Added: ENABLE_CRYPTFS - encrypted rootfs, use-latest-bootloader, cp-cleanup

15 files changed, 261 insertions, 94 deletions

diff --git a/.gitignore b/.gitignore
index 6ba2fb7..239ef3c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 images
 custom.d
 *.swp
+*.bak
 *.log
diff --git a/README.md b/README.md
index 853730b..1f91c88 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,7 @@ ENABLE_MINBASE=true ./rpi2-gen-image.sh
 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi2-gen-image.sh
 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi2-gen-image.sh
 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi2-gen-image.sh
+ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi2-gen-image.sh
 ```
 
 #### APT settings:
@@ -31,7 +32,7 @@ Set Debian packages server address. Choose a server from the list of Debian worl
 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once.
 
 ##### `APT_INCLUDES`=""
-A comma seperated list of additional packages to be installed during bootstrapping.
+A comma separated list of additional packages to be installed during bootstrapping.
 
 #### General system settings:
 ##### `HOSTNAME`="rpi2-jessie"
@@ -65,13 +66,13 @@ Set the supported variant(s) of the keyboard layout(s).
 Set extra xkb configuration options.
 
 #### Networking settings (DHCP):
-This setting is used to set up networking auto configuration in `/etc/systemd/network/eth.network`.
+This parameter is used to set up networking auto configuration in `/etc/systemd/network/eth.network`.
 
 #####`ENABLE_DHCP`=true
 Set the system to use DHCP. This requires an DHCP server.
 
 #### Networking settings (static):
-These settings are used to set up a static networking configuration in /etc/systemd/network/eth.network. The following static networking settings are only supported if `ENABLE_DHCP` was set to `false`.
+These parameters are used to set up a static networking configuration in /etc/systemd/network/eth.network. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`.
 
 #####`NET_ADDRESS`=""
 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
@@ -131,7 +132,7 @@ Install a user defined window manager for the X Window System. To make sure all
 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
 
 ##### `ENABLE_REDUCE`=false
-Reduce the disk usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
+Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
 
 ##### `ENABLE_UBOOT`=false
 Replace default RPi2 second stage bootloader (bootcode.bin) with U-Boot bootloader. U-Boot can boot images via the network using the BOOTP/TFTP protocol.
@@ -159,11 +160,14 @@ Enable IPv4/IPv6 network stack hardening settings.
 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
 
 ##### `CHROOT_SCRIPTS`=""
-Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this direcory is run in lexicographical order.
+Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
+
+##### `ENABLE_INITRAMFS`=false
+Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
 
 #### Kernel compilation:
 ##### `BUILD_KERNEL`=false
-Build and install the latest RPi2 Linux kernel. Currently only the default RPi2 kernel configuration is used. Detailed configuration parameters for customizing the kernel and minor bug fixes still need to get implemented. feel free to help.
+Build and install the latest RPi2 Linux kernel. Currently only the default RPi2 kernel configuration is used.
 
 ##### `KERNEL_REDUCE`=false
 Reduce the size of the generated kernel by removing unwanted device, network and filesystem drivers (experimental).
@@ -184,10 +188,10 @@ Remove all kernel sources from the generated OS image after it was built and ins
 Path to a directory of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
 
 ##### `KERNELSRC_CLEAN`=false
-Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This setting will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
+Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
 
 ##### `KERNELSRC_CONFIG`=true
-Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This setting is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This settings is ignored if `KERNELSRC_PREBUILT`=true.
+Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
 
 ##### `KERNELSRC_PREBUILT`=false
 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
@@ -204,7 +208,7 @@ Remove all doc files (harsh). Configure APT to not include doc files on future `
 ##### `REDUCE_MAN`=true
 Remove all man pages and info files (harsh).  Configure APT to not include man pages on future `apt-get` package installations.
 
-##### `REDUCE_VIM`=true
+##### `REDUCE_VIM`=false
 Replace `vim-tiny` package by `levee` a tiny vim clone.
 
 ##### `REDUCE_BASH`=false
@@ -214,11 +218,28 @@ Remove `bash` package and switch to `dash` shell (experimental).
 Remove PCI related hwdb files (experimental).
 
 ##### `REDUCE_SSHD`=true
-Replace `openssh-server` with dropbear.
+Replace `openssh-server` with `dropbear`.
 
 ##### `REDUCE_LOCALE`=true
 Remove all `locale` translation files.
 
+#### Encrypted root partition:
+
+##### `ENABLE_CRYPTFS`=false
+Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. `ENABLE_UBOOT`, `ENABLE_SPLITFS`, `EXPANDROOT` and SSH-to-initramfs are currently not supported but will be soon - feel free to help.
+
+##### `CRYPTFS_PASSWORD`=""
+Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
+
+##### `CRYPTFS_MAPPING`="secure"
+Set name of dm-crypt managed device-mapper mapping.
+
+##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
+Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
+
+##### `CRYPTFS_XTSKEYSIZE`=512
+Sets key size in bits. The argument has to be a multiple of 8.
+
 ## Understanding the script
 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
 
@@ -235,11 +256,13 @@ The functions of this script that are required for the different stages of the b
 | `41-uboot.sh` | Build and Setup U-Boot |
 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
 | `50-firstboot.sh` | First boot actions |
+| `99-reduce.sh` | Reduce the disk space usage |
 
 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
 
 | Directory | Description |
 | --- | --- |
+| `apt` | APT management configuration files |
 | `boot` | Boot and RPi2 configuration files |
 | `dpkg` | Package Manager configuration |
 | `firstboot` | Scripts that get executed on first boot  |
diff --git a/bootstrap.d/10-bootstrap.sh b/bootstrap.d/10-bootstrap.sh
index 7b4a04d..f55c3e3 100644
--- a/bootstrap.d/10-bootstrap.sh
+++ b/bootstrap.d/10-bootstrap.sh
@@ -13,11 +13,11 @@ else
 fi
 
 # Copy qemu emulator binary to chroot
-cp "${QEMU_BINARY}" "$R/usr/bin"
+install_exec "${QEMU_BINARY}" "${R}${QEMU_BINARY}"
 
 # Copy debian-archive-keyring.pgp
 mkdir -p "$R/usr/share/keyrings"
-cp /usr/share/keyrings/debian-archive-keyring.gpg "$R/usr/share/keyrings/debian-archive-keyring.gpg"
+install_readonly /usr/share/keyrings/debian-archive-keyring.gpg "$R/usr/share/keyrings/debian-archive-keyring.gpg"
 
 # Complete the bootstrapping process
 chroot_exec /debootstrap/debootstrap --second-stage
diff --git a/bootstrap.d/11-apt.sh b/bootstrap.d/11-apt.sh
index 9610832..554aaf5 100644
--- a/bootstrap.d/11-apt.sh
+++ b/bootstrap.d/11-apt.sh
@@ -11,18 +11,25 @@ if [ -z "$APT_PROXY" ] ; then
   sed -i "s/\"\"/\"${APT_PROXY}\"/" "$R/etc/apt/apt.conf.d/10proxy"
 fi
 
-# Install APT pinning configuration for flash-kernel package
-install_readonly files/apt/flash-kernel "$R/etc/apt/preferences.d/flash-kernel"
+if [ "$BUILD_KERNEL" = false ] ; then
+  # Install APT pinning configuration for flash-kernel package
+  install_readonly files/apt/flash-kernel "$R/etc/apt/preferences.d/flash-kernel"
 
-# Upgrade collabora package index and install collabora keyring
-echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" > "$R/etc/apt/sources.list"
-chroot_exec apt-get -qq -y update
-chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring
+  # Install APT sources.list
+  install_readonly files/apt/sources.list "$R/etc/apt/sources.list"
+  echo "deb https://repositories.collabora.co.uk/debian ${RELEASE} rpi2" >> "$R/etc/apt/sources.list"
+
+  # Upgrade collabora package index and install collabora keyring
+  chroot_exec apt-get -qq -y update
+  chroot_exec apt-get -qq -y --force-yes install collabora-obs-archive-keyring
+else # BUILD_KERNEL=true
+  # Install APT sources.list
+  install_readonly files/apt/sources.list "$R/etc/apt/sources.list"
 
-# Install APT sources.list
-install_readonly files/apt/sources.list "$R/etc/apt/sources.list"
-sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "$R/etc/apt/sources.list"
-sed -i "s/ jessie/ ${RELEASE}/" "$R/etc/apt/sources.list"
+  # Use specified APT server and release
+  sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "$R/etc/apt/sources.list"
+  sed -i "s/ jessie/ ${RELEASE}/" "$R/etc/apt/sources.list"
+fi
 
 # Upgrade package index and update all installed packages and changed dependencies
 chroot_exec apt-get -qq -y update
diff --git a/bootstrap.d/13-kernel.sh b/bootstrap.d/13-kernel.sh
index 671025d..ec6b59f 100644
--- a/bootstrap.d/13-kernel.sh
+++ b/bootstrap.d/13-kernel.sh
@@ -110,24 +110,31 @@ if [ "$BUILD_KERNEL" = true ] ; then
   KERNEL_VERSION=`cat "$R/usr/src/linux/include/config/kernel.release"`
 
   # Copy kernel configuration file to the boot directory
-  cp "$R/usr/src/linux/.config" "$R/boot/config-${KERNEL_VERSION}"
+  install_readonly "$R/usr/src/linux/.config" "$R/boot/config-${KERNEL_VERSION}"
 
   # Copy dts and dtb device tree sources and binaries
   mkdir "$R/boot/firmware/overlays/"
-  cp "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/"*.dtb "$R/boot/firmware/"
-  cp "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb* "$R/boot/firmware/overlays/"
-  cp "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "$R/boot/firmware/overlays/"
+  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/"*.dtb "$R/boot/firmware/"
+  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb* "$R/boot/firmware/overlays/"
+  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "$R/boot/firmware/overlays/README"
 
-  # Convert kernel zImage and copy it to the boot directory
-  "$R/usr/src/linux/scripts/mkknlimg" "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/zImage" "$R/boot/firmware/kernel7.img"
+  # Copy zImage kernel to the boot directory
+  install_readonly "$R/usr/src/linux/arch/${KERNEL_ARCH}/boot/zImage" "$R/boot/firmware/kernel7.img"
 
   # Remove kernel sources
   if [ "$KERNEL_REMOVESRC" = true ] ; then
     rm -fr "$R/usr/src/linux"
   fi
 
-  # Install raspberry bootloader and flash-kernel packages
-  chroot_exec apt-get -qq -y --no-install-recommends install raspberrypi-bootloader-nokernel
+  # Install latest boot binaries from raspberry/firmware github
+  wget -q -O "$R/boot/firmware/bootcode.bin" https://github.com/raspberrypi/firmware/raw/master/boot/bootcode.bin
+  wget -q -O "$R/boot/firmware/fixup_cd.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_cd.dat
+  wget -q -O "$R/boot/firmware/fixup.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup.dat
+  wget -q -O "$R/boot/firmware/fixup_x.dat" https://github.com/raspberrypi/firmware/raw/master/boot/fixup_x.dat
+  wget -q -O "$R/boot/firmware/start_cd.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_cd.elf
+  wget -q -O "$R/boot/firmware/start.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start.elf
+  wget -q -O "$R/boot/firmware/start_x.elf" https://github.com/raspberrypi/firmware/raw/master/boot/start_x.elf
+
 else # BUILD_KERNEL=false
   # Kernel installation
   chroot_exec apt-get -qq -y --no-install-recommends install linux-image-"${COLLABORA_KERNEL}" raspberrypi-bootloader-nokernel
@@ -135,9 +142,15 @@ else # BUILD_KERNEL=false
   # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
   chroot_exec apt-get -qq -y install flash-kernel
 
+  # Check if kernel installation was successful
   VMLINUZ="$(ls -1 $R/boot/vmlinuz-* | sort | tail -n 1)"
-  [ -z "$VMLINUZ" ] && exit 1
-  cp "$VMLINUZ" "$R/boot/firmware/kernel7.img"
+  if [ -z "$VMLINUZ" ] ; then
+    echo "error: kernel installation failed! (/boot/vmlinuz-* not found)"
+    cleanup
+    exit 1
+  fi
+  # Copy vmlinuz kernel to the boot directory
+  install_readonly "$VMLINUZ" "$R/boot/firmware/kernel7.img"
 fi
 
 # Setup firmware boot cmdline
@@ -160,6 +173,11 @@ fi
 # Install firmware boot cmdline
 echo "${CMDLINE}" > "$R/boot/firmware/cmdline.txt"
 
+# Add encrypted root partition to cmdline.txt
+if [ "$ENABLE_CRYPTFS" = true ] ; then
+    sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/" "$R/boot/firmware/cmdline.txt"
+fi
+
 # Install firmware config
 install_readonly files/boot/config.txt "$R/boot/firmware/config.txt"
 
@@ -168,6 +186,11 @@ if [ "$ENABLE_MINGPU" = true ] ; then
   echo "gpu_mem=16" >> "$R/boot/firmware/config.txt"
 fi
 
+# Setup boot with initramfs
+if [ "$ENABLE_INITRAMFS" = true ] ; then
+  echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "$R/boot/firmware/config.txt"
+fi
+
 # Create firmware configuration and cmdline symlinks
 ln -sf firmware/config.txt "$R/boot/config.txt"
 ln -sf firmware/cmdline.txt "$R/boot/cmdline.txt"
@@ -192,8 +215,37 @@ install_readonly files/modules/raspi-blacklist.conf "$R/etc/modprobe.d/raspi-bla
 
 # Install and setup fstab
 install_readonly files/mount/fstab "$R/etc/fstab"
+
+# Add usb/sda disk root partition to fstab
 if [ "$ENABLE_SPLITFS" = true ] ; then
-  sed -i 's/mmcblk0p2/sda1/' "$R/etc/fstab"
+  sed -i "s/mmcblk0p2/sda1/" "$R/etc/fstab"
+fi
+
+# Add encrypted root partition to fstab and crypttab
+if [ "$ENABLE_CRYPTFS" = true ] ; then
+  # Replace fstab root partition with encrypted partition mapping
+  sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "$R/etc/fstab"
+
+  # Add encrypted partition to crypttab and fstab
+  install_readonly files/mount/crypttab "$R/etc/crypttab"
+  echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks" >> "$R/etc/crypttab"
+fi
+
+# Generate initramfs file
+if [ "$ENABLE_INITRAMFS" = true ] ; then
+  if [ "$ENABLE_CRYPTFS" = true ] ; then
+    # Dummy mapping required by mkinitramfs
+    echo "0 1 crypt $(echo ${CRYPTFS_CIPHER} | cut -d ':' -f 1) ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
+
+    # Generate initramfs with encrypted root partition support
+    chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
+
+    # Remove dummy mapping
+    chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
+  else
+    # Generate initramfs without encrypted root partition support
+    chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
+  fi
 fi
 
 # Install sysctl.d configuration files
diff --git a/bootstrap.d/41-uboot.sh b/bootstrap.d/41-uboot.sh
index d3f13b9..8f59f26 100644
--- a/bootstrap.d/41-uboot.sh
+++ b/bootstrap.d/41-uboot.sh
@@ -19,7 +19,7 @@ if [ "$ENABLE_UBOOT" = true ] ; then
   chroot_exec make -C /tmp/u-boot/ rpi_2_defconfig all
 
   # Copy compiled bootloader binary and set config.txt to load it
-  cp "$R/tmp/u-boot/u-boot.bin" "$R/boot/firmware/"
+  install_readonly "$R/tmp/u-boot/u-boot.bin" "$R/boot/firmware/u-boot.bin"
   printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "$R/boot/firmware/config.txt"
 
   # Install and setup U-Boot command file
diff --git a/bootstrap.d/50-firstboot.sh b/bootstrap.d/50-firstboot.sh
index 0c93d11..2ec9404 100644
--- a/bootstrap.d/50-firstboot.sh
+++ b/bootstrap.d/50-firstboot.sh
@@ -9,9 +9,8 @@
 cat files/firstboot/10-begin.sh > "$R/etc/rc.firstboot"
 
 # Ensure openssh server host keys are regenerated on first boot
-if [ "$ENABLE_SSHD" = true ] && [ "$ENABLE_REDUCE" = false ]; then
+if [ "$ENABLE_SSHD" = true ] ; then
   cat files/firstboot/21-generate-ssh-keys.sh >> "$R/etc/rc.firstboot"
-  rm -f "$R/etc/ssh/ssh_host_*"
 fi
 
 # Prepare filesystem auto expand
diff --git a/bootstrap.d/99-reduce.sh b/bootstrap.d/99-reduce.sh
index f3b2848..99fbc9b 100644
--- a/bootstrap.d/99-reduce.sh
+++ b/bootstrap.d/99-reduce.sh
@@ -66,6 +66,12 @@ if [ "$ENABLE_REDUCE" = true ] ; then
     rm -f "$R/boot/firmware/fixup_x.dat"
   fi
 
+  # Remove kernel and initrd from /boot (already in /boot/firmware)
+  if [ "$BUILD_KERNEL" = false ] ; then
+    rm -r "$R/boot/vmlinuz--*"
+    rm -r "$R/boot/initrd.img-*"
+  fi
+
   # Clean APT list of repositories
   rm -fr "$R/var/lib/apt/lists/*"
   chroot_exec apt-get -qq -y update
diff --git a/files/apt/sources.list b/files/apt/sources.list
index 36472fc..ffc2c9b 100644
--- a/files/apt/sources.list
+++ b/files/apt/sources.list
@@ -6,5 +6,3 @@ deb http://ftp.debian.org/debian/ jessie-updates main contrib
 
 deb http://security.debian.org/ jessie/updates main contrib
 #deb-src http://security.debian.org/ jessie/updates main contrib
-
-deb https://repositories.collabora.co.uk/debian jessie rpi2
diff --git a/files/firstboot/21-generate-ssh-keys.sh b/files/firstboot/21-generate-ssh-keys.sh
index a6c567c..928ee2e 100644
--- a/files/firstboot/21-generate-ssh-keys.sh
+++ b/files/firstboot/21-generate-ssh-keys.sh
@@ -1,8 +1,20 @@
 logger -t "rc.firstboot" "Generating SSH host keys"
-rm -f /etc/ssh/ssh_host_*
-ssh-keygen -q -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key
-ssh-keygen -q -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key
-ssh-keygen -q -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key
-ssh-keygen -q -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key
 
-systemctl restart sshd
+if [ -d "/etc/ssh/" ] ; then
+  rm -f /etc/ssh/ssh_host_*
+  systemctl stop sshd
+  ssh-keygen -q -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key
+  ssh-keygen -q -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key
+  ssh-keygen -q -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key
+  ssh-keygen -q -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key
+  systemctl start sshd
+fi
+
+if [ -d "/etc/dropbear/" ] ; then
+  rm -f /etc/dropbear/dropbear_*
+  systemctl stop dropbear
+  dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
+  dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key
+  dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
+  systemctl start dropbear
+fi
diff --git a/files/firstboot/22-expandroot.sh b/files/firstboot/22-expandroot.sh
index 00b94af..03ec50d 100644
--- a/files/firstboot/22-expandroot.sh
+++ b/files/firstboot/22-expandroot.sh
@@ -5,14 +5,14 @@ case "${ROOT_PART}" in
   mmcblk0*) ROOT_DEV=mmcblk0 ;;
   sda*)     ROOT_DEV=sda ;;
 esac
-if [ "$PART_NUM" = "$ROOT_PART" ]; then
+if [ "$PART_NUM" = "$ROOT_PART" ] ; then
   logger -t "rc.firstboot" "$ROOT_PART is not an SD card. Don't know how to expand"
   return 0
 fi
 
 # NOTE: the NOOBS partition layout confuses parted. For now, let's only
 # agree to work with a sufficiently simple partition layout
-if [ "$PART_NUM" -gt 2 ]; then
+if [ "$PART_NUM" -gt 2 ] ; then
   logger -t "rc.firstboot" "Your partition layout is not currently supported by this tool."
   return 0
 fi
@@ -24,14 +24,18 @@ fi
 
 # Get the starting offset of the root partition
 PART_START=$(parted /dev/${ROOT_DEV} -ms unit s p | grep "^${PART_NUM}" | cut -f 2 -d: | sed 's/[^0-9]//g')
-[ "$PART_START" ] || return 1
+if [ -z "$PART_START" ] ; then
+  logger -t "rc.firstboot" "${ROOT_DEV} unable to get starting sector of the partition"
+  return 1
+fi
 
 # Get the possible last sector for the root partition
 PART_LAST=$(fdisk -l /dev/${ROOT_DEV} | grep '^Disk.*sectors' | awk '{ print $7 - 1 }')
-[ "$PART_LAST" ] || return 1
+if [ -z "$PART_LAST" ] ; then
+  logger -t "rc.firstboot" "${ROOT_DEV} unable to get last sector of the partition"
+  return 1
+fi
 
-# Return value will likely be error for fdisk as it fails to reload the
-# partition table because the root fs is mounted
 ### Since rc.local is run with "sh -e", let's add "|| true" to prevent premature exit
 fdisk /dev/${ROOT_DEV} <<EOF2 || true
 p
diff --git a/files/firstboot/24-create-resolv-symlink.sh b/files/firstboot/24-create-resolv-symlink.sh
index 0dd09de..8a3f00b 100644
--- a/files/firstboot/24-create-resolv-symlink.sh
+++ b/files/firstboot/24-create-resolv-symlink.sh
@@ -1,13 +1,15 @@
 logger -t "rc.firstboot" "Creating /etc/resolv.conf symlink"
 
-
 # Check if systemd resolve directory exists
-if [ -d "/run/systemd/resolve" ] ; then
-  # Create resolv.conf file if it does not exists
-  if [ ! -f "/run/systemd/resolve/resolv.conf" ] ; then
-    touch /run/systemd/resolve/resolv.conf
-  fi
+if [ ! -d "/run/systemd/resolve" ] ; then
+  systemctl enable systemd-resolved.service
+  systemctl restart systemd-resolved.service
+fi
 
-  # Create symlink to /etc/reolv.conf
-  ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
+# Create resolv.conf file if it does not exists
+if [ ! -f "/run/systemd/resolve/resolv.conf" ] ; then
+  touch /run/systemd/resolve/resolv.conf
 fi
+
+# Create symlink to /etc/reolv.conf
+ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
diff --git a/files/mount/crypttab b/files/mount/crypttab
new file mode 100644
index 0000000..78ae2e1
--- /dev/null
+++ b/files/mount/crypttab
@@ -0,0 +1 @@
+# <target name> <source device> <key file> <options>
diff --git a/functions.sh b/functions.sh
index 36f6bc3..cbd5bad 100644
--- a/functions.sh
+++ b/functions.sh
@@ -6,17 +6,18 @@ cleanup (){
 
   # Identify and kill all processes still using files
   echo "killing processes using mount point ..."
-  fuser -k $R
+  fuser -k "$R"
   sleep 3
-  fuser -9 -k -v $R
+  fuser -9 -k -v "$R"
 
   # Clean up all temporary mount points
   echo "removing temporary mount points ..."
-  umount -l $R/proc 2> /dev/null
-  umount -l $R/sys 2> /dev/null
-  umount -l $R/dev/pts 2> /dev/null
+  umount -l "$R/proc" 2> /dev/null
+  umount -l "$R/sys" 2> /dev/null
+  umount -l "$R/dev/pts" 2> /dev/null
   umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
   umount "$BUILDDIR/mount" 2> /dev/null
+  cryptsetup close "${CRYPTFS_MAPPING}" 2> /dev/null
   losetup -d "$ROOT_LOOP" 2> /dev/null
   losetup -d "$FRMW_LOOP" 2> /dev/null
   trap - 0 1 2 3 6
diff --git a/rpi2-gen-image.sh b/rpi2-gen-image.sh
index dcaef9c..d25bdb6 100755
--- a/rpi2-gen-image.sh
+++ b/rpi2-gen-image.sh
@@ -23,7 +23,7 @@ fi
 
 # Check if ./functions.sh script exists
 if [ ! -r "./functions.sh" ] ; then
-  echo "error: './functions.sh' required script not found. please reinstall the latest script version!"
+  echo "error: './functions.sh' required script not found!"
   exit 1
 fi
 
@@ -45,9 +45,9 @@ KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
 
 # Build directories
-BASEDIR=$(pwd)/images/${RELEASE}
-BUILDDIR=${BASEDIR}/build
-R=${BUILDDIR}/chroot
+BASEDIR="$(pwd)/images/${RELEASE}"
+BUILDDIR="${BASEDIR}/build"
+R="${BUILDDIR}/chroot"
 
 # General settings
 HOSTNAME=${HOSTNAME:=rpi2-${RELEASE}}
@@ -101,6 +101,7 @@ ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
+ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
 
 # Kernel compilation settings
 BUILD_KERNEL=${BUILD_KERNEL:=false}
@@ -120,12 +121,22 @@ KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
 REDUCE_APT=${REDUCE_APT:=true}
 REDUCE_DOC=${REDUCE_DOC:=true}
 REDUCE_MAN=${REDUCE_MAN:=true}
-REDUCE_VIM=${REDUCE_VIM:=true}
+REDUCE_VIM=${REDUCE_VIM:=false}
 REDUCE_BASH=${REDUCE_BASH:=false}
 REDUCE_HWDB=${REDUCE_HWDB:=true}
 REDUCE_SSHD=${REDUCE_SSHD:=true}
 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
 
+# Encrypted filesystem settings
+ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
+CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
+CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
+CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
+CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
+
+# Stop the Crypto Wars
+DISABLE_FBI=${DISABLE_FBI:=false}
+
 # Chroot scripts directory
 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
 
@@ -149,6 +160,28 @@ if [ "$KERNEL_MENUCONFIG" = true ] ; then
   REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses5-dev"
 fi
 
+# Stop the Crypto Wars
+if [ "$DISABLE_FBI" = true ] ; then
+  ENABLE_CRYPTFS=true
+fi
+
+# Add cryptsetup package to enable filesystem encryption
+if [ "$ENABLE_CRYPTFS" = true ]  && [ "$BUILD_KERNEL" = true ] ; then
+  REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
+  APT_INCLUDES="${APT_INCLUDES},cryptsetup"
+
+  if [ -z "$CRYPTFS_PASSWORD" ] ; then
+    echo "error: no password defined (CRYPTFS_PASSWORD)!"
+    exit 1
+  fi
+  ENABLE_INITRAMFS=true
+fi
+
+# Add initramfs generation tools
+if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
+  APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
+fi
+
 # Check if all required packages are installed on the build system
 for package in $REQUIRED_PACKAGES ; do
   if [ "`dpkg-query -W -f='${Status}' $package`" != "install ok installed" ] ; then
@@ -193,6 +226,12 @@ if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
    exit 1
 fi
 
+# Check if specified device mapping already exists (will be used by cryptsetup)
+if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
+  echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
+  exit 1
+fi
+
 # Don't clobber an old build
 if [ -e "$BUILDDIR" ] ; then
   echo "error: directory ${BUILDDIR} already exists, not proceeding"
@@ -215,7 +254,7 @@ trap cleanup 0 1 2 3 6
 
 # Add required packages for the minbase installation
 if [ "$ENABLE_MINBASE" = true ] ; then
-  APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools"
+  APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
 else
   APT_INCLUDES="${APT_INCLUDES},locales,keyboard-configuration,console-setup"
 fi
@@ -321,6 +360,11 @@ fi
 # Remove apt-utils
 chroot_exec apt-get purge -qq -y --force-yes apt-utils
 
+# Generate required machine-id
+MACHINE_ID=$(dbus-uuidgen)
+echo -n "${MACHINE_ID}" > "$R/var/lib/dbus/machine-id"
+echo -n "${MACHINE_ID}" > "$R/etc/machine-id"
+
 # APT Cleanup
 chroot_exec apt-get -y clean
 chroot_exec apt-get -y autoclean
@@ -331,19 +375,21 @@ umount -l "$R/proc"
 umount -l "$R/sys"
 
 # Clean up directories
-rm -rf "$R/run"
+rm -rf "$R/run/*"
 rm -rf "$R/tmp/*"
 
 # Clean up files
+rm -f "$R/etc/ssh/ssh_host_*"
+rm -f "$R/etc/dropbear/dropbear_*"
 rm -f "$R/etc/apt/sources.list.save"
 rm -f "$R/etc/resolvconf/resolv.conf.d/original"
 rm -f "$R/etc/*-"
 rm -f "$R/root/.bash_history"
 rm -f "$R/var/lib/urandom/random-seed"
-rm -f "$R/var/lib/dbus/machine-id"
-rm -f "$R/etc/machine-id"
 rm -f "$R/etc/apt/apt.conf.d/10proxy"
 rm -f "$R/etc/resolv.conf"
+rm -f "$R/initrd.img"
+rm -f "$R/vmlinuz"
 rm -f "${R}${QEMU_BINARY}"
 
 # Calculate size of the chroot directory in KB
@@ -371,43 +417,58 @@ if [ "$ENABLE_SPLITFS" = true ] ; then
   dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img" bs=512 count=0 seek=${FRMW_SECTORS}
   dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}-root.img" bs=512 count=${TABLE_SECTORS}
   dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}-root.img" bs=512 count=0 seek=${ROOT_SECTORS}
-  # Write partition tables
-  sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img" <<EOM
-unit: sectors
-
-1 : start=   ${TABLE_SECTORS}, size=   ${FRMW_SECTORS}, Id= c, bootable
-2 : start=                  0, size=                 0, Id= 0
-3 : start=                  0, size=                 0, Id= 0
-4 : start=                  0, size=                 0, Id= 0
+
+  # Write firmware/boot partition tables
+  sfdisk -q -L -uS -f "$BASEDIR/${DATE}-debian-${RELEASE}-frmw.img" 2> /dev/null <<EOM
+${TABLE_SECTORS},${FRMW_SECTORS},c,*
 EOM
-  sfdisk -q -L -f "$BASEDIR/${DATE}-debian-${RELEASE}-root.img" <<EOM
-unit: sectors
 
-1 : start=   ${TABLE_SECTORS}, size=   ${ROOT_SECTORS}, Id=83
-2 : start=                  0, size=                 0, Id= 0
-3 : start=                  0, size=                 0, Id= 0
-4 : start=                  0, size=                 0, Id= 0
+  # Write root partition table
+  sfdisk -q -L -uS -f "$BASEDIR/${DATE}-debian-${RELEASE}-root.img" 2> /dev/null <<EOM
+${TABLE_SECTORS},${ROOT_SECTORS},83
 EOM
+
   # Setup temporary loop devices
   FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}-frmw.img)"
   ROOT_LOOP="$(losetup -o 1M -f --show $BASEDIR/${DATE}-debian-${RELEASE}-root.img)"
-else
+else # ENABLE_SPLITFS=false
   dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=512 count=${TABLE_SECTORS}
   dd if=/dev/zero of="$BASEDIR/${DATE}-debian-${RELEASE}.img" bs=512 count=0 seek=${IMAGE_SECTORS}
-  # Write partition table
-  sfdisk -q -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" <<EOM
-unit: sectors
 
-1 : start=   ${TABLE_SECTORS}, size=   ${FRMW_SECTORS}, Id= c, bootable
-2 : start=     ${ROOT_OFFSET}, size=   ${ROOT_SECTORS}, Id=83
-3 : start=                  0, size=                 0, Id= 0
-4 : start=                  0, size=                 0, Id= 0
+  # Write partition table
+  sfdisk -q -L -uS -f "$BASEDIR/${DATE}-debian-${RELEASE}.img" 2> /dev/null <<EOM
+${TABLE_SECTORS},${FRMW_SECTORS},c,*
+${ROOT_OFFSET},${ROOT_SECTORS},83
 EOM
+
   # Setup temporary loop devices
   FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
   ROOT_LOOP="$(losetup -o 65M -f --show $BASEDIR/${DATE}-debian-${RELEASE}.img)"
 fi
 
+if [ "$ENABLE_CRYPTFS" = true ] ; then
+  # Create dummy ext4 fs
+  mkfs.ext4 "$ROOT_LOOP"
+
+  # Setup password keyfile
+  echo -n ${CRYPTFS_PASSWORD} > .password
+
+  # Initialize encrypted partition
+  echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
+
+  # Open encrypted partition and setup mapping
+  cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
+
+  # Secure delete password keyfile
+  shred -zu .password
+
+  # Update temporary loop device
+  ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
+
+  # Wipe encrypted partition (encryption cipher is used for randomness)
+  dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count=$(blockdev --getsz "${ROOT_LOOP}")
+fi
+
 # Build filesystems
 mkfs.vfat "$FRMW_LOOP"
 mkfs.ext4 "$ROOT_LOOP"