#!/usr/bin/env -S bash -e # Cleaning the TTY. clear # Selecting the kernel flavor to install. kernel_selector () { echo "List of kernels:" echo "1) Stable — Vanilla Linux kernel and modules, with a few patches applied." echo "2) Hardened — A security-focused Linux kernel." echo "3) Longterm — Long-term support (LTS) Linux kernel and modules." echo "4) Zen Kernel — Optimized for desktop usage." read -r -p "Insert the number of the corresponding kernel: " choice echo "$choice will be installed" case $choice in 1 ) kernel=linux ;; 2 ) kernel=linux-hardened ;; 3 ) kernel=linux-lts ;; 4 ) kernel=linux-zen ;; * ) echo "You did not enter a valid selection." kernel_selector esac } # Checking the microcode to install. CPU=$(grep vendor_id /proc/cpuinfo) if [[ $CPU == *"AuthenticAMD"* ]] then microcode=amd-ucode else microcode=intel-ucode fi # Selecting the target for the installation. PS3="Select the disk where Arch Linux is going to be installed: " select ENTRY in $(lsblk -dpnoNAME|grep -P "/dev/sd|nvme"); do DISK=$ENTRY echo "Installing Arch Linux on $DISK." break done # Deleting old partition scheme. read -r -p "This will delete the current partition table on $DISK. Do you agree [y/N]? " response response=${response,,} if [[ "$response" =~ ^(yes|y)$ ]] then wipefs -af $DISK &>/dev/null sgdisk -Zo $DISK &>/dev/null else echo "Quitting." exit fi # Creating a new partition scheme. echo "Creating new partition scheme on $DISK." parted -s $DISK \ mklabel gpt \ mkpart ESP fat32 1MiB 301MiB \ mkpart cryptroot 301MiB 100% \ ESP="/dev/disk/by-partlabel/ESP" Cryptroot="/dev/disk/by-partlabel/cryptroot" # Informing the Kernel of the changes. echo "Informing the Kernel about the disk changes." partprobe $DISK # Formatting the ESP as FAT32. echo "Formatting the EFI Partition as FAT32." mkfs.fat -F 32 $ESP &>/dev/null # Creating a LUKS Container for the root partition. echo "Creating LUKS Container for the root partition." cryptsetup --type luks1 luksFormat $Cryptroot echo "Opening the newly created LUKS Container." cryptsetup open $Cryptroot cryptroot BTRFS="/dev/mapper/cryptroot" # Formatting the LUKS Container as BTRFS. echo "Formatting the LUKS container as BTRFS." mkfs.btrfs $BTRFS &>/dev/null mount $BTRFS /mnt # Creating BTRFS subvolumes. echo "Creating BTRFS subvolumes." btrfs su cr /mnt/@ &>/dev/null btrfs su cr /mnt/@boot &>/dev/null btrfs su cr /mnt/@home &>/dev/null btrfs su cr /mnt/@var &>/dev/null # Mounting the newly created subvolumes. umount /mnt echo "Mounting the newly created subvolumes." mount -o ssd,noatime,space_cache,compress=zstd,subvol=@ $BTRFS /mnt mkdir -p /mnt/{home,var,boot} mount -o ssd,noatime,space_cache,compress=zstd,subvol=@boot $BTRFS /mnt/boot mount -o ssd,noatime,space_cache,compress=zstd,subvol=@home $BTRFS /mnt/home mount -o ssd,noatime,space_cache,nodatacow,subvol=@var $BTRFS /mnt/var/ mkdir -p /mnt/boot/efi mount $ESP /mnt/boot/efi chattr +C /mnt/var kernel_selector # Pacstrap (setting up a base sytem onto the new root). echo "Installing the base system (it may take a while)." pacstrap /mnt base base-devel ${kernel} ${kernel}-headers ${microcode} linux-firmware btrfs-progs grub grub-btrfs efibootmgr sudo networkmanager apparmor &>/dev/null nano gnome-shell gdm gnome-control-center gnome-terminal gnome-software gnome-tweaks nautilus flatpak xdg-user-dirs firewalld # Generating /etc/fstab. echo "Generating a new fstab." genfstab -U /mnt >> /mnt/etc/fstab # Setting hostname. read -r -p "Please enter the hostname: " hostname echo $hostname > /mnt/etc/hostname # Setting up locales. read -r -p "Please insert the locale you use in this format (xx_XX): " locale echo "$locale.UTF-8 UTF-8" > /mnt/etc/locale.gen echo "LANG=$locale.UTF-8" > /mnt/etc/locale.conf # Setting up keyboard layout. read -r -p "Please insert the keyboard layout you use: " kblayout echo "KEYMAP=$kblayout" > /mnt/etc/vconsole.conf # Setting hosts file. echo "Setting hosts file." cat > /mnt/etc/hosts <> /mnt/etc/default/grub echo -e "# Booting with BTRFS subvolume\nGRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION=true" >> /mnt/etc/default/grub # Adding keyfile to the initramfs to avoid double password. dd bs=512 count=4 if=/dev/random of=/mnt/.root.key iflag=fullblock &>/dev/null chmod 000 /mnt/.root.key &>/dev/null cryptsetup -v luksAddKey /dev/disk/by-partlabel/cryptroot /mnt/.root.key sed -i -e "s,quiet,quiet cryptdevice=UUID=$UUID:cryptroot root=$BTRFS cryptkey=rootfs:/.root.key,g" /mnt/etc/default/grub sed -i 's#FILES=()#FILES=(/.root.key)#g' /mnt/etc/mkinitcpio.conf # Configuring the system. arch-chroot /mnt /bin/bash -e </dev/null # Setting up clock. hwclock --systohc # Generating locales. echo "Generating locales." locale-gen &>/dev/null # Generating a new initramfs. echo "Creating a new initramfs." chmod 600 /boot/initramfs-linux* &>/dev/null mkinitcpio -P &>/dev/null # Installing GRUB. echo "Installing GRUB on /boot." grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB &>/dev/null # Creating grub config file. echo "Creating GRUB config file." grub-mkconfig -o /boot/grub/grub.cfg &>/dev/null EOF # Setting root password. echo "Setting root password." arch-chroot /mnt /bin/passwd # Enabling auto-trimming service. echo "Enabling auto-trimming." systemctl enable fstrim.timer --root=/mnt &>/dev/null # Enabling NetworkManager service. echo "Enabling NetworkManager." systemctl enable NetworkManager --root=/mnt &>/dev/null # Enabling GDM systemctl enable gdm --root=/mnt &>/dev/null # Enabling AppArmor systemctl enable apparmor --root=/mnt &>/dev/null # Enabling Firewalld systemctl enable firewalld --root=/mnt &>/dev/null # Setting umask to 077 sed -i 's/022/077/g' /mnt/etc/profile echo "" >> /mnt/etc/bash.bashrc echo "umask 077" >> /mnt/etc/bash.bashrc #Security kernel settings sudo bash -c 'cat > /mnt/etc/sysctl.d/51-dmesg-restrict.conf' <<-'EOF' kernel.dmesg_restrict = 1 EOF sudo bash -c 'cat > /mnt/etc/sysctl.d/51-kptr-restrict.conf' <<-'EOF' kernel.kptr_restrict = 2 EOF sudo bash -c 'cat > /mnt/etc/sysctl.d/51-kexec-restrict.conf' <<-'EOF' kernel.kexec_load_disabled = 1 EOF sudo bash -c 'cat > /mnt/etc/sysctl.d/10-security.conf' <<-'EOF' fs.protected_hardlinks = 1 fs.protected_symlinks = 1 net.core.bpf_jit_harden = 2 kernel.yama.ptrace_scope = 3 EOF #Blacklist Firewire SBP2 echo "blacklist firewire-sbp2" | sudo tee /mnt/etc/modprobe.d/blacklist.conf echo "Done, you may now wish to reboot (further changes can be done by chrooting into /mnt)." exit