X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=debian%2Fpostinst;h=e6d7b0a878c45663e1db7871614ccb2d246a2e3c;hb=f6676590525ca740e8cc78b7a1a156a8f6a9b9d6;hp=0312b32d920ce304bcb21481954153a46b6a71aa;hpb=e2e6d1ca096979fbbaf7fcb05de8943358eed0e0;p=kernel-cn.git diff --git a/debian/postinst b/debian/postinst index 0312b32..e6d7b0a 100755 --- a/debian/postinst +++ b/debian/postinst @@ -27,6 +27,9 @@ case "$1" in ;; esac +# Source debconf library. +. /usr/share/debconf/confmodule + # import CN-functions . /usr/share/carnet-tools/functions.sh @@ -69,6 +72,20 @@ echo "CN: Removed old symlinks in / and /boot." ################################################################################ +DIVERT_TO="grub grub-probe" + +echo -n "CN: Undiverting binaries:" +for i in $DIVERT_TO; do + if [ -e /usr/sbin/$i.real ]; then + dpkg-divert --remove --rename --package 'kernel-2.6-cn' \ + --divert /usr/sbin/$i.real /usr/sbin/$i >/dev/null + echo -n " $i" + fi +done +echo "." + +################################################################################ + # intro msg echo -n "CN: Configuring system (this will take a while):" @@ -134,21 +151,24 @@ fi echo -n " grub2" # workaround grsec -if [ -x /sbin/chpax ]; then - if [ -x /usr/sbin/grub ]; then - chpax -spmrx /usr/sbin/grub || true +if uname -a | grep -q grsec; then + if [ -x /sbin/chpax ]; then + # grub + if [ -x /usr/sbin/grub.real ]; then + chpax -spmrx /usr/sbin/grub.real >/dev/null 2>&1 || true + elif [ -x /usr/sbin/grub ]; then + chpax -spmrx /usr/sbin/grub >/dev/null 2>&1 || true + fi + + # grub-probe + if [ -x /usr/sbin/grub-probe.real ]; then + chpax -spmrx /usr/sbin/grub-probe.real >/dev/null 2>&1 || true + elif [ -x /usr/sbin/grub-probe ]; then + chpax -spmrx /usr/sbin/grub-probe >/dev/null 2>&1 || true + fi + + echo -n " grsec" fi - if [ -x /usr/sbin/grub-probe ]; then - chpax -spmrx /usr/sbin/grub-probe || true - fi -fi -echo -n " grub3" - -# workaround execshield -SHIELD=$(sysctl -e -n kernel.exec-shield) -if [ ! -z "$SHIELD" ]; then - sysctl -e -w kernel.exec-shield=0 >/dev/null 2>&1 - echo -n " execshield1" fi # remove obsolete devfs/compat links and restore normal udev behaviour @@ -157,7 +177,7 @@ rm -f /etc/udev/rules.d/devfs.rules /etc/udev/rules.d/compat.rules \ #if [ ! -e /etc/udev/rules.d/udev.rules ]; then # ln -s ../udev.rules /etc/udev/rules.d/udev.rules #fi -udevcontrol reload_rules >/dev/null 2>&1 || true +udevadm control --reload_rules >/dev/null 2>&1 || true udevsettle || true echo -n " udev" @@ -165,7 +185,7 @@ echo -n " udev" if [ -f "$device_map" ]; then mv -f "$device_map" "$device_map.old" fi -grub --batch --no-floppy --device-map="$device_map" </dev/null 2>&1 +grub --batch --no-floppy --device-map="$device_map" <<'EOF' >/dev/null 2>&1 quit EOF if [ ! -s "$device_map" ]; then @@ -173,10 +193,13 @@ if [ ! -s "$device_map" ]; then mv -f "$device_map.old" "$device_map" fi -:q!else +else rm -f "$device_map.old" fi -echo -n " grub4" +echo -n " grub3" + +# import GRUB helper functions (again, updated device map) +. /usr/share/kernel-2.6-cn/grub-functions.sh # get install device (0x80 BIOS device) install_device=$(grep '^(hd0)' "$device_map" | \ @@ -202,7 +225,7 @@ if [ -h "$install_device" ]; then || true fi fi -echo -n " grub5" +echo -n " grub4" # install GRUB loader if ! grub-install --no-floppy "$install_device" >/dev/null 2>&1; then @@ -211,7 +234,7 @@ if ! grub-install --no-floppy "$install_device" >/dev/null 2>&1; then echo "CN: Do not reboot your server and report this to OTRS immediately!" exit 1 fi -echo -n " grub6" +echo -n " grub5" # fix possible wrong params in menu.lst cp_check_and_sed '^# groot=' \ @@ -221,7 +244,7 @@ cp_check_and_sed '^# kopt=' \ "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \ "$menu_file" || true /usr/sbin/update-grub >/dev/null 2>&1 || true -echo -n " grub7" +echo -n " grub6" # and final stage of devfs/udev brokeness fix if [ "x$install_device_resolved" != "x$install_device" ]; then @@ -246,13 +269,7 @@ if [ "x$install_device_resolved" != "x$install_device" ]; then "s;\(^kernel.*\)root=[^[:space:]]*\(.*\);\1root=$root_device\2;g" \ "$menu_file" || true fi -echo -n " grub8" - -# restore execshield state -if [ ! -z "$SHIELD" ]; then - sysctl -e -w "kernel.exec-shield=$SHIELD" >/dev/null 2>&1 - echo -n " execshield2" -fi +echo -n " grub7" # disable lilo if [ -e /etc/lilo.conf ]; then @@ -310,8 +327,7 @@ fi # default kernel parameters rm -f /etc/sysctl.conf.$$ -cat > /etc/sysctl.conf.$$ < /etc/sysctl.conf.$$ <<'EOF' kernel.maps_protect=1 net.core.rmem_default=1048576 net.core.wmem_default=1048576 @@ -325,24 +341,23 @@ net.ipv4.icmp_echo_ignore_broadcasts=1 net.ipv4.icmp_ignore_bogus_error_responses=1 net.ipv4.ip_forward=0 net.ipv4.ip_local_port_range=10000 65000 -net.ipv4.tcp_congestion_control=cubic net.ipv4.tcp_ecn=0 -net.ipv4.tcp_max_syn_backlog=8192 +net.ipv4.tcp_max_syn_backlog=1024 net.ipv4.tcp_retries1=2 net.ipv4.tcp_rfc1337=1 net.ipv4.tcp_syncookies=1 vm.mmap_min_addr=65536 EOF -# old kernel params +# old kernel params (skipping some of the obsolete or overrided entries) if [ -e /etc/sysctl.conf ]; then - egrep -v 'net\.core\.(r|w)mem_max|net\.ipv4\.tcp_(r|w)mem|vm\.bdflush|net\.ipv4\.ip_local_port_range|kernel\.rtsig-max|net\.ipv4\.tcp_syncookies' \ + egrep -v 'net\.core\.(r|w)mem_max|net\.ipv4\.tcp_(r|w)mem|vm\.bdflush|net\.ipv4\.ip_local_port_range|kernel\.rtsig-max|net\.ipv4\.tcp_syncookies|kernel\.exec-shield|net\.ipv4\.tcp_max_syn_backlog|net\.ipv4\.tcp_congestion_control|kernel\.exec-shield' \ /etc/sysctl.conf >> /etc/sysctl.conf.$$ fi # add sysctl.conf Debian headers rm -f /etc/sysctl.conf-head -cat > /etc/sysctl.conf-head < /etc/sysctl.conf-head <<'EOF' # # /etc/sysctl.conf - Configuration file for setting system variables # See sysctl.conf (5) for information. @@ -389,7 +404,7 @@ echo -n "CN: Setting up PAM configurations:" if [ -e /etc/security/limits.conf ]; then rm -f /etc/security/limits.conf.$$ cp /etc/security/limits.conf /etc/security/limits.conf.$$ - cp-update kernel-2.6-cn /etc/security/limits.conf.$$ < /var/lib/dpkg/info/kernel-2.4-cn.postrm.$$ < /var/lib/dpkg/info/kernel-2.4-cn.postrm.$$ <<'EOF' #!/bin/sh set -e @@ -455,7 +470,7 @@ fi # fix old kernel-cn postrm if [ -e /var/lib/dpkg/info/kernel-cn.postrm ]; then echo "CN: Fixed old kernel-cn postrm." - cat > /var/lib/dpkg/info/kernel-cn.postrm.$$ < /var/lib/dpkg/info/kernel-cn.postrm.$$ <<'EOF' #!/bin/sh set -e