mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-08-16 22:37:12 +00:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 gandalf
|
f61932c6c6 | ||
|
gandalf
|
ff806523b7 | ||
|
gandalf
|
dcb4ce828b | ||
|
gandalf
|
a88c177372 | ||
|
gandalf
|
36612f622d | ||
|
gandalf
|
930a885f04 |
+38
-165
@@ -141,8 +141,7 @@ fi
|
||||
|
||||
# Required tools
|
||||
log "Checking dependencies..."
|
||||
apt-get install -y -qq debootstrap squashfs-tools \
|
||||
grub-efi-amd64-bin grub-efi-amd64-signed grub-pc-bin shim-signed \
|
||||
apt-get install -y -qq debootstrap squashfs-tools grub-efi-amd64-bin grub-pc-bin \
|
||||
xorriso mtools dosfstools parted e2fsprogs live-boot 2>/dev/null || true
|
||||
|
||||
for cmd in debootstrap parted mkfs.fat mkfs.ext4 mksquashfs grub-mkimage; do
|
||||
@@ -781,96 +780,37 @@ else
|
||||
# Uses two separate match patterns to avoid conflicts when multiple interfaces match
|
||||
# secubox-net-detect.service will generate proper config at first boot
|
||||
cat > "${ROOTFS}/etc/netplan/00-secubox.yaml" <<'NETPLAN'
|
||||
# /etc/netplan/00-secubox.yaml — SecuBox Live USB (Bare Metal) — Bootstrap Config
|
||||
# This is a minimal bootstrap configuration for real AMD64 hardware.
|
||||
# secubox-net-detect.service will generate the proper config at first boot.
|
||||
# /etc/netplan/00-secubox.yaml — SecuBox Live USB bootstrap.
|
||||
#
|
||||
# Strategy: Enable DHCP on ALL detected Ethernet interfaces initially.
|
||||
# secubox-net-detect will refine this to router mode (WAN + br-lan).
|
||||
# DHCP on every ethernet interface. That's it. Operators wire WiFi
|
||||
# and router-mode br-lan later via secubox-net-* tools.
|
||||
#
|
||||
# Earlier versions baked an empty `br-lan` bridge with a static
|
||||
# 192.168.1.1/24 address into the bootstrap. On bare-metal real
|
||||
# hardware the physical NIC went silent and only the phantom br-lan
|
||||
# showed an IP — networkd was honouring the static bridge but
|
||||
# something (predictable rename? secubox-net-detect leftover?)
|
||||
# stopped the DHCP request reaching the real cable. Stripping the
|
||||
# bridge + the wifi-with-empty-SSID block restores classic DHCP.
|
||||
# secubox-net-detect.service (disabled by default, no .wants/ link)
|
||||
# can still be run by hand once the operator has decided whether
|
||||
# this box is a router vs an endpoint.
|
||||
network:
|
||||
version: 2
|
||||
renderer: networkd
|
||||
|
||||
ethernets:
|
||||
# Bootstrap: Enable DHCP on all ethernet interfaces for initial connectivity
|
||||
# This ensures we get an IP regardless of interface naming (eno1, enp2s0, etc.)
|
||||
# After first boot, secubox-net-detect rewrites this with proper WAN/LAN split.
|
||||
|
||||
# Match modern interface patterns (enp*, eno*, ens*, enx*).
|
||||
# WAN fallback (closes #370): static 192.168.1.55/24 + gw
|
||||
# 192.168.1.254 carried alongside DHCP. systemd-networkd accepts
|
||||
# both — DHCP routes get the low metric (100), the static gets
|
||||
# metric 1000, so DHCP wins when available and the static keeps
|
||||
# the appliance reachable when DHCP fails. Caveat: if multiple
|
||||
# interfaces match, both will try to claim 192.168.1.55 and one
|
||||
# will fail with address-in-use; bare-metal boxes typically have
|
||||
# one primary NIC, and multi-NIC operators run net-detect to
|
||||
# refine the layout anyway.
|
||||
eth-dhcp:
|
||||
# Match everything that *looks* like ethernet — covers enpXsY /
|
||||
# enoX / ensX / enxAABBCC (USB ethernet) / ethX. All get DHCP.
|
||||
eth-all:
|
||||
match:
|
||||
name: "en*"
|
||||
name: "e*"
|
||||
dhcp4: true
|
||||
dhcp6: false
|
||||
dhcp4-overrides:
|
||||
use-dns: true
|
||||
use-routes: true
|
||||
route-metric: 100
|
||||
optional: true
|
||||
|
||||
# Match legacy interface patterns (eth0, eth1, etc.)
|
||||
eth-legacy:
|
||||
match:
|
||||
name: "eth*"
|
||||
dhcp4: true
|
||||
dhcp6: false
|
||||
dhcp4-overrides:
|
||||
use-dns: true
|
||||
use-routes: true
|
||||
route-metric: 200
|
||||
optional: true
|
||||
|
||||
# No-IP fallback is handled by secubox-net-fallback.service (ARP-probes
|
||||
# common gateways, picks a free .250 IP in the discovered subnet). My
|
||||
# earlier v2.12.1 attempt to bake `addresses: [192.168.1.55/24]` into
|
||||
# both eth-dhcp and eth-legacy created an address-in-use collision when
|
||||
# both matched the same NIC and broke netplan apply entirely on bare
|
||||
# metal + VBox — boot console showed no IP at all (regressed even DHCP).
|
||||
# Keep the netplan DHCP-only; trust net-fallback for the fallback path.
|
||||
|
||||
wifis:
|
||||
# All WiFi interfaces (wlp*, wlan*, wl*)
|
||||
all-wifi:
|
||||
match:
|
||||
name: "wl*"
|
||||
dhcp4: true
|
||||
dhcp4-overrides:
|
||||
route-metric: 300
|
||||
use-dns: true
|
||||
use-routes: true
|
||||
optional: true
|
||||
access-points:
|
||||
# Open networks (fallback)
|
||||
"": {}
|
||||
|
||||
bridges:
|
||||
# br-lan: Pre-defined but empty - secubox-net-detect populates interfaces
|
||||
br-lan:
|
||||
interfaces: []
|
||||
addresses:
|
||||
- 192.168.1.1/24
|
||||
dhcp4: false
|
||||
optional: true
|
||||
parameters:
|
||||
stp: false
|
||||
forward-delay: 0
|
||||
|
||||
# Note: At first boot, secubox-net-detect.service will:
|
||||
# 1. Detect board type (x64-baremetal) and available interfaces
|
||||
# 2. Determine WAN (first interface with link/DHCP response)
|
||||
# 3. Assign remaining interfaces to br-lan
|
||||
# 4. Rewrite this file with explicit interface names
|
||||
#
|
||||
# To force re-detection: rm /var/lib/secubox/.net-configured && reboot
|
||||
NETPLAN
|
||||
chmod 600 "${ROOTFS}/etc/netplan/00-secubox.yaml"
|
||||
fi # end static-IP branch
|
||||
@@ -3581,6 +3521,7 @@ else
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# Mount for file copy
|
||||
MNT="${WORK_DIR}/mnt"
|
||||
mkdir -p "${MNT}/esp" "${MNT}/live"
|
||||
@@ -3748,109 +3689,41 @@ fi
|
||||
|
||||
cp "${MNT}/esp/boot/grub/grub.cfg" "${MNT}/esp/EFI/BOOT/grub.cfg"
|
||||
|
||||
# ── Build GRUB EFI ────────────────────────────────────────────────────────
|
||||
# Module set tuned for booting from a USB stick / VM disk under both
|
||||
# OVMF (VirtualBox + qemu) and real UEFI firmware. The list MUST include
|
||||
# `disk`, `usb`, `usbms` so the firmware can hand off block IO; without
|
||||
# them OVMF drops to the EFI Shell PXE prompt instead of loading GRUB
|
||||
# (this was the v2.12.0/v2.12.1 regression — see issue #382 followup).
|
||||
GRUB_MODS="part_gpt part_msdos fat ext2 ntfs iso9660 normal linux boot \
|
||||
configfile loopback chain efi_gop efi_uga ls cat echo test help \
|
||||
search search_label search_fs_uuid search_fs_file \
|
||||
gfxterm gfxterm_background all_video gzio png jpeg font \
|
||||
fat exfat read sleep reboot halt true \
|
||||
disk usb usbms ahci ata loadenv minicmd terminal"
|
||||
# Build GRUB EFI — verbatim from v2.10.3 (last known-good real UEFI
|
||||
# boot). Do NOT optimise this block: every "improvement" attempted in
|
||||
# the v2.12.x series (Secure Boot shim, $cmdpath, search --fs-uuid,
|
||||
# extra modules, multi-stage fallbacks) broke at least one piece of
|
||||
# hardware. Stay simple, stay shipped.
|
||||
GRUB_MODS="part_gpt part_msdos fat ext2 normal linux boot configfile loopback chain efi_gop efi_uga ls search search_label gfxterm all_video"
|
||||
|
||||
cat > "${WORK_DIR}/grub-embed.cfg" <<'EMBEDCFG'
|
||||
# Fallback chain — label first (set by mkfs.fat -n ESP), then UUID,
|
||||
# then EFI's $cmdpath (the directory the .EFI was loaded from). Last
|
||||
# resort: hardcode the relative prefix so configfile can still find the
|
||||
# menu even if no var resolution worked.
|
||||
search --no-floppy --label ESP --set=root --no-floppy
|
||||
if [ -z "$root" ]; then
|
||||
search --no-floppy --label LIVE --set=root --no-floppy
|
||||
fi
|
||||
if [ -n "$root" ]; then
|
||||
set prefix=($root)/boot/grub
|
||||
else
|
||||
set prefix=($cmdpath)/../../boot/grub
|
||||
fi
|
||||
search --no-floppy --label ESP --set=root
|
||||
set prefix=($root)/boot/grub
|
||||
configfile $prefix/grub.cfg
|
||||
EMBEDCFG
|
||||
|
||||
# Build the EFI binary. Bail loudly if grub-mkimage fails — silent
|
||||
# failure leaves the ESP without BOOTX64.EFI and the box drops to PXE
|
||||
# at first boot, which is exactly the bug we just hit.
|
||||
if ! grub-mkimage -o "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" \
|
||||
-O x86_64-efi \
|
||||
-c "${WORK_DIR}/grub-embed.cfg" \
|
||||
-p /boot/grub \
|
||||
--compress=xz \
|
||||
${GRUB_MODS}; then
|
||||
err "grub-mkimage failed — the image will not boot under EFI"
|
||||
fi
|
||||
[[ -s "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" ]] || err "BOOTX64.EFI missing or empty after grub-mkimage"
|
||||
EFI_SIZE=$(stat -c%s "${MNT}/esp/EFI/BOOT/BOOTX64.EFI")
|
||||
ok "BOOTX64.EFI built (${EFI_SIZE} bytes)"
|
||||
grub-mkimage -o "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" \
|
||||
-O x86_64-efi \
|
||||
-c "${WORK_DIR}/grub-embed.cfg" \
|
||||
-p /boot/grub \
|
||||
${GRUB_MODS}
|
||||
|
||||
# Mirror to /EFI/BOOT/grubx64.efi (some firmware looks for this name)
|
||||
# and to /EFI/secubox/grubx64.efi (lets `efibootmgr` register a named
|
||||
# entry once the live system is running, without clobbering /BOOT).
|
||||
cp "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" "${MNT}/esp/EFI/BOOT/grubx64.efi"
|
||||
mkdir -p "${MNT}/esp/EFI/secubox"
|
||||
cp "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" "${MNT}/esp/EFI/secubox/grubx64.efi"
|
||||
|
||||
# Secure Boot assets: ship shim + signed grub alongside the unsigned
|
||||
# BOOTX64.EFI, but DON'T swap shim into BOOTX64.EFI.
|
||||
#
|
||||
# Rationale: shim requires Microsoft-signed keys enrolled in the firmware
|
||||
# to chainload grubx64.efi. OVMF / VirtualBox EFI ship without those keys
|
||||
# and Secure Boot off — shim refuses to hand off and the boot drops to
|
||||
# the EFI Shell / PXE. By keeping the unsigned grub-mkimage as
|
||||
# BOOTX64.EFI, every firmware (OVMF, VBox, real laptops with SB off)
|
||||
# loads grub directly.
|
||||
#
|
||||
# For Secure Boot ON systems: the firmware boot menu / efibootmgr can
|
||||
# point at /EFI/BOOT/shimx64.efi explicitly. Users opting into SB do
|
||||
# this once when registering the boot entry.
|
||||
SHIM_SRC="/usr/lib/shim/shimx64.efi.signed"
|
||||
GRUB_SIGNED_SRC="/usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed"
|
||||
if [[ -f "$SHIM_SRC" && -f "$GRUB_SIGNED_SRC" ]]; then
|
||||
cp "$SHIM_SRC" "${MNT}/esp/EFI/BOOT/shimx64.efi"
|
||||
cp "$GRUB_SIGNED_SRC" "${MNT}/esp/EFI/BOOT/grubx64-signed.efi"
|
||||
cp "$GRUB_SIGNED_SRC" "${MNT}/esp/EFI/secubox/grubx64-signed.efi"
|
||||
ok "Secure Boot assets shipped (shimx64.efi + grubx64-signed.efi alongside unsigned default)"
|
||||
else
|
||||
log "Secure Boot assets not present — image boots fine without SB"
|
||||
log " (to enable: apt-get install shim-signed grub-efi-amd64-signed)"
|
||||
fi
|
||||
|
||||
# EFI shell fallback — some OVMF builds drop into the shell on first
|
||||
# boot if no BootOrder is set. startup.nsh auto-runs the bootloader.
|
||||
# Add startup.nsh for EFI shell auto-boot (VirtualBox/OVMF compatibility)
|
||||
cat > "${MNT}/esp/startup.nsh" <<'STARTUPNSH'
|
||||
@echo -off
|
||||
echo "SecuBox Live — handing off to BOOTX64.EFI..."
|
||||
\EFI\BOOT\BOOTX64.EFI
|
||||
STARTUPNSH
|
||||
|
||||
# Copy GRUB modules — only the bits BOOTX64.EFI's embedded prefix
|
||||
# might want to load on demand. Failure is non-fatal: we statically
|
||||
# linked everything we need above, this is belt-and-suspenders.
|
||||
# Copy GRUB modules
|
||||
cp /usr/lib/grub/x86_64-efi/*.mod "${MNT}/esp/boot/grub/x86_64-efi/" 2>/dev/null || true
|
||||
|
||||
# ── BIOS GRUB ──────────────────────────────────────────────────────────────
|
||||
# Fail loudly here too — BIOS-only systems (older laptops, VBox legacy
|
||||
# default) silently won't boot if i386-pc grub isn't installed in the
|
||||
# BIOS-boot partition (p1, set bios_grub on).
|
||||
if ! grub-install --target=i386-pc \
|
||||
--boot-directory="${MNT}/esp/boot" \
|
||||
--recheck "${LOOP}" 2>&1 | tee "${WORK_DIR}/grub-install-bios.log"; then
|
||||
cat "${WORK_DIR}/grub-install-bios.log"
|
||||
err "BIOS grub-install failed — image will not boot on legacy systems"
|
||||
fi
|
||||
# Install BIOS GRUB
|
||||
grub-install --target=i386-pc --boot-directory="${MNT}/esp/boot" --recheck "${LOOP}" 2>/dev/null || warn "BIOS GRUB failed"
|
||||
cp /usr/lib/grub/i386-pc/*.mod "${MNT}/esp/boot/grub/i386-pc/" 2>/dev/null || true
|
||||
|
||||
ok "GRUB installed (UEFI BOOTX64.EFI + BIOS i386-pc, dual-boot ready)"
|
||||
ok "GRUB installed (UEFI + BIOS)"
|
||||
|
||||
# Persistence
|
||||
if [[ $INCLUDE_PERSISTENCE -eq 1 ]] && [[ -b "${LOOP}p4" ]]; then
|
||||
|
||||
@@ -377,8 +377,15 @@ enable_kiosk() {
|
||||
# Enable kiosk service
|
||||
systemctl enable secubox-kiosk.service
|
||||
|
||||
# Start kiosk
|
||||
systemctl start secubox-kiosk.service || log "Kiosk will start on next boot"
|
||||
# Start kiosk in the background so this caller doesn't block. The
|
||||
# service has Conflicts=getty@tty7.service + TTYPath=/dev/tty7 and
|
||||
# systemd will sometimes wait for /dev/tty7 to release / sync up,
|
||||
# which deadlocks a synchronous `systemctl start` invoked from
|
||||
# firstboot.sh (firstboot runs from inside the autologin shell on
|
||||
# tty1 itself — observed live USB hang where kiosk-setup ran for
|
||||
# 5+ minutes and the service stayed `inactive (dead)`).
|
||||
systemctl --no-block start secubox-kiosk.service \
|
||||
|| log "Kiosk will start on next boot"
|
||||
|
||||
ok "Kiosk mode enabled (${mode})"
|
||||
log "SecuBox WebUI will display on the connected screen"
|
||||
|
||||
Reference in New Issue
Block a user