parent
1725120a49
commit
a3e2a970f8
11 changed files with 845 additions and 772 deletions
pkgs/rootfs
217
pkgs/rootfs/mkrootfs.nix
Normal file
217
pkgs/rootfs/mkrootfs.nix
Normal file
|
|
@ -0,0 +1,217 @@
|
|||
{
|
||||
pkgs,
|
||||
patosPkgs,
|
||||
version,
|
||||
runCommand,
|
||||
...
|
||||
}:
|
||||
let
|
||||
defaultPassword = "patos";
|
||||
in
|
||||
|
||||
runCommand "patos-rootfs"
|
||||
{
|
||||
buildInputs = [
|
||||
pkgs.glibc
|
||||
pkgs.binutils
|
||||
];
|
||||
}
|
||||
''
|
||||
### create directory structure
|
||||
mkdir -p $out/etc/repart.d $out/dev $out/proc $out/sys \
|
||||
$out/tmp $out/root $out/run $out/boot $out/mnt $out/home $out/srv $out/var/tmp
|
||||
ln -sf /usr/bin $out/bin
|
||||
ln -sf /usr/bin $out/sbin
|
||||
ln -sf /usr/lib $out/lib
|
||||
ln -sf /usr/lib $out/lib64
|
||||
ln -sf ../proc/self/mounts $out/etc/mtab
|
||||
|
||||
### install systemd
|
||||
echo "Installing systemd"
|
||||
cp -Pr ${patosPkgs.systemd}/* $out/
|
||||
find $out -type d -exec chmod 755 {} \;
|
||||
rm -rf $out/usr/include
|
||||
rm -rf $out/usr/sbin
|
||||
ln -sf /usr/bin $out/usr/sbin
|
||||
rm -f $out/usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service
|
||||
rm -f $out/usr/lib/systemd/ukify
|
||||
rm -f $out/usr/bin/ukify
|
||||
rm -f $out/usr/lib/udev/rules.d/90-vconsole.rules
|
||||
ln -s /run/systemd/resolve/stub-resolv.conf $out/etc/resolv.conf
|
||||
|
||||
cat <<EOF > $out/etc/os-release
|
||||
NAME=PatOS
|
||||
PRETTY_NAME=PatOS v${version} (Pre-Alpha)
|
||||
IMAGE_ID=patos
|
||||
ID=patos
|
||||
IMAGE_VERSION=${version}
|
||||
VERSION=${version}
|
||||
VERSION_ID=patos
|
||||
BUILD_ID=somehash
|
||||
EOF
|
||||
|
||||
cat <<EOF > $out/etc/issue
|
||||
<<< Welcome to PatOS v${version} (Pre-Alpha) (\m) - \l >>>
|
||||
|
||||
EOF
|
||||
|
||||
# replace agetty with busybox getty (optionally autologin)
|
||||
mkdir $out/usr/lib/systemd/system/serial-getty@.service.d
|
||||
cat <<EOF > $out/usr/lib/systemd/system/serial-getty@.service.d/override.conf
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=-/bin/login -f root
|
||||
EOF
|
||||
# ExecStart=-/sbin/getty -L %I 115200 vt100
|
||||
|
||||
# Configure systemd-repart
|
||||
cat <<EOF > $out/etc/repart.d/10-esp.conf
|
||||
[Partition]
|
||||
Type=esp
|
||||
Format=vfat
|
||||
SizeMaxBytes=160M
|
||||
SizeMinBytes=160M
|
||||
EOF
|
||||
|
||||
cat <<EOF > $out/etc/repart.d/20-root-a.conf
|
||||
[Partition]
|
||||
Type=root
|
||||
SizeMaxBytes=256M
|
||||
SizeMinBytes=256M
|
||||
EOF
|
||||
|
||||
cat <<EOF > $out/etc/repart.d/22-root-verify-a.conf
|
||||
[Partition]
|
||||
Type=root-verity
|
||||
SizeMaxBytes=10M
|
||||
SizeMinBytes=10M
|
||||
EOF
|
||||
|
||||
cat <<EOF > $out/etc/repart.d/30-root-b.conf
|
||||
[Partition]
|
||||
Type=root
|
||||
Label=_empty
|
||||
SizeMaxBytes=256M
|
||||
SizeMinBytes=256M
|
||||
ReadOnly=1
|
||||
EOF
|
||||
|
||||
cat <<EOF > $out/etc/repart.d/32-root-verity-b.conf
|
||||
[Partition]
|
||||
Type=root-verity
|
||||
Label=_empty
|
||||
SizeMaxBytes=10M
|
||||
SizeMinBytes=10M
|
||||
ReadOnly=1
|
||||
EOF
|
||||
|
||||
cat <<EOF > $out/etc/repart.d/40-var.conf
|
||||
[Partition]
|
||||
Type=var
|
||||
Format=btrfs
|
||||
MakeDirectories=/var/lib/confexts /var/lib/extensions /var/lib/portables /var/.snapshots
|
||||
MountPoint=/var
|
||||
Label=patos-state
|
||||
Encrypt=tpm2
|
||||
EncryptedVolume=patos-state:none:tpm2-device=auto,luks,discard
|
||||
Subvolumes=/var/lib/confexts /var/lib/extensions /var/lib/portables /var/.snapshots
|
||||
MountPoint=/var/lib/confexts:subvol=/var/lib/confexts
|
||||
MountPoint=/var/lib/extensions:subvol=/var/lib/extensions
|
||||
MountPoint=/var/lib/portables:subvol=/var/lib/portables
|
||||
MountPoint=/var/.snapshots:subvol=/var/.snapshots
|
||||
SizeMinBytes=1G
|
||||
Minimize=off
|
||||
FactoryReset=yes
|
||||
EOF
|
||||
|
||||
# as rootfs is read-only we need to configure the fstab and cryptsetup generators to look
|
||||
# for config under /run (which are generated by systemd-repart in initrd)
|
||||
rm -f $out/etc/systemd/system.conf
|
||||
cat <<EOF > $out/etc/systemd/system.conf
|
||||
[Manager]
|
||||
DefaultEnvironment=PATH=/bin:/sbin:/usr/bin
|
||||
ManagerEnvironment=PATH=/bin:/sbin:/usr/bin SYSTEMD_CRYPTTAB=/run/crypttab SYSTEMD_SYSROOT_FSTAB=/run/fstab SYSTEMD_FSTAB=/run/fstab
|
||||
EOF
|
||||
|
||||
### install PatOS glibc
|
||||
cp -P ${patosPkgs.glibc}/lib/*.so* $out/usr/lib/
|
||||
|
||||
### install openssl
|
||||
cp -P ${patosPkgs.openssl}/lib/*.so* $out/usr/lib/
|
||||
cp -Pr ${patosPkgs.openssl}/etc/ssl $out/etc/
|
||||
|
||||
### install busybox
|
||||
cp ${patosPkgs.busybox}/bin/busybox $out/usr/bin/
|
||||
$out/usr/bin/busybox --list | xargs -I {} ln -sf busybox $out/usr/bin/{}
|
||||
|
||||
### install dbus broker
|
||||
cp -r ${patosPkgs.dbus-broker}/* $out/
|
||||
|
||||
### install kexec
|
||||
cp -Pr ${patosPkgs.kexec}/sbin/kexec $out/usr/bin/
|
||||
|
||||
### install dmsetup udev rules
|
||||
cp -P ${patosPkgs.lvm2}/usr/bin/dmsetup $out/usr/bin/
|
||||
cp -P ${patosPkgs.lvm2}/lib/libdevmapper.so* $out/usr/lib/
|
||||
cp -P ${patosPkgs.lvm2}/lib/udev/rules.d/* $out/usr/lib/udev/rules.d/
|
||||
|
||||
### install btrfs progs
|
||||
cp -Pr ${pkgs.btrfs-progs}/bin/* $out/usr/bin/
|
||||
cp -Pr ${pkgs.btrfs-progs}/lib/* $out/usr/lib/
|
||||
|
||||
### install tpm2 libs
|
||||
cp -P ${patosPkgs.tpm2-tss}/lib/*.so* $out/usr/lib/
|
||||
|
||||
### install lib kmod
|
||||
cp -P ${pkgs.kmod.lib}/lib/*.so* $out/usr/lib/
|
||||
cp -P ${pkgs.kmod}/bin/* $out/usr/bin
|
||||
|
||||
### install libbpf
|
||||
cp -P ${pkgs.libbpf}/lib/libbpf*.so* $out/usr/lib
|
||||
|
||||
### install ca cert bundle
|
||||
chmod 755 $out/etc/ssl $out/etc/ssl/certs
|
||||
cp -P ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/cert.pem
|
||||
ln -sf ../cert.pem $out/etc/ssl/certs/ca-certificates.crt
|
||||
ln -sf ../cert.pem $out/etc/ssl/certs/ca-bundle.crt
|
||||
|
||||
# setup default files
|
||||
${patosPkgs.systemd}/usr/bin/systemd-hwdb --root=$out --usr update
|
||||
${patosPkgs.systemd}/usr/bin/systemd-tmpfiles --root=$out $out/usr/lib/tmpfiles.d/etc.conf --create
|
||||
cp $out/usr/share/factory/etc/nsswitch.conf $out/etc/
|
||||
cp $out/usr/share/factory/etc/locale.conf $out/etc/
|
||||
cp $out/usr/share/factory/etc/vconsole.conf $out/etc/
|
||||
# install sys users
|
||||
mkdir creds
|
||||
echo -n ${defaultPassword} > creds/passwd.plaintext-password.root
|
||||
CREDENTIALS_DIRECTORY=$PWD/creds SYSTEMD_CRYPT_PREFIX='$6$' ${patosPkgs.systemd}/usr/bin/systemd-sysusers --root=$out rootfs/usr/lib/sysusers.d/*.conf
|
||||
chmod 600 $out/etc/shadow
|
||||
rm -rf creds
|
||||
|
||||
|
||||
# Ephemeral machine-id until registration
|
||||
ln -sf /run/machine-id $out/etc/machine-id
|
||||
|
||||
# remove pkgconfig
|
||||
rm -rf $out/usr/lib/pkgconfig
|
||||
|
||||
### Find and install all shared libs
|
||||
find $out -type f -executable -exec ldd {} \; | awk '{print $3}' | \
|
||||
grep -vE "(systemd|glibc|openssl|tpm2|devmapper)" | \
|
||||
sort -u | xargs -I {} cp {} $out/usr/lib/
|
||||
|
||||
find $out -type f -executable -exec chmod 755 {} \;
|
||||
|
||||
# FIXME: ELF patching. Is there a better way?
|
||||
find $out -type f -executable -exec patchelf --set-rpath /lib:/usr/lib:/usr/lib/systemd:/usr/lib/cryptsetup {} \;
|
||||
find $out -type f -executable -exec patchelf --set-interpreter /lib/ld-linux-x86-64.so.2 {} \;
|
||||
patchelf --remove-rpath $out/usr/lib/ld-linux-x86-64.so.2
|
||||
|
||||
# strip binaries
|
||||
find $out -type f -executable -exec strip {} \;
|
||||
find $out -type d -exec chmod 755 {} \;
|
||||
|
||||
### install kernel modules
|
||||
cp -r ${patosPkgs.kernel}/lib/modules $out/usr/lib/
|
||||
find $out/usr/lib/modules -type d -exec chmod 755 {} \;
|
||||
''
|
||||
Loading…
Add table
Add a link
Reference in a new issue