aboutsummaryrefslogtreecommitdiff
path: root/docs/gnulinux
diff options
context:
space:
mode:
authorAlyssa Rosenzweig <alyssa@rosenzweig.io>2017-04-03 10:23:37 -0700
committerAlyssa Rosenzweig <alyssa@rosenzweig.io>2017-04-03 10:23:37 -0700
commit6caf836e3390faefaad8257b9cec2eb97bdbfb41 (patch)
tree0c96f4640b4b8bce441269b5d2bdf83e7f12a459 /docs/gnulinux
parent78c7b8355832b9f3eb574788ab4c5a7d96f0486e (diff)
downloadlibrebootfr-6caf836e3390faefaad8257b9cec2eb97bdbfb41.tar.gz
librebootfr-6caf836e3390faefaad8257b9cec2eb97bdbfb41.zip
Global fix
Diffstat (limited to 'docs/gnulinux')
-rw-r--r--docs/gnulinux/configuring_parabola.md120
-rw-r--r--docs/gnulinux/encrypted_parabola.md174
-rw-r--r--docs/gnulinux/grub_boot_installer.md21
-rw-r--r--docs/gnulinux/grub_cbfs.md15
4 files changed, 220 insertions, 110 deletions
diff --git a/docs/gnulinux/configuring_parabola.md b/docs/gnulinux/configuring_parabola.md
index 1ba9e366..0c35eacd 100644
--- a/docs/gnulinux/configuring_parabola.md
+++ b/docs/gnulinux/configuring_parabola.md
@@ -133,7 +133,8 @@ updating, resync with the latest package names/versions:
(according to the wiki, -Syy is better than Sy because it refreshes the
package list even if it appears to be up to date, which can be useful
when switching to another mirror).\
-Then, update the system:\
+Then, update the system:
+
# pacman -Syu
**Before installing packages with 'pacman -S', always update first,
@@ -198,7 +199,8 @@ once in a while, to prevent it from growing too big (it's a cache of
old package information, updated automatically when you do anything in
pacman).**
-To clean out all old packages that are cached:\
+To clean out all old packages that are cached:
+
# pacman -Sc
The wiki cautions that this should be used with care. For example, since
@@ -207,7 +209,8 @@ want to revert back to an older package then it's useful to have the
caches available. Only do this if you are sure that you won't need it.
The wiki also mentions this method for removing everything from the
-cache, including currently installed packages that are cached:\
+cache, including currently installed packages that are cached:
+
# pacman -Scc
This is inadvisable, since it means re-downloading the package again if
you wanted to quickly re-install it. This should only be used when disk
@@ -253,9 +256,11 @@ access to the entire operating system.
Read the entire document linked to above, and then continue.
-Add your user:\
+Add your user:
+
# useradd -m -G wheel -s /bin/bash *yourusername*
-Set a password:\
+Set a password:
+
# passwd *yourusername*
Use of the *diceware method* is recommended, for generating secure
@@ -282,7 +287,8 @@ sshd (openssh), dhcp, etc. There are countless others.
the background behind the decision by Arch (Parabola's upstream
supplier) to use systemd.
-The manpage should also help:\
+The manpage should also help:
+
# man systemd
The section on 'unit types' is especially useful.
@@ -302,7 +308,8 @@ The wiki also recommended a method for forwarding journal output to TTY
12 (accessible by pressing ctrl+alt+f12, and you use ctrl+alt+\[F1-F12\]
to switch between terminals). I decided not to enable it.
-Restart journald:\
+Restart journald:
+
# systemctl restart systemd-journald
The wiki recommends that if the journal gets too large, you can also
@@ -313,9 +320,11 @@ delete older records when the journal size reaches it's limit
(according to systemd developers).
Finally, the wiki mentions 'temporary' files and the utility for
-managing them.\
+managing them.
+
# man systemd-tmpfiles
-The command for 'clean' is:\
+The command for 'clean' is:
+
# systemd-tmpfiles --clean
According to the manpage, this *"cleans all files and directories with
an age parameter"*. According to the Arch wiki, this reads information
@@ -325,7 +334,8 @@ locations to get a better understanding.
I looked in /etc/tmpfiles.d/ and found that it was empty on my system.
However, /usr/lib/tmpfiles.d/ contained some files. The first one was
-etc.conf, containing information and a reference to this manpage:\
+etc.conf, containing information and a reference to this manpage:
+
# man tmpfiles.d
Read that manpage, and then continue studying all the files.
@@ -350,10 +360,12 @@ and below the 'extra' section add:\
*\[kernels\]\
Include = /etc/pacman.d/mirrorlist*
-Now sync with the repository:\
+Now sync with the repository:
+
# pacman -Syy
-List all available packages in this repository:\
+List all available packages in this repository:
+
# pacman -Sl kernels
In the end, I decided not to install anything from it but I kept the
@@ -374,10 +386,12 @@ Read <https://wiki.archlinux.org/index.php/Configuring_Network>.
This should be the same as the hostname that you set in /etc/hostname
when installing Parabola. You can also do it with systemd (do so now, if
-you like):\
+you like):
+
# hostnamectl set-hostname *yourhostname*
This writes the specified hostname to /etc/hostname. More information
-can be found in these manpages:\
+can be found in these manpages:
+
# man hostname
# info hostname
# man hostnamectl
@@ -401,7 +415,8 @@ According to the Arch wiki,
[udev](https://wiki.archlinux.org/index.php/Udev) should already detect
the ethernet chipset and load the driver for it automatically at boot
time. You can check this in the *"Ethernet controller"* section when
-running this command:\
+running this command:
+
# lspci -v
Look at the remaining sections *'Kernel driver in use'* and *'Kernel
@@ -410,7 +425,8 @@ modules'*. In my case it was as follows:\
Kernel modules: e1000e*
Check that the driver was loaded by issuing *dmesg | grep module\_name*.
-In my case, I did:\
+In my case, I did:
+
# dmesg | grep e1000e
### Network device names {#network_devicenames}
@@ -432,7 +448,8 @@ instructions in [grub\_cbfs.html](grub_cbfs.html)).
For background information, read [Predictable Network Interface
Names](http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/)
-Show device names:\
+Show device names:
+
# ls /sys/class/net
Changing the device names is possible (I chose not to do it):\
@@ -464,7 +481,8 @@ is important, so make sure to read them!**
Install smartmontools (it can be used to check smart data. HDDs use
non-free firmware inside, but it's transparent to you but the smart
-data comes from it. Therefore, don't rely on it too much):\
+data comes from it. Therefore, don't rely on it too much):
+
# pacman -S smartmontools
Read <https://wiki.archlinux.org/index.php/S.M.A.R.T.> to learn how to
use it.
@@ -489,27 +507,33 @@ provide LXDE by default.
Based on <https://wiki.archlinux.org/index.php/Xorg>.
-Firstly, install it!\
+Firstly, install it!
+
# pacman -S xorg-server
I also recommend installing this (contains lots of useful tools,
-including *xrandr*):\
+including *xrandr*):
+
# pacman -S xorg-server-utils
Install the driver. For me this was *xf86-video-intel* on the ThinkPad
-X60. T60 and macbook11/21 should be the same.\
+X60. T60 and macbook11/21 should be the same.
+
# pacman -S xf86-video-intel
-For other systems you can try:\
+For other systems you can try:
+
# pacman -Ss xf86-video- | less
Combined with looking at your *lspci* output, you can determine which
driver is needed. By default, Xorg will revert to xf86-video-vesa which
is a generic driver and doesn't provide true hardware acceleration.
Other drivers (not just video) can be found by looking at the
-*xorg-drivers* group:\
+*xorg-drivers* group:
+
# pacman -Sg xorg-drivers
Mostly you will rely on a display manager, but in case you ever want to
-start X without one:\
+start X without one:
+
# pacman -S xorg-xinit
<optional>\
@@ -537,7 +561,8 @@ will notice that the layout you set in /etc/vconsole.conf earlier might
not actually be the same in X.
To see what layout you currently use, try this on a terminal emulator in
-X:\
+X:
+
# setxkbmap -print -verbose 10
In my case, I wanted to use the Dvorak (UK) keyboard which is quite
@@ -584,27 +609,34 @@ would like to try something different, refer to
Refer to <https://wiki.archlinux.org/index.php/LXDE>.
-Install it, choosing 'all' when asked for the default package list:\
+Install it, choosing 'all' when asked for the default package list:
+
# pacman -S lxde obconf
-I didn't want the following, so I removed them:\
+I didn't want the following, so I removed them:
+
# pacman -R lxmusic lxtask
-I also lazily installed all fonts:\
+I also lazily installed all fonts:
+
# pacman -S \$(pacman -Ssq ttf-)
-And a mail client:\
+And a mail client:
+
# pacman -S icedove
In IceCat, go to *Preferences :: Advanced* and disable *GNU IceCat
Health Report*.
-I also like to install these:\
+I also like to install these:
+
# pacman -S xsensors stress htop
-Enable LXDM (the default display manager, providing a graphical login):\
+Enable LXDM (the default display manager, providing a graphical login):
+
# systemctl enable lxdm.service
-It will start when you boot up the system. To start it now, do:\
+It will start when you boot up the system. To start it now, do:
+
# systemctl start lxdm.service
Log in with your standard (non-root) user that you created earlier. It
@@ -649,7 +681,8 @@ NOTE TO SELF: come back to this later.
### LXDE - screenlock {#lxde_screenlock}
-Arch wiki recommends to use *xscreensaver*:\
+Arch wiki recommends to use *xscreensaver*:
+
# pacman -S xscreensaver
Under *Preferences :: Screensaver* in the LXDE menu, I chose *Mode:
@@ -700,30 +733,37 @@ cursor over it, it'll show information about the battery.
Refer to <https://wiki.archlinux.org/index.php/LXDE#Network_Management>.
Then I read: <https://wiki.archlinux.org/index.php/NetworkManager>.
-Install Network Manager:\
+Install Network Manager:
+
# pacman -S networkmanager
-You will also want the graphical applet:\
+You will also want the graphical applet:
+
# pacman -S network-manager-applet
Arch wiki says that an autostart rule will be written at
*/etc/xdg/autostart/nm-applet.desktop*
I want to be able to use a VPN at some point, so the wiki tells me to
-do:\
+do:
+
# pacman -S networkmanager-openvpn
LXDE uses openbox, so I refer to:\
<https://wiki.archlinux.org/index.php/NetworkManager#Openbox>.
-It tells me for the applet I need:\
+It tells me for the applet I need:
+
# pacman -S xfce4-notifyd gnome-icon-theme
-Also, for storing authentication details (wifi) I need:\
+Also, for storing authentication details (wifi) I need:
+
# pacman -S gnome-keyring
-I wanted to quickly enable networkmanager:\
+I wanted to quickly enable networkmanager:
+
# systemctl stop dhcpcd
# systemctl start NetworkManager
-Enable NetworkManager at boot time:\
+Enable NetworkManager at boot time:
+
# systemctl enable NetworkManager
Restart LXDE (log out, and then log back in).
diff --git a/docs/gnulinux/encrypted_parabola.md b/docs/gnulinux/encrypted_parabola.md
index c4e92c16..bf944a14 100644
--- a/docs/gnulinux/encrypted_parabola.md
+++ b/docs/gnulinux/encrypted_parabola.md
@@ -95,7 +95,8 @@ Change keyboard layout
----------------------
Parabola live shell assumes US Qwerty. If you have something different,
-list the available keymaps and use yours:\
+list the available keymaps and use yours:
+
# localectl list-keymaps
# loadkeys LAYOUT
For me, LAYOUT would have been dvorak-uk.
@@ -124,7 +125,8 @@ dm-mod
------
device-mapper will be used - a lot. Make sure that the kernel module is
-loaded:\
+loaded:
+
# modprobe dm-mod
Create LUKS partition
@@ -138,7 +140,8 @@ prepared cryptsetup command below. Note that the iteration time is for
security purposes (mitigates brute force attacks), so anything lower
than 5 seconds is probably not ok.
-I am using MBR partitioning, so I use cfdisk:\
+I am using MBR partitioning, so I use cfdisk:
+
# cfdisk /dev/sda
I create a single large sda1 filling the whole drive, leaving it as the
@@ -151,15 +154,18 @@ I am then directed to
Parabola forces you to RTFM. Do that.
-It tells me to run:\
+It tells me to run:
+
# cryptsetup benchmark (for making sure the list below is
populated)\
-Then:\
+Then:
+
# cat /proc/crypto
This gives me crypto options that I can use. It also provides a
representation of the best way to set up LUKS (in this case, security is
a priority; speed, a distant second). To gain a better understanding, I
-am also reading:\
+am also reading:
+
# man cryptsetup
Following that page, based on my requirements, I do the following based
@@ -186,29 +192,36 @@ Create LVM
Now I refer to <https://wiki.archlinux.org/index.php/LVM>.
-Open the LUKS partition:\
+Open the LUKS partition:
+
# cryptsetup luksOpen /dev/sda1 lvm
(it will be available at /dev/mapper/lvm)
-Create LVM partition:\
+Create LVM partition:
+
# pvcreate /dev/mapper/lvm
-Show that you just created it:\
+Show that you just created it:
+
# pvdisplay
Now I create the volume group, inside of which the logical volumes will
-be created:\
+be created:
+
# vgcreate matrix /dev/mapper/lvm
(volume group name is 'matrix' - choose your own name, if you like)
-Show that you created it:\
+Show that you created it:
+
# vgdisplay
-Now create the logical volumes:\
+Now create the logical volumes:
+
# lvcreate -L 2G matrix -n swapvol (2G swap partition, named
swapvol)\
Again, choose your own name if you like. Also, make sure to choose a
swap size of your own needs. It basically depends on how much RAM you
have installed. I refer to
-<http://www.linux.com/news/software/applications/8208-all-about-linux-swap-space>.\
+<http://www.linux.com/news/software/applications/8208-all-about-linux-swap-space>.
+
# lvcreate -l +100%FREE matrix -n root (single large partition in
the rest of the space, named root)\
You can also be flexible here, for example you can specify a /boot, a /,
@@ -218,7 +231,8 @@ fills up with logs, it won't crash your system). For a home/laptop
system (typical use case), a root and a swap will do (really).
Verify that the logical volumes were created, using the following
-command:\
+command:
+
# lvdisplay
@@ -226,15 +240,19 @@ command:\
Create / and swap partitions, and mount
---------------------------------------
-For the swapvol LV I use:\
+For the swapvol LV I use:
+
# mkswap /dev/mapper/matrix-swapvol
-Activate swap:\
+Activate swap:
+
# swapon /dev/matrix/swapvol
-For the root LV I use:\
+For the root LV I use:
+
# mkfs.btrfs /dev/mapper/matrix-root
-Mount the root (/) partition:\
+Mount the root (/) partition:
+
# mount /dev/matrix/root /mnt
@@ -249,7 +267,8 @@ Now I am following the rest of
<https://wiki.parabolagnulinux.org/Installation_Guide>. I also cross
referenced <https://wiki.archlinux.org/index.php/Installation_guide>.
-Create /home and /boot on root mountpoint:\
+Create /home and /boot on root mountpoint:
+
# mkdir -p /mnt/home
# mkdir -p /mnt/boot
@@ -258,7 +277,8 @@ devices are ready to install Parabola.
In **/etc/pacman.d/mirrorlist**, comment out all lines except the Server
line closest to where you are (I chose the UK Parabola server (main
-server)) and then did:\
+server)) and then did:
+
# pacman -Syy
# pacman -Syu
# pacman -Sy pacman (and then I did the other 2 steps above,
@@ -312,21 +332,26 @@ Configure the system
Generate an fstab - UUIDs are used because they have certain advantages
(see <https://wiki.parabola.nu/Fstab#Identifying_filesystems>. If you
-prefer labels instead, replace the -U option with -L):\
+prefer labels instead, replace the -U option with -L):
+
# genfstab -U -p /mnt >> /mnt/etc/fstab
-Check the created file:\
+Check the created file:
+
# cat /mnt/etc/fstab
(If there are any errors, edit the file. Do **NOT** run the genfstab
command again!)
-Chroot into new system:\
+Chroot into new system:
+
# arch-chroot /mnt /bin/bash
-It's a good idea to have this installed:\
+It's a good idea to have this installed:
+
# pacman -S linux-libre-lts
It was also suggested that you should install this kernel (read up on
-what GRSEC is):\
+what GRSEC is):
+
# pacman -S linux-libre-grsec
This is another kernel that sits inside /boot, which you can use. LTS
@@ -334,35 +359,43 @@ means 'long-term support'. These are so-called 'stable' kernels that
can be used as a fallback during updates, if a bad kernel causes issues
for you.
-Parabola does not have wget. This is sinister. Install it:\
+Parabola does not have wget. This is sinister. Install it:
+
# pacman -S wget
-Locale:\
+Locale:
+
# vi /etc/locale.gen
Uncomment your needed localisations. For example en\_GB.UTF-8 (UTF-8 is
-highly recommended over other options).\
+highly recommended over other options).
+
# locale-gen
# echo LANG=en\_GB.UTF-8 > /etc/locale.conf
# export LANG=en\_GB.UTF-8
-Console font and keymap:\
+Console font and keymap:
+
# vi /etc/vconsole.conf
In my case:
KEYMAP=dvorak-uk
FONT=lat9w-16
-Time zone:\
+Time zone:
+
# ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
(Replace Zone and Subzone to your liking. See /usr/share/zoneinfo)
-Hardware clock:\
+Hardware clock:
+
# hwclock --systohc --utc
Hostname: Write your hostname to /etc/hostname. For example, if your
-hostname is parabola:\
+hostname is parabola:
+
# echo parabola > /etc/hostname
-Add the same hostname to /etc/hosts:\
+Add the same hostname to /etc/hosts:
+
# vi /etc/hosts
#<ip-address> <hostname.domain.org> <hostname>
@@ -376,7 +409,8 @@ Mkinitcpio: Configure /etc/mkinitcpio.conf as needed (see
<https://wiki.parabola.nu/Mkinitcpio>). Runtime modules can be found in
/usr/lib/initcpio/hooks, and build hooks can be found in
/usr/lib/initcpio/install. (\# **mkinitcpio -H hookname** gives
-information about each hook.) Specifically, for this use case:\
+information about each hook.) Specifically, for this use case:
+
# vi /etc/mkinitcpio.conf
Then modify the file like so:
@@ -401,18 +435,23 @@ Then modify the file like so:
Now using mkinitcpio, you can create the kernel and ramdisk for booting
with (this is different from Arch, specifying linux-libre instead of
-linux):\
+linux):
+
# mkinitcpio -p linux-libre
-Also do it for linux-libre-lts:\
+Also do it for linux-libre-lts:
+
# mkinitcpio -p linux-libre-lts
-Also do it for linux-libre-grsec:\
+Also do it for linux-libre-grsec:
+
# mkinitcpio -p linux-libre-grsec
Set the root password: At the time of writing, Parabola used SHA512 by
default for its password hashing. I referred to
-<https://wiki.archlinux.org/index.php/SHA_password_hashes>.\
+<https://wiki.archlinux.org/index.php/SHA_password_hashes>.
+
# vi /etc/pam.d/passwd
-Add rounds=65536 at the end of the uncommented 'password' line.\
+Add rounds=65536 at the end of the uncommented 'password' line.
+
# passwd root
Make sure to set a secure password! Also, it must never be the same as
your LUKS password.
@@ -427,7 +466,8 @@ Extra security tweaks
Based on <https://wiki.archlinux.org/index.php/Security>.
-Restrict access to important directories:\
+Restrict access to important directories:
+
# chmod 700 /boot /etc/{iptables,arptables}
Lockout user after three failed login attempts:\
@@ -437,7 +477,8 @@ Or just delete it. Above it, put:\
*auth required pam\_tally.so deny=2 unlock\_time=600 onerr=succeed
file=/var/log/faillog*\
To unlock a user manually (if a password attempt is failed 3 times),
-do:\
+do:
+
# pam\_tally --user *theusername* --reset What the above
configuration does is lock the user out for 10 minutes, if they make 3
failed login attempts.
@@ -451,18 +492,22 @@ don't really need sudo.
Unmount, reboot!
----------------
-Exit from chroot:\
+Exit from chroot:
+
# exit
-unmount:\
+unmount:
+
# umount -R /mnt
# swapoff -a
-deactivate the lvm lv's:\
+deactivate the lvm lv's:
+
# lvchange -an /dev/matrix/root
# lvchange -an /dev/matrix/swapvol
-Lock the encrypted partition (close it):\
+Lock the encrypted partition (close it):
+
# cryptsetup luksClose lvm
# shutdown -h now
@@ -520,7 +565,8 @@ possibility of bricking your device!
I will go for the re-flash option here. Firstly, cd to the
libreboot\_util/cbfstool/{armv7l i686 x86\_64} directory. Dump the
current firmware - where *libreboot.rom* is an example: make sure to
-adapt:\
+adapt:
+
# flashrom -p internal -r libreboot.rom
If flashrom complains about multiple flash chips detected, add a *-c*
option at the end, with the name of your chosen chip is quotes.\
@@ -529,7 +575,8 @@ would be really nice):
$ ./cbfstool libreboot.rom print
Extract grubtest.cfg:
$ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg\
-And modify:\
+And modify:
+
$ vi grubtest.cfg
In grubtest.cfg, inside the 'Load Operating System' menu entry, change
@@ -558,18 +605,21 @@ detected LUKS volumes. You can also specify -u UUID or -a (device).
hardening your GRUB configuration, for security purposes.
Save your changes in grubtest.cfg, then delete the unmodified config
-from the ROM image:\
+from the ROM image:
+
$ ./cbfstool libreboot.rom remove -n grubtest.cfg
and insert the modified grubtest.cfg:\
\$ **./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t
raw**\
Now refer to <http://libreboot.org/docs/install/#flashrom>. Cd (up) to
-the libreboot\_util directory and update the flash chip contents:\
+the libreboot\_util directory and update the flash chip contents:
+
# ./flash update libreboot.rom
Ocassionally, coreboot changes the name of a given board. If flashrom
complains about a board mismatch, but you are sure that you chose the
-correct ROM image, then run this alternative command:\
+correct ROM image, then run this alternative command:
+
# ./flash forceupdate libreboot.rom
You should see "Verifying flash\... VERIFIED." written at the end of
the flashrom output.
@@ -600,21 +650,25 @@ with the following command:\
\$ **sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e
's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg >
grub.cfg**\
-Delete the grub.cfg that remained inside the ROM:\
+Delete the grub.cfg that remained inside the ROM:
+
$ ./cbfstool libreboot.rom remove -n grub.cfg
-Add the modified version that you just made:\
+Add the modified version that you just made:
+
$ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw
Now you have a modified ROM. Once more, refer to
<http://libreboot.org/docs/install/#flashrom>. Cd to the libreboot\_util
-directory and update the flash chip contents:\
+directory and update the flash chip contents:
+
# ./flash update libreboot.rom
And wait for the "Verifying flash\... VERIFIED." Once you have done
that, shut down and then boot up with your new configuration.
When done, delete GRUB (remember, we only needed it for the
*grub-mkpasswd-pbkdf2* utility; GRUB is already part of libreboot,
-flashed alongside it as a *payload*):\
+flashed alongside it as a *payload*):
+
# pacman -R grub
@@ -639,17 +693,21 @@ putting a keyfile inside initramfs would be a bad idea).\
Boot up and login as root or your user. Then generate the key file:\
\# **dd bs=512 count=4 if=/dev/urandom of=/etc/mykeyfile
iflag=fullblock**\
-Insert it into the luks volume:\
+Insert it into the luks volume:
+
# cryptsetup luksAddKey /dev/sdX /etc/mykeyfile
and enter your LUKS passphrase when prompted. Add the keyfile to the
-initramfs by adding it to FILES in /etc/mkinitcpio.conf. For example:\
+initramfs by adding it to FILES in /etc/mkinitcpio.conf. For example:
+
# FILES="/etc/mykeyfile"
-Create the initramfs image from scratch:\
+Create the initramfs image from scratch:
+
# mkinitcpio -p linux-libre
# mkinitcpio -p linux-libre-lts
# mkinitcpio -p linux-libre-grsec
Add the following to your grub.cfg - you are now able to do that, see
-above! -, or add it in the kernel command line for GRUB:\
+above! -, or add it in the kernel command line for GRUB:
+
# cryptkey=rootfs:/etc/mykeyfile
\
You can also place this inside the grub.cfg that exists in CBFS:
diff --git a/docs/gnulinux/grub_boot_installer.md b/docs/gnulinux/grub_boot_installer.md
index 4609db97..3dafb51b 100644
--- a/docs/gnulinux/grub_boot_installer.md
+++ b/docs/gnulinux/grub_boot_installer.md
@@ -32,16 +32,19 @@ Connect the USB drive. Check dmesg:
$ dmesg
-Check lsblk to confirm which drive it is:\
+Check lsblk to confirm which drive it is:
+
$ lsblk
Check that it wasn't automatically mounted. If it was, unmount it. For
-example:\
+example:
+
$ sudo umount /dev/sdX\*
# umount /dev/sdX\*
dmesg told you what device it is. Overwrite the drive, writing your
-distro ISO to it with dd. For example:\
+distro ISO to it with dd. For example:
+
$ sudo dd if=gnulinux.iso of=/dev/sdX bs=8M; sync
# dd if=gnulinux.iso of=/dev/sdX bs=8M; sync
@@ -73,17 +76,21 @@ Prepare the USB drive (in LibertyBSD or OpenBSD)
If you downloaded your ISO on a LibertyBSD or OpenBSD system, here is
how to create the bootable GNU+Linux USB drive:
-Connect the USB drive. Check dmesg:\
+Connect the USB drive. Check dmesg:
+
$ dmesg | tail
-Check to confirm which drive it is, for example, if you think its sd3:\
+Check to confirm which drive it is, for example, if you think its sd3:
+
$ disklabel sd3
Check that it wasn't automatically mounted. If it was, unmount it. For
-example:\
+example:
+
$ doas umount /dev/sd3i
dmesg told you what device it is. Overwrite the drive, writing the
-OpenBSD installer to it with dd. For example:\
+OpenBSD installer to it with dd. For example:
+
$ doas dd if=gnulinux.iso of=/dev/rsdXc bs=1M; sync
You should now be able to boot the installer from your USB drive.
diff --git a/docs/gnulinux/grub_cbfs.md b/docs/gnulinux/grub_cbfs.md
index dbe55206..9809785f 100644
--- a/docs/gnulinux/grub_cbfs.md
+++ b/docs/gnulinux/grub_cbfs.md
@@ -154,7 +154,8 @@ to the command, for example:
Extract grubtest.cfg from the ROM image {#extract_testconfig}
---------------------------------------
-You can check the contents of the ROM image, inside CBFS:\
+You can check the contents of the ROM image, inside CBFS:
+
$ cd \.../libreboot\_util/cbfstool** $ ./cbfstool libreboot.rom
print**
@@ -163,7 +164,8 @@ loaded by default, with a menuentry for switching to grubtest.cfg. In
this tutorial, you will first modify and test *grubtest.cfg*. This is to
reduce the possibility of bricking your device, so DO NOT SKIP THIS!
-Extract grubtest.cfg from the ROM image:\
+Extract grubtest.cfg from the ROM image:
+
$ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg
Modify the grubtest.cfg accordingly.
@@ -176,7 +178,8 @@ Re-insert the modified grubtest.cfg into the ROM image {#reinsert_modified_testc
------------------------------------------------------
Once your grubtest.cfg is modified and saved, delete the unmodified
-config from the ROM image:\
+config from the ROM image:
+
$ ./cbfstool libreboot.rom remove -n grubtest.cfg
Next, insert the modified version:\
@@ -229,10 +232,12 @@ the already modified config). From /libreboot\_util/cbfstool, do:\
's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg >
grub.cfg**\
-Delete the grub.cfg that remained inside the ROM:\
+Delete the grub.cfg that remained inside the ROM:
+
$ ./cbfstool libreboot.rom remove -n grub.cfg
-Add the modified version that you just made:\
+Add the modified version that you just made:
+
$ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw
**Now you have a modified ROM. Again, refer back to