1*2f2c4c7aSAndroid Build Coastguard Worker#!/bin/sh 2*2f2c4c7aSAndroid Build Coastguard Worker# 3*2f2c4c7aSAndroid Build Coastguard Worker# Copyright (C) 2021 The Android Open Source Project 4*2f2c4c7aSAndroid Build Coastguard Worker# 5*2f2c4c7aSAndroid Build Coastguard Worker# Licensed under the Apache License, Version 2.0 (the "License"); 6*2f2c4c7aSAndroid Build Coastguard Worker# you may not use this file except in compliance with the License. 7*2f2c4c7aSAndroid Build Coastguard Worker# You may obtain a copy of the License at 8*2f2c4c7aSAndroid Build Coastguard Worker# 9*2f2c4c7aSAndroid Build Coastguard Worker# http://www.apache.org/licenses/LICENSE-2.0 10*2f2c4c7aSAndroid Build Coastguard Worker# 11*2f2c4c7aSAndroid Build Coastguard Worker# Unless required by applicable law or agreed to in writing, software 12*2f2c4c7aSAndroid Build Coastguard Worker# distributed under the License is distributed on an "AS IS" BASIS, 13*2f2c4c7aSAndroid Build Coastguard Worker# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14*2f2c4c7aSAndroid Build Coastguard Worker# See the License for the specific language governing permissions and 15*2f2c4c7aSAndroid Build Coastguard Worker# limitations under the License. 16*2f2c4c7aSAndroid Build Coastguard Worker# 17*2f2c4c7aSAndroid Build Coastguard Worker 18*2f2c4c7aSAndroid Build Coastguard Workertrap "echo 3 >${exitcode}" ERR 19*2f2c4c7aSAndroid Build Coastguard Worker 20*2f2c4c7aSAndroid Build Coastguard Worker# $1 - Suite names for apt sources 21*2f2c4c7aSAndroid Build Coastguard Worker# $2 - Additional repos, if any 22*2f2c4c7aSAndroid Build Coastguard Workerupdate_apt_sources() { 23*2f2c4c7aSAndroid Build Coastguard Worker # Add the needed debian sources 24*2f2c4c7aSAndroid Build Coastguard Worker cat >/etc/apt/sources.list << EOF 25*2f2c4c7aSAndroid Build Coastguard WorkerEOF 26*2f2c4c7aSAndroid Build Coastguard Worker for source in $1; do 27*2f2c4c7aSAndroid Build Coastguard Worker cat >>/etc/apt/sources.list <<EOF 28*2f2c4c7aSAndroid Build Coastguard Workerdeb http://ftp.debian.org/debian $source main $2 29*2f2c4c7aSAndroid Build Coastguard Workerdeb-src http://ftp.debian.org/debian $source main $2 30*2f2c4c7aSAndroid Build Coastguard WorkerEOF 31*2f2c4c7aSAndroid Build Coastguard Worker done 32*2f2c4c7aSAndroid Build Coastguard Worker 33*2f2c4c7aSAndroid Build Coastguard Worker # Disable the automatic installation of recommended packages 34*2f2c4c7aSAndroid Build Coastguard Worker cat >/etc/apt/apt.conf.d/90recommends <<EOF 35*2f2c4c7aSAndroid Build Coastguard WorkerAPT::Install-Recommends "0"; 36*2f2c4c7aSAndroid Build Coastguard WorkerEOF 37*2f2c4c7aSAndroid Build Coastguard Worker 38*2f2c4c7aSAndroid Build Coastguard Worker # On the ARM64, allow packages from AMD64 to be installed 39*2f2c4c7aSAndroid Build Coastguard Worker dpkg --add-architecture amd64 40*2f2c4c7aSAndroid Build Coastguard Worker 41*2f2c4c7aSAndroid Build Coastguard Worker # Update for the above changes 42*2f2c4c7aSAndroid Build Coastguard Worker apt-get update 43*2f2c4c7aSAndroid Build Coastguard Worker} 44*2f2c4c7aSAndroid Build Coastguard Worker 45*2f2c4c7aSAndroid Build Coastguard Worker# $1 - Output file for currently installed packages 46*2f2c4c7aSAndroid Build Coastguard Workerget_installed_packages() { 47*2f2c4c7aSAndroid Build Coastguard Worker LANG=C dpkg --get-selections | sort 48*2f2c4c7aSAndroid Build Coastguard Worker} 49*2f2c4c7aSAndroid Build Coastguard Worker 50*2f2c4c7aSAndroid Build Coastguard Worker# $1 - File containing package selections to restore to 51*2f2c4c7aSAndroid Build Coastguard Worker# $2 - File containing currently installed packages list 52*2f2c4c7aSAndroid Build Coastguard Workerremove_installed_packages() { 53*2f2c4c7aSAndroid Build Coastguard Worker apt-get purge --allow-remove-essential -y \ 54*2f2c4c7aSAndroid Build Coastguard Worker $(comm -3 "$1" "$2" | sed -e 's,install,,' -e 's,\t,,' | xargs) 55*2f2c4c7aSAndroid Build Coastguard Worker rm -f "$1" "$2" 56*2f2c4c7aSAndroid Build Coastguard Worker} 57*2f2c4c7aSAndroid Build Coastguard Worker 58*2f2c4c7aSAndroid Build Coastguard Workersetup_static_networking() { 59*2f2c4c7aSAndroid Build Coastguard Worker # Temporarily bring up static QEMU SLIRP networking (no DHCP) 60*2f2c4c7aSAndroid Build Coastguard Worker ip link set dev eth0 up 61*2f2c4c7aSAndroid Build Coastguard Worker ip addr add 10.0.2.15/24 broadcast 10.0.2.255 dev eth0 62*2f2c4c7aSAndroid Build Coastguard Worker ip route add default via 10.0.2.2 dev eth0 63*2f2c4c7aSAndroid Build Coastguard Worker 64*2f2c4c7aSAndroid Build Coastguard Worker # Permanently update the resolv.conf with the Google DNS servers 65*2f2c4c7aSAndroid Build Coastguard Worker echo "nameserver 8.8.8.8" >/etc/resolv.conf 66*2f2c4c7aSAndroid Build Coastguard Worker echo "nameserver 8.8.4.4" >>/etc/resolv.conf 67*2f2c4c7aSAndroid Build Coastguard Worker} 68*2f2c4c7aSAndroid Build Coastguard Worker 69*2f2c4c7aSAndroid Build Coastguard Worker# $1 - Network interface for bridge (or traditional DHCP) 70*2f2c4c7aSAndroid Build Coastguard Worker# $2 - Bridge name. If not specified, no bridge is configured 71*2f2c4c7aSAndroid Build Coastguard Workersetup_dynamic_networking() { 72*2f2c4c7aSAndroid Build Coastguard Worker # So isc-dhcp-client can work with a read-only rootfs.. 73*2f2c4c7aSAndroid Build Coastguard Worker cat >>/etc/fstab <<EOF 74*2f2c4c7aSAndroid Build Coastguard Workertmpfs /var/lib/dhcp tmpfs defaults 0 0 75*2f2c4c7aSAndroid Build Coastguard WorkerEOF 76*2f2c4c7aSAndroid Build Coastguard Worker 77*2f2c4c7aSAndroid Build Coastguard Worker # Bring up networking one time with dhclient 78*2f2c4c7aSAndroid Build Coastguard Worker mount /var/lib/dhcp 79*2f2c4c7aSAndroid Build Coastguard Worker dhclient eth0 80*2f2c4c7aSAndroid Build Coastguard Worker echo "nameserver 8.8.8.8" >/run/resolvconf/resolv.conf 81*2f2c4c7aSAndroid Build Coastguard Worker echo "nameserver 8.8.4.4" >>/run/resolvconf/resolv.conf 82*2f2c4c7aSAndroid Build Coastguard Worker 83*2f2c4c7aSAndroid Build Coastguard Worker # Set up automatic DHCP for *future* boots 84*2f2c4c7aSAndroid Build Coastguard Worker if [ -z "$2" ]; then 85*2f2c4c7aSAndroid Build Coastguard Worker cat >/etc/network/interfaces.d/$1.conf <<EOF 86*2f2c4c7aSAndroid Build Coastguard Workerauto $1 87*2f2c4c7aSAndroid Build Coastguard Workeriface $1 inet dhcp 88*2f2c4c7aSAndroid Build Coastguard WorkerEOF 89*2f2c4c7aSAndroid Build Coastguard Worker else 90*2f2c4c7aSAndroid Build Coastguard Worker cat >/etc/network/interfaces.d/$2.conf <<EOF 91*2f2c4c7aSAndroid Build Coastguard Workerauto $2 92*2f2c4c7aSAndroid Build Coastguard Workeriface $2 inet dhcp 93*2f2c4c7aSAndroid Build Coastguard Worker bridge_ports $1 94*2f2c4c7aSAndroid Build Coastguard Worker bridge_stp off 95*2f2c4c7aSAndroid Build Coastguard Worker bridge_fd 0 96*2f2c4c7aSAndroid Build Coastguard WorkerEOF 97*2f2c4c7aSAndroid Build Coastguard Worker fi 98*2f2c4c7aSAndroid Build Coastguard Worker} 99*2f2c4c7aSAndroid Build Coastguard Worker 100*2f2c4c7aSAndroid Build Coastguard Workersetup_cuttlefish_user() { 101*2f2c4c7aSAndroid Build Coastguard Worker # Add a default user and put them in the right group 102*2f2c4c7aSAndroid Build Coastguard Worker addgroup --system cvdnetwork 103*2f2c4c7aSAndroid Build Coastguard Worker useradd -m -G cvdnetwork,kvm,render,sudo,video \ 104*2f2c4c7aSAndroid Build Coastguard Worker -d /home/vsoc-01 --shell /bin/bash vsoc-01 105*2f2c4c7aSAndroid Build Coastguard Worker echo -e "cuttlefish\ncuttlefish" | passwd vsoc-01 106*2f2c4c7aSAndroid Build Coastguard Worker 107*2f2c4c7aSAndroid Build Coastguard Worker # Enable unlimited memory locking for vsoc-01, which is needed by protected 108*2f2c4c7aSAndroid Build Coastguard Worker # KVM, which is enabled by default on arm64 devices 109*2f2c4c7aSAndroid Build Coastguard Worker echo "vsoc-01 - memlock unlimited" >>/etc/security/limits.conf 110*2f2c4c7aSAndroid Build Coastguard Worker} 111*2f2c4c7aSAndroid Build Coastguard Worker 112*2f2c4c7aSAndroid Build Coastguard Worker# $* - One or more device names for getty spawns 113*2f2c4c7aSAndroid Build Coastguard Workercreate_systemd_getty_symlinks() { 114*2f2c4c7aSAndroid Build Coastguard Worker for device in $*; do 115*2f2c4c7aSAndroid Build Coastguard Worker ln -s /lib/systemd/system/serial-getty\@.service \ 116*2f2c4c7aSAndroid Build Coastguard Worker /etc/systemd/system/getty.target.wants/serial-getty\@"${device}".service 117*2f2c4c7aSAndroid Build Coastguard Worker done 118*2f2c4c7aSAndroid Build Coastguard Worker} 119*2f2c4c7aSAndroid Build Coastguard Worker 120*2f2c4c7aSAndroid Build Coastguard Worker# $1 - Additional default command line 121*2f2c4c7aSAndroid Build Coastguard Workersetup_grub() { 122*2f2c4c7aSAndroid Build Coastguard Worker if [[ "${embed_kernel_initrd_dtb}" = "0" && "${install_grub}" = "0" ]]; then 123*2f2c4c7aSAndroid Build Coastguard Worker return 124*2f2c4c7aSAndroid Build Coastguard Worker fi 125*2f2c4c7aSAndroid Build Coastguard Worker 126*2f2c4c7aSAndroid Build Coastguard Worker if [[ "${install_grub}" = "1" ]]; then 127*2f2c4c7aSAndroid Build Coastguard Worker # Mount fstab entry added by stage2 128*2f2c4c7aSAndroid Build Coastguard Worker findmnt /boot/efi > /dev/null 2>&1 129*2f2c4c7aSAndroid Build Coastguard Worker if [ $? != 0 ]; then 130*2f2c4c7aSAndroid Build Coastguard Worker mount /boot/efi 131*2f2c4c7aSAndroid Build Coastguard Worker fi 132*2f2c4c7aSAndroid Build Coastguard Worker 133*2f2c4c7aSAndroid Build Coastguard Worker # Install GRUB EFI (removable, for Cloud) 134*2f2c4c7aSAndroid Build Coastguard Worker apt-get install -y grub-efi 135*2f2c4c7aSAndroid Build Coastguard Worker grub_arch="$(uname -m)" 136*2f2c4c7aSAndroid Build Coastguard Worker # Remap some mismatches with uname -m 137*2f2c4c7aSAndroid Build Coastguard Worker [ "${grub_arch}" = "i686" ] && grub_arch=i386 138*2f2c4c7aSAndroid Build Coastguard Worker [ "${grub_arch}" = "aarch64" ] && grub_arch=arm64 139*2f2c4c7aSAndroid Build Coastguard Worker grub-install --target "${grub_arch}-efi" --removable 140*2f2c4c7aSAndroid Build Coastguard Worker else 141*2f2c4c7aSAndroid Build Coastguard Worker # Install common grub components 142*2f2c4c7aSAndroid Build Coastguard Worker apt-get install -y grub2-common 143*2f2c4c7aSAndroid Build Coastguard Worker mkdir /boot/grub 144*2f2c4c7aSAndroid Build Coastguard Worker fi 145*2f2c4c7aSAndroid Build Coastguard Worker 146*2f2c4c7aSAndroid Build Coastguard Worker cat >/etc/default/grub <<EOF 147*2f2c4c7aSAndroid Build Coastguard WorkerGRUB_DEFAULT=0 148*2f2c4c7aSAndroid Build Coastguard WorkerGRUB_TIMEOUT=5 149*2f2c4c7aSAndroid Build Coastguard WorkerGRUB_DISTRIBUTOR=Debian 150*2f2c4c7aSAndroid Build Coastguard WorkerGRUB_CMDLINE_LINUX_DEFAULT="" 151*2f2c4c7aSAndroid Build Coastguard WorkerGRUB_CMDLINE_LINUX="\\\$cmdline $1" 152*2f2c4c7aSAndroid Build Coastguard WorkerEOF 153*2f2c4c7aSAndroid Build Coastguard Worker update-grub 154*2f2c4c7aSAndroid Build Coastguard Worker} 155*2f2c4c7aSAndroid Build Coastguard Worker 156*2f2c4c7aSAndroid Build Coastguard Workercleanup() { 157*2f2c4c7aSAndroid Build Coastguard Worker # Prevents systemd boot issues with read-only rootfs 158*2f2c4c7aSAndroid Build Coastguard Worker mkdir -p /var/lib/systemd/{coredump,linger,rfkill,timesync} 159*2f2c4c7aSAndroid Build Coastguard Worker chown systemd-timesync:systemd-timesync /var/lib/systemd/timesync 160*2f2c4c7aSAndroid Build Coastguard Worker 161*2f2c4c7aSAndroid Build Coastguard Worker 162*2f2c4c7aSAndroid Build Coastguard Worker # If embedding isn't enabled, remove the embedded modules and initrd 163*2f2c4c7aSAndroid Build Coastguard Worker if [[ "${embed_kernel_initrd_dtb}" = "0" ]]; then 164*2f2c4c7aSAndroid Build Coastguard Worker rm -f "/boot/initrd.img-$(uname -r)" 165*2f2c4c7aSAndroid Build Coastguard Worker rm -rf "/lib/modules/$(uname -r)" 166*2f2c4c7aSAndroid Build Coastguard Worker fi 167*2f2c4c7aSAndroid Build Coastguard Worker 168*2f2c4c7aSAndroid Build Coastguard Worker # If embedding isn't enabled *and* GRUB isn't being installed, uninstall 169*2f2c4c7aSAndroid Build Coastguard Worker # the tools to regenerate the initrd, as they're unlikely to ever be used 170*2f2c4c7aSAndroid Build Coastguard Worker if [[ "${embed_kernel_initrd_dtb}" = "0" && "${install_grub}" = "0" ]]; then 171*2f2c4c7aSAndroid Build Coastguard Worker apt-get purge -y initramfs-tools initramfs-tools-core klibc-utils kmod 172*2f2c4c7aSAndroid Build Coastguard Worker fi 173*2f2c4c7aSAndroid Build Coastguard Worker 174*2f2c4c7aSAndroid Build Coastguard Worker # Miscellaneous cleanup 175*2f2c4c7aSAndroid Build Coastguard Worker rm -rf /var/lib/apt/lists/* || true 176*2f2c4c7aSAndroid Build Coastguard Worker rm -f /root/* || true 177*2f2c4c7aSAndroid Build Coastguard Worker rm -f /etc/cron.d/cron-run-installer-script || true 178*2f2c4c7aSAndroid Build Coastguard Worker apt-get clean 179*2f2c4c7aSAndroid Build Coastguard Worker 180*2f2c4c7aSAndroid Build Coastguard Worker echo 0 >"${exitcode}" 181*2f2c4c7aSAndroid Build Coastguard Worker sync && poweroff -f 182*2f2c4c7aSAndroid Build Coastguard Worker} 183