Update and fix mini-x.sh
This commit is contained in:
Arszilla
264
mini-x.sh
264
mini-x.sh
@@ -14,82 +14,121 @@ set -e
|
||||
# debug=true
|
||||
|
||||
if [ "$debug" = true ]; then
|
||||
exec > >(tee -a -i "${0%.*}.log") 2>&1
|
||||
set -x
|
||||
exec > >(tee -a -i "${0%.*}.log") 2>&1
|
||||
set -x
|
||||
|
||||
fi
|
||||
|
||||
# Architecture
|
||||
architecture=${architecture:-"armhf"}
|
||||
|
||||
# Generate a random machine name to be used
|
||||
machine=$(tr -cd 'A-Za-z0-9' < /dev/urandom | head -c16 ; echo)
|
||||
machine=$(
|
||||
tr -cd 'A-Za-z0-9' </dev/urandom | head -c16
|
||||
echo
|
||||
)
|
||||
|
||||
# Custom hostname variable
|
||||
hostname=${2:-kali}
|
||||
|
||||
# Custom image file name variable - MUST NOT include .img at the end
|
||||
image_name=${3:-kali-linux-$1-mini-x}
|
||||
|
||||
# Suite to use, valid options are:
|
||||
# kali-rolling, kali-dev, kali-bleeding-edge, kali-dev-only, kali-experimental, kali-last-snapshot
|
||||
suite=${suite:-"kali-rolling"}
|
||||
|
||||
# Free space rootfs in MiB
|
||||
free_space="300"
|
||||
|
||||
# /boot partition in MiB
|
||||
bootsize="128"
|
||||
|
||||
# Select compression, xz or none
|
||||
compress="xz"
|
||||
|
||||
# Choose filesystem format to format (ext3 or ext4)
|
||||
fstype="ext3"
|
||||
|
||||
# If you have your own preferred mirrors, set them here
|
||||
mirror=${mirror:-"http://http.kali.org/kali"}
|
||||
|
||||
# GitLab URL Kali repository
|
||||
kaligit="https://gitlab.com/kalilinux"
|
||||
|
||||
# GitHub raw URL
|
||||
githubraw="https://raw.githubusercontent.com"
|
||||
|
||||
# Check EUID=0 you can run any binary as root
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo "This script must be run as root or have super user permissions" >&2
|
||||
echo "Use: sudo $0 ${1:-2.0} ${2:-kali}" >&2
|
||||
exit 1
|
||||
echo "This script must be run as root or have super user permissions" >&2
|
||||
echo "Use: sudo $0 ${1:-2.0} ${2:-kali}" >&2
|
||||
|
||||
exit 1
|
||||
|
||||
fi
|
||||
|
||||
# Pass version number
|
||||
if [[ $# -eq 0 ]] ; then
|
||||
echo "Please pass version number, e.g. $0 2.0, and (if you want) a hostname, default is kali" >&2
|
||||
exit 0
|
||||
if [[ $# -eq 0 ]]; then
|
||||
echo "Please pass version number, e.g. $0 2.0, and (if you want) a hostname, default is kali" >&2
|
||||
|
||||
exit 0
|
||||
|
||||
fi
|
||||
|
||||
# Check exist bsp directory
|
||||
if [ ! -e "bsp" ]; then
|
||||
echo "Error: missing bsp directory structure" >&2
|
||||
echo "Please clone the full repository ${kaligit}/build-scripts/kali-arm" >&2
|
||||
exit 255
|
||||
echo "Error: missing bsp directory structure" >&2
|
||||
echo "Please clone the full repository ${kaligit}/build-scripts/kali-arm" >&2
|
||||
|
||||
exit 255
|
||||
|
||||
fi
|
||||
|
||||
# Current directory
|
||||
repo_dir="$(pwd)"
|
||||
|
||||
# Base directory
|
||||
base_dir=${repo_dir}/minix-"$1"
|
||||
|
||||
# Working directory
|
||||
work_dir="${base_dir}/kali-${architecture}"
|
||||
|
||||
# Check directory build
|
||||
if [ -e "${base_dir}" ]; then
|
||||
echo "${base_dir} directory exists, will not continue" >&2
|
||||
exit 1
|
||||
echo "${base_dir} directory exists, will not continue" >&2
|
||||
|
||||
exit 1
|
||||
|
||||
elif [[ ${repo_dir} =~ [[:space:]] ]]; then
|
||||
echo "The directory "\"${repo_dir}"\" contains whitespace. Not supported." >&2
|
||||
exit 1
|
||||
echo "The directory "\"${repo_dir}"\" contains whitespace. Not supported." >&2
|
||||
|
||||
exit 1
|
||||
|
||||
else
|
||||
echo "The base_dir thinks it is: ${base_dir}"
|
||||
mkdir -p ${base_dir}
|
||||
echo "The base_dir thinks it is: ${base_dir}"
|
||||
mkdir -p ${base_dir}
|
||||
|
||||
fi
|
||||
|
||||
components="main,contrib,non-free"
|
||||
arm="abootimg cgpt fake-hwclock ntpdate u-boot-tools vboot-utils vboot-kernel-utils"
|
||||
base="apt-utils e2fsprogs ifupdown initramfs-tools kali-defaults kali-menu linux-image-armmp parted sudo usbutils firmware-linux firmware-atheros firmware-libertas firmware-realtek u-boot-menu u-boot-sunxi"
|
||||
desktop="kali-menu fonts-croscore fonts-crosextra-caladea fonts-crosextra-carlito kali-desktop-xfce kali-root-login lightdm network-manager network-manager-gnome xfce4 xserver-xorg-video-fbdev"
|
||||
tools="aircrack-ng ethtool hydra john libnfc-bin mfoc nmap passing-the-hash sqlmap usbutils winexe wireshark"
|
||||
|
||||
arm="abootimg cgpt fake-hwclock ntpdate u-boot-tools vboot-kernel-utils vboot-utils"
|
||||
|
||||
base="apt-utils e2fsprogs firmware-atheros firmware-libertas firmware-linux \
|
||||
firmware-realtek ifupdown initramfs-tools kali-defaults kali-menu \
|
||||
linux-image-armmp parted sudo u-boot-menu u-boot-sunxi usbutils"
|
||||
|
||||
desktop="fonts-croscore fonts-crosextra-caladea fonts-crosextra-carlito \
|
||||
kali-desktop-xfce kali-menu kali-root-login lightdm network-manager \
|
||||
network-manager-gnome xfce4 xserver-xorg-video-fbdev"
|
||||
|
||||
tools="aircrack-ng ethtool hydra john libnfc-bin mfoc nmap passing-the-hash sqlmap \
|
||||
usbutils winexe wireshark"
|
||||
|
||||
services="apache2 openssh-server"
|
||||
extras="firefox-esr xfce4-terminal wpasupplicant"
|
||||
|
||||
extras="firefox-esr wpasupplicant xfce4-terminal"
|
||||
|
||||
packages="${arm} ${base} ${services}"
|
||||
|
||||
@@ -98,76 +137,91 @@ packages="${arm} ${base} ${services}"
|
||||
# apt_cacher=off
|
||||
# By default the proxy settings are local, but you can define an external proxy
|
||||
# proxy_url="http://external.intranet.local"
|
||||
apt_cacher=${apt_cacher:-"$(lsof -i :3142|cut -d ' ' -f3 | uniq | sed '/^\s*$/d')"}
|
||||
apt_cacher=${apt_cacher:-"$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')"}
|
||||
|
||||
if [ -n "$proxy_url" ]; then
|
||||
export http_proxy=$proxy_url
|
||||
elif [ "$apt_cacher" = "apt-cacher-ng" ] ; then
|
||||
if [ -z "$proxy_url" ]; then
|
||||
proxy_url=${proxy_url:-"http://127.0.0.1:3142/"}
|
||||
export http_proxy=$proxy_url
|
||||
fi
|
||||
|
||||
elif [ "$apt_cacher" = "apt-cacher-ng" ]; then
|
||||
if [ -z "$proxy_url" ]; then
|
||||
proxy_url=${proxy_url:-"http://127.0.0.1:3142/"}
|
||||
export http_proxy=$proxy_url
|
||||
|
||||
fi
|
||||
fi
|
||||
|
||||
# Detect architecture
|
||||
if [[ "${architecture}" == "arm64" ]]; then
|
||||
qemu_bin="/usr/bin/qemu-aarch64-static"
|
||||
lib_arch="aarch64-linux-gnu"
|
||||
qemu_bin="/usr/bin/qemu-aarch64-static"
|
||||
lib_arch="aarch64-linux-gnu"
|
||||
|
||||
elif [[ "${architecture}" == "armhf" ]]; then
|
||||
qemu_bin="/usr/bin/qemu-arm-static"
|
||||
lib_arch="arm-linux-gnueabihf"
|
||||
qemu_bin="/usr/bin/qemu-arm-static"
|
||||
lib_arch="arm-linux-gnueabihf"
|
||||
|
||||
elif [[ "${architecture}" == "armel" ]]; then
|
||||
qemu_bin="/usr/bin/qemu-arm-static"
|
||||
lib_arch="arm-linux-gnueabi"
|
||||
qemu_bin="/usr/bin/qemu-arm-static"
|
||||
lib_arch="arm-linux-gnueabi"
|
||||
|
||||
fi
|
||||
|
||||
# create the rootfs - not much to modify here, except maybe throw in some more packages if you want
|
||||
eatmydata debootstrap --foreign --keyring=/usr/share/keyrings/kali-archive-keyring.gpg --include=kali-archive-keyring,eatmydata \
|
||||
--components=${components} --arch ${architecture} ${suite} ${work_dir} http://http.kali.org/kali
|
||||
eatmydata debootstrap --foreign \
|
||||
--keyring=/usr/share/keyrings/kali-archive-keyring.gpg \
|
||||
--include=kali-archive-keyring,eatmydata \
|
||||
--components=${components} \
|
||||
--arch ${architecture} ${suite} ${work_dir} http://http.kali.org/kali
|
||||
|
||||
# systemd-nspawn environment
|
||||
systemd-nspawn_exec(){
|
||||
LANG=C systemd-nspawn -q --bind-ro ${qemu_bin} -M ${machine} -D ${work_dir} "$@"
|
||||
systemd-nspawn_exec() {
|
||||
LANG=C systemd-nspawn -q --bind-ro ${qemu_bin} -M ${machine} -D ${work_dir} "$@"
|
||||
}
|
||||
|
||||
# We need to manually extract eatmydata to use it for the second stage
|
||||
for archive in ${work_dir}/var/cache/apt/archives/*eatmydata*.deb; do
|
||||
dpkg-deb --fsys-tarfile "$archive" > ${work_dir}/eatmydata
|
||||
tar -xkf ${work_dir}/eatmydata -C ${work_dir}
|
||||
rm -f ${work_dir}/eatmydata
|
||||
dpkg-deb --fsys-tarfile "$archive" >${work_dir}/eatmydata
|
||||
tar -xkf ${work_dir}/eatmydata -C ${work_dir}
|
||||
rm -f ${work_dir}/eatmydata
|
||||
|
||||
done
|
||||
|
||||
# Prepare dpkg to use eatmydata
|
||||
systemd-nspawn_exec dpkg-divert --divert /usr/bin/dpkg-eatmydata --rename --add /usr/bin/dpkg
|
||||
|
||||
cat > ${work_dir}/usr/bin/dpkg << EOF
|
||||
cat >${work_dir}/usr/bin/dpkg <<EOF
|
||||
#!/bin/sh
|
||||
if [ -e /usr/lib/${lib_arch}/libeatmydata.so ]; then
|
||||
[ -n "\${LD_PRELOAD}" ] && LD_PRELOAD="\$LD_PRELOAD:"
|
||||
LD_PRELOAD="\$LD_PRELOAD\$so"
|
||||
|
||||
fi
|
||||
|
||||
for so in /usr/lib/${lib_arch}/libeatmydata.so; do
|
||||
[ -n "\$LD_PRELOAD" ] && LD_PRELOAD="\$LD_PRELOAD:"
|
||||
LD_PRELOAD="\$LD_PRELOAD\$so"
|
||||
|
||||
done
|
||||
|
||||
export LD_PRELOAD
|
||||
exec "\$0-eatmydata" --force-unsafe-io "\$@"
|
||||
EOF
|
||||
|
||||
chmod 0755 ${work_dir}/usr/bin/dpkg
|
||||
|
||||
# debootstrap second stage
|
||||
systemd-nspawn_exec eatmydata /debootstrap/debootstrap --second-stage
|
||||
|
||||
cat << EOF > ${work_dir}/etc/apt/sources.list
|
||||
cat <<EOF >${work_dir}/etc/apt/sources.list
|
||||
deb ${mirror} ${suite} ${components//,/ }
|
||||
#deb-src ${mirror} ${suite} ${components//,/ }
|
||||
EOF
|
||||
|
||||
# Set hostname
|
||||
echo "${hostname}" > ${work_dir}/etc/hostname
|
||||
echo "${hostname}" >${work_dir}/etc/hostname
|
||||
|
||||
# So X doesn't complain, we add kali to hosts
|
||||
cat << EOF > ${work_dir}/etc/hosts
|
||||
127.0.0.1 ${hostname} localhost
|
||||
cat <<EOF >${work_dir}/etc/hosts
|
||||
127.0.0.1 ${hostname} localhost
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
@@ -176,12 +230,12 @@ ff02::2 ip6-allrouters
|
||||
EOF
|
||||
|
||||
# Disable IPv6
|
||||
cat << EOF > ${work_dir}/etc/modprobe.d/ipv6.conf
|
||||
cat <<EOF >${work_dir}/etc/modprobe.d/ipv6.conf
|
||||
# Don't load ipv6 by default
|
||||
alias net-pf-10 off
|
||||
EOF
|
||||
|
||||
cat << EOF > ${work_dir}/etc/network/interfaces
|
||||
cat <<EOF >${work_dir}/etc/network/interfaces
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
@@ -191,20 +245,22 @@ iface eth0 inet dhcp
|
||||
EOF
|
||||
|
||||
# DNS server
|
||||
echo "nameserver ${nameserver}" > "${work_dir}"/etc/resolv.conf
|
||||
echo "nameserver ${nameserver}" >"${work_dir}"/etc/resolv.conf
|
||||
|
||||
# Copy directory bsp into build dir
|
||||
cp -rp bsp ${work_dir}
|
||||
|
||||
export MALLOC_CHECK_=0 # workaround for LP: #520465
|
||||
# Workaround for LP: #520465
|
||||
export MALLOC_CHECK_=0
|
||||
|
||||
# Enable the use of http proxy in third-stage in case it is enabled
|
||||
if [ -n "$proxy_url" ]; then
|
||||
echo "Acquire::http { Proxy \"$proxy_url\" };" > ${work_dir}/etc/apt/apt.conf.d/66proxy
|
||||
echo "Acquire::http { Proxy \"$proxy_url\" };" >${work_dir}/etc/apt/apt.conf.d/66proxy
|
||||
|
||||
fi
|
||||
|
||||
# Third stage
|
||||
cat << EOF > ${work_dir}/third-stage
|
||||
cat <<EOF >${work_dir}/third-stage
|
||||
#!/bin/bash -e
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
@@ -292,7 +348,7 @@ systemd-nspawn_exec /third-stage
|
||||
systemd-nspawn_exec dpkg-divert --remove --rename /usr/bin/dpkg
|
||||
|
||||
# Clean system
|
||||
systemd-nspawn_exec << 'EOF'
|
||||
systemd-nspawn_exec <<'EOF'
|
||||
rm -f /0
|
||||
rm -rf /bsp
|
||||
fc-cache -frs
|
||||
@@ -313,18 +369,20 @@ EOF
|
||||
|
||||
# Disable the use of http proxy in case it is enabled
|
||||
if [ -n "$proxy_url" ]; then
|
||||
unset http_proxy
|
||||
rm -rf ${work_dir}/etc/apt/apt.conf.d/66proxy
|
||||
unset http_proxy
|
||||
rm -rf ${work_dir}/etc/apt/apt.conf.d/66proxy
|
||||
|
||||
fi
|
||||
|
||||
# Mirror & suite replacement
|
||||
if [[ ! -z "${4}" || ! -z "${5}" ]]; then
|
||||
mirror=${4}
|
||||
suite=${5}
|
||||
mirror=${4}
|
||||
suite=${5}
|
||||
|
||||
fi
|
||||
|
||||
# Define sources.list
|
||||
cat << EOF > ${work_dir}/etc/apt/sources.list
|
||||
cat <<EOF >${work_dir}/etc/apt/sources.list
|
||||
deb ${mirror} ${suite} ${components//,/ }
|
||||
#deb-src ${mirror} ${suite} ${components//,/ }
|
||||
EOF
|
||||
@@ -336,8 +394,8 @@ sed -i -e 's/append.*/append console=ttyS0,115200 console=tty1 root=\/dev\/mmcbl
|
||||
|
||||
# Calculate the space to create the image
|
||||
root_size=$(du -s -B1 ${work_dir} --exclude=${work_dir}/boot | cut -f1)
|
||||
root_extra=$((${root_size}/1024/1000*5*1024/5))
|
||||
raw_size=$(($((${free_space}*1024))+${root_extra}+$((${bootsize}*1024))+4096))
|
||||
root_extra=$((${root_size} / 1024 / 1000 * 5 * 1024 / 5))
|
||||
raw_size=$(($((${free_space} * 1024)) + ${root_extra} + $((${bootsize} * 1024)) + 4096))
|
||||
|
||||
# Create the disk and partition it
|
||||
echo "Creating image file ${image_name}.img"
|
||||
@@ -346,17 +404,20 @@ parted -s "${image_dir}/${image_name}.img" mklabel msdos
|
||||
parted -s -a minimal "${image_dir}/${image_name}.img" mkpart primary $fstype 4MiB 100%
|
||||
|
||||
# Set the partition variables
|
||||
loopdevice=`losetup -f --show ${repo_dir}/${image_name}.img`
|
||||
device=`kpartx -va ${loopdevice} | sed 's/.*\(loop[0-9]\+\)p.*/\1/g' | head -1`
|
||||
loopdevice=$(losetup -f --show ${repo_dir}/${image_name}.img)
|
||||
device=$(kpartx -va ${loopdevice} | sed 's/.*\(loop[0-9]\+\)p.*/\1/g' | head -1)
|
||||
sleep 5
|
||||
device="/dev/mapper/${device}"
|
||||
rootp=${device}p1
|
||||
|
||||
if [[ $fstype == ext4 ]]; then
|
||||
features="-O ^64bit,^metadata_csum"
|
||||
features="-O ^64bit,^metadata_csum"
|
||||
|
||||
elif [[ $fstype == ext3 ]]; then
|
||||
features="-O ^64bit"
|
||||
features="-O ^64bit"
|
||||
|
||||
fi
|
||||
|
||||
mkfs $features -t $fstype -L ROOTFS ${rootp}
|
||||
|
||||
# Create the dirs for the partitions and mount them
|
||||
@@ -364,11 +425,11 @@ mkdir -p "${base_dir}"/root
|
||||
mount ${rootp} "${base_dir}"/root
|
||||
|
||||
# We do this down here to get rid of the build system's resolv.conf after running through the build
|
||||
echo "nameserver ${nameserver}" > "${work_dir}"/etc/resolv.conf
|
||||
echo "nameserver ${nameserver}" >"${work_dir}"/etc/resolv.conf
|
||||
|
||||
# Create an fstab so that we don't mount / read-only
|
||||
UUID=$(blkid -s UUID -o value ${rootp})
|
||||
echo "UUID=$UUID / $fstype errors=remount-ro 0 1" >> ${work_dir}/etc/fstab
|
||||
echo "UUID=$UUID / $fstype errors=remount-ro 0 1" >>${work_dir}/etc/fstab
|
||||
|
||||
echo "Rsyncing rootfs into image file"
|
||||
rsync -HPavz -q ${work_dir}/ ${base_dir}/root/
|
||||
@@ -384,36 +445,53 @@ dd if=${work_dir}/usr/lib/u-boot/Mini-X/u-boot-sunxi-with-spl.bin of=${loopdevic
|
||||
losetup -d ${loopdevice}
|
||||
|
||||
# Limit CPU function
|
||||
limit_cpu (){
|
||||
rand=$(tr -cd 'A-Za-z0-9' < /dev/urandom | head -c4 ; echo) # Random name group
|
||||
cgcreate -g cpu:/cpulimit-${rand} # Name of group cpulimit
|
||||
cgset -r cpu.shares=800 cpulimit-${rand} # Max 1024
|
||||
cgset -r cpu.cfs_quota_us=80000 cpulimit-${rand} # Max 100000
|
||||
# Retry command
|
||||
local n=1; local max=5; local delay=2
|
||||
while true; do
|
||||
cgexec -g cpu:cpulimit-${rand} "$@" && break || {
|
||||
if [[ $n -lt $max ]]; then
|
||||
((n++))
|
||||
echo -e "\e[31m Command failed. Attempt $n/$max \033[0m"
|
||||
sleep $delay;
|
||||
else
|
||||
echo "The command has failed after $n attempts."
|
||||
break
|
||||
fi
|
||||
}
|
||||
done
|
||||
limit_cpu() {
|
||||
# Random name group
|
||||
rand=$(
|
||||
tr -cd 'A-Za-z0-9' </dev/urandom | head -c4
|
||||
echo
|
||||
)
|
||||
|
||||
cgcreate -g cpu:/cpulimit-${rand} # Name of group cpulimit
|
||||
cgset -r cpu.shares=800 cpulimit-${rand} # Max 1024
|
||||
cgset -r cpu.cfs_quota_us=80000 cpulimit-${rand} # Max 100000
|
||||
|
||||
# Retry command
|
||||
local n=1
|
||||
local max=5
|
||||
local delay=2
|
||||
|
||||
while true; do
|
||||
cgexec -g cpu:cpulimit-${rand} "$@" && break || {
|
||||
if [[ $n -lt $max ]]; then
|
||||
((n++))
|
||||
echo -e "\e[31m Command failed. Attempt $n/$max \033[0m"
|
||||
|
||||
sleep $delay
|
||||
|
||||
else
|
||||
echo "The command has failed after $n attempts."
|
||||
|
||||
break
|
||||
|
||||
fi
|
||||
}
|
||||
|
||||
done
|
||||
}
|
||||
|
||||
if [ $compress = xz ]; then
|
||||
if [ $(arch) == 'x86_64' ]; then
|
||||
echo "Compressing ${image_name}.img"
|
||||
[ $(nproc) \< 3 ] || cpu_cores=3 # cpu_cores = Number of cores to use
|
||||
limit_cpu pixz -p ${cpu_cores:-2} "${image_dir}/${image_name}.img" # -p Nº cpu cores use
|
||||
chmod 0644 ${repo_dir}/${image_name}.img.xz
|
||||
fi
|
||||
if [ $(arch) == 'x86_64' ]; then
|
||||
echo "Compressing ${image_name}.img"
|
||||
[ $(nproc) -lt 3 ] || cpu_cores=3 # cpu_cores = Number of cores to use
|
||||
limit_cpu pixz -p ${cpu_cores:-2} "${image_dir}/${image_name}.img" # -p Nº cpu cores use
|
||||
chmod 0644 ${repo_dir}/${image_name}.img.xz
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
chmod 0644 "${image_dir}/${image_name}.img"
|
||||
chmod 0644 "${image_dir}/${image_name}.img"
|
||||
|
||||
fi
|
||||
|
||||
# Clean up all the temporary build stuff and remove the directories
|
||||
|
||||
Reference in New Issue
Block a user