When running `pmbootstrap install`, pmbootstrap does not unlock root
when it completes. This patch allows `pmbootstrap install` to run two or
more times (without zap).
Co-Authored-By: Oliver Smith <ollieparanoid@postmarketos.org>
This removes the hard-coded installation of osk-sdl when specifying
--fde (or using the on-device installer) and instead determines the
unlocker package by taking the most suitable provider of
postmarketos-fde-unlocker (factoring provider priority and packages
selected for installation).
With this change applied, one can manually select an unlocker package to
be installed via
pmbootstrap install --fde --add other-unlocker
Relates to: postmarketOS/pmaports#1309
So I can finally run `pmbootstrap install --password 147147` and go and
make a cup of tea.
Based on MR 1919.
Co-Authored-By: Oliver Smith <ollieparanoid@postmarketos.org>
The provider selection for "pmbootstrap init" added in this commit
is a flexible way to offer UI/device-specific configuration options
in "pmbootstrap init", without hardcoding them in pmbootstrap.
Instead, the options are defined entirely in pmaports using APK's
virtual package provider mechanism. The code in pmbootstrap searches
for available providers and displays them together with their pkgdesc.
There are many possible use cases for this but I have tested two so far:
1. Selecting root provider (sudo vs doas). This can be defined entirely
in postmarketos-base, without having to handle this specifically in
pmbootstrap.
$ pmbootstrap init
[...]
Available providers for postmarketos-root (2):
* sudo: Use sudo to run root commands (**default**)
* doas: Use doas (minimal replacement for sudo) to run root commands
(Note: Does not support all functionality of sudo)
Provider [default]: doas
2. Device-specific options. My main motivation for working on this
feature is a new configuration option for the MSM8916-based devices.
It allows more control about which firmware to enable:
$ pmbootstrap init
[...]
Available providers for soc-qcom-msm8916-rproc (3):
* all: Enable all remote processors (audio goes through modem) (default)
* no-modem: Disable only modem (audio bypasses modem, ~80 MiB more RAM)
* none: Disable all remote processors (no WiFi/BT/modem, ~90 MiB more RAM)
Provider [default]: no-modem
The configuration prompts show up dynamically by defining
_pmb_select="<virtual packages>" in postmarketos-base, a UI PKGBUILD
or the device APKBUILD. Selecting "default" (just pressing enter)
means that no provider is selected. This allows APK to choose it
automatically based on the "provider_priority". It also provides
compatibility with existing installation; APK will just choose the
default provider when upgrading. The selection can still be changed
after installation by installing another provider using "apk".
Note that at the end this is just a more convenient interface for the
already existing "extra packages" prompt. When using pmbootstrap in
automated scripts the providers (e.g. "postmarketos-root-doas") can be
simply selected through the existing "extra_packages" option.
The current install code looks a bit confusing, there is an existing
if statement for the ui and ui-extras package but the recommended
packages are already installed before with a check in a completely
different file. Make this a bit more clear by moving this to the
ui if statement instead.
kernel is named /boot/vmlinuz now, looking at the filename will no
longer tell us what flavor it is. This now will look at
/usr/share/kernel, which has always contained the kernel 'flavor', and
since we currently only install 1 kernel these days, guarding this with
pmaports.cfg should be unnecessary. In the worst case (if there are
multiple kernel 'flavors' installed), it'll just grab the first one and
return it.
In order to support FAT32 as boot partition, the label is shortened from
pmOS_inst_boot to pmOS_i_boot. Read the value from pmaports.cfg and fall
back to the old value, so both are supported (-> building v21.06 and
v21.03 will use the old label).
Remove the old codepath that would set "pmOS_boot" as label for the
install partition, if the postmarketos-ondev package was older than
0.4.0. This is only the case on the long unsupported v20.05 branch.
Install osk-sdl in the installer OS's boot partition for now. I forgot
about a code path earlier, which could render an encrypted target OS
without osk-sdl in the initramfs (and being unable to boot).
The target OS gets embeded in the installer OS as image file. This can
happen in two formats:
a) a full image with partition header and the boot and root partition
This is what bpo is doing when building the official, pre-built images,
as this method allows having the exact same image available separately
without the installer. Basically:
pmbootstrap install \
--ondev \
--no-rootfs \
--cp path/to/rootfs:/var/lib/rootfs.img
b) an image with just the root partition, no partition header and no
boot partition. This is what you get when running regular
"pmbootstrap install --ondev". It's slightly smaller, as there is no
duplicate boot partition.
If b) was done, the installer will copy the contents of the installer's
boot partition to the target OS. And that means: if osk-sdl is missing
from the installer's boot partition (the initramfs generated there), it
will also be missing in the boot partition of the target OS!
I think we should get rid of the b) code path to avoid confusion in the
future/make maintenance. But until that is done, always install osk-sdl
into the installer OS.
Remove /in-pmbootstrap inside chroots in "pmbootstrap shutdown" instead
of having it at a specific part of "pmbootstrap install".
Reasoning:
* With current approach, it didn't get removed in the on-device
installer chroot.
* This is less error prone than calling it multiple times in
"pmbootstrap install"
Devices such as ODROIDs have binaries use which every single block for
embedding. Do not raise an error when binaries are touching, but not
overlapping, each other when embedding these binaries during installation.
Add a test for this scenario, which fails when reverting the change.
Co-Authored-By: Oliver Smith <ollieparanoid@postmarketos.org>
This adds osk-sdl to the rootfs when --fde is set, or when building a
rootfs for the ondev installer. Ideally the ondev installer would
selectively install osk-sdl if the user opted for fde at runtime, but
I haven't found a straight forward way to enable that yet, and this
behavior here is no different than the current behavior (where osk-sdl
is always installed in the rootfs by way of depends= in pmos-mkinitfs).
For images that are built without --fde, osk-sdl won't be installed at
all in the rootfs, once the dependency is dropped from pmos-mkinitfs.
Instead, a dummy package postmarketos-base-nofde will be installed
instead to satisfy the dependency that postmarketos-mkinitfs has on the
virtual package "postmarketos-fde-unlocker"
The option, --no-firewall, will disable nftables on boot in the image,
and print a warning message if it's being disabled in a device image
where the device's kernel should support running the firewall.
Co-Authored-By: Oliver Smith <ollieparanoid@postmarketos.org>
Touch the file /in-pmbootstrap in chroots so that we can avoid
performing automated actions that should only happen on a real device
(like flashing the kernel).
Made changes to limit the line length in following files for #1986,
- pmb/install/_install.py
- pmb/install/blockdevice.py
- pmb/install/losetup.py
- pmb/install/partition.py
Added the above files in E501 flake8 command list.
Substitute f-string for string concatenation.
Split images have /dev/installp1 and /dev/installp2 but no
/dev/install to place the firmware, so it will actually create that file
in devfs where it might run out of space since it's only 1MB big
Leave some visual space before the flashing and ssh daemon information
blocks, so they don't get overlooked by the user:
[12:50:31] *** (4/4) FILL INSTALL BLOCKDEVICE ***
[12:50:31] (native) copy rootfs_qemu-amd64 to /mnt/install/
[12:50:36]
[12:50:36] *** FLASHING INFORMATION ***
[12:50:36] Refer to the installation instructions of your device, or the generic install instructions in the wiki.
[12:50:36] https://wiki.postmarketos.org/wiki/Installation_guide#pmbootstrap_flash
[12:50:36]
[12:50:36] *** SSH DAEMON INFORMATION ***
[12:50:36] SSH daemon is disabled (--no-sshd).
[12:50:36]
[12:50:36] NOTE: chroot is still active (use 'pmbootstrap shutdown' as necessary)
[12:50:36] Done
Change "configured" to "valid" in the error message:
Selected kernel (mainline_modem) is not configured for device bq-paella.
Please run 'pmbootstrap init' to select a valid kernel.
"configured" makes one think of "pmbootstrap init", but the valid
kernels are defined in the APKBUILD. Therefore I think "not valid" fits
better here.
Run setup_login() while creating the installer OS too, in order to
disable passwordless root login.
Note that this may sound like a security flaw, but it isn't.
* setup_login already ran for the target OS, meaning after the
installation is done, one is not be able to login as root without
password
* root login without password was only possible via serial console (or by
attaching a keyboard), not via SSH
* getting root rights via serial in the installer OS is actually desired
for debugging, we add a debug user with sudo set up by default:
https://wiki.postmarketos.org/wiki/On-device_installer#Debug_user
So even though this isn't a problem, disable it to avoid confusion.
When unmounting SD card after `pmbootstrap install --sdcard=...`
it takes a lot of time for kernel to sync filesystem cache
before actual umounting happehs. This looks like pmbootstrap is
stuck, so before doing unmount print a message to inform user of
what's happening, in case `--sdcard` was used.
With postmarketos-ondev >= 0.4.0, have a different label for the boot
partition in the installer OS, so the postmarketOS initramfs can find
the proper partition to boot. Even if the boot partition is available
twice (once installed on eMMC, once as part of installer OS on SD card).
pmOS_inst_boot instead of pmOS_install_boot because of character limit.
Adds a list of locales user can choose from on init step.
If locale isn't default, then "lang" package is installed
and LANG is changed to the chosen locale.
Get rid of hardcoded step numbers, even for the currently common steps.
With the upcoming --ondev --no-rootfs, we will need to skip the
hardcoded step 2 (create device rootfs).
Move related code from pmb/install/_install.py:install() to a new
create_device_rootfs() function in the same file, so it can be skipped
with the upcoming --no-rootfs parameter.
Create an empty home dir if /etc/skel does not exist in the target
rootfs. Due to changes in packaging, this can happen now, previously
/etc/skel would always have existed.
Embed the firmware from the right chroot suffix. Previously it would
always use the rootfs_{args.device} chroot, which does not work anymore
with upcoming 'pmbootstrap install --ondev --no-rootfs' as there will
only be the installer_{args.device} chroot.
Tony Garnock-Jones
Rudraksha Gupta
Newbyte
Johannes Marbach
Oliver Smith
BO41
Caleb Connolly
Ultracoolguy
Minecrell
Clayton Craft
afeuerstein
Maxim Karasev
Dylan Van Assche
Shubham Naik
Martijn Braam
Alexey Min
HenriDellal