diff --git a/Documentation.adoc b/Documentation.adoc index 155ae87..eb0e4cd 100644 --- a/Documentation.adoc +++ b/Documentation.adoc @@ -1,9 +1,9 @@ = DustArch: DustVoice's Arch Linux from scratch David Holland -v10.1, 2020-03-10 +v10.2, 2020-04-01 :doctype: book :docinfo: shared -:title-logo-image: image:arch.png[] +:title-logo-image: image:arch_dracula.png[] :toc: left :toc-title: Table Of Contents :toclevels: 6 @@ -201,7 +201,7 @@ Of course, you can adapt everything to your needs, especially in the <>. +==== + +For example, if I want to sign the kernel image of my USB installation, where I mounted the boot partition to `/mnt/dustarchusb/boot`, I would have to do the following + +[source, console] +---- +[root@archiso ~/sb]# sbsign --key /etc/efi-keys/db.key --cert /etc/efi-keys/db.crt --output /boot/vmlinuz-linux /boot/vmlinuz-linux +---- + +<<< + +[#sbupdate] +====== `sbupdate` + +[cols="^.^m,^.^m", options="header"] +|=== +2+|Software Packages + +|AUR +|sbupdate-git +|=== + +Of course, if you're using `Secure Boot` productively, you would want something more practical than manual signing, especially since you need to sign + +* the boot loader + +* the kernel image + +* the `initramfs` + +Fortunately there is an easy and uncomplicated tool out there, that does all that for you, called `sbupdate`. + +It not only signs everything and also foreign `EFI` binaries, if specified, but also combines your kernel and `initramfs` into a single executable `EFI` binary, so you don't even need a boot loader, if your motherboard implementation supports booting those. + +After installing `sbupdate`, we can edit the `/etc/sbupdate.conf` file, to set everything up. + +Everything in this config should be self-explanatory. + +You will probably need to + +* set `ESP_DIR` to `/efi` + +* add any other `EFI` binary you want to have signed to `EXTRA_SIGN` + +* add your kernel parameters, for example `rd.luks.name`, `root`, `rw`, `resume`, etc. to `CMDLINE_DEFAULT` + +After you've successfully configured `sbupdate`, you can run it as root, to create all the signed files. + +[NOTE] +==== +`sbupdate` will be executed upon kernel updates by `pacman`, but not if you change your `initramfs` with something like `mkinitcpio`. +In that case you will have to run `sbupdate` manually. +==== + +<<< + +===== Add `EFI` entries + +[cols="^.^m,^.^m", options="header"] +|=== +2+|Software Packages + +|core +|efibootmgr +|=== + +Now the only thing left to do, if you want to stay boot loader free anyways, is to add the signed images to the boot list of your `NVRAM`. +You can do this with `efibootmgr`. + +[source, console] +---- +[root@archiso ~/sb]# efibootmgr -c -d /dev/nvme0n1 -p 1 -L "Arch Linux fallback" -l "EFI\Arch\linux-fallback-signed.efi +[root@archiso ~/sb]# efibootmgr -c -d /dev/nvme0n1 -p 1 -L "Arch Linux" -l "EFI\Arch\linux-signed.efi +---- + +Of course you can extend this list, with whichever entries you need. + +<<< + +===== Enrolling everything + +First off, copy all `.cer`, `.esl` and `.auth` files to a `FAT` formatted filesystem. +I'm using my `EFI System Partition` for this. + +After that reboot into the firmware setup of your motherboard, clear the existing Platform Key, to set the firmware into "Setup Mode" and enroll the `db`, `KEK` and `PK` certificates in sequence. + +[NOTE] +==== +Enroll the Platform Key last, as it sets most firmware's `Secure Boot` sections back into "User mode", exiting "Setup Mode". +==== + +<<< + == Inside the `DustArch` This section helps at setting up the customized system from within an installed system. @@ -2724,23 +2878,23 @@ As you now have a working graphical desktop environment, you might want to insta 2+|Software Packages |community -|i3lock xss-lock +|xsecurelock xss-lock |=== Probably the first thing you'll want to set up is a session locker, which locks your ``X``-session after resuming from sleep, hibernation, etc. It then requires you to input your password again, so no unauthorized user can access you machine. -I'll use `xss-lock` to hook into the necessary `systemd` events and `i3lock` as my locker. +I'll use `xss-lock` to hook into the necessary `systemd` events and `xsecurelock` as my locker. [NOTE] ==== -I have placed the required command to start `xss-lock` with the right parameters inside my `i3` configuration file. +I have placed the required command to start `xss-lock` with the right parameters inside my `bspwm` configuration file. -If you use something other than `i3`, you need to make sure this command gets executed upon start of the ``X``-session +If you use something other than `bspwm`, you need to make sure this command gets executed upon start of the ``X``-session [source, text] ---- -xss-lock -- i3lock -n -e -c 333333 +xss-lock -l -- xsecurelock & ---- ==== @@ -2762,7 +2916,7 @@ We could use `gnome-polkit` for that purpose, which resides inside the official Now you just need to startup ``xfce-polkit``^`AUR`^ before trying to execute something like `gparted` and you'll be prompted for your password. -As I already launch it as a part of my `i3` configuration, I won't have to worry about that. +As I already launch it as a part of my `bspwm` configuration, I won't have to worry about that. <<< diff --git a/arch.png b/arch.png deleted file mode 100644 index 7a81637..0000000 Binary files a/arch.png and /dev/null differ diff --git a/generate-pdfs.sh b/generate-pdfs.sh deleted file mode 100755 index 402f0b7..0000000 --- a/generate-pdfs.sh +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh -asciidoctor-pdf -a pdf-page-size=a4 -o Documentation_A4.pdf Documentation.adoc -asciidoctor-pdf -a pdf-page-size=a5 -o Documentation_A5.pdf Documentation.adoc