Better virtualization handling

Signed-off-by: Tommy <contact@tommytran.io>

Fedora-Server-40.sh

@@ -24,6 +24,8 @@ unpriv(){
     sudo -u nobody "$@"
 }
 
+virtualization=$(systemd-detect-virt)
+
 # Increase compression level
 sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
 
@@ -98,63 +100,62 @@ sudo sed -i 's/^metalink=.*/&\&protocol=https/g' /etc/yum.repos.d/*
 # Remove unnecessary packages
 sudo dnf remove -y cockpit*
 
+# Install appropriate virtualization drivers
+if [ "$virtualization" = 'kvm' ]; then
+    sudo dnf install -y qemu-guest-agent
+fi
+
 # Setup fwupd
-echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
+if [ "$virtualization" = 'none' ]; then
-sudo systemctl restart fwupd
+  sudo dnf install -y fwupd
+  echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
+  sudo systemctl restart fwupd
+  mkdir -p /etc/systemd/system/fwupd-refresh.service.d
+  unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/fwupd-refresh.service.d/override.conf | sudo tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
+  sudo systemctl daemon-reload
+  sudo systemctl enable --now fwupd-refresh.timer
+fi
 
 # Enable auto TRIM
 sudo systemctl enable fstrim.timer
 
 ### Differentiating bare metal and virtual installs
 
-# Installing tuned first here because virt-what is 1 of its dependencies anyways
+# Setup tuned
-sudo dnf install tuned -y
+sudo dnf install -y tuned
 sudo systemctl enable --now tuned
 
-virt_type=$(virt-what)
+if [ "$virtualization" = 'none' ]; then
-if [ "$virt_type" = '' ]; then
-    output 'Virtualization: Bare Metal.'
-elif [ "$virt_type" = 'openvz lxc' ]; then
-    output 'Virtualization: OpenVZ 7.'
-elif [ "$virt_type" = 'xen xen-hvm' ]; then
-    output 'Virtualization: Xen-HVM.'
-elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
-    output 'Virtualization: Xen-HVM on AWS.'
-else
-    output "Virtualization: $virt_type."
-fi
-
-# Setup tuned
-if [ "$virt_type" = '' ]; then
     sudo tuned-adm profile latency-performance
 else
-    if [ "$virt_type" = 'kvm' ]; then
+    if [ "$virtualization" = 'kvm' ]; then
-        sudo dnf install qemu-guest-agent -y
+        sudo dnf install -y qemu-guest-agent
     fi
     sudo tuned-adm profile virtual-guest
 fi
 
+
 # Setup real-ucode and hardened_malloc
 MACHINE_TYPE=$(uname -m)
-if [ "$virt_type" = '' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
+if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
-    sudo dnf install 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm' -y
+    sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
     sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
     if [ "${MACHINE_TYPE}" != 'x86_64' ]; then
         sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
-        sudo dnf install real-ucode -y
+        sudo dnf install -y real-ucode
         sudo dracut -f
-    elif [ "$virt_type" != '' ]; then
+    elif [ "$virtualization" != 'none' ]; then
         sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,hardened_malloc
-        sudo dnf install hardened_malloc -y
+        sudo dnf install -y hardened_malloc
     else
         sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware,hardened_malloc
-        sudo dnf install real-ucode hardened_malloc -y
+        sudo dnf install -y real-ucode hardened_malloc
         echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
         sudo dracut -f
     fi
 elif [ "${MACHINE_TYPE}" == 'aarch64' ]; then
     sudo dnf copr enable secureblue/hardened_malloc -y
-    sudo dnf install hardened_malloc -y
+    sudo dnf install -y hardened_malloc
 fi
 
 # Setup Networking

Fedora-Workstation-40.sh

@@ -24,22 +24,7 @@ unpriv(){
     sudo -u nobody "$@"
 }
 
-install_options(){
+virtualization=$(systemd-detect-virt)
-    output "Are you using a Parallels Virtual Machine?"
-    output "[1] Yes"
-    output "[2] No"
-    read -r choice
-    case $choice in
-        1 ) parallels=1
-            ;;
-        2 ) parallels=0
-            ;;
-        * ) output "You did not enter a valid selection."
-            install_options
-    esac
-}
-
-install_options
 
 # Increase compression level
 sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
@@ -59,7 +44,7 @@ sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
 sudo chmod 700 /home/*
 
 # Setup NTS
-if [ "${parallels}" = '1' ]; then
+if [ "${virtualization}" = 'parallels' ]; then
     sudo dnf -y remove chrony
 else
     sudo rm -rf /etc/chrony.conf
@@ -91,14 +76,14 @@ sudo dracut -f
 sudo sysctl -p
 
 if sudo bootctl status | grep -q systemd-boot; then
-    if [ "${parallels}" = '1' ]; then
+    if [ "${virtualization}" = 'parallels' ]; then
         sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off root/g' /etc/kernel/cmdline
     else 
         sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 root/g' /etc/kernel/cmdline
     fi
     sudo dnf reinstall -y kernel-core
 else
-    if [ "${parallels}" = '1' ]; then
+    if [ "${virtualization}" = 'parallels' ]; then
         sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off'
     else
         sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1'
@@ -180,6 +165,11 @@ sudo dnf -y upgrade
 # Install packages that I use
 sudo dnf -y install adw-gtk3-theme gnome-console gnome-shell-extension-appindicator gnome-shell-extension-blur-my-shell gnome-shell-extension-background-logo
 
+# Install appropriate virtualization drivers
+if [ "$virtualization" = 'kvm' ]; then
+    sudo dnf install -y qemu-guest-agent spice-vdagent
+fi
+
 # Setup Flatpak
 sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
 flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
@@ -218,55 +208,36 @@ sudo systemctl enable fstrim.timer
 
 ### Differentiating bare metal and virtual installs
 
-# Installing tuned first here because virt-what is 1 of its dependencies anyways
-sudo dnf install tuned -y
-sudo systemctl enable --now tuned
-
-virt_type=$(virt-what)
-if [ "$virt_type" = '' ]; then
-    output 'Virtualization: Bare Metal.'
-elif [ "$virt_type" = 'openvz lxc' ]; then
-    output 'Virtualization: OpenVZ 7.'
-elif [ "$virt_type" = 'xen xen-hvm' ]; then
-    output 'Virtualization: Xen-HVM.'
-elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
-    output 'Virtualization: Xen-HVM on AWS.'
-else
-    output "Virtualization: $virt_type."
-fi
-
 # Setup tuned
-if [ "$virt_type" = '' ]; then
+if [ "$virtualization" = 'none' ]; then
-    # Don't know whether using tuned would be a good idea on a laptop, power-profiles-daemon should be handling performance tuning IMO.
+    output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
-    sudo systemctl disable --now tuned
-    sudo dnf remove tuned -y
 else
-    if [ "$virt_type" = 'kvm' ]; then
+    sudo dnf remove power-profiles-daemon
-        sudo dnf install qemu-guest-agent -y
+    sudo dnf install -y tuned
-    fi
+    sudo systemctl enable --now tuned
     sudo tuned-adm profile virtual-guest
 fi
 
 # Setup real-ucode and hardened_malloc
-if [ "$virt_type" = '' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
+if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
-    sudo dnf install 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm' -y
+    sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
     sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
     if [ "${MACHINE_TYPE}" != 'x86_64' ]; then
         sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
-        sudo dnf install real-ucode -y
+        sudo dnf install -y real-ucode
         sudo dracut -f
-    elif [ "$virt_type" != '' ]; then
+    elif [ "$virtualization" != 'none' ]; then
         sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,hardened_malloc
-        sudo dnf install hardened_malloc -y
+        sudo dnf install -y hardened_malloc
     else
         sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware,hardened_malloc
-        sudo dnf install real-ucode hardened_malloc -y
+        sudo dnf install -y real-ucode hardened_malloc
         echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
         sudo dracut -f
     fi
 elif [ "${MACHINE_TYPE}" == 'aarch64' ]; then
     sudo dnf copr enable secureblue/hardened_malloc -y
-    sudo dnf install hardened_malloc -y
+    sudo dnf install -y hardened_malloc
 fi
 
 # Setup Networking

Ubuntu-23.10-Desktop.sh

@@ -24,22 +24,7 @@ unpriv(){
     sudo -u nobody "$@"
 }
 
-install_options(){
+virtualization=$(systemd-detect-virt)
-    output "Are you using a Parallels Virtual Machine?"
-    output "[1] Yes"
-    output "[2] No"
-    read -r choice
-    case $choice in
-        1 ) parallels=1
-            ;;
-        2 ) parallels=0
-            ;;
-        * ) output "You did not enter a valid selection."
-            install_options
-    esac
-}
-
-install_options
 
 # Compliance and updates
 sudo systemctl mask debug-shell.service
@@ -57,7 +42,7 @@ sudo chmod 700 /home/*
 sudo systemctl disable --now systemd-timesyncd
 sudo systemctl mask systemd-timesyncd
 
-if [ "${parallels}" = "0" ]; then
+if [ "${virtualization}" = "parallels" ]; then
     sudo apt install -y chrony
     unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
     sudo systemctl restart chronyd
@@ -126,16 +111,12 @@ sudo systemctl mask whoopsie.service
 sudo systemctl disable --now whoopsie.path
 sudo systemctl mask whoopsie.path
 
-# Update packages and firmware
+# Update packages
 sudo apt update -y
 sudo apt full-upgrade -y
-sudo fwupdmgr get-devices
-sudo fwupdmgr refresh --force
-sudo fwupdmgr get-updates -y
-sudo fwupdmgr update -y
 
 ## Avoid phased updates
-sudo apt install curl -y
+sudo apt install -y curl 
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades
 sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades
 
@@ -155,6 +136,11 @@ sudo rm -rf /usr/share/hplip
 sudo apt install -y gnome-console gnome-software-plugin-flatpak
 sudo snap install gnome-text-editor
 
+# Install appropriate virtualization drivers
+if [ "$virtualization" = 'kvm' ]; then
+    sudo apt install -y qemu-guest-agent spice-vdagent
+fi
+
 # Setup Flatpak
 sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
 flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
@@ -202,33 +188,22 @@ fi
 # Enable fstrim.timer
 sudo systemctl enable --now fstrim.timer
 
-# Installing tuned first here because virt-what is 1 of its dependencies anyways
+### Differentiating bare metal and virtual installs
-sudo apt install tuned -y
-virt_type=$(virt-what)
-if [ "$virt_type" = '' ]; then
-    output 'Virtualization: Bare Metal.'
-elif [ "$virt_type" = 'openvz lxc' ]; then
-    output 'Virtualization: OpenVZ 7.'
-elif [ "$virt_type" = 'xen xen-hvm' ]; then
-    output 'Virtualization: Xen-HVM.'
-elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
-    output 'Virtualization: Xen-HVM on AWS.'
-else
-    output "Virtualization: $virt_type."
-fi
 
 # Setup tuned
-if [ "$virt_type" = '' ]; then
+if [ "$virtualization" = 'none' ]; then
-    # Don't know whether using tuned would be a good idea on a laptop, power-profiles-daemon should be handling performance tuning IMO.
+    output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
-        sudo apt remove tuned -y
-        sudo apt autoremove -y
 else
-    if [ "$virt_type" = 'kvm' ]; then
+    sudo apt purge -y power-profiles-daemon
-        sudo apt install qemu-guest-agent -y
+    sudo apt install -y tuned
-    fi
+    systemctl enable --now tuned
     sudo tuned-adm profile virtual-guest
 fi
 
+# Setup fwupd
+echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
+sudo systemctl restart fwupd
+
 # Setup Networking
 
 # UFW Snap is strictly confined, unlike its .deb counterpart

Ubuntu-24.04-Server.sh

@@ -24,6 +24,8 @@ unpriv(){
   sudo -u nobody "$@"
 }
 
+virtualization=$(systemd-detect-virt)
+
 # Compliance and updates
 sudo systemctl mask debug-shell.service
 echo 'Authorized uses only. All activity may be monitored and reported.' | sudo tee /etc/issue
@@ -95,50 +97,31 @@ sudo apt full-upgrade -y
 sudo apt autoremove -y
 
 ## Install basic sysadmin tools
-sudo apt install nano iputils-ping
+sudo apt install -y nano iputils-ping
 
-#Setup fwupd
+# Install appropriate virtualization drivers
-sudo apt install fwupd -y
+if [ "$virtualization" = 'kvm' ]; then
-mkdir -p /etc/systemd/system/fwupd-refresh.service.d
+    sudo apt install -y qemu-guest-agent
-echo '[Service]
+fi
-ExecStart=/usr/bin/fwupdmgr update' | tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
-sudo systemctl daemon-reload
-sudo systemctl enable --now fwupd-refresh.timer
 
 # Enable fstrim.timer
 sudo systemctl enable --now fstrim.timer
 
 ### Differentiating bare metal and virtual installs
 
-# Installing tuned first here because virt-what is 1 of its dependencies anyways
-sudo apt install tuned -y
-
-virt_type=$(virt-what)
-if [ "$virt_type" = "" ]; then
-  output 'Virtualization: Bare Metal.'
-elif [ "$virt_type" = 'openvz lxc' ]; then
-  output 'Virtualization: OpenVZ 7.'
-elif [ "$virt_type" = 'xen xen-hvm' ]; then
-  output 'Virtualization: Xen-HVM.'
-elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
-  output 'Virtualization: Xen-HVM on AWS.'
-else
-  output "Virtualization: $virt_type."
-fi
-
 # Setup tuned
-if [ "$virt_type" = "" ]; then
+if [ "$virtualization" = 'none' ]; then
-  sudo tuned-adm profile latency-performance
+    output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
 else
-  if [ "$virt_type" = 'kvm' ]; then
+    sudo apt purge -y power-profiles-daemon
-    sudo apt install qemu-guest-agent -y
+    sudo apt install -y tuned
-  fi
+    systemctl enable --now tuned
-  sudo tuned-adm profile virtual-guest
+    sudo tuned-adm profile virtual-guest
 fi
 
 # Setup fwupd
-if [ "$virt_type" = '' ]; then
+if [ "$virtualization" = 'none' ]; then
-  sudo apt install fwupd -y
+  sudo apt install -y fwupd
   echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
   sudo systemctl restart fwupd
   mkdir -p /etc/systemd/system/fwupd-refresh.service.d