59 lines
2.5 KiB
Makefile
59 lines
2.5 KiB
Makefile
HARDENED = $(CHROOT)/var/tmp/hardened
|
|
PAM_SSH_AGENT_AUTH = $(CHROOT)/var/tmp/pam_ssh_agent_auth
|
|
ADMINUSER = $(CHROOT)/var/tmp/adminuser
|
|
timesyncd_conf = $(CHROOT)/etc/systemd/timesyncd.conf
|
|
01firstboot = $(CHROOT)/usr/local/bin/01firstboot.start
|
|
network_example = $(CHROOT)/00-eth0.network.example
|
|
tmux_conf = $(CHROOT)//root/.tmux.conf
|
|
|
|
$(HARDENED):
|
|
mkdir -p $(CHROOT)/etc/portage/profile
|
|
echo "-hardened" >> $(CHROOT)/etc/portage/profile/use.mask
|
|
RUN $(EMERGE) $(USEPKG) --oneshot gcc
|
|
RUN $(EMERGE) $(USEPKG) --oneshot binutils virtual/libc
|
|
RUN $(EMERGE) --depclean --with-bdeps=n
|
|
-$(gcc_config)
|
|
RUN $(EMERGE) $(USEPKG) --emptytree @world
|
|
RUN $(EMERGE) --depclean --with-bdeps=n
|
|
RUN bash -c 'yes YES | etc-update --automode -9'
|
|
ifneq ($(EXTERNAL_KERNEL),YES)
|
|
if ! grep -q "$(shell /usr/bin/gcc --version | grep gcc)" "$(shell cat $(KERNEL_PATH))/.config"; then \
|
|
RUN $(EMERGE) $(USEPKG) --onlydeps --oneshot --noreplace sys-kernel/$(KERNEL_PKG); \
|
|
RUN make -C /usr/src/linux MAKEOPTS=$(MAKEOPTS) clean oldconfig $(KERNEL_MODULES_PREPARE); \
|
|
fi
|
|
endif
|
|
touch $(HARDENED)
|
|
|
|
$(timesyncd_conf): default/timesyncd.conf
|
|
cp $< $@
|
|
|
|
$(01firstboot): default/01firstboot.start default/bashrc.firstboot
|
|
mkdir -p $(CHROOT)/usr/local/bin
|
|
cp $< $@
|
|
cat default/bashrc.firstboot >> $(CHROOT)/home/admin/.bashrc
|
|
touch $(CHROOT)/01firstboot
|
|
|
|
$(network_example): default/00-eth0.network
|
|
cp $< $@
|
|
|
|
$(tmux_conf): default/tmux.conf
|
|
RUN systemctl enable tmux@root.service
|
|
cp $< $@
|
|
|
|
$(PAM_SSH_AGENT_AUTH):
|
|
sed -i 's/# %wheel ALL=(ALL:ALL) NOPASSWD: ALL/%wheel ALL=(ALL:ALL) NOPASSWD: ALL/' $(CHROOT)/etc/sudoers
|
|
sed -i 's#^auth.*$$#auth sufficient pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth required pam_env.so readenv=1 user_readenv=0\nsession required pam_env.so readenv=1 user_readenv=0\nauth substack system-auth#' $(CHROOT)/etc/pam.d/sudo
|
|
sed -i 's#^auth.*$$#auth sufficient pam_ssh_agent_auth.so file=~/.ssh/authorized_keys\nauth required pam_env.so readenv=1 user_readenv=0\nsession required pam_env.so readenv=1 user_readenv=0\nauth substack system-auth#' $(CHROOT)/etc/pam.d/sudo-i
|
|
mkdir -p $(CHROOT)/etc/sudoers.d
|
|
echo "Defaults env_keep += SSH_AUTH_SOCK" > $(CHROOT)/etc/sudoers.d/ssh_auth_sock
|
|
touch $(PAM_SSH_AGENT_AUTH)
|
|
|
|
$(ADMINUSER):
|
|
-RUN useradd -m -G users,wheel -s /bin/bash --comment="virtual appliance admin" --uid 2000 admin
|
|
RUN passwd -d admin; $(inroot) passwd -e admin
|
|
touch $(ADMINUSER)
|
|
|
|
preinstall: $(HARDENED)
|
|
|
|
postinstall: $(PAM_SSH_AGENT_AUTH) $(ADMINUSER) $(timesyncd_conf) $(01firstboot) $(network_example) $(tmux_conf)
|