Skip to content

Commit f3fa265

Browse files
tschafftertschaffter
authored
Add program to build pi kernel (#1)
* Initial commit * Add README
1 parent 8609985 commit f3fa265

File tree

4 files changed

+512
-0
lines changed

4 files changed

+512
-0
lines changed

‎CONTRIBUTING.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Contributing
2+
3+
When contributing to this repository, please first discuss the change you wish to make via issue,
4+
email, or any other method with the owners of this repository before making a change.
5+
6+
Please note we have a code of conduct, please follow it in all your interactions with the project.
7+
8+
## Pull Request Process
9+
10+
1. Ensure any install or build dependencies are removed before the end of the layer when doing a
11+
build.
12+
2. Update the README.md with details of changes to the interface, this includes new environment
13+
variables, exposed ports, useful file locations and container parameters.
14+
3. Increase the version numbers in any examples files and the README.md to the new version that this
15+
Pull Request would represent. The versioning scheme we use is [SemVer](http://semver.org/).
16+
4. You may merge the Pull Request in once you have the sign-off of two other developers, or if you
17+
do not have permission to do that, you may request the second reviewer to merge it for you.
18+
19+
## Code of Conduct
20+
21+
### Our Pledge
22+
23+
We as members, contributors, and leaders pledge to make participation in our
24+
community a harassment-free experience for everyone, regardless of age, body
25+
size, visible or invisible disability, ethnicity, sex characteristics, gender
26+
identity and expression, level of experience, education, socio-economic status,
27+
nationality, personal appearance, race, religion, or sexual identity
28+
and orientation.
29+
30+
We pledge to act and interact in ways that contribute to an open, welcoming,
31+
diverse, inclusive, and healthy community.
32+
33+
### Our Standards
34+
35+
Examples of behavior that contributes to a positive environment for our
36+
community include:
37+
38+
* Demonstrating empathy and kindness toward other people
39+
* Being respectful of differing opinions, viewpoints, and experiences
40+
* Giving and gracefully accepting constructive feedback
41+
* Accepting responsibility and apologizing to those affected by our mistakes,
42+
and learning from the experience
43+
* Focusing on what is best not just for us as individuals, but for the
44+
overall community
45+
46+
Examples of unacceptable behavior include:
47+
48+
* The use of sexualized language or imagery, and sexual attention or
49+
advances of any kind
50+
* Trolling, insulting or derogatory comments, and personal or political attacks
51+
* Public or private harassment
52+
* Publishing others' private information, such as a physical or email
53+
address, without their explicit permission
54+
* Other conduct which could reasonably be considered inappropriate in a
55+
professional setting
56+
57+
### Enforcement Responsibilities
58+
59+
Community leaders are responsible for clarifying and enforcing our standards of
60+
acceptable behavior and will take appropriate and fair corrective action in
61+
response to any behavior that they deem inappropriate, threatening, offensive,
62+
or harmful.
63+
64+
Community leaders have the right and responsibility to remove, edit, or reject
65+
comments, commits, code, wiki edits, issues, and other contributions that are
66+
not aligned to this Code of Conduct, and will communicate reasons for moderation
67+
decisions when appropriate.
68+
69+
### Scope
70+
71+
This Code of Conduct applies within all community spaces, and also applies when
72+
an individual is officially representing the community in public spaces.
73+
Examples of representing our community include using an official e-mail address,
74+
posting via an official social media account, or acting as an appointed
75+
representative at an online or offline event.
76+
77+
### Enforcement
78+
79+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
80+
reported to the community leaders responsible for enforcement at
81+
[INSERT CONTACT METHOD].
82+
All complaints will be reviewed and investigated promptly and fairly.
83+
84+
All community leaders are obligated to respect the privacy and security of the
85+
reporter of any incident.
86+
87+
### Attribution
88+
89+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0,
90+
available at [http://contributor-covenant.org/version/2/0][version]
91+
92+
[homepage]: http://contributor-covenant.org
93+
[version]: http://contributor-covenant.org/version/2/0/

‎Dockerfile‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
FROM debian:buster-20200607-slim
2+
3+
LABEL maintainer="[email protected]"
4+
5+
ARG user=builder
6+
7+
# Install Git and the build dependencies
8+
# hadolint ignore=DL3008
9+
RUN apt-get update -qq -y && apt-get install --no-install-recommends -qq -y \
10+
apt-transport-https \
11+
bc \
12+
bison \
13+
build-essential \
14+
ca-certificates \
15+
cpio \
16+
dpkg-dev \
17+
fakeroot \
18+
flex \
19+
git \
20+
kmod \
21+
libssl-dev \
22+
libc6-dev \
23+
libncurses5-dev \
24+
make \
25+
rsync \
26+
&& update-ca-certificates \
27+
&& rm -rf /var/lib/apt/lists/*
28+
29+
# Create user and set work directory
30+
RUN useradd -m $user
31+
USER $user
32+
WORKDIR /home/$user
33+
34+
# Copy script that builds the kernel
35+
COPY --chown=$user:$user build-kernel.sh .
36+
RUN chmod +x build-kernel.sh
37+
38+
ENTRYPOINT ["bash", "build-kernel.sh"]
39+
CMD ["--help"]

‎README.md‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# Hardened kerrnel for Raspberry Pi
2+
3+
## Overview
4+
5+
This repository provides a dockerized tool to cross-compile the [Linux kernel for
6+
Raspberry Pi](https://www.raspberrypi.org/documentation/linux/kernel/building.md)
7+
with enhanced security.
8+
9+
## Features
10+
11+
- Dockerized tool to cross-compile the kernel with a single command
12+
- Hardened kernel features
13+
- Enable Audit
14+
- Enable SELinux
15+
16+
## Builder options
17+
18+
Run the folllowing command to see the options of the builder:
19+
20+
```console
21+
$ docker run --rm tschaffter/raspberry-pi-kernel-hardened
22+
Cross-compiling hardened kernels for Raspberry Pi
23+
Usage: build-kernel.sh [--kernel-branch <arg>] [--kernel-defconfig <arg>] [--kernel-localversion <arg>] [-h|--help]
24+
--kernel-branch: Kernel branch to build (default: '')
25+
--kernel-defconfig: Default kernel config to use (default: '')
26+
--kernel-localversion: Kernel local version (default: '')
27+
-h, --help: Prints help
28+
```
29+
30+
## Build the hardered kernel
31+
32+
### Identify the kernel version to build
33+
34+
Go to the GitHub repository of the [Linux kernel of Raspberry Pi](https://github.com/raspberrypi/linux)
35+
and identify the name of the branch or tag that you want to build.
36+
37+
Examples:
38+
39+
- The branch `rpi-4.19.y`
40+
- The tag `raspberrypi-kernel_1.20200527-1`
41+
42+
### Identify the default configuration to use
43+
44+
Go to the page [Kernel building](https://www.raspberrypi.org/documentation/linux/kernel/building.md)
45+
of the Raspberry Pi website to identify the default build configuration to use
46+
for the target Pi.
47+
48+
Examples:
49+
50+
- `bcmrpi_defconfig` for Raspberry Pi 1, Pi Zero, Pi Zero W, and Compute Module
51+
- `bcm2709_defconfig` for Raspberry Pi 2, Pi 3, Pi 3+, and Compute Module 3
52+
- `bcm2711_defconfig` for Raspberry Pi 4
53+
54+
Check the above documentation to make sure that these examples are up-to-date.
55+
56+
### Cross-compile the kernel
57+
58+
The command below builds the branch `rpi-4.19.y` for the Raspberry Pi 4
59+
(`bcm2711_defconfig`). Because this branch is not stable, we include today's
60+
date to the value of `--kernel-localversion` (`4.19.y-20200614-hardened`).
61+
62+
Once installed, the full kernel name will be
63+
64+
```console
65+
$ uname -a
66+
Linux raspberrypi 4.19.127-4.19.y-20200614-hardened+ #1 SMP Sun Jun 14 15:06:51 UTC 2020 armv7l GNU/Linux
67+
```
68+
69+
This command builds kernel:
70+
71+
```console
72+
$ docker run \
73+
--rm \
74+
-v $PWD/output:/output \
75+
tschaffter/raspberry-pi-kernel-hardened \
76+
--kernel-branch rpi-4.19.y \
77+
--kernel-defconfig bcm2711_defconfig \
78+
--kernel-localversion 4.19.y-20200614-hardened
79+
Cloning into '/home/builder/tools'...
80+
Installing cross compiler toolchain
81+
Checking out files: 100% (19059/19059), done.
82+
Getting kernel source code
83+
Cloning into '/home/builder/linux'...
84+
...
85+
86+
Moving .deb packages to /output
87+
SUCCESS The kernel has been successfully packaged.
88+
89+
INSTALL
90+
sudo dpkg -i linux-*-4.19.y-20200614-hardened*.deb
91+
sudo sh -c "echo 'kernel=vmlinuz-4.19.127-4.19.y-20200614-hardened+' >> /boot/config.txt"
92+
sudo reboot
93+
94+
ENABLE SELinux
95+
sudo apt-get install selinux-basics selinux-policy-default auditd
96+
sudo sh -c "echo ' selinux=1 security=selinux' >> /boot/cmdline.txt"
97+
sudo touch /.autorelabel
98+
sudo reboot
99+
sestatus
100+
```
101+
102+
## Install the kernel
103+
104+
Copy the Debian packages `$PWD/output/*.deb` to the target Raspbery Pi, for
105+
example using `scp`, then follow the instructions given at the end of the build
106+
command.
107+
108+
## Notes
109+
110+
- The builder uses all the CPU cores available to the Docker container. By default,
111+
that is all the CPU cores of the host. Use
112+
[Docker runtime options](https://docs.docker.com/config/containers/resource_constraints/#cpu)
113+
to limit the usage of CPU cores by the builder.
114+
115+
- The builder clones two GitHub repositories, the cross-compiler toolchain and
116+
the source code of the kernel, unless their target directories already exist
117+
(`/home/builder/tools` and `/home/builder/linux`). When running the dockerized
118+
builder, you can mount volumes that points to these two directories to specify
119+
a different toolchain and kernel source code.
120+
121+
```console
122+
$ git clone <toolchain-repo> tools
123+
$ git cllone <kernel-repo> linux
124+
$ docker run \
125+
--rm \
126+
-v $PWD/output:/output \
127+
-v $PWD/tools:/home/builder/tools \
128+
-v $PWD/linux:/home/builder/linux \
129+
tschaffter/raspberry-pi-kernel-hardened \
130+
--kernel-branch rpi-4.19.y \
131+
--kernel-defconfig bcm2711_defconfig \
132+
--kernel-localversion 4.19.y-20200614-hardened
133+
```
134+
135+
## Contributing change
136+
137+
Please read the [`CONTRIBUTING.md`](CONTRIBUTING.md) for details on how to
138+
contribute to this project.

0 commit comments

Comments
 (0)