suricata: Change midstream policy to "pass-flow"

[ipfire-2.x.git] / lfs / stage2

###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

###############################################################################
# Definitions
###############################################################################

include Config

VER        = ipfire

THISAPP    = stage2
TARGET     = $(DIR_INFO)/$(THISAPP)

###############################################################################
# Top-level Rules
###############################################################################

install : $(TARGET)

check :

download :

b2 :

###############################################################################
# Installation Details
###############################################################################

$(TARGET) :
	@$(PREBUILD)

	# Create directories
	-mkdir -pv /{bin,boot,etc/opt,etc/modprobe.d,home,lib/firmware/brcm,mnt,opt,run}
	-mkdir -pv /{media/{floppy,cdrom,usbkey},sbin,srv,var}
	-install -dv -m 0750 /root
	-install -dv -m 1777 /tmp /var/tmp
	-mkdir -pv /usr/{,local/}{bin,include,lib,sbin,src}
	-mkdir -pv /usr/{,local/}share/{doc,info,locale,man}
	-mkdir -v  /usr/{,local/}share/{misc,terminfo,zoneinfo}
	-mkdir -pv /usr/{,local/}share/man/man{1..8}
	#-for dir in /usr /usr/local; do \
	#  ln -sv share/{man,doc,info} $$dir; \
	#done

	# Symlink /var/run -> /run.
	ln -svf ../run /var/run

	ln -svf lib /lib64
	ln -svf lib /usr/lib64

ifeq "$(BUILD_ARCH)" "riscv64"
	ln -svf . /lib/lp64d
	ln -svf . /usr/lib/lp64d
endif

	# Symlinks
	# for this reason, stage2 rebuild will broke the iso:perl, grubbatch
	-ln -sv $(TOOLS_DIR)/bin/{bash,cat,echo,pwd,stty} /bin
	-ln -sv $(TOOLS_DIR)/bin/perl /usr/bin
	-ln -sv $(TOOLS_DIR)/lib/libgcc_s.so{,.1} /usr/lib
	-ln -sv $(TOOLS_DIR)/lib/libstdc++.so{,.6} /usr/lib
	sed 's@$(TOOLS_DIR)@/usr@' $(TOOLS_DIR)/lib/libstdc++.la > /usr/lib/libstdc++.la
	-ln -sv bash /bin/sh

	# Config files
	cp -rvf $(DIR_SRC)/config/etc/* /etc;
	[ ! -d "$(DIR_SRC)/config/etc-$(BUILD_ARCH)" ] || cp -rvf $(DIR_SRC)/config/etc-$(BUILD_ARCH)/* /etc
	cp -rvf $(DIR_SRC)/config/lib/* /lib;
	touch /etc/fstab
	ln -s /proc/self/mounts /etc/mtab
	echo "$(NAME) v$(VERSION) - $(SLOGAN)" >  /etc/issue
	echo "===============================" >> /etc/issue
	echo "\n running on \s \r \m"          >> /etc/issue
	-cat /etc/motd >> /etc/issue

	# Bash startup files
	install --directory --mode=0755 --owner=root --group=root /etc/profile.d
	for i in $(DIR_SRC)/config/profile.d/*; do \
	    [ -f $$i ] && cp $$i /etc/profile.d; \
	done
	chmod 755 /etc/bashrc

	# Install root's bash files.
	for i in $(DIR_SRC)/config/bash/dot_*; do \
		[ -f $$i ] && cp $$i /root/$$(basename $${i/dot_/\.}); \
	done

	# Scripts
	for i in `find $(DIR_SRC)/src/scripts -maxdepth 1 -type f`; do \
	    sed "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" $$i > /usr/local/bin/`basename $$i`; \
	    chmod 755 /usr/local/bin/`basename $$i`; \
	done

	# Move script to correct place.
	mv -vf /usr/local/bin/openvpn-metrics /usr/sbin/
	mv -vf /usr/local/bin/captive-cleanup /usr/bin/

	# Install firewall scripts.
	mkdir -pv /usr/lib/firewall
	install -m 755 $(DIR_SRC)/config/firewall/rules.pl \
		/usr/lib/firewall/rules.pl
	install -m 644 $(DIR_SRC)/config/firewall/firewall-lib.pl \
		/usr/lib/firewall/firewall-lib.pl
	install -m 755 $(DIR_SRC)/config/firewall/ipsec-policy \
		/usr/lib/firewall/ipsec-policy

	# Nobody user
	-mkdir -p /home/nobody
	chown -R nobody:nobody /home/nobody

	# Create /var dirs and files
	-mkdir -v /var/{lock,log,mail,spool,empty}
	-mkdir -pv /var/{opt,cache,lib/misc,local}
	-mkdir -pv /var/log/{counter,calamaris}
	chown nobody.nobody /var/log/calamaris
	touch /var/log/{btmp,lastlog,wtmp}
	chmod -v 600 /var/log/btmp
	chgrp -v utmp /var/log/lastlog
	chmod -v 664 /var/log/lastlog

	# Permissions
	chmod 0711 /var/empty

	# A small hack to include /root to the iso but not all of it's files.
	touch /root/ipfire

	# License agreement
	-mkdir -pv /usr/share/doc/licenses/
	cp -vf $(DIR_SRC)/doc/COPYING /usr/share/doc/licenses/GPLv3

	# System release
	echo "$(SYSTEM_RELEASE)" > /etc/system-release

	# OS release
	: >/etc/os-release
	echo "NAME=\"$(NAME)\"" >> /etc/os-release
	echo "VERSION=\"$(VERSION)\"" >> /etc/os-release
	echo "ID=$(SNAME)" >> /etc/os-release
	echo "VERSION_ID=2" >> /etc/os-release
	echo "PRETTY_NAME=\"$(SYSTEM_RELEASE)\"" >> /etc/os-release
	echo "ANSI_COLOR=\"0:31\"" >> /etc/os-release

	# Pakfire
	-mkdir -pv /opt/pakfire/db/core
	echo "$(CORE)" > /opt/pakfire/db/core/mine

	# IPblocklist.
	-mkdir -pv /var/lib/ipblocklist
	chown nobody:nobody /var/lib/ipblocklist

	@$(POSTBUILD)