Jason Mehring
10 years ago
parent
f5ede83def
commit
82a68e9c87
@ -0,0 +1,15 @@
|
||||
Package: grub-pc
|
||||
Pin: version *
|
||||
Pin-Priority: -100
|
||||
|
||||
Package: grub-pc-bin
|
||||
Pin: version *
|
||||
Pin-Priority: -100
|
||||
|
||||
Package: grub-common
|
||||
Pin: version *
|
||||
Pin-Priority: -100
|
||||
|
||||
Package: grub2-common
|
||||
Pin: version *
|
||||
Pin-Priority: -100
|
||||
@ -0,0 +1,8 @@
|
||||
## This file is part of Whonix.
|
||||
## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
|
||||
## See the file COPYING for copying conditions.
|
||||
|
||||
[Desktop Entry]
|
||||
Type=Application
|
||||
Terminal=false
|
||||
Exec=/usr/lib/whonix/qubes-whonixsetup
|
||||
Binary file not shown.
@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
# vim: set ts=4 sw=4 sts=4 et :
|
||||
|
||||
set -x
|
||||
|
||||
WHONIX_DIR="$(readlink -m .)"
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# Initialize Whonix submodules
|
||||
# --------------------------------------------------------------------------
|
||||
pushd "${WHONIX_DIR}"
|
||||
{
|
||||
sudo git submodule update --init --recursive;
|
||||
}
|
||||
popd
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# Patch Whonix submodules
|
||||
# --------------------------------------------------------------------------
|
||||
|
||||
# Chekout a branch; create a branch first if it does not exist
|
||||
checkout_branch() {
|
||||
branch=$(git symbolic-ref --short -q HEAD)
|
||||
if ! [ "${branch}" == "${1}" ]; then
|
||||
sudo -u "${user_name}" git checkout "${1}" >/dev/null 2>&1 || \
|
||||
{
|
||||
sudo -u "${user_name}" git branch "${1}"
|
||||
sudo -u "${user_name}" git checkout "${1}"
|
||||
}
|
||||
fi
|
||||
}
|
||||
|
||||
# sed search and replace. return 0 if replace happened, otherwise 1
|
||||
search_replace() {
|
||||
local search="${1}"
|
||||
local replace="${2}"
|
||||
local file="${3}"
|
||||
|
||||
sed -i.bak '/'"${search}"'/,${s//'"${replace}"'/;b};$q1' "${file}"
|
||||
}
|
||||
|
||||
# Patch anon-meta-packages to not depend on grub-pc
|
||||
pushd "${WHONIX_DIR}"
|
||||
{
|
||||
search_replace "grub-pc" "" "grml_packages" || :
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "${WHONIX_DIR}/packages/anon-meta-packages/debian"
|
||||
{
|
||||
search1=" grub-pc,";
|
||||
replace="";
|
||||
|
||||
#checkout_branch qubes
|
||||
search_replace "${search1}" "${replace}" control && \
|
||||
{
|
||||
cd "${WHONIX_DIR}/packages/anon-meta-packages";
|
||||
:
|
||||
#sudo -E -u "${user_name}" make deb-pkg || :
|
||||
#su "${user_name}" -c "dpkg-source --commit" || :
|
||||
#git add .
|
||||
#su "${user_name}" -c "git commit -am 'removed grub-pc depend'"
|
||||
} || :
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "${WHONIX_DIR}/packages/anon-shared-build-fix-grub/usr/lib/anon-dist/chroot-scripts-post.d"
|
||||
{
|
||||
search1="update-grub";
|
||||
replace=":";
|
||||
|
||||
#checkout_branch qubes
|
||||
search_replace "${search1}" "${replace}" 85_update_grub && \
|
||||
{
|
||||
cd "${WHONIX_DIR}/packages/anon-shared-build-fix-grub";
|
||||
sudo -E -u "${user_name}" make deb-pkg || :
|
||||
su "${user_name}" -c "EDITOR=/bin/true dpkg-source -q --commit . no_grub";
|
||||
#git add . ;
|
||||
#su "${user_name}" -c "git commit -am 'removed grub-pc depend'"
|
||||
} || :
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "${WHONIX_DIR}/build-steps.d"
|
||||
{
|
||||
search1=" check_for_uncommited_changes";
|
||||
replace=" #check_for_uncommited_changes";
|
||||
|
||||
search_replace "${search1}" "${replace}" 1200_create-debian-packages || :
|
||||
}
|
||||
popd
|
||||
|
||||
@ -0,0 +1,60 @@
|
||||
#!/bin/bash
|
||||
# vim: set ts=4 sw=4 sts=4 et :
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Whonix Post Installation Configurations
|
||||
# ------------------------------------------------------------------------------
|
||||
echo "Post Configuring Whonix System"
|
||||
|
||||
pushd "/etc/network"
|
||||
{
|
||||
rm -f interfaces;
|
||||
ln -s interfaces.backup interfaces;
|
||||
}
|
||||
popd
|
||||
|
||||
pushd "/etc"
|
||||
{
|
||||
rm -f resolv.conf;
|
||||
cp -p resolv.conf.backup resolv.conf;
|
||||
}
|
||||
popd
|
||||
|
||||
# Enable Tor
|
||||
#if [ "${TEMPLATE_FLAVOR}" == "whonix-gateway" ]; then
|
||||
# sed -i 's/#DisableNetwork 0/DisableNetwork 0/g' "/etc/tor/torrc"
|
||||
#fi
|
||||
|
||||
# Fake that whonixsetup was already run
|
||||
#mkdir -p "/var/lib/whonix/do_once"
|
||||
#touch "/var/lib/whonix/do_once/whonixsetup.done"
|
||||
|
||||
# Fake that initializer was already run
|
||||
mkdir -p "/root/.whonix"
|
||||
touch "/root/.whonix/first_run_initializer.done"
|
||||
|
||||
# Prevent whonixcheck error
|
||||
echo 'WHONIXCHECK_NO_EXIT_ON_UNSUPPORTED_VIRTUALIZER="1"' >> "/etc/whonix.d/30_whonixcheck_default"
|
||||
|
||||
# Use gdialog as an alternative for dialog
|
||||
update-alternatives --install /usr/bin/dialog dialog /usr/bin/gdialog 999
|
||||
|
||||
# Disable unwanted applications
|
||||
update-rc.d network-manager disable || :
|
||||
update-rc.d spice-vdagent disable || :
|
||||
update-rc.d swap-file-creator disable || :
|
||||
update-rc.d whonix-initializer disable || :
|
||||
|
||||
service apt-cacher-ng stop || :
|
||||
update-rc.d apt-cacher-ng disable || :
|
||||
|
||||
# Remove apt-cacher-ng
|
||||
DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
|
||||
apt-get.anondist-orig -y --force-yes remove --purge apt-cacher-ng
|
||||
|
||||
# Remove original sources.list
|
||||
rm -f "/etc/apt/sources.list"
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
|
||||
apt-get.anondist-orig update
|
||||
|
||||
@ -0,0 +1,41 @@
|
||||
################################################################################
|
||||
# Pre Fixups
|
||||
sudo mkdir -p /boot/grub2
|
||||
sudo touch /boot/grub2/grub.cfg
|
||||
sudo mkdir -p /boot/grub
|
||||
sudo touch /boot/grub/grub.cfg
|
||||
sudo mkdir --parents --mode=g+rw "/tmp/uwt"
|
||||
|
||||
# Whonix seems to re-install sysvinit even though there is a hold
|
||||
# on the package. Things seem to work anyway. BUT hopfully the
|
||||
# hold on grub* don't get removed
|
||||
sudo apt-mark hold sysvinit
|
||||
sudo apt-mark hold grub-pc grub-pc-bin grub-common grub2-common
|
||||
|
||||
# Whonix expects haveged to be started
|
||||
sudo /etc/init.d/haveged start
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Link our build steps into Whonix build directory
|
||||
# ------------------------------------------------------------------------------
|
||||
#pushd /home/user/Whonix/build-steps.d
|
||||
#cp -pf /home/user/build-steps.d/* .
|
||||
#popd
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Whonix installation
|
||||
# ------------------------------------------------------------------------------
|
||||
export WHONIX_BUILD_UNATTENDED_PKG_INSTALL="1"
|
||||
|
||||
pushd ~/Whonix
|
||||
sudo ~/Whonix/whonix_build \
|
||||
--build $1 \
|
||||
--64bit-linux \
|
||||
--current-sources \
|
||||
--enable-whonix-apt-repository \
|
||||
--whonix-apt-repository-distribution $2 \
|
||||
--install-to-root \
|
||||
--skip-verifiable \
|
||||
--minimal-report \
|
||||
--skip-sanity-tests || { exit 1; }
|
||||
popd
|
||||
@ -0,0 +1,3 @@
|
||||
DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true \
|
||||
sudo apt-get -y --force-yes remove grub-pc grub-common grub-pc-bin grub2-common
|
||||
sudo apt-mark hold grub-common grub-pc-bin grub2-common
|
||||
@ -0,0 +1,23 @@
|
||||
#/bin/bash
|
||||
|
||||
# XXX: TODO:
|
||||
# - Make sure we can't just run this from setup-ip
|
||||
# - Alternatives? instead of deleting dialog?
|
||||
#
|
||||
# INSTALLATION NOTES:
|
||||
# - Make sure /etc/tor/torrc is disabled initially
|
||||
# - Make sure /var/lib/whonix/do_once/whonixsetup.done does not exist
|
||||
# so repo questions will be asked
|
||||
# - /etc/xdg/autostart/qubes-whonixsetup must be in place
|
||||
# - this file must be in place
|
||||
# - gdialog must have over-written dialog
|
||||
# - patches to setup-ip:
|
||||
# - bring eth1 up
|
||||
# - remove old code that was trying to get setup working
|
||||
|
||||
grep "^DisableNetwork 0$" /etc/tor/torrc || {
|
||||
sudo systemctl stop whonixcheck
|
||||
sudo systemctl stop tor
|
||||
sudo /usr/lib/whonix/setup-ip
|
||||
sudo /usr/bin/whonixsetup
|
||||
}
|
||||
@ -0,0 +1,41 @@
|
||||
################################################################################
|
||||
# Pre Fixups
|
||||
sudo mkdir -p /boot/grub2
|
||||
sudo touch /boot/grub2/grub.cfg
|
||||
sudo mkdir -p /boot/grub
|
||||
sudo touch /boot/grub/grub.cfg
|
||||
sudo mkdir --parents --mode=g+rw "/tmp/uwt"
|
||||
|
||||
# Whonix seems to re-install sysvinit even though there is a hold
|
||||
# on the package. Things seem to work anyway. BUT hopfully the
|
||||
# hold on grub* don't get removed
|
||||
sudo apt-mark hold sysvinit
|
||||
sudo apt-mark hold grub-pc grub-pc-bin grub-common grub2-common
|
||||
|
||||
# Whonix expects haveged to be started
|
||||
sudo /etc/init.d/haveged start
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Link our build steps into Whonix build directory
|
||||
# ------------------------------------------------------------------------------
|
||||
#pushd /home/user/Whonix/build-steps.d
|
||||
#cp -pf /home/user/build-steps.d/* .
|
||||
#popd
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Whonix installation
|
||||
# ------------------------------------------------------------------------------
|
||||
export WHONIX_BUILD_UNATTENDED_PKG_INSTALL="1"
|
||||
|
||||
pushd ~/Whonix
|
||||
sudo ~/Whonix/whonix_build \
|
||||
--build $1 \
|
||||
--64bit-linux \
|
||||
--current-sources \
|
||||
--enable-whonix-apt-repository \
|
||||
--whonix-apt-repository-distribution $2 \
|
||||
--install-to-root \
|
||||
--skip-verifiable \
|
||||
--minimal-report \
|
||||
--skip-sanity-tests || { exit 1; }
|
||||
popd
|
||||
@ -0,0 +1,157 @@
|
||||
#!/bin/bash
|
||||
# vim: set ts=4 sw=4 sts=4 et :
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Source external scripts
|
||||
# ------------------------------------------------------------------------------
|
||||
. ${SCRIPTSDIR}/vars.sh
|
||||
. ./umount_kill.sh >/dev/null
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Configurations
|
||||
# ------------------------------------------------------------------------------
|
||||
if [ "${VERBOSE}" -ge 2 -o "${DEBUG}" == "1" ]; then
|
||||
set -x
|
||||
else
|
||||
set -e
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# XXX: Create a snapshot - Only for DEBUGGING!
|
||||
# ------------------------------------------------------------------------------
|
||||
# Only execute if SNAPSHOT is set
|
||||
if [ "${SNAPSHOT}" == "1" ]; then
|
||||
splitPath "${IMG}" path_parts
|
||||
PREPARED_IMG="${path_parts[dir]}${path_parts[base]}-updated${path_parts[dotext]}"
|
||||
|
||||
if ! [ -f "${PREPARED_IMG}" ] && ! [ -f "${INSTALLDIR}/tmp/.whonix_prepared" ]; then
|
||||
umount_kill "${INSTALLDIR}" || :
|
||||
warn "Copying ${IMG} to ${PREPARED_IMG}"
|
||||
cp -f "${IMG}" "${PREPARED_IMG}"
|
||||
mount -o loop "${IMG}" "${INSTALLDIR}" || exit 1
|
||||
for fs in /dev /dev/pts /proc /sys /run; do mount -B $fs "${INSTALLDIR}/$fs"; done
|
||||
fi
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Set defualts for apt not to install recommended or extra packages
|
||||
# ------------------------------------------------------------------------------
|
||||
#read -r -d '' WHONIX_APT_PREFERENCES <<'EOF'
|
||||
#Acquire::Languages "none";
|
||||
#APT::Install-Recommends "false";
|
||||
#APT::Install-Suggests "false";
|
||||
#Dpkg::Options "--force-confold";
|
||||
#EOF
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Cleanup function
|
||||
# ------------------------------------------------------------------------------
|
||||
function cleanup() {
|
||||
error "Whonix error; umounting ${INSTALLDIR} to prevent further writes"
|
||||
umount_kill "${INSTALLDIR}" || :
|
||||
exit 1
|
||||
}
|
||||
trap cleanup ERR
|
||||
trap cleanup EXIT
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Mount devices, etc required for Whonix installation
|
||||
# ------------------------------------------------------------------------------
|
||||
if ! [ -f "${INSTALLDIR}/tmp/.whonix_prepared" ]; then
|
||||
info "Preparing Whonix system"
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# Qubes needs a user named 'user'
|
||||
# --------------------------------------------------------------------------
|
||||
debug "Whonix Add user"
|
||||
chroot "${INSTALLDIR}" id -u 'user' >/dev/null 2>&1 || \
|
||||
{
|
||||
chroot "${INSTALLDIR}" groupadd -f user
|
||||
chroot "${INSTALLDIR}" useradd -g user -G dialout,cdrom,floppy,sudo,audio,dip,video,plugdev -m -s /bin/bash user
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Copy over any extra files
|
||||
# ------------------------------------------------------------------------------
|
||||
copyTree "files"
|
||||
|
||||
touch "${INSTALLDIR}/tmp/.whonix_prepared"
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Install Whonix
|
||||
# ------------------------------------------------------------------------------
|
||||
if [ -f "${INSTALLDIR}/tmp/.whonix_prepared" ] && ! [ -f "${INSTALLDIR}/tmp/.whonix_installed" ]; then
|
||||
info "Installing Whonix system"
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Create Whonix mount point
|
||||
# ------------------------------------------------------------------------------
|
||||
if ! [ -d "${INSTALLDIR}/home/user/Whonix" ]; then
|
||||
debug "Installing Whonix build environment..."
|
||||
chroot "${INSTALLDIR}" su user -c 'mkdir /home/user/Whonix'
|
||||
fi
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# Install Whonix code base
|
||||
# --------------------------------------------------------------------------
|
||||
if [ -d "${INSTALLDIR}/home/user/Whonix" ]; then
|
||||
debug "Building Whonix..."
|
||||
mount --bind "../Whonix" "${INSTALLDIR}/home/user/Whonix"
|
||||
sync
|
||||
sleep 1
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Determine type of Whonix build
|
||||
# ------------------------------------------------------------------------------
|
||||
if [ "${TEMPLATE_FLAVOR}" == "whonix-gateway" ]; then
|
||||
BUILD_TYPE="--torgateway"
|
||||
elif [ "${TEMPLATE_FLAVOR}" == "whonix-workstation" ]; then
|
||||
BUILD_TYPE="--torworkstation"
|
||||
else
|
||||
error "Incorrent Whonix type \"${TEMPLATE_FLAVOR}\" selected. Not building Whonix modules"
|
||||
error "You need to set TEMPLATE_FLAVOR environment variable to either"
|
||||
error "whonix-gateway OR whonix-workstation"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Start Whonix build process
|
||||
# ------------------------------------------------------------------------------
|
||||
chroot "${INSTALLDIR}" su user -c "cd ~; ./whonix_build.sh ${BUILD_TYPE} ${DIST}" || { exit 1; }
|
||||
|
||||
touch "${INSTALLDIR}/tmp/.whonix_installed"
|
||||
touch "${INSTALLDIR}/tmp/.whonix_post"
|
||||
fi
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Execute any template flavor or sub flavor scripts
|
||||
# ------------------------------------------------------------------------------
|
||||
buildStep "99_custom_configuration.sh"
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Bring back original apt-get for installation of Qubues
|
||||
# ------------------------------------------------------------------------------
|
||||
pushd "${INSTALLDIR}/usr/bin"
|
||||
{
|
||||
rm -f apt-get;
|
||||
cp -p apt-get.anondist-orig apt-get;
|
||||
}
|
||||
popd
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Make sure the temporary policy-rc.d to prevent apt from starting services
|
||||
# on package installation is still active; Whonix may have reset it
|
||||
# ------------------------------------------------------------------------------
|
||||
cat > "${INSTALLDIR}/usr/sbin/policy-rc.d" <<EOF
|
||||
#!/bin/sh
|
||||
return 101 # Action forbidden by policy
|
||||
EOF
|
||||
chmod 755 "${INSTALLDIR}/usr/sbin/policy-rc.d"
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Leave cleanup to calling function
|
||||
# ------------------------------------------------------------------------------
|
||||
trap - ERR EXIT
|
||||
trap
|
||||
Loading…
Reference in new issue