69 lines
3.3 KiB
Makefile
69 lines
3.3 KiB
Makefile
OT_VER ?= 0.54.2
|
|
OT_SUBVER ?= b
|
|
OT_TARBALL = oletools-$(OT_VER).tar.gz
|
|
OT_URL = https://github.com/decalage2/oletools/releases/download/v$(OT_VER)$(OT_SUBVER)/$(OT_TARBALL)
|
|
|
|
OF_COMMIT ?= 7929bd927eaa93d1d67a0cfa6da7bed2be57ca15
|
|
OF_TARBALL = $(OF_COMMIT).tar.gz
|
|
OF_URL = https://github.com/HeinleinSupport/olefy/archive/$(OF_TARBALL)
|
|
|
|
preinstall:
|
|
# hardcoded users and groups
|
|
$(inroot) useradd --system --comment="created from appliance building - zabbix user" --home-dir="/var/lib/zabbix/home" --shell="/sbin/nologin" --no-create-home --uid 600 --user-group zabbix
|
|
$(inroot) useradd --system --comment="created from appliance building - clamav user" --home-dir="/dev/null" --shell="/sbin/nologin" --no-create-home --uid 601 --user-group clamav
|
|
$(inroot) useradd --system --comment="created from appliance building - rspamd user" --home-dir="/var/lib/rspamd" --shell="/sbin/nologin" --no-create-home --uid 602 --user-group rspamd
|
|
$(inroot) useradd --system --comment="created from appliance building - olefy user" --home-dir="/dev/null" --shell="/sbin/nologin" --no-create-home --uid 603 --user-group olefy
|
|
# switch to hardened, build hardened toolchain, rebuild everything
|
|
mkdir -p $(CHROOT)/etc/portage/profile
|
|
echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
|
|
$(inroot) $(EMERGE) $(USEPKG) --oneshot gcc
|
|
$(inroot) $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
|
|
-$(gcc_config)
|
|
$(inroot) $(EMERGE) $(USEPKG) --emptytree @world
|
|
$(inroot) bash -c 'yes YES | etc-update --automode -9'
|
|
|
|
# Unitas-Portage-Overlay einbinden
|
|
$(inroot) $(EMERGE) -n $(USEPKG) app-portage/layman
|
|
sed -i 's/check_official : Yes/check_official : No/' $(CHROOT)/etc/layman/layman.cfg
|
|
wget -P $(CHROOT)/etc/layman/overlays http://dev.unitas-network.de/raw/Gentoo/Unitas.git/master/unitas-overlays.xml
|
|
$(inroot) layman -l | grep -q unitas || $(inroot) layman -La unitas
|
|
|
|
install_oletools:
|
|
$(inroot) test -f /usr/portage/distfiles/$(OT_TARBALL) || \
|
|
$(inroot) wget -P /usr/portage/distfiles $(OT_URL)
|
|
$(inroot) sh -c 'tar xf /usr/portage/distfiles/$(OT_TARBALL) -C /tmp && cd /tmp/oletools-$(OT_VER) && python setup.py install'
|
|
|
|
install_olefy:
|
|
$(inroot) test -f /usr/portage/distfiles/$(OF_TARBALL) || \
|
|
$(inroot) wget -P /usr/portage/distfiles $(OF_URL)
|
|
$(inroot) sh -c 'tar xf /usr/portage/distfiles/$(OF_TARBALL) -C /tmp && cd /tmp/olefy-$(OF_COMMIT) && cp olefy.py /usr/bin && cp olefy.conf /etc && cp olefy.service /etc/systemd/system'
|
|
|
|
postinstall: timesyncd.conf firstboot.start
|
|
# Konfigurationen anpassen
|
|
cp timesyncd.conf $(CHROOT)/etc/systemd/timesyncd.conf
|
|
mkdir -p $(CHROOT)/etc/local.d
|
|
cp firstboot.start $(CHROOT)/etc/local.d/firstboot.start
|
|
touch $(CHROOT)/firstboot
|
|
sed -i 's/# %wheel ALL=(ALL) ALL/%wheel ALL=(ALL) ALL/' $(CHROOT)/etc/sudoers
|
|
$(inroot) useradd -m -G users,wheel -s /bin/bash admin
|
|
$(inroot) passwd -d admin; $(inroot) passwd -e admin
|
|
$(inroot) systemctl enable tmux@root.service
|
|
|
|
# Beispiel feste IP-Adresse
|
|
cp 00-eth0.network $(CHROOT)/00-eth0.network.example
|
|
|
|
# MariaDB-Konfiguration
|
|
cp mariadb/my.cnf $(CHROOT)/etc/mysql/my.cnf
|
|
cp mariadb/my.cnf.root $(CHROOT)/root/.my.cnf
|
|
chmod 0600 $(CHROOT)/root/.my.cnf
|
|
rm -rf $(CHROOT)/var/lib/mysql/*
|
|
$(inroot) bash -c 'yes gentoo | emerge --config dev-db/mariadb'
|
|
|
|
# oletools zur Office-Macro-Erkennung in rspamd
|
|
$(MAKE) install_oletools
|
|
$(MAKE) install_olefy
|
|
|
|
# Anpassungen
|
|
$(inroot) usermod -a -G clamav rspamd
|
|
clean:
|