From 52fa9b736066ea3b76062b9ef6f74506d49cd41d Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 15:40:23 +0200 Subject: [PATCH 1/9] Improved apt gpg management Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 43 +++++++++++++++++++++++++++-------------- templates/lxc-kali.in | 29 ++++++++++++++++++++------- 2 files changed, 51 insertions(+), 21 deletions(-) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index fd26d5e..84b1fb3 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -40,6 +40,7 @@ LOCALSTATEDIR="@LOCALSTATEDIR@" LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@" # Allows the lxc-cache directory to be set by environment variable LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc"} +[ -z "$DOWNLOAD_KEYRING" ] && DOWNLOAD_KEYRING=1 find_interpreter() { @@ -347,18 +348,32 @@ openssh-server # If debian-archive-keyring isn't installed, fetch GPG keys directly releasekeyring=/usr/share/keyrings/debian-archive-keyring.gpg - if [ ! -f $releasekeyring ]; then - releasekeyring="$cache/archive-key.gpg" - case $release in - "wheezy") - gpgkeyname="archive-key-7.0" - ;; - *) - gpgkeyname="archive-key-8" - ;; - esac - wget https://ftp-master.debian.org/keys/${gpgkeyname}.asc -O - --quiet \ - | gpg --import --no-default-keyring --keyring="${releasekeyring}" + lreleasekeyring=/etc/apt/trusted.gpg.d/debian-archive-$release-stable.gpg + if [ -f "$releasekeyring" ]; then + apt_gpg_opt="--keyring=${releasekeyring}" + elif [ -f "$lreleasekeyring" ]; then + apt_gpg_opt="--keyring=${lreleasekeyring}" + elif [ "$DOWNLOAD_KEYRING" = 1 ]; then + [ ! -d "/etc/apt/trusted.gpg.d" ] && lreleasekeyring="$cache/archive-key.gpg" + if [[ "$(id -u)" == "0" ]]; then + case $release in + "wheezy") + gpgkeyname="archive-key-7.0" + ;; + *) + gpgkeyname="archive-key-8" + ;; + esac + wget https://ftp-master.debian.org/keys/${gpgkeyname}.asc -O - --quiet \ + | gpg --import --no-default-keyring --keyring="${lreleasekeyring}" + apt_gpg_opt="--keyring=${lreleasekeyring}" + else + echo "Must be root (sudo) to save $lreleasekeyring" + fi + fi + if [ -z "$apt_gpg_opt" ]; then + echo "WARNING: No GPG check" + apt_gpg_opt='--no-check-gpg' fi # check the mini debian was not already downloaded try_mksubvolume "$cache/partial-$release-$arch" @@ -371,7 +386,7 @@ openssh-server echo "Downloading debian minimal ..." if [ "$interpreter" = "" ] ; then debootstrap --verbose --variant=minbase --arch="$arch" \ - --include=$packages --keyring="${releasekeyring}" \ + --include=$packages "${apt_gpg_opt}" \ "$release" "$cache/partial-$release-$arch" "$MIRROR" if [ $? -ne 0 ]; then echo "Failed to download the rootfs, aborting." @@ -379,7 +394,7 @@ openssh-server fi else debootstrap --foreign --verbose --variant=minbase --arch="$arch" \ - --include=$packages --keyring="${releasekeyring}" \ + --include=$packages "${apt_gpg_opt}" \ "$release" "$cache/partial-$release-$arch" "$MIRROR" if [ $? -ne 0 ]; then echo "Failed to download the rootfs, aborting." diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index 44f242f..d198fb5 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -41,6 +41,7 @@ LOCALSTATEDIR="@LOCALSTATEDIR@" LXC_TEMPLATE_CONFIG="@LXCTEMPLATECONFIG@" # Allows the lxc-cache directory to be set by environment variable LXC_CACHE_PATH=${LXC_CACHE_PATH:-"$LOCALSTATEDIR/cache/lxc"} +[ -z "$DOWNLOAD_KEYRING" ] && DOWNLOAD_KEYRING=1 find_interpreter() { @@ -330,11 +331,25 @@ kali-archive-keyring # If kali-archive-keyring isn't installed, fetch GPG keys directly releasekeyring=/usr/share/keyrings/kali-archive-keyring.gpg - if [ ! -f $releasekeyring ]; then - releasekeyring="$cache/archive-key.gpg" - gpgkeyname="archive-key" - wget https://archive.kali.org/${gpgkeyname}.asc -O - --quiet \ - | gpg --import --no-default-keyring --keyring="${releasekeyring}" + lreleasekeyring=/etc/apt/trusted.gpg.d/kali-archive-keyring.gpg + if [ -f "$releasekeyring" ]; then + apt_gpg_opt="--keyring=${releasekeyring}" + elif [ -f "$lreleasekeyring" ]; then + apt_gpg_opt="--keyring=${lreleasekeyring}" + elif [ "$DOWNLOAD_KEYRING" = 1 ]; then + [ ! -d "/etc/apt/trusted.gpg.d" ] && lreleasekeyring="$cache/archive-key.gpg" + if [[ "$(id -u)" == "0" ]]; then + gpgkeyname="archive-key" + wget https://archive.kali.org/${gpgkeyname}.asc -O - --quiet \ + | gpg --import --no-default-keyring --keyring="${lreleasekeyring}" + apt_gpg_opt="--keyring=${lreleasekeyring}" + else + echo "Must be root (sudo) to save $lreleasekeyring" + fi + fi + if [ -z "$apt_gpg_opt" ]; then + echo "WARNING: No GPG check" + apt_gpg_opt='--no-check-gpg' fi # check the mini kali was not already downloaded try_mksubvolume "$cache/partial-$release-$arch" @@ -347,7 +362,7 @@ kali-archive-keyring echo "Downloading kali minimal ..." if [ "$interpreter" = "" ] ; then debootstrap --verbose --variant=minbase --arch="$arch" \ - --include=$packages --keyring="${releasekeyring}" \ + --include=$packages "${apt_gpg_opt}" \ "$release" "$cache/partial-$release-$arch" "$MIRROR" if [ $? -ne 0 ]; then echo "Failed to download the rootfs, aborting." @@ -355,7 +370,7 @@ kali-archive-keyring fi else debootstrap --foreign --verbose --variant=minbase --arch="$arch" \ - --include=$packages --keyring="${releasekeyring}" \ + --include=$packages "${apt_gpg_opt}" \ "$release" "$cache/partial-$release-$arch" "$MIRROR" if [ $? -ne 0 ]; then echo "Failed to download the rootfs, aborting." From bd16f6b10cdd7b27d40e9366d229b9a5c1957d3c Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 15:48:51 +0200 Subject: [PATCH 2/9] Added proper copyrights to fixes authors Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 2 ++ templates/lxc-kali.in | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index 84b1fb3..a1c7701 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -5,6 +5,8 @@ # Authors: # Daniel Lezcano +# Greg Olsen (lxc-devuan) +# Tanya # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index d198fb5..265f465 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -5,7 +5,9 @@ # Authors: # Daniel Lezcano -# Re4son +# Re4son +# Greg Olsen (lxc-devuan) +# Tanya # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public From fc18b362d87ebe5b57757d090885df5da94c94a3 Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 16:33:11 +0200 Subject: [PATCH 3/9] Added DOWNLOAD_KEYRING in usage Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 2 ++ templates/lxc-kali.in | 2 ++ 2 files changed, 4 insertions(+) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index a1c7701..0cd3dfc 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -649,6 +649,8 @@ Environment variables: Defaults to '$MIRROR' SECURITY_MIRROR The Debian package security mirror to use. See also the --security-mirror switch above. Defaults to '$SECURITY_MIRROR' + DOWNLOAD_KEYRING Sets whether to download keyring when missing or ignore keyring checks + Defaults to '1' EOF return 0 diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index 265f465..7da3d0c 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -621,6 +621,8 @@ Environment variables: MIRROR The Kali package mirror to use. See also the --mirror switch above. Defaults to '$MIRROR' + DOWNLOAD_KEYRING Sets whether to download keyring when missing or ignore keyring checks + Defaults to '1' EOF return 0 } From 59e707a5ca770fc53c14d6a7966075ecdd186897 Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 16:57:18 +0200 Subject: [PATCH 4/9] Quotation marks makes you think it's a string Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 2 +- templates/lxc-kali.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index 0cd3dfc..6193c3d 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -650,7 +650,7 @@ Environment variables: SECURITY_MIRROR The Debian package security mirror to use. See also the --security-mirror switch above. Defaults to '$SECURITY_MIRROR' DOWNLOAD_KEYRING Sets whether to download keyring when missing or ignore keyring checks - Defaults to '1' + Defaults to 1 EOF return 0 diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index 7da3d0c..a8ab0b8 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -622,7 +622,7 @@ Environment variables: MIRROR The Kali package mirror to use. See also the --mirror switch above. Defaults to '$MIRROR' DOWNLOAD_KEYRING Sets whether to download keyring when missing or ignore keyring checks - Defaults to '1' + Defaults to 1 EOF return 0 } From afa18e5a3088234590d7a6cf2d7793a532303a3c Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 19:41:17 +0200 Subject: [PATCH 5/9] Force hostname inclusion in /etc/hosts Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 11 +++++++++++ templates/lxc-kali.in | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index 6193c3d..a3603c1 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -120,6 +120,17 @@ EOF # set the hostname cat < $rootfs/etc/hostname $hostname +EOF + + # set minimal hosts + cat < $rootfs/etc/hosts +127.0.0.1 localhost +127.0.1.1 $hostname + +# The following lines are desirable for IPv6 capable hosts +::1 localhost ip6-localhost ip6-loopback +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters EOF # reconfigure some services diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index a8ab0b8..491198e 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -121,6 +121,17 @@ EOF # set the hostname cat < $rootfs/etc/hostname $hostname +EOF + + # set minimal hosts + cat < $rootfs/etc/hosts +127.0.0.1 localhost +127.0.1.1 $hostname + +# The following lines are desirable for IPv6 capable hosts +::1 localhost ip6-localhost ip6-loopback +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters EOF # reconfigure some services From 8911d8ff4b381b6d44b6617dfca7c0fa351f35ca Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 22:14:12 +0200 Subject: [PATCH 6/9] Fix timezone configuration Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 2 ++ templates/lxc-kali.in | 2 ++ 2 files changed, 4 insertions(+) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index a3603c1..ca767ab 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -186,10 +186,12 @@ EOF # set initial timezone as on host if [ -f /etc/timezone ]; then cat /etc/timezone > "$rootfs/etc/timezone" + rm -f "$rootfs/etc/localtime" chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata elif [ -f /etc/sysconfig/clock ]; then . /etc/sysconfig/clock echo "$ZONE" > "$rootfs/etc/timezone" + rm -f "$rootfs/etc/localtime" chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata else echo "Timezone in container is not configured. Adjust it manually." diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index 491198e..89338f6 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -181,10 +181,12 @@ EOF # set initial timezone as on host if [ -f /etc/timezone ]; then cat /etc/timezone > "$rootfs/etc/timezone" + rm -f "$rootfs/etc/localtime" chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata elif [ -f /etc/sysconfig/clock ]; then . /etc/sysconfig/clock echo "$ZONE" > "$rootfs/etc/timezone" + rm -f "$rootfs/etc/localtime" chroot "$rootfs" dpkg-reconfigure -f noninteractive tzdata else echo "Timezone in container is not configured. Adjust it manually." From c1552e32f2e5e6f44f042f083a96efcc0a44320e Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sat, 4 Jul 2020 22:19:13 +0200 Subject: [PATCH 7/9] Fix indentation Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 2 +- templates/lxc-kali.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index ca767ab..97a38a9 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -226,7 +226,7 @@ write_sourceslist() fi cat >> "${rootfs}/etc/apt/sources.list" << EOF -${prefix} $MIRROR ${release} main${non_main} +${prefix} $MIRROR ${release} main${non_main} EOF if [ "$release" != "unstable" -a "$release" != "sid" ]; then diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index 89338f6..68a66fe 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -221,7 +221,7 @@ write_sourceslist() fi cat >> "${rootfs}/etc/apt/sources.list" << EOF -${prefix} $MIRROR ${release} main${non_main} +${prefix} $MIRROR ${release} main${non_main} EOF } From f91a618e02dcf4c8e1e702e6f50ca503d25145c7 Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Sun, 5 Jul 2020 11:10:51 +0200 Subject: [PATCH 8/9] Avoid warning 'stdin not a tty' in some cases Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 5 +++++ templates/lxc-kali.in | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index 97a38a9..49073b0 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -594,6 +594,11 @@ EOF # Re-enable service startup rm "${rootfs}/usr/sbin/policy-rc.d" + + # Fix by Greg Olsen, avoid warning 'stdin not a tty' in some cases + if [[ -f "${rootfs}/root/.profile" ]]; then + sed -i -e 's/^mesg n/test -t 0 \&\& mesg n/g' ${rootfs}/root/.profile + fi # end } diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index 68a66fe..ef8cd01 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -570,6 +570,11 @@ EOF # Re-enable service startup rm "${rootfs}/usr/sbin/policy-rc.d" + + # Fix by Greg Olsen, avoid warning 'stdin not a tty' in some cases + if [[ -f "${rootfs}/root/.profile" ]]; then + sed -i -e 's/^mesg n/test -t 0 \&\& mesg n/g' ${rootfs}/root/.profile + fi # end } From 118c8f4699ece9197dc9f43f09a29e309d6aca39 Mon Sep 17 00:00:00 2001 From: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> Date: Mon, 6 Jul 2020 10:44:57 +0200 Subject: [PATCH 9/9] Handle languages that are only UTF-8 encoded MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Pierre-Elliott Bécue Signed-off-by: Tanya Degurechaff <34323200+TanyaEleventhGoddess@users.noreply.github.com> --- templates/lxc-debian.in | 3 ++- templates/lxc-kali.in | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/templates/lxc-debian.in b/templates/lxc-debian.in index 49073b0..5769b39 100644 --- a/templates/lxc-debian.in +++ b/templates/lxc-debian.in @@ -143,7 +143,8 @@ EOF chroot "$rootfs" locale-gen en_US.UTF-8 UTF-8 chroot "$rootfs" update-locale LANG=en_US.UTF-8 else - encoding=$(echo "$LANG" | cut -d. -f2) + encoding=$(locale charmap) + [ -z "${encoding}" ] && encoding="UTF-8" chroot "$rootfs" sed -e "s/^# \(${LANG} ${encoding}\)/\1/" \ -i /etc/locale.gen 2> /dev/null cat >> "$rootfs/etc/locale.gen" << EOF diff --git a/templates/lxc-kali.in b/templates/lxc-kali.in index ef8cd01..0aca315 100755 --- a/templates/lxc-kali.in +++ b/templates/lxc-kali.in @@ -144,7 +144,8 @@ EOF chroot "$rootfs" locale-gen en_US.UTF-8 UTF-8 chroot "$rootfs" update-locale LANG=en_US.UTF-8 else - encoding=$(echo "$LANG" | cut -d. -f2) + encoding=$(locale charmap) + [ -z "${encoding}" ] && encoding="UTF-8" chroot "$rootfs" sed -e "s/^# \(${LANG} ${encoding}\)/\1/" \ -i /etc/locale.gen 2> /dev/null cat >> "$rootfs/etc/locale.gen" << EOF