KNEL/football
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
200 Commits 1 Branch 0 Tags
8b5714971ec88c76dfccfd955a0259b6643a21bf
Commit Graph

6 Commits

Author SHA1 Message Date
reachableceo
ae1344c57e fix: resolve remaining CRITICAL/HIGH/MEDIUM findings (batch 2) 
Addresses C-01, C-03, C-04, M-03, M-06, L-01, L-05, L-07.

Changes:
- luks-kdf-configure.sh: Auto-attempt Argon2id conversion during
  installation instead of just creating a manual helper (C-01)
- run.sh: Replace --privileged with fine-grained capabilities
  (SYS_ADMIN, MKNOD, NET_ADMIN, SYS_CHROOT, SETFCAP) (C-03)
- run.sh: Restrict SB key directory to mode 700 and key files
  to mode 600 (C-04)
- security-hardening.sh: Add PAM enforcement via common-password
  with enforce_for_root (M-03)
- security-hardening.sh: Initialize AIDE database and create daily
  cron job for integrity checks (M-06)
- sudo-hardening.sh: Use atomic install -m 600 instead of touch+chmod
  to avoid race condition (L-07)
- preseed.cfg: Disable direct root login (L-01)
- run.sh: Comment explaining KNEL_BUILD_MODE cannot be env-spoofed
  since it's set from command argument (L-05)

All tests pass. Zero shellcheck warnings.
STATUS.md updated with 22/28 findings resolved.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>
 2026-05-08 12:19:04 -05:00
reachableceo
0fb9abe43e feat: add dual-mode ISO builds (production vs demo) with serial console 
Two build modes:
- `./run.sh iso` — production ISO (prompts for credentials, quiet boot)
- `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial
  console output, verbose kernel)

Changes:
- run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker
- run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0
- config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0
  at 115200 baud alongside VGA gfxterm (dual output)
- config/includes.installer/demo.preseed.cfg: Fully automated preseed
  with hardcoded test credentials (NOT for production use)
- config/hooks/binary/0199-serial-console.hook: Ensures serial console
  on Debian installer entries too
- .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/)

Demo credentials (TESTING ONLY):
- User: football / Kn3l-F00tball-D3m0!
- Root: Kn3l-R00t-D3m0!
- LUKS: Kn3l-D3m0-LUKS!

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>
 2026-05-01 11:35:43 -05:00
Charles N Wyble
af03f2feba fix: restore user-mode libvirt (no sudo) and fix preseed partitioning 
Two critical fixes in this commit:

1. VM Creation Regression (13139f2):
   - Restored qemu:///session (user mode) from qemu:///system (root mode)
   - Changed storage paths from /var/lib/libvirt/images to ~/.local/share/libvirt/images
   - Removed all sudo calls from vm_create and vm_destroy functions
   - Updated test to expect session URI

2. Preseed Partitioning Fix:
   - Added GPT partition table directives
   - Added LVM confirmation settings
   - Fixed EFI partition syntax per Debian official example
   - Fixed /boot max size from 512 to 1024
   - KEY FIX: Added 'partman-auto/choose_recipe select efi-boot-root'

Additional changes:
- Added LICENSE file (GNU AGPL v3.0 only)
- Updated AGENTS.md to enforce auto-commit/push behavior

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-02-20 10:10:06 -05:00
Charles N Wyble
e3e729af80 fix: correct preseed expert_recipe for crypto+LVM partitioning 
- Remove $defaultignore{ } from LVM partitions (was preventing root FS detection)
- Fix swap minimum size from 100% to 1024
- Use -1 for root max size to fill available space
- Ensure LVM logical volumes are properly recognized inside LUKS container

Fixes: "No root file system is defined" error during installation

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-02-20 07:07:01 -05:00
Charles N Wyble
626e49c3e7 fix: preseed.cfg UEFI partitioning and user password prompts 
- Add EFI System Partition (ESP) for UEFI boot support
- Add $defaultignore{ } to LVM partitions for proper crypto handling
- Add in_vg{ knel_vg } and lv_name{ } for explicit volume placement
- Change debconf priority from critical to high to allow user password prompts
- Update documentation dates to 2026-02-19
- Update ISO size references from 450 MB to 816 MB
- Update checksums to current values

Fixes installer error "No root file system is defined"
Fixes missing non-root user password prompt

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-02-19 23:29:31 -05:00
Charles N Wyble
89fd6b7dfb fix: move preseed.cfg to includes.installer for live-build 
The preseed file needs to be in config/includes.installer/ for live-build
to embed it into the Debian installer. Previously it was in config/ which
doesn't get picked up by lb build.

- Moved config/preseed.cfg -> config/includes.installer/preseed.cfg
- Updated all test files to reference new path

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
 2026-02-19 19:39:35 -05:00