Browse Source

Use capsh to ensure file capabilities aren't set

pull/35/head
Serge Schneider 5 years ago
parent
commit
c4fb032d3b
12 changed files with 20 additions and 19 deletions
  1. +4
    -4
      build.sh
  2. +1
    -0
      depends
  3. +1
    -1
      export-image/01-set-sources/01-run.sh
  4. +1
    -1
      export-image/03-finalise/01-run.sh
  5. +3
    -3
      scripts/common
  6. +1
    -1
      stage0/01-configure-apt/00-run.sh
  7. +1
    -1
      stage1/01-sys-tweaks/00-run.sh
  8. +1
    -1
      stage1/02-net-tweaks/00-run.sh
  9. +4
    -4
      stage2/01-sys-tweaks/01-run.sh
  10. +1
    -1
      stage2/03-cleanup/00-run.sh
  11. +1
    -1
      stage3/00-install-packages/01-run.sh
  12. +1
    -1
      stage4/03-cleanup/00-run.sh

+ 4
- 4
build.sh View File

@ -7,7 +7,7 @@ run_sub_stage()
for i in {00..99}; do
if [ -f ${i}-debconf ]; then
log "Begin ${SUB_STAGE_DIR}/${i}-debconf"
on_chroot sh -e - << EOF
on_chroot << EOF
debconf-set-selections <<SELEOF
`cat ${i}-debconf`
SELEOF
@ -18,7 +18,7 @@ EOF
log "Begin ${SUB_STAGE_DIR}/${i}-packages-nr"
PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < ${i}-packages-nr)"
if [ -n "$PACKAGES" ]; then
on_chroot sh -e - << EOF
on_chroot << EOF
apt-get install --no-install-recommends -y $PACKAGES
EOF
fi
@ -28,7 +28,7 @@ EOF
log "Begin ${SUB_STAGE_DIR}/${i}-packages"
PACKAGES="$(sed -f "${SCRIPT_DIR}/remove-comments.sed" < ${i}-packages)"
if [ -n "$PACKAGES" ]; then
on_chroot sh -e - << EOF
on_chroot << EOF
apt-get install -y $PACKAGES
EOF
fi
@ -69,7 +69,7 @@ EOF
fi
if [ -f ${i}-run-chroot ]; then
log "Begin ${SUB_STAGE_DIR}/${i}-run-chroot"
on_chroot sh -e - < ${i}-run-chroot
on_chroot < ${i}-run-chroot
log "End ${SUB_STAGE_DIR}/${i}-run-chroot"
fi
done

+ 1
- 0
depends View File

@ -4,3 +4,4 @@ debootstrap
kpartx zerofree
pxz zip
mkdosfs:dosfstools
capsh:libcap2-bin

+ 1
- 1
export-image/01-set-sources/01-run.sh View File

@ -1,6 +1,6 @@
#!/bin/bash -e
on_chroot sh -e - <<EOF
on_chroot << EOF
apt-get update
apt-get -y dist-upgrade
apt-get clean

+ 1
- 1
export-image/03-finalise/01-run.sh View File

@ -2,7 +2,7 @@
IMG_FILE="${STAGE_WORK_DIR}/${IMG_DATE}-${IMG_NAME}${IMG_SUFFIX}.img"
on_chroot sh -e - <<EOF
on_chroot << EOF
/etc/init.d/fake-hwclock stop
hardlink -t /usr/share/doc
EOF

+ 3
- 3
scripts/common View File

@ -14,10 +14,10 @@ bootstrap(){
local BOOTSTRAP_CMD=debootstrap
fi
${BOOTSTRAP_CMD} --components=main,contrib,non-free \
capsh --drop=cap_setfcap -- -c "${BOOTSTRAP_CMD} --components=main,contrib,non-free \
--arch armhf\
--no-check-gpg \
$1 $2 $3
$1 $2 $3"
}
export -f bootstrap
@ -80,7 +80,7 @@ on_chroot() {
mount --bind /sys ${ROOTFS_DIR}/sys
fi
chroot ${ROOTFS_DIR}/ "[email protected]"
capsh --drop=cap_setfcap --chroot=${ROOTFS_DIR}/ -- "[email protected]"
}
export -f on_chroot

+ 1
- 1
stage0/01-configure-apt/00-run.sh View File

@ -11,7 +11,7 @@ else
fi
on_chroot apt-key add - < files/raspberrypi.gpg.key
on_chroot sh -e - << EOF
on_chroot << EOF
apt-get update
apt-get dist-upgrade -y
EOF

+ 1
- 1
stage1/01-sys-tweaks/00-run.sh View File

@ -5,7 +5,7 @@ install -m 644 files/noclear.conf ${ROOTFS_DIR}/etc/systemd/system/[email protected]
install -m 744 files/policy-rc.d ${ROOTFS_DIR}/usr/sbin/policy-rc.d #TODO: Necessary in systemd?
install -v -m 644 files/fstab ${ROOTFS_DIR}/etc/fstab
on_chroot sh -e - <<EOF
on_chroot << EOF
if ! id -u pi >/dev/null 2>&1; then
adduser --disabled-password --gecos "" pi
fi

+ 1
- 1
stage1/02-net-tweaks/00-run.sh View File

@ -4,6 +4,6 @@ install -m 644 files/ipv6.conf ${ROOTFS_DIR}/etc/modprobe.d/ipv6.conf
install -m 644 files/interfaces ${ROOTFS_DIR}/etc/network/interfaces
install -m 644 files/hostname ${ROOTFS_DIR}/etc/hostname
on_chroot sh -e - << EOF
on_chroot << EOF
dpkg-divert --add --local /lib/udev/rules.d/75-persistent-net-generator.rules
EOF

+ 4
- 4
stage2/01-sys-tweaks/01-run.sh View File

@ -10,7 +10,7 @@ install -m 644 files/ttyoutput.conf ${ROOTFS_DIR}/etc/systemd/system/rc-local.
install -m 644 files/50raspi ${ROOTFS_DIR}/etc/apt/apt.conf.d/
on_chroot sh -e - <<EOF
on_chroot << EOF
systemctl disable hwclock.sh
systemctl disable nfs-common
systemctl disable rpcbind
@ -20,7 +20,7 @@ systemctl enable apply_noobs_os_config
systemctl enable resize2fs_once
EOF
on_chroot sh -e - << \EOF
on_chroot << \EOF
for GRP in input spi i2c gpio; do
groupadd -f -r $GRP
done
@ -29,11 +29,11 @@ for GRP in adm dialout cdrom audio users sudo video games plugdev input gpio spi
done
EOF
on_chroot sh -e - <<EOF
on_chroot << EOF
setupcon --force --save-only -v
EOF
on_chroot sh -e - <<EOF
on_chroot << EOF
usermod --pass='*' root
EOF

+ 1
- 1
stage2/03-cleanup/00-run.sh View File

@ -1,5 +1,5 @@
#!/bin/bash -e
on_chroot sh -e - <<EOF
on_chroot << EOF
apt-get clean
EOF

+ 1
- 1
stage3/00-install-packages/01-run.sh View File

@ -1,6 +1,6 @@
#!/bin/bash -e
on_chroot sh -e - <<EOF
on_chroot << EOF
update-alternatives --install /usr/bin/x-www-browser \
x-www-browser /usr/bin/chromium-browser 86
update-alternatives --install /usr/bin/gnome-www-browser \

+ 1
- 1
stage4/03-cleanup/00-run.sh View File

@ -1,5 +1,5 @@
#!/bin/bash -e
on_chroot sh -e - <<EOF
on_chroot << EOF
apt-get clean
EOF

Loading…
Cancel
Save