Build Latest GrSec KErnel (Cron-able)

build_kernel.sh

#!/bin/bash

verify_sig() {
  local file=$1 out=
  if out=$(gpg --status-fd 1 --verify "$file" 2>/dev/null) &&
    echo $out | grep "\[GNUPG:\] VALIDSIG" | grep "\[GNUPG:\] GOODSIG" | grep -qsv "\[GNUPG:\] TRUST_NEVER"; then
      return 0
  else
    echo "$out" >&2
    return 1
  fi
}

echo Clearing old files..
rm -rf linux-*
rm -f grsecurity-*
cd /home/builder
rm -rf linux-*
cd ~

echo Fetching version info..
grsecurl=`wget -q -O- "https://grsecurity.net/testing_rss.php" | grep -o '<link>.*\.patch</link>' | grep -o 'http.*\.patch' -m 1`
grsecsig=`echo $grsecurl | awk '{print $1".sig"}'`
kernelver=`echo $grsecurl | cut -d "-" -f 3`
kernelfolderver=`echo $kernelver | cut -d "." -f 1 | awk '{print "v"$1".x"}'`
kernelurl=`echo "https://www.kernel.org/pub/linux/kernel/"$kernelfolderver"/linux-"$kernelver".tar.xz"`
kernelsig=`echo "https://www.kernel.org/pub/linux/kernel/"$kernelfolderver"/linux-"$kernelver".tar.sign"`
grsecfile=`echo $grsecsig | grep -o 'grsecurity-.*'`
kernelfile=`echo $kernelsig | grep -o 'linux-.*'`
currentkernelver=`uname -r | cut -d - -f 1`

if [ $kernelver == $currentkernelver ]; then
  echo "Nothing to do"
  exit
fi

echo Fetching GrSec..
wget -t 3 -T 60 $grsecurl &>/dev/null
wget -t 3 -T 60 $grsecsig &>/dev/null
echo Fetching kernel..
wget -t 3 -T 60 $kernelurl &>/dev/null
wget -t 3 -T 60 $kernelsig &>/dev/null

echo Verifying GrSec..
if verify_sig $grsecfile; then
  echo Good GrSec signature
else
  echo Bad GrSec signature
  exit
fi

if [ ! -f "linux-"$kernelver".tar" ]; then
  echo Unpacking kernel..
  unxz "linux-"$kernelver".tar.xz"
fi

echo Verifying kernel..
if verify_sig $kernelfile; then
  echo Good kernel signature
else
  echo Bad kernel signature
  exit
fi

if [ ! -d "linux-"$kernelver ]; then
  echo Unpacking kernel..
  tar -xvf "linux-"$kernelver".tar" &>/dev/null
fi

echo Applying patch..
cd "linux-"$kernelver
patch -p1 < ../$(echo $grsecurl | grep -o 'grsecurity-.*') &>/dev/null
cp "/boot/config-"$currentkernelver"-grsec" .config
cd ..

echo Moving to unprevileged user..
mv "linux-"$kernelver /home/builder/
chown -R builder:builder "/home/builder/linux-"$kernelver

echo Building..
cd "/home/builder/linux-"$kernelver
su builder -c 'fakeroot make deb-pkg'
cd ..

echo Installing new kernel..
dpkg -i linux-*.deb

echo Moving packages..
find . -type f -name "*.deb" -exec mv -t /mnt/build-bucket/grsec-kernel/ {} +

cd ~

echo Removing old kernels..
dpkg -l linux-{image,headers}-* | \
awk '/^ii/{print $2}' | \
egrep '[0-9]+\.[0-9]+\.[0-9]+' | \
awk 'BEGIN{FS="-"}; {if ($3 ~ /[0-9]+/) print $3"-"$4,$0; else if ($4 ~ /[0-9]+/) print $4"-"$5,$0}' | \
sort -k1,1 --version-sort -r | \
sed -e "1,/$(uname -r | cut -f1,2 -d"-")/d" | \
grep -v -e `uname -r | cut -f1,2 -d"-"` | \
awk '{print $2}' | \
xargs apt-get -y purge
update-grub

echo Restarting..
reboot