Adolfo Delorenzo
efc7f80b65
Security hardening: bind kubeconfig server to localhost, mount hardening (noexec/nosuid/nodev on tmpfs), sysctl network hardening, kernel module loading lock after boot, SHA256 checksum verification for downloads, kernel AppArmor + Audit support, complain-mode AppArmor profiles for containerd and kubelet, and security integration test. ARM64 Raspberry Pi support: piCore64 base extraction, RPi kernel build from raspberrypi/linux fork, RPi firmware fetch, SD card image with 4- partition GPT and tryboot A/B mechanism, BootEnv Go interface abstracting GRUB vs RPi boot environments, architecture-aware build scripts, QEMU aarch64 dev VM and boot test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
63 lines
2.5 KiB
Bash
Executable File
63 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# 00-early-mount.sh — Mount essential virtual filesystems
|
|
|
|
# After switch_root, /proc /sys /dev are already mounted — only mount if missing
|
|
if ! mountpoint -q /proc 2>/dev/null; then
|
|
mount -t proc proc /proc 2>/dev/null || true
|
|
fi
|
|
if ! mountpoint -q /sys 2>/dev/null; then
|
|
mount -t sysfs sysfs /sys 2>/dev/null || true
|
|
fi
|
|
if ! mountpoint -q /dev 2>/dev/null; then
|
|
mount -t devtmpfs devtmpfs /dev 2>/dev/null || mount -t tmpfs tmpfs /dev
|
|
fi
|
|
if ! mountpoint -q /tmp 2>/dev/null; then
|
|
mount -t tmpfs -o noexec,nosuid,nodev,size=256M tmpfs /tmp
|
|
fi
|
|
if ! mountpoint -q /run 2>/dev/null; then
|
|
mount -t tmpfs -o nosuid,nodev,size=64M tmpfs /run
|
|
fi
|
|
|
|
mkdir -p /dev/pts /dev/shm
|
|
if ! mountpoint -q /dev/pts 2>/dev/null; then
|
|
mount -t devpts devpts /dev/pts
|
|
fi
|
|
if ! mountpoint -q /dev/shm 2>/dev/null; then
|
|
mount -t tmpfs -o noexec,nosuid,nodev,size=64M tmpfs /dev/shm
|
|
fi
|
|
|
|
# Ensure essential device nodes exist (devtmpfs may be incomplete after switch_root)
|
|
[ -e /dev/console ] || mknod -m 600 /dev/console c 5 1 2>/dev/null || true
|
|
[ -e /dev/null ] || mknod -m 666 /dev/null c 1 3 2>/dev/null || true
|
|
[ -e /dev/zero ] || mknod -m 666 /dev/zero c 1 5 2>/dev/null || true
|
|
[ -e /dev/kmsg ] || mknod -m 660 /dev/kmsg c 1 11 2>/dev/null || true
|
|
[ -e /dev/random ] || mknod -m 666 /dev/random c 1 8 2>/dev/null || true
|
|
[ -e /dev/urandom ] || mknod -m 666 /dev/urandom c 1 9 2>/dev/null || true
|
|
[ -e /dev/tty ] || mknod -m 666 /dev/tty c 5 0 2>/dev/null || true
|
|
|
|
# Set up BusyBox mdev as hotplug handler (creates /dev nodes for new devices)
|
|
echo /sbin/mdev > /proc/sys/kernel/hotplug 2>/dev/null || true
|
|
mdev -s 2>/dev/null || true
|
|
|
|
# Mount cgroup v2 unified hierarchy
|
|
mkdir -p /sys/fs/cgroup
|
|
if ! mountpoint -q /sys/fs/cgroup 2>/dev/null; then
|
|
mount -t cgroup2 cgroup2 /sys/fs/cgroup 2>/dev/null || true
|
|
fi
|
|
|
|
# Enable ALL available controllers for child cgroups
|
|
# Required: memory (memory.max), cpu (cpu.max), pids (pids.max)
|
|
# First, move init process to its own cgroup so controllers can be enabled
|
|
# (cgroup v2 "no internal process" rule for non-root cgroups)
|
|
if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
|
|
mkdir -p /sys/fs/cgroup/init
|
|
echo $$ > /sys/fs/cgroup/init/cgroup.procs 2>/dev/null || true
|
|
for ctrl in $(cat /sys/fs/cgroup/cgroup.controllers); do
|
|
echo "+${ctrl}" > /sys/fs/cgroup/cgroup.subtree_control 2>/dev/null || true
|
|
done
|
|
fi
|
|
|
|
# Mount BPF filesystem (required for cgroup v2 device control via BPF)
|
|
mkdir -p /sys/fs/bpf
|
|
mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true
|