未加星标

Encrypted Gentoo Installation on MacBook Pro

字体大小 | |
[系统(linux) 所属分类 系统(linux) | 发布者 店小二04 | 时间 2016 | 作者 红领巾 ] 0人收藏点击收藏

Encrypted Gentoo Installation on MacBook Pro

It looks like it's been a while again since I last posted something... but here I am. About three months ago I was planning to replace my late 2013 iMac 27" with a Mac Pro; overall I liked the iMac a lot but from time to time I do some video editing/encoding and the iMac got very hot and noisy each time. So I was originally thinking to switch to a Mac Pro mainly for this reason. However there was no sight of new Mac Pros and the ones currently available are still ridiculously expensive considering that we are talking about hardware released in 2013; with much less money you can easily build yourself a much more powerful machine, and so I did. I sold the iMac and with half the amount I'd have spent for a Mac Pro I bought all the parts (plus two 27" monitors, new keyboard/mouse and webcam!) and built a very powerful machine with recent hardware. It's very fast and very quiet even overclocked.

I initially thought I'd use the new PC as a Hackintosh and install macOS on it as the primary OS, but having used a Hackintosh in recent past I didn't want again the hassle of getting the computer to work with macOS knowing that each time there is a big update there is also the risk that the OS could stop working altogether.

So the primary candidate was Ubuntu since I have been using it on servers for many years, but I then decided to install Gentoo linux instead. IMO the installation isn't as complicated and difficult as many think it is, so I eventually installed Gentoo on my two MacBook Pros as well as the desktop. I must say that so far I am loving it and I don't miss OSX/macOS at all since I found and got used to the alternative apps for Linux.

Why Gentoo?

Some of the reasons why I wanted to give Gentoo a try as my primary OS are:

you can install binary packages but most software is compiled and thus it is optimised for your hardware, which means it does take longer when you install stuff but you usually get a faster system in return ("Gentoo" is the name of the fastest penguins on earth); you really install only what you want/need. It's not like most other distros which install a lot of stuff and features that you may never use. Instead with Gentoo you only install what you actually need and just the dependencies required; for example if you use Gnome like me, you can configure the system so that it doesn't install all the packages required for KDE and so on. With USE flags you can even customise features on a per package basis if you wish; Gentoo differs from other distros also in that it uses a rolling release system, so you can just install the system once and keep it frequently updated with the latest versions of everything, rather than having to perform a bigger upgrade in one go each time a new release is out; you must update your system frequently though for this to work well; documentation is perhaps the best one I've seen so far for Linux distributions. Installing Gentoo on a MacBook Pro with full disk encryption

There are several guides on the Internet (especially the official Gentoo Handbook ) which show how to do a typical Gentoo installation, but I thought I'd add here my own notes on how to do this specifically on a MacBook Pro with full disk encryption and LVM, so it can hopefully save some time vs reading several guides to achieve the same. I want to keep this as short as possible so I won't go into the details for every command, which you can easily find yourself. Here I will just describe the steps necessary to get a system up and running quickly, and will update the post each time I install Gentoo, if needed.

First, a few notes:

the two MacBook Pros on which I have installed Gentoo are a mid-2010 and an early-2011, so they are not very recent; you might find you have to tweak the installation process a little if you own a more recent MBP but most of the process will be the same; while learning the installing process I had at times to force eject the installation CD/DVD during boot. I found that you can do this by holding the touch-pad's left button while the MBP is booting; once you install the system, you may find that your MBP takes around 30 seconds before actually booting and it will seem as if it freezes on the white screen after the startup chime sound; to fix this you will need to boot the system from an OSX/macOS installation media or use the Internet recovery, and lunch the following command from a terminal: bless --device /dev/disk0s1 --setBoot --legacy

You need to replace /dev/disk0s1 with the correct name for your disk device which you can find with the diskutil list command;

during the installation the network interface may not work automatically until you get everything sorted; you can use the ip link show

command to find the correct name for your network interface, which as we'll see later you will need to manually activate.

you can use either the Gentoo CD or the DVD to install the system. The difference is that the CD only boots in BIOS mode while the DVD can also boot in EFI mode. So if you want to do an installation in EFI mode you will have to use the DVD. In my case, I have chosen to install Gentoo in BIOS mode on both my MBPs, because when the system boots in BIOS mode the integrated Intel graphics card is automatically disabled, forcing you to use the discrete ATI or nVidia card instead; if you want to avoid possible issues which may arise when having both the integrated card and the discrete card enabled, I recommend you also install the system in BIOS mode; it's just easier. This is what I will show here. The installation media

So, to get started with the installation first burn the Gentoo CD/DVD image which you can download here , then insert the CD/DVD in the optical drive and turn the MBP on while holding the Alt key, so you can chose to boot the system from the installation media. If you are using the DVD version you will be able to choose whether to boot the system in "windows" mode or EFI mode. Choose "Windows" mode. You will then see the bootloader screen with some options; press "e" to temporarily edit the boot configuration and add the nomodeset argument to the line which starts with linux . This will avoid some issues with the graphics card during boot. Continue with the boot process making sure you boot into a terminal if you are using the DVD installation disk, otherwise it will load the "Live" version of Gentoo.

Disk and partitions

Next, assuming that you are going to install Gentoo as the only OS or anyway as the first OS (I won't show here how to install multiple operating systems), you will want to wipe the disk and create the necessary partitions - if you want you can create separate partitions for /home etc but here I will assume you want a single main partition for simplicity. Run

fdisk /dev/sda

Press "p" to see the current partition scheme of the disk; to delete the first partition press "d" followed by the number of the partition you want to delete (starting from 1); repeat this until all the partitions have been removed from the configuration of the disk. Then you need to create the new partitions.

First, create the BIOS partition by pressing "n", then "p" (to specify that you want to create a primary partition), and then "1" as the partition number; fdisk will now ask for both the first sector and the last sector for this partition; enter "2048" first and then "+2M" so that the size of the partition is 2MB. Next, create the boot partition by pressing "n", then "p", "2" (second partition); accept the default value for the first sector and enter "+128M" for the last sector so to have a 128M boot partition. Now press "a" and then "2" to make this partition bootable.

The last partition you need to create is /dev/sda3 which will later be encrypted and contain both the root partition for the OS and the data, and the swap partition. Press "n" again, followed by "p", then "3"; accept the default values for both the first sector and the last sector so that this partition will take the remaining space on the disk.

If everything is OK you will see something like the following by pressing "p":

Disk /dev/sda: 223.6 GiB, 240057409536 bytes, 468862128 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x00000000 Device Boot Start End Sectors Size Id Type /dev/sda1 2048 6143 4096 2M 4 FAT16 <32M /dev/sda2 * 6144 268287 262144 128M 83 Linux /dev/sda3 268288 468860079 468591792 223.5G 83 Linux

The changes you have made haven't been written to disk yet, so to confirm these changes and actually wipe the disk and create partitions press "w" then exit fdisk.

Now run

mkfs.vfat -F 32 /dev/sda2

to format the boot partition. Next it's time to set up the encrypted partition. To activate the kernel modules required for the encryption run

modprobe dm-crypt modprobe aes (if it returns an error it means that no hardware cryptographic device is present; in this case run "modprobe aes_generic" instead) modprobe sha256

Next, to set up encryption and LVM run

cryptsetup luksFormat /dev/sda3 (type uppercase YES and enter a passphrase which you will use to unlock the encrypted disk) cryptsetup luksOpen /dev/sda3 main pvcreate /dev/mapper/main vgcreate vg /dev/mapper/main lvcreate -L 1GB -n swap vg lvcreate -l 100%FREE -n root vg

Please note that I am using cryptsetup here with the default settings, but you can tweak the luksFormat command if you want to achieve higher security. Please refer to the man pages for more details. Next run vgdisplay to verify that all the space has been allocated to the encrypted partitions, then run:

mkswap /dev/vg/swap swapon /dev/vg/swap mkfs.ext4 /dev/vg/root mount /dev/vg/root /mnt/gentoo mkdir /mnt/gentoo/boot mount /dev/sda2 /mnt/gentoo/boot cd /mnt/gentoo

These commands will prepare and activate the swap partition, format the root partition as ext4 and mount both the boot and root partitions.

Installing the base system

Now you are ready to download the archive which contains the base system and install it. Run

links https://www.gentoo.org/downloads/mirrors/

which will launch a text based browser. Choose a mirror close to your location and download a stage3 archive from releases/amd64/autobuilds . Then run

tar xvjpf stage3-*.tar.bz2 --xattrs

to extract all the files for the base system on the root partition. Next run

nano -w /mnt/gentoo/etc/portage/make.conf

and change the follow settings:

CFLAGS="-march=native -O2 -pipe" MAKEOPTS="-j5" USE="mmx sse sse2 -kde gtk gnome dvd alsa cdr emu efi-32 efi-64i -bindist xvmc" INPUT_DEVICES="evdev synaptics mtrack tslib" VIDEO_CARDS="nouveau" (for nVidia graphics cards, or "radeon" for ATI cards)

Set MAKEOPTS to the number of cores + 1. Please note that I am assuming here you want to use Gnome, that's why I have gnome but -kde in the USE setting. If you want to use something else you will have to change the USE setting. Now run

mirrorselect -i -o >> /mnt/gentoo/etc/portage/make.conf

and choose a mirror which will be used to download software from the repos hereinafter. Next,

mkdir /mnt/gentoo/etc/portage/repos.conf cp /mnt/gentoo/usr/share/portage/config/repos.conf /mnt/gentoo/etc/portage/repos.conf/gentoo.conf

and then run

cp -L /etc/resolv.conf /mnt/gentoo/etc/

to configure DNS resolution for the installation process. Now run

mount -t proc proc /mnt/gentoo/proc mount --rbind /sys /mnt/gentoo/sys mount --rbind /dev /mnt/gentoo/dev mount --make-rslave /mnt/gentoo/sys mount --make-rslave /mnt/gentoo/dev

after which you are ready to chroot into the new system:

chroot /mnt/gentoo /bin/bash source /etc/profile export PS1="chroot $PS1"

It's time to configure which system "profile" you want to use to configure and install the software. Run

emerge-webrsync eselect news read eselect profile list eselect profile set X (where X is the profile you want to use, I use gnome/systemd)

Now install all the packages required to reflect the system profile you have chosen - as said I will assume you also have chosen gnome/systemd .

emerge --ask --update --deep --newuse @world

This will take some time, so go and enjoy a coffee. Once it's done, choose your timezone, e.g.:

echo "Europe/Helsinki" > /etc/timezone emerge --config sys-libs/timezone-data

and configure the locale:

nano -w /etc/locale.gen locale-gen eselect locale list eselect locale set X (choose one)

So that these changes take effect, run

env-update && source /etc/profile && export PS1="(chroot) $PS1" Configuring and compiling the Kernel

Now download the kernel sources with

emerge --ask sys-kernel/gentoo-sources

To ensure that the kernel will support encryption, run

echo "sys-kernel/genkernel-next cryptsetup" >> /etc/portage/package.use/genkernel-next

Then install genkernel which is a tool you can use to configure and compile the kernel.

emerge --ask sys-kernel/genkernel-next

You need now to edit /etc/fstab to ensure the boot partition is mounted at boot:

nano -w /etc/fstab

and add:

/dev/sda2 /boot ext2 defaults 0 0

Next install LVM:

emerge -av sys-fs/cryptsetup sys-fs/lvm2

Then edit /etc/genkernel.conf and make the following changes:

MRPROPER="no" MAKEOPTS="-j5" LVM="yes" LUKS="yes" REAL_ROOT="/dev/vg/root" INITRAMFS_OVERLAY="/boot/overlay" BUSY_BOX="yes" MENU_CONFIG="yes"

Here also set MAKEOPTS to the number of cores + 1.

To compile the kernel, run:

genkernel --no-zfs --no-btrfs --install all

Now you can customise the kernel if you wish, or leave the defaults as they are - up to you. As you can see I am passing the --no-zfs --no-btrfs arguments since I don't use these file system, so the compilation takes a little less time.

Once the kernel has been compiled, edit /etc/fstab once again and add

/dev/sda2 /boot vfat defaults 0 2 /dev/vg/root / ext4 noatime 0 0 /dev/vg/swap none swap sw 0 0 /dev/cdrom /mnt/cdrom auto noauto,user 0 0 Networking

Check which name your network interface has with

ip link show

then edit /etc/conf.d/net and change it so it looks as follows:

config_enp2s0f0="dhcp"

Of course change enp2s0f0 with the name of your network interface. Next, run

cd /etc/init.d ln -s net.lo net.enp2s0f0 (again, use the name of your network interface here) rc-update add net.enp2s0f0 default Miscellaneous

At this stage you may want to set your root password with

passwd

Also install sysklogd with

emerge --ask app-admin/sysklogd Bootloader

To install the bootloader, run

emerge --ask sys-boot/grub:2

Then edit /etc/default/grub and change the GRUB_CMDLINE_LINUX setting as follows:

GRUB_CMDLINE_LINUX="init=/usr/lib/systemd/systemd crypt_root=/dev/sda3 root=/dev/mapper/vg-root dolvm rootfstype=ext4 nomodeset"

This makes sure the correct settings are used each time you update the bootloader. In this example we specify that systemd , encryption and lvm must be used during boot otherwise it will not be possible to access the encrypted partitions. We also add nomodeset to avoid problems with the graphics card as explained earlier. Next,

grub-install /dev/sda grub-mkconfig -o /boot/grub/grub.cfg

You should now be able to boot into the new system:

exit cd umount -l /mnt/gentoo/dev{/shm,/pts.} umount /mnt/gentoo{/boot,/sys,/proc} shutdown -r now

Hopefully the system will start from the disk. If all is OK, run

systemd-machine-id-setup hostnamectl set-hostname vito-laptop (choose whichever hostname you wish here)

Next edit /etc/systemd/network/50-dhcp.network and change the contents as follow:

[Match] Name=en* [Network] DHCP=yes

To activate networking now and ensure it is activated at startup, run

systemctl enable systemd-networkd.service systemctl start systemd-networkd.service

At this stage I'd add the main user account with

useradd -m -G users,wheel,audio,video -s /bin/bash vito passwd vito

Of course use your chosen account name instead of "vito".

Graphics card and environment

To install the drivers for your graphics card and X, run

emerge --ask --verbose x11-base/xorg-drivers emerge --ask x11-base/xorg-server env-update source /etc/profile

Next, to install Gnome edit /etc/portage/package.use/gnome-session and add

gnome-base/gnome-session branding

Then run

emerge --ask gnome-base/gnome eselect news read gpasswd -a vito plugdev (your account name instead of 'vito')

Edit /etc/conf.d/xdm and set GDM as the window manager, then run

echo "exec gnome-session" > ~/.xinitrc systemctl enable gdm.service systemctl start gdm.service shutdown -r now

If all went well, the system will now boot into Gnome.

Touch pad

If the touch pad isn't working you will need to recompile the kernel. Run

genkernel --no-zfs --no-btrfs --install all

and enable the following settings before saving and exiting - which will trigger recompilation:

EHCI HCD (USB 2.0) support Root Hub Transaction Translators Improved Transaction Translator scheduling Generic EHCI driver for a platform device Device Drivers ---> Input device support ---> Mice ---> Apple USB BCM5974 Multitouch trackpad support Keeping the system up to date

As I mentioned earlier, it is recommended you update the system frequently to avoid problems with big updates. To update the system, I usually run the following commands weekly:

emerge --sync emerge -avuDU --with-bdeps=y @world emaint --check world emerge -av --depclean emerge --update --newuse --deep @world revdep-rebuild perl-cleaner --all Conclusions

I actually had some more notes about using proprietary drivers for the graphics card (instead of the open source nouveau or radeon drivers) and a few more things, but I can't find them at the moment. I will update the post if I find them or if I go through the installation process again. Anyway the steps described in the post will get you up and running with an encrypted installation with gnome/systemd.

Let me know in the comments if this post has been somehow useful.

本文系统(linux)相关术语:linux系统 鸟哥的linux私房菜 linux命令大全 linux操作系统

主题: MacBookLinuxWindowsUbuntuAppleLVOPTUBTIUT
分页:12
转载请注明
本文标题:Encrypted Gentoo Installation on MacBook Pro
本站链接:http://www.codesec.net/view/481090.html
分享请点击:


1.凡CodeSecTeam转载的文章,均出自其它媒体或其他官网介绍,目的在于传递更多的信息,并不代表本站赞同其观点和其真实性负责;
2.转载的文章仅代表原创作者观点,与本站无关。其原创性以及文中陈述文字和内容未经本站证实,本站对该文以及其中全部或者部分内容、文字的真实性、完整性、及时性,不作出任何保证或承若;
3.如本站转载稿涉及版权等问题,请作者及时联系本站,我们会及时处理。
登录后可拥有收藏文章、关注作者等权限...
技术大类 技术大类 | 系统(linux) | 评论(0) | 阅读(36)