690ca79812
An RTC-less Pi boots at 1970; Tor then rejects the consensus and the unlock onion never publishes. Bake a clock floor (build epoch) into the initramfs and jump the clock forward to it before Tor starts, and pass a numeric tor_ntp= in the cmdline so busybox ntpd syncs without DNS. Proven on hardware: the onion unlock succeeded on a Pi 3 after this. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
2.0 KiB
Bash
56 lines
2.0 KiB
Bash
#!/bin/sh
|
|
# initramfs-tools runtime hook: bring up networking, sync the clock and start
|
|
# the Tor onion service so the dropbear unlock shell is reachable while
|
|
# cryptsetup waits. Installed to /etc/initramfs-tools/scripts/init-premount/tor.
|
|
PREREQ=""
|
|
prereqs() { echo "$PREREQ"; }
|
|
case "$1" in
|
|
prereqs) prereqs; exit 0 ;;
|
|
esac
|
|
|
|
. /scripts/functions
|
|
|
|
log_begin_msg "tor: bringing up networking and starting the onion service"
|
|
|
|
# init-premount runs BEFORE the cryptroot/dropbear networking, so Tor would
|
|
# start with no network and never publish the onion. Bring the interface up
|
|
# ourselves from the ip= cmdline (idempotent; the later dropbear setup reuses
|
|
# the lease in /run/net-*.conf).
|
|
configure_networking
|
|
|
|
# initramfs-tools does not export arbitrary cmdline params as shell vars.
|
|
tor_ntp=$(sed -n 's/.*\btor_ntp=\([^ ]*\).*/\1/p' /proc/cmdline)
|
|
|
|
# Best-effort DNS from the DHCP lease; extract ONLY the DNS fields with sed,
|
|
# never source the files (attacker-controllable DHCP option strings would run
|
|
# as root pre-boot).
|
|
if [ ! -s /etc/resolv.conf ]; then
|
|
for conf in /run/net-*.conf /tmp/net-*.conf; do
|
|
[ -f "$conf" ] || continue
|
|
for dns in $(sed -n 's/^IPV4DNS[01]=//p' "$conf"); do
|
|
[ -n "$dns" ] && [ "$dns" != "0.0.0.0" ] \
|
|
&& echo "nameserver $dns" >> /etc/resolv.conf
|
|
done
|
|
done
|
|
fi
|
|
|
|
floor=$(cat /etc/tor-clock-floor 2>/dev/null || echo 0)
|
|
if [ "$(date +%s)" -lt "$floor" ]; then
|
|
/usr/local/bin/busybox date -s "@$floor" >/dev/null 2>&1 \
|
|
|| date -s "@$floor" >/dev/null 2>&1 || true
|
|
fi
|
|
|
|
if [ -x /usr/local/bin/busybox ]; then
|
|
/usr/local/bin/busybox timeout 30 \
|
|
/usr/local/bin/busybox ntpd -n -q -p "${tor_ntp:-pool.ntp.org}" \
|
|
|| log_warning_msg "tor: NTP sync failed, keeping current clock"
|
|
fi
|
|
|
|
mkdir -p /var/lib/tor
|
|
chmod 0700 /var/lib/tor /etc/tor/onion
|
|
chmod 0600 /etc/tor/onion/hs_ed25519_secret_key
|
|
tor -f /etc/tor/torrc --RunAsDaemon 1 --Log "notice file /run/tor.log" \
|
|
|| log_warning_msg "tor: failed to start, unlock stays reachable via direct IP"
|
|
|
|
log_end_msg
|