vyos-build.git/data/live-build-config/hooks/live, branch currentArchived in favor of https://github.com/NOTvyos/vyos-build (mirror of https://github.com/dd010101/vyos-build.git)
https://git.amelek.net/dd010101/vyos-build.git/atom?h=current2024-10-24T22:07:11+00:00live: T5568: Fix live grub menu entries2024-10-24T22:07:11+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2024-10-24T21:18:45+00:00urn:sha1:61d3585f19045424684ff5ccc978f810264ea8c1T861: sign all Kernel modules with an ephemeral key2024-09-25T18:24:21+00:00Christian Breunigchristian@breunig.cc2024-09-25T18:24:21+00:00urn:sha1:d235b31a095f9b8fdb2d5c231935c8b4b4c3da6c
The shim review board (which is the secure boot base loader) recommends using
ephemeral keys when signing the Linux Kernel. This commit enables the Kernel
build system to generate a one-time ephemeral key that is used to:
* sign all build-in Kernel modules
* sign all other out-of-tree Kernel modules
The key lives in /tmp and is destroyed after the build container exits and is
named: "VyOS build time autogenerated kernel key".
In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it
unable to load any Kernel Module to the image that is NOT signed by the
ephemeral key.
T861: stripping Kernel modules would also remove module signatures2024-09-22T07:31:31+00:00Christian Breunigchristian@breunig.cc2024-09-20T20:51:39+00:00urn:sha1:53bd06d17be1d5c66f75b4546f006a6ed1b4675c
As the VyOS Linux Kernel will be compiled with CONFIG_MODULE_SIG_FORCE all
driver modules need to be cryptographically signed. This happens during build
of the Kernel and it's 3rd party modules.
Stripping the objects would remove said signature and the system will be unable
to boot b/c of CONFIG_MODULE_SIG_FORCE.
T861: add UEFI Secure Boot support2024-09-14T21:05:23+00:00Christian Breunigchristian@breunig.cc2024-09-04T19:37:11+00:00urn:sha1:fd737172f1068870fe1ededbe9b2ed4a86663acd
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux
Kernel and enforces module signing. This results in an additional security
layer where untrusted (unsigned) Kernel modules can no longer be loaded into
the live system.
NOTE: This commit will not work unless signing keys are present. Arbitrary
keys can be generated using instructions found in:
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
podman: T6598: add custom podman build for version 4.9.52024-07-23T06:03:07+00:00Christian Breunigchristian@breunig.cc2024-07-22T20:01:45+00:00urn:sha1:a9baaaba16124f847911eeceaff3dbf17f397aebhooks: T6346: set default boot target to multi-user.target2024-05-16T05:19:59+00:00Christian Breunigchristian@breunig.cc2024-05-16T05:19:59+00:00urn:sha1:ca31af2cc33e965c4ebf98fd6f71f7a10c7f5032Merge pull request #582 from 0xThiebaut/suricata2024-05-14T17:27:46+00:00Christian Breunigchristian@breunig.cc2024-05-14T17:27:46+00:00urn:sha1:fabf5326b80519cee6a335a80d44d82a59550e3c
suricata: T751: Disable suricata.service by defaultT3420: Remove service upnp2024-05-14T16:59:59+00:00Viacheslav Hletenkov.gletenko@vyos.io2024-05-14T16:59:59+00:00urn:sha1:618b1379b710d72e85833d17b8d4eede25dea973suricata: T751: Disable suricata.service by default2024-05-02T22:31:38+00:00Maxime THIEBAUT46688461+0xThiebaut@users.noreply.github.com2024-05-01T23:10:31+00:00urn:sha1:845846108e9eeeaa90e7e1787b8fedc55bbb56beMerge pull request #556 from sever-sever/T62282024-04-11T14:05:48+00:00Christian Breunigchristian@breunig.cc2024-04-11T14:05:48+00:00urn:sha1:1a7a54730d9cde5543ca788d064cddbf17daa200
T6228: Cleanup of not existing systemd units