mirror of
https://github.com/armbian/build.git
synced 2025-08-31 19:31:28 +02:00
94d4c007d1
* using the configured volume group name * added LVM support * ensuring /boot never on LVM volume, created hook to setup root device * preparing root device via extension, not assuming any particular partition for root * using tab spacing * using global parameter to require a boot partition * using boot require, moving cryptroot code to extension * adds crypt image suffix --------- Co-authored-by: rafael <rvalle@privaz.io>
76 lines
3.7 KiB
Bash
76 lines
3.7 KiB
Bash
# `cryptroot` / LUKS support is no longer included by default in prepare-host.sh.
|
|
# Enable this extension to include the required dependencies for building.
|
|
# This is automatically enabled if CRYPTROOT_ENABLE is set to yes in main-config.sh.
|
|
|
|
function add_host_dependencies__add_cryptroot_tooling() {
|
|
display_alert "Adding cryptroot to host dependencies" "cryptsetup LUKS" "debug"
|
|
EXTRA_BUILD_DEPS="${EXTRA_BUILD_DEPS} cryptsetup openssh-client" # @TODO: convert to array later
|
|
|
|
display_alert "Adding rootfs encryption related packages" "cryptsetup cryptsetup-initramfs" "info"
|
|
add_packages_to_rootfs cryptsetup cryptsetup-initramfs
|
|
|
|
if [[ $CRYPTROOT_SSH_UNLOCK == yes ]]; then
|
|
display_alert "Adding rootfs encryption related packages" "dropbear-initramfs" "info"
|
|
add_packages_to_rootfs dropbear-initramfs
|
|
fi
|
|
}
|
|
|
|
function extension_prepare_config__prepare_cryptroot() {
|
|
# Config for cryptroot, a boot partition is required.
|
|
declare -g BOOTPART_REQUIRED=yes
|
|
EXTRA_IMAGE_SUFFIXES+=("-crypt")
|
|
}
|
|
|
|
function prepare_root_device__encrypt_root_device(){
|
|
# We encrypt the rootdevice (currently a loop device) and return the new mapped rootdevice
|
|
check_loop_device "$rootdevice"
|
|
display_alert "Encrypting root partition with LUKS..." "cryptsetup luksFormat $rootdevice" ""
|
|
echo -n $CRYPTROOT_PASSPHRASE | cryptsetup luksFormat $CRYPTROOT_PARAMETERS $rootdevice -
|
|
echo -n $CRYPTROOT_PASSPHRASE | cryptsetup luksOpen $rootdevice $ROOT_MAPPER -
|
|
display_alert "Root partition encryption complete." "" "ext"
|
|
# TODO: pass /dev/mapper to Docker
|
|
rootdevice=/dev/mapper/$ROOT_MAPPER # used by `mkfs` and `mount` commands
|
|
}
|
|
|
|
function pre_install_kernel_debs__adjust_dropbear_configuration() {
|
|
# Adjust initramfs dropbear configuration
|
|
# Needs to be done before kernel installation, else it won't be in the initrd image
|
|
if [[ $CRYPTROOT_SSH_UNLOCK == yes ]]; then
|
|
declare dropbear_dir="${SDCARD}/etc/dropbear-initramfs"
|
|
declare dropbear_config="config"
|
|
|
|
if [[ -d "${SDCARD}/etc/dropbear/initramfs" ]]; then
|
|
dropbear_dir="${SDCARD}/etc/dropbear/initramfs"
|
|
dropbear_config="dropbear.conf"
|
|
fi
|
|
|
|
# Set the port of the dropbear ssh daemon in the initramfs to a different one if configured
|
|
# this avoids the typical 'host key changed warning' - `WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!`
|
|
[[ -f "${dropbear_dir}/${dropbear_config}" ]] &&
|
|
sed -i 's/^#DROPBEAR_OPTIONS=/DROPBEAR_OPTIONS="-j -k -p '"${CRYPTROOT_SSH_UNLOCK_PORT}"' -s -c cryptroot-unlock"/' \
|
|
"${dropbear_dir}/${dropbear_config}"
|
|
|
|
# setup dropbear authorized_keys, either provided by userpatches or generated
|
|
if [[ -f $USERPATCHES_PATH/dropbear_authorized_keys ]]; then
|
|
cp "$USERPATCHES_PATH"/dropbear_authorized_keys "${dropbear_dir}"/authorized_keys
|
|
else
|
|
# generate a default ssh key for login on dropbear in initramfs
|
|
# this key should be changed by the user on first login
|
|
display_alert "Generating a new SSH key pair for dropbear (initramfs)" "" ""
|
|
|
|
# Generate the SSH keys
|
|
ssh-keygen -t ecdsa -f "${dropbear_dir}"/id_ecdsa \
|
|
-N '' -O force-command=cryptroot-unlock -C 'AUTOGENERATED_BY_ARMBIAN_BUILD' 2>&1
|
|
|
|
# /usr/share/initramfs-tools/hooks/dropbear will automatically add 'id_ecdsa.pub' to authorized_keys file
|
|
# during mkinitramfs of update-initramfs
|
|
#cat "${dropbear_dir}"/id_ecdsa.pub > "${SDCARD}"/etc/dropbear-initramfs/authorized_keys
|
|
CRYPTROOT_SSH_UNLOCK_KEY_NAME="${VENDOR}_${REVISION}_${BOARD^}_${RELEASE}_${BRANCH}_${DESKTOP_ENVIRONMENT}".key
|
|
# copy dropbear ssh key to image output dir for convenience
|
|
cp "${dropbear_dir}"/id_ecdsa "${DEST}/images/${CRYPTROOT_SSH_UNLOCK_KEY_NAME}"
|
|
display_alert "SSH private key for dropbear (initramfs) has been copied to:" \
|
|
"$DEST/images/$CRYPTROOT_SSH_UNLOCK_KEY_NAME" "info"
|
|
fi
|
|
fi
|
|
}
|