TMPDIR"/bootx64.efi
|
||||||
|
|
||||||
|
|
||||||
|
mkdir -p "$OUTDIR"
|
||||||
|
mv "$MY_TMPDIR"/root-hash.txt \
|
||||||
|
"$MY_TMPDIR"/bootx64.efi \
|
||||||
|
"$MY_TMPDIR"/root.squashfs.img \
|
||||||
|
"$MY_TMPDIR"/root.verity.img \
|
||||||
|
"$MY_TMPDIR"/release.txt \
|
||||||
|
"$MY_TMPDIR"/options.txt \
|
||||||
|
"$MY_TMPDIR"/linux \
|
||||||
|
"$MY_TMPDIR"/initrd \
|
||||||
|
"$OUTDIR"
|
||||||
51
quirks/nss_db.sh
Normal file
51
quirks/nss_db.sh
Normal file
|
|
@ -0,0 +1,51 @@
|
||||||
|
|
||||||
|
sed -i -e 's#files#files db#g' "$sysroot"/etc/nsswitch.conf
|
||||||
|
mkdir -p "$sysroot"/usr/db
|
||||||
|
sed -i -e 's#/var/db#/usr/db#g' "$sysroot"/lib64/libnss_db-2*.so "$sysroot"/var/db/Makefile
|
||||||
|
|
||||||
|
chroot "$sysroot" bash -c 'useradd -G wheel admin'
|
||||||
|
egrep -e '^(adm|wheel):.*' "$sysroot"/etc/group > "$sysroot"/etc/group.admin
|
||||||
|
egrep -e '^(adm|wheel):.*' "$sysroot"/etc/gshadow > "$sysroot"/etc/gshadow.admin
|
||||||
|
|
||||||
|
sed -i -e '/^wheel:.*/d;/^adm:.*/d' "$sysroot"/etc/group "$sysroot"/etc/gshadow
|
||||||
|
sed -i -e '/^admin:.*/d' "$sysroot"/etc/passwd "$sysroot"/etc/shadow "$sysroot"/etc/group "$sysroot"/etc/gshadow
|
||||||
|
|
||||||
|
chroot "$sysroot" bash -c 'make -C /var/db /usr/db/passwd.db /usr/db/shadow.db /usr/db/gshadow.db /usr/db/group.db && >/etc/passwd && > /etc/shadow && >/etc/group && >/etc/gshadow'
|
||||||
|
mv "$sysroot"/etc/group.admin "$sysroot"/etc/group
|
||||||
|
mv "$sysroot"/etc/gshadow.admin "$sysroot"/etc/gshadow
|
||||||
|
chroot "$sysroot" bash -c 'useradd admin; usermod -a -G wheel admin; echo -n admin | passwd --stdin admin'
|
||||||
|
#chroot "$sysroot" bash -c 'passwd -e admin'
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/var
|
||||||
|
mv "$sysroot"/etc/passwd "$sysroot"/etc/sub{u,g}id "$sysroot"/etc/shadow "$sysroot"/etc/group "$sysroot"/etc/gshadow "$sysroot"/usr/share/factory/var
|
||||||
|
|
||||||
|
sed -i -e 's!^# directory = /etc!directory = /var!g' "$sysroot"/etc/libuser.conf
|
||||||
|
|
||||||
|
for i in passwd shadow group gshadow .pwd.lock subuid subgid; do
|
||||||
|
ln -sfnr "$sysroot"/var/"$i" "$sysroot"/etc/"$i"
|
||||||
|
done
|
||||||
|
|
||||||
|
sed -i -e 's#/etc/passwd#/var/passwd#g;s#/etc/npasswd#/var/npasswd#g' "$sysroot"/usr/lib64/security/pam_unix.so
|
||||||
|
sed -i -e 's#/etc/shadow#/var/shadow#g;s#/etc/nshadow#/var/nshadow#g' "$sysroot"/usr/lib64/security/pam_unix.so
|
||||||
|
sed -i -e 's#/etc/.pwdXXXXXX#/var/.pwdXXXXXX#g' "$sysroot"/usr/lib64/security/pam_unix.so
|
||||||
|
sed -i -e 's#/etc/passwd#/var/passwd#g;s#/etc/shadow#/var/shadow#g;s#/etc/gshadow#/var/gshadow#g;s#/etc/group#/var/group#g;s#/etc/subuid#/var/subuid#g;s#/etc/subgid#/var/subgid#g' "$sysroot"/usr/sbin/user{add,mod,del} "$sysroot"/usr/sbin/group{add,mod,del}
|
||||||
|
sed -i -e 's#/etc/.pwd.lock#/var/.pwd.lock#g' \
|
||||||
|
"$sysroot"/lib*/{,*/*/}libc.so.* \
|
||||||
|
"$sysroot"/usr/lib*/librpmostree-1.so.1 \
|
||||||
|
"$sysroot"/usr/lib/systemd/libsystemd-shared*.so
|
||||||
|
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/home
|
||||||
|
cp -avxr "$sysroot"/etc/skel "$sysroot"/usr/share/factory/home/admin
|
||||||
|
chown -R +1000.+1000 "$sysroot"/usr/share/factory/home/admin
|
||||||
|
|
||||||
|
cat > "$sysroot"/usr/lib/tmpfiles.d/home.conf <<EOF
|
||||||
|
C /data/home/admin - - - - -
|
||||||
|
C /data/var/passwd - - - - -
|
||||||
|
C /data/var/shadow - - - - -
|
||||||
|
C /data/var/group - - - - -
|
||||||
|
C /data/var/gshadow - - - - -
|
||||||
|
C /data/var/subuid - - - - -
|
||||||
|
C /data/var/subgid - - - - -
|
||||||
|
C /data/var/etc - - - - -
|
||||||
|
EOF
|
||||||
31
quirks/passwd.sh
Normal file
31
quirks/passwd.sh
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
chroot "$sysroot" bash -c 'useradd admin; usermod -a -G wheel admin; echo -n admin | passwd --stdin admin'
|
||||||
|
#chroot "$sysroot" bash -c 'passwd -e admin'
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/var
|
||||||
|
mv "$sysroot"/etc/passwd "$sysroot"/etc/sub{u,g}id "$sysroot"/etc/shadow "$sysroot"/etc/group "$sysroot"/etc/gshadow "$sysroot"/usr/share/factory/var
|
||||||
|
|
||||||
|
sed -i -e 's!^# directory = /etc!directory = /var!g' "$sysroot"/etc/libuser.conf
|
||||||
|
|
||||||
|
for i in passwd shadow group gshadow .pwd.lock subuid subgid; do
|
||||||
|
ln -sfnr "$sysroot"/var/"$i" "$sysroot"/etc/"$i"
|
||||||
|
done
|
||||||
|
|
||||||
|
sed -i -e 's#/etc/passwd#/var/passwd#g;s#/etc/npasswd#/var/npasswd#g' "$sysroot"/usr/lib64/security/pam_unix.so
|
||||||
|
sed -i -e 's#/etc/shadow#/var/shadow#g;s#/etc/nshadow#/var/nshadow#g' "$sysroot"/usr/lib64/security/pam_unix.so
|
||||||
|
sed -i -e 's#/etc/.pwdXXXXXX#/var/.pwdXXXXXX#g' "$sysroot"/usr/lib64/security/pam_unix.so
|
||||||
|
sed -i -e 's#/etc/passwd#/var/passwd#g;s#/etc/shadow#/var/shadow#g;s#/etc/gshadow#/var/gshadow#g;s#/etc/group#/var/group#g;s#/etc/subuid#/var/subuid#g;s#/etc/subgid#/var/subgid#g' "$sysroot"/usr/sbin/user{add,mod,del} "$sysroot"/usr/sbin/group{add,mod,del}
|
||||||
|
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/home
|
||||||
|
cp -avxr "$sysroot"/etc/skel "$sysroot"/usr/share/factory/home/admin
|
||||||
|
chown -R +1000.+1000 "$sysroot"/usr/share/factory/home/admin
|
||||||
|
|
||||||
|
cat > "$sysroot"/usr/lib/tmpfiles.d/home.conf <<EOF
|
||||||
|
C /data/home/admin - - - - -
|
||||||
|
C /data/var/passwd - - - - -
|
||||||
|
C /data/var/shadow - - - - -
|
||||||
|
C /data/var/group - - - - -
|
||||||
|
C /data/var/gshadow - - - - -
|
||||||
|
C /data/var/subuid - - - - -
|
||||||
|
C /data/var/subgid - - - - -
|
||||||
|
C /data/var/etc - - - - -
|
||||||
|
EOF
|
||||||
24
quirks/sssd.sh
Normal file
24
quirks/sssd.sh
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
#---------------
|
||||||
|
# admin user
|
||||||
|
cat > "$sysroot"/etc/sssd/sssd.conf <<EOF
|
||||||
|
[sssd]
|
||||||
|
domains=local
|
||||||
|
config_file_version=2
|
||||||
|
services=nss,pam
|
||||||
|
[domain/local]
|
||||||
|
id_provider=local
|
||||||
|
EOF
|
||||||
|
chmod 0600 "$sysroot"/etc/sssd/sssd.conf
|
||||||
|
|
||||||
|
chroot "$sysroot"
|
||||||
|
|
||||||
|
chroot "$sysroot" bash -c 'authselect select sssd with-sudo with-fingerprint with-mkhomedir -f ; sssd -i & sleep 2; sss_useradd admin ; echo -n admin | passwd --stdin admin; echo -n root | passwd --stdin root; usermod -a -G wheel admin; kill %1; wait; :'
|
||||||
|
|
||||||
|
systemctl --root="$sysroot" enable sssd.service oddjobd.service
|
||||||
|
mkdir -p "$sysroot"/usr/share/factory/var/lib
|
||||||
|
mv "$sysroot"/var/lib/sss "$sysroot"/usr/share/factory/var/lib/
|
||||||
|
|
||||||
|
cat >> "$sysroot"/usr/lib/tmpfiles.d/sssd.conf <<EOF
|
||||||
|
C /var/lib/sss - - - - -
|
||||||
|
d /var/log/sssd 0750 root root - -
|
||||||
|
EOF
|
||||||
Loading…
Reference in a new issue