Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Build scripts? #5

Open
westurner opened this issue Apr 27, 2020 · 6 comments
Open

Build scripts? #5

westurner opened this issue Apr 27, 2020 · 6 comments

Comments

@westurner
Copy link

Are there build scripts for this?
@westurner westurner mentioned this issue Apr 27, 2020
Open
@westurner
Copy link
Author

westurner commented Apr 29, 2020 •
edited

selinux modules, logging commands run (as root)

In reading /root/.bash_history (and /var/log/dnf.log*) in fedora-pinebookpro-gnome-0.8.img.xz, I noticed the SELinux policy modules /root/modules/disk1.pp and /root/modules/*.te. What are these for / [why] are they necessary [after relabeling]?

With fedora-arm-image-installer, you can specify fedora-arm-image-installer --selinux=on --relabel; which enables selinux by setting SELINUX=enforcing in /etc/selinux/config and touches /.autorelabel (which causes the next boot to take quite awhile due to running restorecon on everything in /):
https://pagure.io/arm-image-installer/blob/master/f/arm-image-installer

Inlined copy of `/root/modules/*.te` 
[root@mb2 modules]# (for f in *.te; do echo "#### $f ####"; cat "$f"; echo -e "\n"; done)
#### disk1.te ####

module disk1 1.0;

require {
	type unlabeled_t;
	type local_login_t;
	class file read;
}

#============= local_login_t ==============
allow local_login_t unlabeled_t:file read;


#### mod1.te ####

module mod1 1.0;

require {
	type iptables_t;
	type kernel_t;
	class fifo_file read;
}

#============= iptables_t ==============
allow iptables_t kernel_t:fifo_file read;


#### mod2.te ####

module mod2 1.0;

require {
	type systemd_logind_t;
	type unlabeled_t;
	type system_dbusd_t;
	type systemd_hostnamed_t;
	type systemd_localed_t;
	type xdm_t;
	class file { getattr open read };
}

#============= system_dbusd_t ==============
allow system_dbusd_t unlabeled_t:file { getattr open };

#============= systemd_hostnamed_t ==============
allow systemd_hostnamed_t unlabeled_t:file { getattr open read };

#============= systemd_localed_t ==============
allow systemd_localed_t unlabeled_t:file { getattr open read };

#============= systemd_logind_t ==============
allow systemd_logind_t unlabeled_t:file { getattr open read };

#============= xdm_t ==============
allow xdm_t unlabeled_t:file { getattr open read };


#### mod4.te ####

module mod4 1.0;

require {
	type initrc_t;
	type policykit_auth_t;
	type init_t;
	type chkpwd_t;
	type unconfined_service_t;
	type policykit_t;
	type user_devpts_t;
	class process { noatsecure rlimitinh siginh };
	class chr_file { read write };
}

#============= chkpwd_t ==============
allow chkpwd_t user_devpts_t:chr_file { read write };

#============= init_t ==============
allow init_t initrc_t:process siginh;
allow init_t unconfined_service_t:process siginh;

#============= policykit_t ==============
allow policykit_t policykit_auth_t:process { noatsecure rlimitinh siginh };


#### mod5.te ####

module mod5 1.0;

require {
	type chkpwd_t;
	type unconfined_t;
	type unlabeled_t;
	type xdm_t;
	class file { getattr open read };
	class process noatsecure;
}

#============= xdm_t ==============
allow xdm_t chkpwd_t:process noatsecure;
allow xdm_t unconfined_t:process noatsecure;

#!!!! This avc is allowed in the current policy
allow xdm_t unlabeled_t:file { getattr open read };


#### mod6.te ####

module mod6 1.0;

require {
	type rpm_var_lib_t;
	type xdm_t;
	type unlabeled_t;
	type init_t;
	type chkpwd_t;
	type unconfined_t;
	type abrt_t;
	class dir mounton;
	class process { noatsecure rlimitinh siginh };
	class file write;
}

#============= abrt_t ==============
allow abrt_t rpm_var_lib_t:file write;

#============= init_t ==============
allow init_t chkpwd_t:process siginh;
allow init_t unconfined_t:process siginh;
allow init_t unlabeled_t:dir mounton;

#============= xdm_t ==============

#!!!! This avc is allowed in the current policy
allow xdm_t chkpwd_t:process noatsecure;
allow xdm_t chkpwd_t:process { rlimitinh siginh };

#!!!! This avc is allowed in the current policy
allow xdm_t unconfined_t:process noatsecure;
allow xdm_t unconfined_t:process siginh;


#### mod8.te ####

module mod8 1.0;

require {
	type unlabeled_t;
	type groupadd_t;
	type useradd_t;
	class file read;
}

#============= groupadd_t ==============
allow groupadd_t unlabeled_t:file read;

#============= useradd_t ==============
allow useradd_t unlabeled_t:file read;


#### mod9.te ####

module mod9 1.0;

require {
	type session_dbusd_tmp_t;
	type systemd_logind_t;
	class sock_file unlink;
}

#============= systemd_logind_t ==============
allow systemd_logind_t session_dbusd_tmp_t:sock_file unlink;

/root/.bash_history is not at all a complete log of the image build.
FWIW, you can log all commands run as any user with auditd:

$ cat >> /etc/audit/audit.rules <<EOF

# Log all commands
-a exit,always -F arch=b64 -S execve
-a exit,always -F arch=b32 -S execve
EOF

$ cat >> /etc/audit/audit.rules <<EOF

# Log all commands run as root (effective UID=0)
-a exit,always -F arch=b32 -F euid=0 -S execve 
-a exit,always -F arch=b64 -F euid=0 -S execve 
EOF

I think -F b64 just works on aarch64, but haven't tested it yet:
https://github.com/linux-audit/audit-userspace/blob/4e03eb0c5c/lib/libaudit.c#L1316

$ man audit.rules
# [...]

 When you specify a syscall name, auditctl will look up the name and get
 its syscall number. This leads to some problems on bi-arch  machines.
 The  32  and  64  bit syscall  numbers sometimes, but not always, line
 up. So, to solve this problem, you would generally need to break the
 rule into 2 with one specify‐ing -F arch=b32 and the other specifying
 -F arch=b64. This needs to go in front of the -S option so that
 auditctl looks at the right  lookup  table when returning the number.

Boot config

Search terms:

  • "Pinebook Pro"
  • "pinebookpro"
  • "rk3399"
  • "evb-rk3399"
  • "pbpro"
  • "pbp"

Rockchip docs:

fedora-arm-image-installer

https://pagure.io/arm-image-installer/blob/master/f/arm-image-installer

how to dd u-boot for rk3399 devices

  • Is there an already-built trust.img somewhere?
    • Is this necessary for pinebook pro? manjaro-arm-tools doesn't write a trust.img for pbpro
  • http://opensource.rock-chips.com/wiki_Boot_option#Boot_from_SD.2FTF_Card

    For with SPL:

    dd if=idbloader.img of=sdb seek=64
dd if=u-boot.itb of=sdb seek=16384
dd if=boot.img of=sdb seek=32768
dd if=rootfs.img of=sdb seek=262144

    For with miniloader:

    dd if=idbloader.img of=sdb seek=64
dd if=uboot.img of=sdb seek=16384
dd if=trust.img of=sdb seek=24576
dd if=boot.img of=sdb seek=32768
dd if=rootfs.img of=sdb seek=262144

manjaro-arm-tools

pbp-uboot: U-Boot with Pinebook Pro support patches

"U-Boot with pinebook pro support patches"
https://git.eno.space/pbp-uboot.git

debian u-boot package

The debian u-boot changelog mentions "pinebookpro" and "rk3399":
https://launchpad.net/debian/+source/u-boot/2020.04+dfsg-2 :

  u-boot (2020.04+dfsg-2) unstable; urgency=medium

  * debian/patches:
    - Remove dreamplug cache patch, fixed upstream.
    - Add patches submitted upstream to support pinebook pro.
  * u-boot-rockchip:
    - Add support for rockpro64-rk3399.
    - Add support for pinebook-pro-rk3399.
    - Add u-boot-install-rockchip helper script.

-- Vagrant Cascadian <vagrant@debian.org>  Mon, 20 Apr 2020 19:34:37 -0700

fedora uboot-images-armv8

Source: https://apps.fedoraproject.org/packages/uboot-tools
Source: https://apps.fedoraproject.org/packages/uboot-images-armv8

Changelog: https://apps.fedoraproject.org/packages/uboot-images-armv8/changelog/ :

2020-04-20 - Peter Robinson <pbrobinson@fedoraproject.org> - 2020.04-2
- Fix ATF for new aarch64 devices
- Fix Wandboard board detection (rhbz 1825247)
- Fix mSD card on RockPro64
- Enable (inital) Pinebook Pro

Package Build Spec: https://apps.fedoraproject.org/packages/uboot-images-armv8/sources/spec/

pinebook-pro files in https://fedora.pkgs.org/32/fedora-aarch64/uboot-images-armv8-2020.04-2.fc32.noarch.rpm.html :

/usr/share/uboot/pinebook-pro-rk3399/idbloader.img
/usr/share/uboot/pinebook-pro-rk3399/u-boot-dtb.img
/usr/share/uboot/pinebook-pro-rk3399/u-boot.bin
/usr/share/uboot/pinebook-pro-rk3399/u-boot.dtb
/usr/share/uboot/pinebook-pro-rk3399/u-boot.img
/usr/share/uboot/pinebook-pro-rk3399/u-boot.itb

rockchip U-Boot Custodian Tree

rockchip-linux

https://github.com/rockchip-linux/u-boot/tree/next-dev/board/rockchip

kernel args

ethaddr=${ethaddr} eth1addr=${eth1addr} serial=${serial#} 
video=HDMI-A-1:1920x1080@60 video=eDP-1:1920x1080@60 vga=current
earlycon=uart8250,mmio32,0xff1a0000
#maxcpus=4
#maxcpus=6

@westurner westurner mentioned this issue Apr 29, 2020
Open
@westurner
Copy link
Author

https://pagure.io/arm-image-installer/issue/52#comment-658679 suggests:

Had success installing F32 with the arm-image-installer using
sudo arm-image-installer --addconsole --addkey ~/.ssh/id_rsa.pub --relabel --resizefs --image=/opt/downloads/Pine64/Fedora-Minimal-32-1.6.aarch64.raw.xz --media=/dev/sdb --target=rock64-rk3328

However, I had to rename or create the board file
/usr/share/arm-image-installer/boards.d/rock64-rk3328

# write uboot
echo "= Writing idbloader.img for $TARGET .... on media $MEDIA"
dd if=$PREFIX/usr/share/uboot/$TARGET/idbloader.img of=$MEDIA seek=64; sync; sleep 5
echo "= Writing u-boot FIT image for $TARGET .... on media $MEDIA"
dd if=$PREFIX/usr/share/uboot/$TARGET/u-boot.itb of=$MEDIA seek=16384; sync; sleep 5
# set console for Rockchips
SYSCON=ttyS2,1500000n8

@westurner
Copy link
Author

Wondering how much of these setup scripts can be used for the Pinebook Pro?
https://github.com/nikhiljha/pp-fedora-sdsetup

Is this script all that's specific to the PinePhone?
https://github.com/nikhiljha/pp-fedora-sdsetup/blob/master/phone-scripts/02-install-packages.sh

@bengtfredh
Copy link

bengtfredh commented Jul 25, 2020 •
edited

I copy/paste together a script that is working. It is nice if somone can help testing.
https://github.com/bengtfredh/pinebook-pro-fedora-installer.git

@westurner westurner mentioned this issue Jul 31, 2020
Open
@westurner westurner mentioned this issue Sep 13, 2020
Closed
@westurner
Copy link
Author

Hey are those selinux modules (from fedora-pinebookpro-gnome-0.8.img.xz) that I inlined in
#5 (comment) from audit2allow?
Who could advise on these .pp policies for Fedora 33+?

@westurner
Copy link
Author

https://github.com/major/stopdisablingselinux.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@westurner @bengtfredh