matt/patronageos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hardened malloc, working firewall.

Browse Source
This commit is contained in:
matt
2026-02-08 08:49:55 -07:00
parent d26067b2fa
commit 5b7a3ccd9b
41 changed files with 1141 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/boot_image.sh
View File

@@ -4,5 +4,5 @@ cd ..
disk="./outputs/boot_image.img"
qemu-system-x86_64 -bios /usr/share/ovmf/OVMF.fd -drive if=none,format=raw,file=$disk,id=hd -device virtio-blk-pci,drive=hd -m 16G -smp 8 -vga none --display default,gl=off -usb -device virtio-tablet-pci -device virtio-keyboard-pci --device virtio-gpu-pci -usb -enable-kvm -machine type=pc-q35-3.1,accel=kvm,kernel_irqchip=on -netdev user,id=net0 -device virtio-net-pci,netdev=net0,mac=52:54:00:12:34:56
qemu-system-x86_64 -bios /usr/share/ovmf/OVMF.fd -drive if=none,format=raw,file=$disk,id=hd -device virtio-blk-pci,drive=hd -m 16G -smp 8 -vga none --display default,gl=off -usb -device virtio-tablet-pci -device virtio-keyboard-pci --device virtio-gpu-pci -usb -enable-kvm -machine type=q35,accel=kvm,kernel_irqchip=on -netdev user,id=net0 -device virtio-net-pci,netdev=net0,mac=52:54:00:12:34:56
#--display gtk,gl=off --device virtio-gpu

33
scripts/build_filesystem.sh
View File

@@ -1,5 +1,6 @@
#!/bin/bash
set -e
set -x
if [ "$(id -u)" -ne 0 ]; then
echo "switching from $(id -un) to root"
exec sudo "$0" "$@"
@@ -19,21 +20,49 @@ if mountpoint -q "./outputs/root/proc/"; then
fi
rsync -a ./outputs/root/ ./outputs/chroot/
mkdir -p ./outputs/chroot/proc
mount --bind /proc ./outputs/chroot/proc
cp ./config/filesystem_chroot_install.sh ./outputs/chroot/filesystem_chroot_install.sh
cp ./config/apply_initial_host_configuration.sh ./outputs/chroot/apply_initial_host_configuration.sh
cp ./config/config.json ./outputs/chroot/config.json
#copy opensnitch rules.
echo "copying firewall rules"
mkdir -p ./outputs/chroot/etc/
mkdir -p ./outputs/chroot/etc/opensnitchd/
rsync -a ./config/settings/opensnitch/ ./outputs/chroot/etc/opensnitchd/
#setup user skeleton
sudo mkdir -p ./outputs/chroot/etc/skel/.config
printf "yes" | tee ./outputs/chroot/etc/skel/.config/gnome-initial-setup-done
cp ./config/settings/skel/bash_profile ./outputs/chroot/etc/skel/.bash_profile
cp ./config/settings/skel/bashrc ./outputs/chroot/etc/skel/.bashrc
cp ./config/settings/skel/profile ./outputs/chroot/etc/skel/.profile
cp ./config/settings/skel/gnome_settings.sh ./outputs/chroot/usr/gnome_settings.sh
chmod +x ./outputs/chroot/usr/gnome_settings.sh
#installing hardened memory allocator if built
if [ -f ./dependencies/hardened_malloc/Makefile ]; then
rsync -a ./dependencies/hardened_malloc/ ./outputs/chroot/usr/src/hardened_malloc/
fi
cp ./config/settings/services/*.service ./outputs/chroot/etc/systemd/system/
find ./config/settings/services/ -type f -name '*.sh' -exec chmod +x {} \;
cp ./config/settings/services/*.sh ./outputs/chroot/usr/
echo "installing system from within chroot"
chmod +x ./outputs/chroot/filesystem_chroot_install.sh
chmod +x ./outputs/chroot/apply_initial_host_configuration.sh
mkdir -p ./outputs/chroot/lib/modules/
echo "installing kernel modules"
rsync -a ./dependencies/linux/modules/lib/modules/ ./outputs/chroot/lib/modules/
echo "installing filesystem"
chroot ./outputs/chroot /bin/bash -c "/filesystem_chroot_install.sh"
chroot ./outputs/chroot /bin/bash -c "/apply_initial_host_configuration.sh"
cp ./config/settings/skel/autorun.desktop ./outputs/chroot/etc/xdg/autostart/autorun.desktop
cd $DIR

2
scripts/build_image.sh
View File

@@ -1,7 +1,7 @@
#!/bin/bash
if [ "$(id -u)" -ne 0 ]; then
echo "switching from $(id -un) to root"
exec sudo "$0" "$@"
exec sudo ionice -c 3 "$0" "$@"
fi
set -e
cd "$(dirname "$0")"

2
scripts/install_dependencies.sh
View File

@@ -4,7 +4,7 @@ if [ "$(id -u)" -ne 0 ]; then
exec sudo "$0" "$@"
fi
set -e
list="kpartx podman debootstrap "
list="kpartx podman debootstrap qemu-system"
apt update
for item in $list; do
apt install -y $item