lab/archlinux
Watch
1
0
Fork
You've already forked archlinux
 0
mirror of https://git.myvelabs.com/lab/archlinux.git synced 2026-08-16 12:54:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

Switch /dev/random to urandom and sudo to sudo-rs

Browse source
This commit is contained in:
myve 2026-08-07 10:30:45 +00:00
commit 462624a07e
2 changed files with 41 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
arch.sh
View file

@ -3,9 +3,8 @@ revision=1.0l
set -a set -a
set -E set -E
# ZFS key # myvezfs gpg key
# zfsgpgkey=DDF7DB817396A49B2A2723F7403BD972F75D9D76 # archzfs zfsgpgkey=D0F2AE55C1BF11A026D155813A658A95B8CFCC51
zfsgpgkey=D0F2AE55C1BF11A026D155813A658A95B8CFCC51 # myvezfs
# Exit function # Exit function
trap '[ "${?}" -ne 77 ] || exit 77' ERR trap '[ "${?}" -ne 77 ] || exit 77' ERR
@ -203,7 +202,7 @@ function repeat
# Pacstrap new root and generate fs tables # Pacstrap new root and generate fs tables
function pacstrapGenfstab function pacstrapGenfstab
{ {
local archpkgs="sudo openssh efibootmgr pacman-contrib \ local archpkgs="sudo-rs openssh efibootmgr pacman-contrib \
vim rsync pv git less openbsd-netcat \ vim rsync pv git less openbsd-netcat \
man-db bash-completion reflector \ man-db bash-completion reflector \
wireguard-tools systemd-resolvconf \ wireguard-tools systemd-resolvconf \
@ -572,7 +571,7 @@ function generateKeyfile
{ {
echo echo
say as heading 'Generating keyfile' say as heading 'Generating keyfile'
dd bs=1 count=256 if=/dev/random of=/mnt/crypto_keyfile.bin status=progress dd bs=1 count=256 if=/dev/urandom of=/mnt/crypto_keyfile.bin status=progress
chmod 000 /mnt/crypto_keyfile.bin chmod 000 /mnt/crypto_keyfile.bin
printf '%s' "${grubpass}" | cryptsetup luksAddKey ${bootpart} /mnt/crypto_keyfile.bin printf '%s' "${grubpass}" | cryptsetup luksAddKey ${bootpart} /mnt/crypto_keyfile.bin

63
functions/chroot
View file

@ -170,33 +170,44 @@ unset userpass userpass2
# Disable root account # Disable root account
passwd -l root >/dev/null 2>&1 passwd -l root >/dev/null 2>&1
# Sudoers # sudo-rs sudoers
install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS # install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
Defaults passwd_timeout=0 # Defaults passwd_timeout=0
Defaults timestamp_type=global # Defaults timestamp_type=global
Defaults insults # Defaults insults
# DEFAULTS
# install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
# Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
# Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
# Cmnd_Alias BTRFS = /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
# Cmnd_Alias QEMU = /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
# Cmnd_Alias FAIL2BAN = /usr/bin/fail2ban-client
# Cmnd_Alias ARCHISO = /opt/local/bin/mkairgap, /opt/local/bin/mkiso
# Cmnd_Alias PACMAN = /usr/bin/pacman -Sy
# Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
# Cmnd_Alias MISC = /usr/bin/rsync
# COMMANDS
# install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
# %wheel ALL=(ALL:ALL) ALL
# %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
# WHEEL
# install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
# Defaults:${username} !authenticate
# NOPASSWD
cat >/etc/pam.d/sudo <<- 'sudo'
#%PAM-1.0
auth include system-auth
account include system-auth
session include system-auth
sudo
ln -s -f /etc/pam.d/sudo /etc/pam.d/sudo-i
install -m 0440 /dev/stdin /etc/sudoers-rs <<- 'DEFAULTS'
Defaults!/usr/bin/visudo env_keep += "SUDO_EDITOR EDITOR VISUAL"
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin"
root ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: ALL
DEFAULTS DEFAULTS
ln -s -f /usr/bin/sudo-rs /usr/local/bin/sudo
install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
Cmnd_Alias BTRFS = /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
Cmnd_Alias QEMU = /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
Cmnd_Alias FAIL2BAN = /usr/bin/fail2ban-client
Cmnd_Alias ARCHISO = /opt/local/bin/mkairgap, /opt/local/bin/mkiso
Cmnd_Alias PACMAN = /usr/bin/pacman -Sy
Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
Cmnd_Alias MISC = /usr/bin/rsync
COMMANDS
install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
%wheel ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
WHEEL
install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
Defaults:${username} !authenticate
NOPASSWD
case ${filesystem} in case ${filesystem} in
zfs) zfs)