README.md

@@ -4,7 +4,7 @@
 
 This is my installer for Arch Linux. It sets up a BTRFS system with encrypted `/boot` and full snapper support (both snapshotting and rollback work!). It also includes various system hardening configurations.
 
-The script is based on [easy-arch](https://github.com/classy-giraffe/easy-arch). However, it diverges substantially from the original project does not follow its development.
+The script was originally based off [easy-arch](https://github.com/classy-giraffe/easy-arch). However, it diverges substantially from the original project does not follow its development.
 
 Visit my Matrix group: https://invite.arcticfoxes.net/#/#tommy:arcticfoxes.net
 

desktop_postinstall.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2021-2024 Thien Tran
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not
-# use this file except in compliance with the License. You may obtain a copy of
-# the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations under
-# the License.
-
-# Make sure secureboot is in setup mode before running this
-
-# Secure boot enrollment
-sudo sbctl enroll-keys
-sudo sbctl sign /boot/efi/EFI/GRUB/grubx64.efi
-
-# Setup Flatpak
-sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
-flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
-flatpak remote-add --if-not-exists --user flathub https://dl.flathub.org/repo/flathub.flatpakrepo
-flatpak --user install org.gnome.Extensions com.github.tchx84.Flatseal org.gnome.Loupe -y
-flatpak --user override com.github.tchx84.Flatseal --filesystem=/var/lib/flatpak/app:ro --filesystem=xdg-data/flatpak/app:ro --filesystem=xdg-data/flatpak/overrides:create
-flatpak --user override org.gnome.Extensions --talk-name=org.gnome.Shell.Extensions
-flatpak update -y
-
-# Firewalld setup
-sudo firewall-cmd --set-default-zone=block
-sudo firewall-cmd --permanent --add-service=dhcpv6-client
-sudo firewall-cmd --reload
-sudo firewall-cmd --lockdown-on

install.sh

@@ -38,6 +38,29 @@ install_mode_selector() {
     esac
 }
 
+# Selecting the kernel flavor to install.
+kernel_selector () {
+    output 'List of kernels:'
+    output '1) Stable — Vanilla Linux kernel and modules, with a few patches applied.'
+    output '2) Hardened — A security-focused Linux kernel.'
+    output '3) Longterm — Long-term support (LTS) Linux kernel and modules.'
+    output '4) Zen Kernel — Optimized for desktop usage.'
+    output 'Insert the number of your selection:'
+    read -r choice
+    case $choice in
+        1 ) kernel=linux
+            ;;
+        2 ) kernel=linux-hardened
+            ;;
+        3 ) kernel=linux-lts
+            ;;
+        4 ) kernel=linux-zen
+            ;;
+        * ) output 'You did not enter a valid selection.'
+            kernel_selector
+    esac
+}
+
 luks_password_prompt () {
     output 'Enter your encryption password (the password will not be shown on the screen):'
     read -r -s luks_password
@@ -94,7 +117,6 @@ user_password_prompt () {
 }
 
 hostname_prompt (){
-    if [ "${install_mode}" = 'server' ]; then
     output 'Enter your hostname:'
     read -r hostname
 
@@ -102,9 +124,6 @@ hostname_prompt (){
         output 'You need to enter a hostname.'
         hostname_prompt
     fi
-    else
-        hostname='localhost'
-    fi
 }
 
 # Set hardcoded variables (temporary, these will be replaced by future prompts)
@@ -116,6 +135,7 @@ clear
 
 # Initial prompts
 install_mode_selector 
+kernel_selector
 luks_password_prompt
 disk_prompt
 username_prompt
@@ -158,7 +178,7 @@ mkfs.fat -F 32 -s 2 "${ESP}" &>/dev/null
 
 ## Creating a LUKS Container for the root partition.
 output 'Creating LUKS Container for the root partition.'
-echo -n "${luks_password}" | cryptsetup luksFormat --pbkdf pbkdf2 ${cryptroot} -d - &>/dev/null
+echo -n "${luks_password}" | cryptsetup luksFormat --type luks1 ${cryptroot} -d - &>/dev/null
 echo -n "${luks_password}" | cryptsetup open ${cryptroot} cryptroot -d -
 BTRFS='/dev/mapper/cryptroot'
 
@@ -264,16 +284,10 @@ fi
 
 ## Pacstrap
 output 'Installing the base system (it may take a while).'
-
-output "You may see an error when mkinitcpio tries to generate a new initramfs."
-output "It is okay. The script will regenerate the initramfs later in the installation process."
-
-pacstrap /mnt apparmor base chrony efibootmgr firewalld grub grub-btrfs inotify-tools linux-firmware linux-hardened linux-lts "${microcode}" nano networkmanager reflector sbctl snapper sudo zram-generator
-
 if [ "${install_mode}" = 'desktop' ]; then
-    pacstrap /mnt nautilus gdm gnome-console gnome-control-center flatpak pipewire-alsa pipewire-pulse pipewire-jack
+    pacstrap /mnt base "${kernel}" "${microcode}" apparmor chrony efibootmgr firewalld grub grub-btrfs inotify-tools linux-firmware nano networkmanager reflector sbctl snapper sudo zram-generator nautilus gdm gnome-console gnome-control-center pipewire-alsa pipewire-pulse pipewire-jack
 elif [ "${install_mode}" = 'server' ]; then
-    pacstrap /mnt openssh
+    pacstrap /mnt base "${kernel}" "${microcode}" apparmor chrony efibootmgr firewalld grub grub-btrfs inotify-tools linux-firmware nano networkmanager reflector sbctl snapper sudo zram-generator openssh
 fi
 
 if [ "${virtualization}" = 'none' ]; then
@@ -332,14 +346,14 @@ sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/20_linux_xen
 
 ## Kernel hardening
 UUID=$(blkid -s UUID -o value "${cryptroot}")
-sed -i "s#quiet#rd.luks.name=${UUID}=cryptroot root=${BTRFS} lsm=landlock,lockdown,yama,integrity,apparmor,bpf mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1#g" /mnt/etc/default/grub
+sed -i "s#quiet#rd.luks.name=${UUID}=cryptroot root=${BTRFS} mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1#g" /mnt/etc/default/grub
 
 ## Add keyfile to the initramfs to avoid double password.
 dd bs=512 count=4 if=/dev/random of=/mnt/cryptkey/.root.key iflag=fullblock &>/dev/null
 chmod 000 /mnt/cryptkey/.root.key &>/dev/null
 echo -n "${luks_password}" | cryptsetup luksAddKey /dev/disk/by-partlabel/cryptroot /mnt/cryptkey/.root.key -d -
 sed -i 's#FILES=()#FILES=(/cryptkey/.root.key)#g' /mnt/etc/mkinitcpio.conf
-sed -i "s#module\.sig_enforce=1#module.sig_enforce=1 rd.luks.key=/cryptkey/.root.key#g" /mnt/etc/default/grub
+sed -i "s#module.sig_enforce=1#module.sig_enforce=1 rd.luks.key=/cryptkey/.root.key#g" /mnt/etc/default/grub
 
 ## Continue kernel hardening
 unpriv curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | tee /mnt/etc/modprobe.d/30_security-misc.conf
@@ -363,23 +377,6 @@ sed -i 's/nullok//g' /mnt/etc/pam.d/system-auth
 ## Disable coredump
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | tee /mnt/etc/security/limits.d/30-disable-coredump.conf
 
-# Disable XWayland
-sudo mkdir -p /mnt/etc/systemd/user/org.gnome.Shell@wayland.service.d
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/user/org.gnome.Shell%40wayland.service.d/override.conf | sudo tee /mnt/etc/systemd/user/org.gnome.Shell@wayland.service.d/override.conf
-
-# Setup dconf
-mkdir -p /mnt/etc/dconf/db/local.d/locks
-
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/automount-disable | tee /mnt/etc/dconf/db/local.d/locks/automount-disable
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/privacy | tee /mnt/etc/dconf/db/local.d/locks/privacy
-
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/adw-gtk3-dark | tee /mnt/etc/dconf/db/local.d/adw-gtk3-dark
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/automount-disable | tee /mnt/etc/dconf/db/local.d/automount-disable
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/button-layout | tee /mnt/etc/dconf/db/local.d/button-layout
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/prefer-dark | tee /mnt/etc/dconf/db/local.d/prefer-dark
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/privacy | tee /mnt/etc/dconf/db/local.d/privacy
-unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/touchpad | tee /mnt/etc/dconf/db/local.d/touchpad
-
 ## ZRAM configuration
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf | tee /mnt/etc/systemd/zram-generator.conf
 
@@ -403,36 +400,32 @@ arch-chroot /mnt /bin/bash -e <<EOF
     hwclock --systohc
 
     # Generating locales.my keys aren't even on
-    output "Generating locales."
+    echo "Generating locales."
     locale-gen
 
     # Create SecureBoot keys. This isn't strictly necessary, but certain things like linux-hardened preset expects it and mkinitcpio will fail without it, sooo...
     sbctl create-keys
 
     # Generating a new initramfs.
-    output "Creating a new initramfs."
+    echo "Creating a new initramfs."
     chmod 600 /boot/initramfs-linux*
     mkinitcpio -P
 
     # Installing GRUB.
-    output "Installing GRUB on /boot."
+    echo "Installing GRUB on /boot."
     grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --modules="normal test efi_gop efi_uga search echo linux all_video gfxmenu gfxterm_background gfxterm_menu gfxterm loadenv configfile gzio part_gpt cryptodisk luks gcry_rijndael gcry_sha256 btrfs" --disable-shim-lock
 
     # Creating grub config file.
-    output "Creating GRUB config file."
+    echo "Creating GRUB config file."
     grub-mkconfig -o /boot/grub/grub.cfg
 
     # Adding user with sudo privilege
     if [ -n "$username" ]; then
-        output "Adding $username with root privilege."
+        echo "Adding $username with root privilege."
         useradd -m $username
         usermod -aG wheel $username
     fi
 
-    # Setting up dconf
-    output "Setting up dconf."
-    dconf update
-
     # Snapper configuration
     umount /.snapshots
     rm -r /.snapshots
@@ -449,6 +442,11 @@ EOF
 ## Give wheel user sudo access.
 sed -i 's/# \(%wheel ALL=(ALL\(:ALL\|\)) ALL\)/\1/g' /mnt/etc/sudoers
 
+## Enabling openssh server
+if [ "${install_mode}" = 'server' ]; then
+    systemctl enable sshd --root=/mnt
+fi
+
 ## Enable services
 systemctl enable apparmor --root=/mnt
 systemctl enable chronyd --root=/mnt
@@ -463,14 +461,6 @@ systemctl enable snapper-cleanup.timer --root=/mnt
 systemctl enable systemd-oomd --root=/mnt
 systemctl disable systemd-timesyncd --root=/mnt
 
-if [ "${install_mode}" = 'desktop' ]; then
-    systemctl enable gdm --root=/mnt
-fi
-
-if [ "${install_mode}" = 'server' ]; then
-    systemctl enable sshd --root=/mnt
-fi
-
 ## Set umask to 077.
 sudo sed -i 's/^UMASK.*/UMASK 077/g' /mnt/etc/login.defs
 sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /mnt/etc/login.defs