-
-
Notifications
You must be signed in to change notification settings - Fork 27
/
Copy pathprepare-chroot-ubuntu
executable file
·150 lines (132 loc) · 6.1 KB
/
prepare-chroot-ubuntu
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
#!/bin/bash
# vim: set ts=4 sw=4 sts=4 et :
if [ "$VERBOSE" -ge 2 -o "$DEBUG" == "1" ]; then
set -x
fi
# ------------------------------------------------------------------------------
# Configuration
# $1: chroot directory [chroot-trusty ]
# $2: distribution [trusty ]
# ------------------------------------------------------------------------------
DIR=$1
DIST=$2
set -e
# ------------------------------------------------------------------------------
# Build packages to be installed to allow building of Qubes modules
# ------------------------------------------------------------------------------
BUILDPACKAGES="reprepro build-essential devscripts git git-buildpackage pbuilder debhelper quilt libxen-dev libpulse-dev libtool automake xorg-dev xutils-dev libxdamage-dev libxcomposite-dev libxt-dev libx11-dev equivs"
if [ ${DIST} == 'jammy' ]; then
BUILDPACKAGES+=" python-is-python3"
else
BUILDPACKAGES+=" python"
fi
if [ "0${BUILDER_TURBO_MODE}" -gt 0 ]; then
APT_GET_OPTIONS+=" -o Dpkg::Options::=--force-unsafe-io"
eatmydata_maybe=eatmydata
fi
APT_GET_OPTIONS+=" -o Acquire::Retries=3"
if [ -n "${REPO_PROXY}" ]; then
APT_GET_OPTIONS+=" -o Acquire::http::Proxy=${REPO_PROXY}"
DEBOOTSTRAP_PREFIX+=" env http_proxy=${REPO_PROXY}"
fi
INITIAL=
if ! [ -d $DIR/home/user ]; then
# --------------------------------------------------------------------------
# Install Ubuntu choot if /home/user does not exist (initial run)
# --------------------------------------------------------------------------
INITIAL=1
mkdir -p $DIR
echo "-> Installing Ubuntu build chroot..."
retry=0
apt_https_pkgs="apt-transport-https,ca-certificates"
while ! COMPONENTS="" $DEBOOTSTRAP_PREFIX debootstrap --arch=amd64 \
--include=ncurses-term,ubuntu-keyring,$eatmydata_maybe \
--keyring=${DEBIAN_PLUGIN_DIR}/keys/$DIST-ubuntu-archive-keyring.gpg \
$DIST $DIR http://archive.ubuntu.com/ubuntu
do
if [ $retry -le 3 ]; then
cat "$DIR/debootstrap/debootstrap.log"
echo "Error in debootstrap. Sleeping 60 sec before retrying..."
retry=$((retry + 1))
sleep 60
else
cat "$DIR/debootstrap/debootstrap.log"
echo "Error in debootstrap. Aborting due to too much retries."
exit 1
fi
done
# --------------------------------------------------------------------------
# Set up a temporary policy-rc.d to prevent apt from starting services
# on package installation
# --------------------------------------------------------------------------
cat > $DIR/usr/sbin/policy-rc.d <<EOF
#!/bin/sh
return 101 # Action forbidden by policy
EOF
chmod 755 $DIR/usr/sbin/policy-rc.d
# --------------------------------------------------------------------------
# Add some groups and users
# --------------------------------------------------------------------------
[ -n "$SUDO_UID" ] && USER_OPTS="-u $SUDO_UID"
[ -n "$USER_UID" ] && USER_OPTS="-u $USER_UID"
# Added -f to ignore if group already exists
if [ -n "$USER_GID" ]; then
chroot $DIR groupadd -f -g $USER_GID user
elif [ -n "$SUDO_GID" ]; then
chroot $DIR groupadd -f -g $SUDO_GID user
else
chroot $DIR groupadd user
fi
chroot $DIR sh -c "useradd -g user $USER_OPTS -m user;su -c 'mkdir qubes-src' - user"
# --------------------------------------------------------------------------
# /dev/null should be 0666
# --------------------------------------------------------------------------
chroot $DIR sh -c "chmod 0666 /dev/null"
else
# --------------------------------------------------------------------------
# /home/user directory already exists, so above stage already complete so
# temporary remove builder repo, it will be recreated at the end of this
# script
# --------------------------------------------------------------------------
rm -f $DIR/etc/apt/sources.list.d/qubes-builder.list
# update chroot
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y upgrade
fi
# ------------------------------------------------------------------------------
# Mount /proc within chroot environment
# ------------------------------------------------------------------------------
if ! [ -r $DIR/proc/cpuinfo ]; then
mount -t proc proc $DIR/proc
fi
# ------------------------------------------------------------------------------
# Add universe to sources.list
# ------------------------------------------------------------------------------
sed -i "s/${DIST} main\s*$/${DIST} main universe/g" $DIR/etc/apt/sources.list
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
# ------------------------------------------------------------------------------
# Install all build packages specified
# ------------------------------------------------------------------------------
chroot $DIR $eatmydata_maybe apt-get $APT_GET_OPTIONS -y install $BUILDPACKAGES
if [ $DIST = trusty ]; then
# Install pulseaudio5
chroot $DIR apt-get $APT_GET_OPTIONS install -y software-properties-common
chroot $DIR add-apt-repository -y ppa:ubuntu-audio-dev/pulse-testing
chroot $DIR apt-get $APT_GET_OPTIONS update
# check for CVE-2016-1252 - directly after debootstrap, still vulnerable
# apt is installed
fi
wc -L "${DIR}/var/lib/apt/lists/"*InRelease | awk '$1 > 1024 {print; exit 1}'
chroot $DIR apt-get $APT_GET_OPTIONS install -y libpulse-dev
# ------------------------------------------------------------------------------
# Update Ubuntu apt sources list to use local qubes repo
# ------------------------------------------------------------------------------
cat > $DIR/etc/apt/sources.list.d/qubes-builder.list <<EOF
deb [trusted=yes] file:/tmp/qubes-deb $DIST main
EOF