lab/archlinux
Watch
1
0
Fork
You've already forked archlinux
 0
mirror of https://git.myvelabs.com/lab/archlinux.git synced 2026-08-16 11:04:26 +00:00
Code Issues Projects Releases Packages Wiki Activity

Switch /dev/random to urandom and sudo to sudo-rs

Browse source
This commit is contained in:
myve 2026-08-07 10:30:45 +00:00
commit 462624a07e
2 changed files with 41 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
arch.sh
View file

@ -3,9 +3,8 @@ revision=1.0l
set -a
set -E
# ZFS key
# zfsgpgkey=DDF7DB817396A49B2A2723F7403BD972F75D9D76 # archzfs
zfsgpgkey=D0F2AE55C1BF11A026D155813A658A95B8CFCC51 # myvezfs
# myvezfs gpg key
zfsgpgkey=D0F2AE55C1BF11A026D155813A658A95B8CFCC51
# Exit function
trap '[ "${?}" -ne 77 ] || exit 77' ERR
@ -203,7 +202,7 @@ function repeat
# Pacstrap new root and generate fs tables
function pacstrapGenfstab
{
local archpkgs="sudo openssh efibootmgr pacman-contrib \
local archpkgs="sudo-rs openssh efibootmgr pacman-contrib \
vim rsync pv git less openbsd-netcat \
man-db bash-completion reflector \
wireguard-tools systemd-resolvconf \
@ -572,7 +571,7 @@ function generateKeyfile
{
echo
say as heading 'Generating keyfile'
dd bs=1 count=256 if=/dev/random of=/mnt/crypto_keyfile.bin status=progress
dd bs=1 count=256 if=/dev/urandom of=/mnt/crypto_keyfile.bin status=progress
chmod 000 /mnt/crypto_keyfile.bin
printf '%s' "${grubpass}" | cryptsetup luksAddKey ${bootpart} /mnt/crypto_keyfile.bin

63
functions/chroot
View file

@ -170,33 +170,44 @@ unset userpass userpass2
# Disable root account
passwd -l root >/dev/null 2>&1
# Sudoers
install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
Defaults passwd_timeout=0
Defaults timestamp_type=global
Defaults insults
# sudo-rs sudoers
# install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
# Defaults passwd_timeout=0
# Defaults timestamp_type=global
# Defaults insults
# DEFAULTS
# install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
# Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
# Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
# Cmnd_Alias BTRFS = /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
# Cmnd_Alias QEMU = /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
# Cmnd_Alias FAIL2BAN = /usr/bin/fail2ban-client
# Cmnd_Alias ARCHISO = /opt/local/bin/mkairgap, /opt/local/bin/mkiso
# Cmnd_Alias PACMAN = /usr/bin/pacman -Sy
# Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
# Cmnd_Alias MISC = /usr/bin/rsync
# COMMANDS
# install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
# %wheel ALL=(ALL:ALL) ALL
# %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
# WHEEL
# install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
# Defaults:${username} !authenticate
# NOPASSWD
cat >/etc/pam.d/sudo <<- 'sudo'
#%PAM-1.0
auth include system-auth
account include system-auth
session include system-auth
sudo
ln -s -f /etc/pam.d/sudo /etc/pam.d/sudo-i
install -m 0440 /dev/stdin /etc/sudoers-rs <<- 'DEFAULTS'
Defaults!/usr/bin/visudo env_keep += "SUDO_EDITOR EDITOR VISUAL"
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin"
root ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: ALL
DEFAULTS
install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
Cmnd_Alias BTRFS = /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
Cmnd_Alias QEMU = /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
Cmnd_Alias FAIL2BAN = /usr/bin/fail2ban-client
Cmnd_Alias ARCHISO = /opt/local/bin/mkairgap, /opt/local/bin/mkiso
Cmnd_Alias PACMAN = /usr/bin/pacman -Sy
Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
Cmnd_Alias MISC = /usr/bin/rsync
COMMANDS
install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
%wheel ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
WHEEL
install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
Defaults:${username} !authenticate
NOPASSWD
ln -s -f /usr/bin/sudo-rs /usr/local/bin/sudo
case ${filesystem} in
zfs)