Alpine Linux - User contributions [en]

Alpine Linux:FAQ

2021-04-20T15:24:21Z

Innsill: /* Where to start? */ + https://distrotest.net/AlpineLinux/

[[Image:filetypes.svg|64px|left|link=]]
This is a list of '''frequently asked questions''' about Alpine Linux. 
If your question is not answered on this page, use the search box above to find work in progress pages not linked here, or in case of no answer, edit this page and write down your question.
{{Tip| Prepare your question. Think it through. Make it simple and understandable.}}

=General=

Alpine Linux is used heavily in containers (e.g. docker images) on servers, so many of its main packages are focused on server services.

== Where to start? ==

The «[[Installation|Installation page]]» provides a basic orientation.

A broader overview may be found on the official «[http://alpinelinux.org/about About page]», and at the «[[Alpine Linux:Overview|Wiki Overview]]».

Please note that testing is safer on your own virtual machine or on a public «[https://distrotest.net/AlpineLinux/ DistroTest.net]».

== I have found a bug, where can I report it? ==

You can report it in the [https://gitlab.alpinelinux.org/groups/alpine/-/issues bugtracker], but search it first to see if the issue has already been reported.

== Are there any details about the releases available? ==
Yes, please check the [https://alpinelinux.org/releases/ releases] page.

== How can I contribute? ==
You can contribute by:
* Using the software and giving feedback.
* Documenting your [http://www.alpinelinux.org Alpine Linux] experiences on this [[Main_Page|wiki]].
* In many other ways.
Please visit [[Contribute|Contribute page]] to read more about this topic.

== Why don't I have man pages or where is the 'man' command? ==
The ''man'' command and ''man pages'' are not installed by default. Many packages have documentation companion packages suffixed ''-doc''. Keep in mind, not all packages have a corresponding documentation package and when there is one it may not include ''man pages''.

To install the ''man'' command, and related utilities, first add the {{pkg|man-db}} package:

<code>apk add man-db</code>

Once installed, add documentation for the package where you need it. For example, say you installed {{pkg|nftables}} and you now require its man pages:

<code>apk add nftables-doc</code>

Now we've installed ''nft(8)'' and [https://pkgs.alpinelinux.org/contents?branch=edge&name=nftables-doc&arch=x86_64&repo=main other documentation] to our system and you can issue the command:

<code>man nft</code>.

To allways install the documentation companion package, when available, add the {{pkg|docs}} meta package.

<code>apk add docs</code>

== What is the difference between edge and stable releases? ==
Stable releases are just what they sound like: initially a point-in-time snapshot of the package archives, but then maintained with bug-fixes only in order to keep a stable environment.

[[Edge]] is more of a rolling-release, with the latest and greatest packages available in the online repositories. 
Occasionally, snapshot ISO images of the then-current state of [[edge]] are made and are available for download. 
Typically these are made when there are major kernel upgrades or package upgrades that require initramfs rebuilds.

== What architectures does Alpine support? ==
As Alpine uses the Linux kernel, it supports:
* '''aarch64''': The 64-bit only ARM execution state of the ARMv8 device machines.
* '''armhf''': The newer ARM hard-float for newer, more powerful 32-bit devices alongside 64-bit
* '''armv7''': The 32-bit only ARM execution state of the ARMv7 devices machines.
* '''mips64''':
* '''s390x''': For the Super powered IBM mainframes, especially IBM Z and IBM LinuxONE servers.
* '''ppc64le''': For 64-bit PowerPC devices with pure little-endian mode, mostly for POWER8 and POWER9
* '''x86''': (i386, PC 32bit) and x86_64 (i686, PC 64bit and amd64)
* '''x86_64''': The popular AMD64 compatible 64-bit x86 based machines, i386 is not recommended for newer/latest hardware.

'''Please check [https://alpinelinux.org/downloads Download] page for media availability on each one''' and check [[Alpine_Linux:Releases|Releases]] pages for latest.

== What kind of release of Alpine Linux are available? ==
Please check the [https://alpinelinux.org/releases/ Releases] page for more information.

=Setup=

== What is the difference between ''sys'', ''data'', and ''diskless'' when running <code>setup-alpine</code> or <code>setup-disk</code>? ==

'''sys:''' This mode is a traditional disk install. The following partitions will be created on the disk: ''/boot/'', ''/'' (filesystem root) and ''swap''.
This mode may be used for development boxes, desktops, virtual servers, etc.

'''data:''' This mode uses your disk(s) for data storage, not for the operating system. Runs from the media and only a ''/var/'' is created on disk. The system itself will run from a ''tmpfs'' (RAM). Use this mode if you only want to use the disk(s) for data, like ''mailspool'', ''databases'', ''logs'', etc.

'''diskless:''' No disks are to be used. [[Alpine local backup]] may still be used in this mode.

These modes are explained further [[Installation#Installation_Overview|on the '''Installation''' page]].

== How do I upgrade Alpine? ==

To upgrade to a new stable release or edge:
<code>apk upgrade --available</code>

==My cron jobs don't run?==

Start service ''crond'' and add it to runlevel:

: {{cmd|rc-service crond start && rc-update add crond}}

After that the cron daemon is started automatically on system boot and executes the scripts placed in the folders under ''/etc/periodic/'' - there're folders for ''15min'', ''hourly'', ''daily'', ''weekly'' and ''monthly'' scripts.

To check whether your scripts are likely to run, use the ''run-parts'' command, for example:

{{cmd|run-parts --test /etc/periodic/15min}}

This command will tell you what should run but will not actually execute the scripts.

If the results of the test are not as expected, check the following:

* Make sure the script is executable - if unsure, issue the command {{cmd|chmod a+x /etc/periodic/[path/scriptname]}}
* Make sure the first line of your script is <code>#!/bin/sh</code>
* Do not use periods on your script file names - this stops them from working; for example: <code>/etc/periodic/daily/myscript</code> will run, but <code>/etc/periodic/daildy/myscript.sh</code> won't.

= Time and timezones =

== How do I set the local timezone? ==

If you wish to edit the ''timezone'' (TZ) after installation, run the [[Alpine_setup_scripts#setup-timezone|setup-timezone]] script.

= Packages =

== Can you build an apk package for ...? ==
Yes, we probably can. 
Please create an [https://gitlab.alpinelinux.org/alpine/aports/issues/new issue] in the [https://gitlab.alpinelinux.org bugtracker]. Prefix with "feat" in title and include a short description (one-line), an URL for the home page, and an URL for the source package.

== How can I build my own package? ==
Please see the [[Creating an Alpine package]] page.

== What does "required by: world[$pkgname]" mean? ==

It means that the package you try to install does not exist in the repositories you have configured.

Maybe you forgot to add community, testing or unmaintained to ''/etc/apk/repositories''?

Or is the package in a [[Alpine_Linux_package_management#Repository_pinning|pinned repository]] and you forgot to suffix the package with the repo tag? Example:

{{cmd|apk add experimental-package@testing}}

== How can I find out if a certain package exists in Alpine? ==

If you want to only search repositories you have configured in /etc/apk/repositories, then <code>apk search $pkgname</code> should get you sorted. If you want to search all repositories have a look at the [https://pkgs.alpinelinux.org/ online pkg oracle]

== WARNING: Ignoring APKINDEX.xxxx.tar.gz ==
If you get <code>WARNING: Ignoring APKINDEX.xxxx.tar.gz: No such file or directory</code> while running [[Alpine_Linux_package_management|package related tools]], check your ''/etc/apk/repositories'' file.

To check the content of the repositories file
{{Cmd|cat /etc/apk/repositories}}

or
{{Cmd|setup-apkrepos}}

= Dynamic DNS =
== How do I schedule a regular dynamic DNS update? ==
You'll want to install the {{pkg|ez-ipupdate}} package:
{{cmd|apk add ez-ipupdate}}

After that, create a new file at {{path|/etc/ez-ipupdate.conf}} with contents similar to:
service-type=dyndns
user=myusername:mypassword
interface=eth1
host=myhostname.dyndns.org

Make the new ip cache directory:
{{cmd|mkdir /var/cache/ez-ipupdate
lbu add /var/cache/ez-ipupdate}}

Then schedule a new cron job with this command:
{{cmd|echo >> /var/log/ez-ipupdate && \ /bin/date >> /var/log/ez-ipupdate && \ ez-ipupdate --config-file /etc/ez-ipupdate.conf -f -F /var/run/ez-ipupdate.pid \ --cache-file /var/cache/ez-ipupdate/ipcache --quiet >> /var/log/ez-ipupdate 2>&1}}

Don't forget to backup your settings!
{{cmd|lbu ci}}

= Terminal =

== How to enable/fix colors for git? ==

The problem is not in git itself or terminal, but in the <tt>less</tt> command.
Busybox’s <tt>less</tt> doesn’t support <tt>-r</tt> (<tt>--raw-control-chars</tt>) and <tt>-R</tt> (<tt>--RAW-CONTROL-CHARS</tt>) options.

The simplest (yet not ideal) solution is to install GNU less:

{{cmd|apk add less}}

= Old questions, no longer freqently asked =

== Alpine freezes during boot from Compact Flash, how can I fix? ==
Most Compact Flash card readers do not support proper DMA. 
You should append '''nodma''' to the ''append'' line in {{path|syslinux.cfg}}.

== How do I remove the CDROM? ==
Since the modloop loopback device is on CDROM you cannot just run <code>eject</code>. You need to unmount the modloop first. 
Unmounting both the modloop and the CDROM in one step can be done by executing:
{{Cmd|/etc/init.d/modloop stop}}

Then it's possible to eject the CDROM:
{{Cmd|eject}}

== How can I install a custom firmware in a diskless system? ==

The modules and firmware are both special images which are mounted as read-only. 
To fix this issue you can copy the firmware directory to your writeable media (cf/usb) and copy your custom firmware to it. 
After reboot Alpine should automatically use the directory on your local storage instead of the loopback device.

== How do I play my .ogg/.mp3 files? ==
First, the sound card should be recognized (you must have {{path|/dev/snd/*****}} files)

{{pkg|sox}}, {{pkg|mpg123}}, etc all use the oss sound driver, while Alpine uses ALSA drivers. 
So you need to load the snd-pcm-oss compatibility module. 
While you're at it, you might need {{pkg|aumix}} to turn up the sound volume
{{cmd|echo snd-pcm-oss >> /etc/modules
modprobe snd-pcm-oss
apk_add aumix sox
aumix (set volume settings)
play really_cool_song.mp3}}

== OpenNTPD reports an error with "adjtime" ==
Your log contains something like:
reply from 85.214.86.126: offset 865033148.784255 delay 0.055466, next query 32s
reply from 202.150.212.24: offset 865033148.779314 delay 0.400771, next query 3s
adjusting local clock by 865033148.779835s
adjtime failed: Invalid argument

{{pkg|openntpd}} is supposed to make small adjustments in the time without causing time jumps. 
If the adjustment is too big then something is clearly wrong and ntpd gives up. (its actually adjtime(3) that has a limit on how big adjustments are allowed)

You can make ntpd set the time at startup by adding ''-s'' option to ntpd. This is done by setting '''NTPD_OPTS="-s"''' in {{path|/etc/conf.d/ntpd}}.

== Using a cron job to keep the time in sync ==
Add the following to {{path|/etc/periodic/daily}} (or use another folder under the {{path|/etc/periodic}} heirarchy if you want to run the script more/less frequently)

Example: file called {{path|do-ntp}}
<pre>
#!/bin/sh
ntpd -d -q -n -p uk.pool.ntp.org</pre>

This queries the uk time server pool - you can modify this to suit your localisation, or just use ''pool.ntp.org''. More info here: [http://www.pool.ntp.org/zone/@ http://www.pool.ntp.org/zone/@]

== Windows clients reports an error when trying to sync ==
{{pkg|openntpd}} needs to run for a while before it is satisfied it is in sync.
Until then it will set a flag "clock not synchronized" and Windows will report an error while trying to sync with your {{pkg|openntpd}} server.

Only thing to do is wait, do something else for 15-20mins and then check.

[[Category:Newbie]]

Flatpak

2019-11-19T09:25:18Z

Innsill:

Flatpak is a technology for building and distributing desktop applications on GNU/Linux.

There are currently 3 main [[runtime]]s available:
* [http://docs.flatpak.org/en/latest/available-runtimes.html Freedesktop]
** [[GNOME]] (based on the Freedesktop runtime)
** [[KDE]] (based on the Freedesktop runtime)
These are all hosted on [https://flathub.org/ Flathub.org].

= =
* [https://flatpak.org/ flatpak.org]
* [https://flatpak.org/setup/Alpine/ Alpine Quick Setup. Follow these simple steps to start using Flatpak]
* [http://docs.flatpak.org/en/latest/using-flatpak.html#the-flatpak-command The flatpak command]
* [https://blogs.gnome.org/alexl/2018/06/20/flatpak-a-history/ Flatpak – a history] Alexander Larsson 2018

* [https://winepak.org/ winepak.org]
* [http://archive.is/BzBfV How to Easily Install Windows Games on Linux with Winepak] Nick Congleton 2018

* [https://unix.stackexchange.com/questions/487787/why-os-needs-explicit-support-for-musl Why OS needs explicit support for musl?] Stephen Kitt 2018

[[Category:Flatpak]]
[[category: desktop]]

User:Innsill/dwm-starter (x86-64)

2019-11-19T08:32:48Z

Innsill:

... ???
{{TOC right}}

<pre>
/dev/sda /dev/nvme0n1
(old bios bootable) (m.2 PCIe NVMe, unbootable)
+-------------------+ +-------------------+
| *--------------+ | | +--------------+ |
| | /boot | | | | swap | |
| +--------------+ | | +--------------+ |
+-------------------+ | +--------------+ |
| | / | |
| +--------------+ |
+-------------------+
</pre>

'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''

= setup-alpine =
'''{{c| setup-alpine}}''' ...none, none, none,...

* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot


= setup-disk =
* BOOTLOADER=grub '''{{c| setup-disk /mnt}}'''
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
echo "ff ALL = (ALL) NOPASSWD: /usr/sbin/hdparm -Y /dev/sda" >> /etc/sudoers.d/ff

chmod 400 /etc/sudoers.d/ff

echo "sudo hdparm -Y /dev/sda" >> /home/ff/.profile

= X ??? =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

...

$vi .xinitrc {{cat |/home/ff/.xinitrc |<nowiki>setxkbmap ... &
exec dvm</nowiki>}}

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]
* [[dwm]]

User:Innsill/omxplayer-starter (amdhf)

2019-11-17T16:21:17Z

Innsill:

{{Warning|
Be careful !

<s>Spy backdoors China/Huawei</s> !
Spy backdoors USA/Microsoft: ''[http://archive.fo/caysY#selection-691.152-697.117 Archive], [https://ownyourbits.com/2019/02/02/whats-wrong-with-the-raspberry-pi/ Source], [https://en.wikipedia.org/wiki/ThreadX#Products_Using_ThreadX ThreadX]'' }}

# https://alpinelinux.org/downloads/
#* alpine-rpi-3.10.3-armhf.tar.gz
#* alpine-rpi-3.10.3-armhf.tar.gz.sha256
#** sha256sum --check {{c |alpine-rpi-3.10.3-armhf.tar.gz.sha256}}
#
# find / -name setup* -print | sort
#* setup-alpine
#
# [https://pkgs.alpinelinux.org/contents?file=omxplayer&path=&name=&branch=v3.10&arch=armhf omxplayer ?]
#* vi {{c |/etc/apk/repositories}}
#* apk update && apk upgrade
#* apk add omxplayer
# vi {{c| /etc/inittab}} {{cat |/etc/inittab |<nowiki>tty1::respawn:/bin/login -f root
tty2::respawn:/sbin/getty 38400 tty2
#tty3::respawn:/sbin/getty 38400 tty3 </nowiki>}} vi {{c| .profile}} {{cat |/root/.profile |<nowiki>mount /dev/sda1 /mnt
mount /dev/sda /mnt
cd /mnt
VIDEO=$( ls | sort )
for i in $VIDEO
do
omxplayer $i
done</nowiki>}} lbu include /root/.profile lbu commit
= =
* [https://elinux.org/Omxplayer Omxplayer] eLinux.org
* [https://www.raspberrypi.org/documentation/raspbian/applications/omxplayer.md OMXPlayer: An accelerated command line media player] raspberrypi.org

User:Innsill/omxplayer-starter (amdhf)

2019-11-13T09:58:35Z

Innsill:

{{Warning|
Be careful !

<s>Spy backdoors China/Huawei</s> !
Spy backdoors USA/Microsoft: ''[http://archive.fo/caysY#selection-691.152-697.117 Archive], [https://ownyourbits.com/2019/02/02/whats-wrong-with-the-raspberry-pi/ Source], [https://en.wikipedia.org/wiki/ThreadX#Products_Using_ThreadX ThreadX]'' }}

# https://alpinelinux.org/downloads/
#* alpine-rpi-3.10.3-armhf.tar.gz
#* alpine-rpi-3.10.3-armhf.tar.gz.sha256
#** sha256sum --check {{c |alpine-rpi-3.10.3-armhf.tar.gz.sha256}}
#
# find / -name setup* -print | sort
#* setup-alpine
#
# [https://pkgs.alpinelinux.org/contents?file=omxplayer&path=&name=&branch=v3.10&arch=armhf omxplayer ?]
#* vi {{c |/etc/apk/repositories}}
#* apk update && apk upgrade
#* apk add omxplayer
# vi {{c| /etc/inittab}} {{cat |/etc/inittab |<nowiki>tty1::respawn:/bin/login -f root
tty2::respawn:/sbin/getty 38400 tty2
#tty3::respawn:/sbin/getty 38400 tty3 </nowiki>}} vi {{c| .profile}} {{cat |/root/.profile |<nowiki>mount /dev/sda1 /mnt
cd /mnt
VIDEO=$( ls | sort )
for i in $VIDEO
do
omxplayer $i
done</nowiki>}} lbu include /root/.profile lbu commit
= =
* [https://elinux.org/Omxplayer Omxplayer] eLinux.org
* [https://www.raspberrypi.org/documentation/raspbian/applications/omxplayer.md OMXPlayer: An accelerated command line media player] raspberrypi.org

User:Innsill/omxplayer-starter (amdhf)

2019-11-12T11:09:38Z

Innsill:

{{Warning|
Be careful !

<s>Spy backdoors China/Huawei</s> !
Spy backdoors USA/Microsoft: ''[http://archive.fo/caysY#selection-691.152-697.117 Archive], [https://ownyourbits.com/2019/02/02/whats-wrong-with-the-raspberry-pi/ Source], [https://en.wikipedia.org/wiki/ThreadX#Products_Using_ThreadX ThreadX]'' }}

# https://alpinelinux.org/downloads/
#* alpine-rpi-3.10.3-armhf.tar.gz
#* alpine-rpi-3.10.3-armhf.tar.gz.sha256
#** sha256sum --check {{c |alpine-rpi-3.10.3-armhf.tar.gz.sha256}}
#
# find / -name setup* -print | sort
#* setup-alpine
#
# [https://pkgs.alpinelinux.org/contents?file=omxplayer&path=&name=&branch=v3.10&arch=armhf omxplayer ?]
#* vi {{c |/etc/apk/repositories}}
#* apk update && apk upgrade
#* apk add omxplayer
# vi {{c| /etc/inittab}} {{cat |/etc/inittab |<nowiki>tty1::respawn:/bin/login -f root
tty2::respawn:/sbin/getty 38400 tty2
#tty3::respawn:/sbin/getty 38400 tty3 </nowiki>}} vi {{c| .profile}} {{cat |/root/.profile |<nowiki>mount /dev/sda1 /mnt
omxplayer /mnt/video</nowiki>}}

= =
* [https://elinux.org/Omxplayer Omxplayer] eLinux.org
* [https://www.raspberrypi.org/documentation/raspbian/applications/omxplayer.md OMXPlayer: An accelerated command line media player] raspberrypi.org

User:Innsill/omxplayer-starter (amdhf)

2019-11-12T11:02:49Z

Innsill:

{{Warning|
Be careful !

<s>Spy backdoors China/Huawei</s> !
Spy backdoors USA/Microsoft: ''[http://archive.fo/caysY#selection-691.152-697.117 Archive], [https://ownyourbits.com/2019/02/02/whats-wrong-with-the-raspberry-pi/ Source], [https://en.wikipedia.org/wiki/ThreadX#Products_Using_ThreadX ThreadX]'' }}

# https://alpinelinux.org/downloads/
#* alpine-rpi-3.10.3-armhf.tar.gz
#* alpine-rpi-3.10.3-armhf.tar.gz.sha256
#** sha256sum --check alpine-rpi-3.10.3-armhf.tar.gz.sha256
#
# find / -name setup* -print | sort
#* setup-alpine
#
# [https://pkgs.alpinelinux.org/contents?file=omxplayer&path=&name=&branch=v3.10&arch=armhf omxplayer ?]
#* vi /etc/apk/repositories
#* apk update && apk upgrade
#* apk add omxplayer
# vi {{c| /etc/inittab}} {{cat |/etc/inittab |<nowiki>tty1::respawn:/bin/login -f root
tty2::respawn:/sbin/getty 38400 tty2
#tty3::respawn:/sbin/getty 38400 tty3 </nowiki>}} $vi {{c| .profile}} {{cat |/root/.profile |<nowiki>mount /dev/sda1 /mnt
omxplayer /mnt/video</nowiki>}}

= =
* [https://elinux.org/Omxplayer Omxplayer] eLinux.org
* [https://www.raspberrypi.org/documentation/raspbian/applications/omxplayer.md OMXPlayer: An accelerated command line media player] raspberrypi.org

User:Innsill

2019-11-11T08:28:56Z

Innsill:

* [[Special: UncategorizedPages]]

* [[User:Innsill/firefox-starter (x86-64 ) |firefox-starter (x86-64)]] -- PC
* [[User:Innsill/omxplayer-starter (amdhf) |omxplayer-starter (amdhf)]] -- Raspberry-2
* [[User:Innsill/dwm-starter (aarch64) |dwm-starter (aarch64)]] -- Odroid-C2
* [[user: Innsill/dwm-starter (x86-64) |dwm-starter (x86-64)]]

User:Innsill/dwm-starter (x86-64)

2019-11-11T08:23:49Z

Innsill:

... ???
{{TOC right}}

<pre>
/dev/sda /dev/nvme0n1 (m.2 PCIe NVMe, unbootable)
+-------------------+ +-------------------+
| *--------------+ | | +--------------+ |
| | /boot | | | | swap | |
| +--------------+ | | +--------------+ |
+-------------------+ | +--------------+ |
| | / | |
| +--------------+ |
+-------------------+
</pre>

'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''

= setup-alpine =
'''{{c| setup-alpine}}''' ...none, none, none,...

* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot


= setup-disk =
* BOOTLOADER=grub '''{{c| setup-disk /mnt}}'''
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
echo "ff ALL = (ALL) NOPASSWD: /usr/sbin/hdparm -Y /dev/sda" >> /etc/sudoers.d/ff

chmod 400 /etc/sudoers.d/ff

echo "sudo hdparm -Y /dev/sda" >> /home/ff/.profile

= X ??? =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

User:Innsill/dwm-starter (x86-64)

2019-11-11T08:21:25Z

Innsill:

... ???
{{TOC right}}

<pre>
/dev/sda /dev/nvme0n1 (m.2 PCIe NVMe, unbootable)
+-------------------+ +-------------------+
| +--------------+ | | +--------------+ |
| | /boot | | | | swap | |
| +--------------* | | +--------------+ |
+-------------------+ | +--------------* |
| | / | |
| +--------------* |
+-------------------+
</pre>

'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''

= setup-alpine =
'''{{c| setup-alpine}}''' ...none, none, none,...

* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot


= setup-disk =
* BOOTLOADER=grub '''{{c| setup-disk /mnt}}'''
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
echo "ff ALL = (ALL) NOPASSWD: /usr/sbin/hdparm -Y /dev/sda" >> /etc/sudoers.d/ff

chmod 400 /etc/sudoers.d/ff

echo "sudo hdparm -Y /dev/sda" >> /home/ff/.profile

= X ??? =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

Suspend on LID close

2019-11-09T08:08:49Z

Innsill:

This article explains how to make your laptop go to Suspend when closing the LID.

This can be done via <code>acpid</code> with a hook in {{path|/etc/acpi/LID/00000080}}:

'''a) with pm-utils:'''
{{cmd|apk add pm-utils}}
{{cat|/etc/acpi/LID/00000080|#!/bin/sh
exec pm-suspend
}}

'''b) with this raw variant:'''
{{cat|/etc/acpi/LID/00000080|#!/bin/sh
echo mem > /sys/power/state
}}

Make the hook executable:
{{cmd|chmod +x /etc/acpi/LID/00000080}}

And that should be it. Make sure that the acpid daemon is running:
{{cmd|/etc/init.d/acpid start}}

= =
* [https://unix.stackexchange.com/questions/484550/pm-suspend-vs-systemctl-suspend pm-suspend vs systemd...]
* [http://archive.md/Bcqlz pm-utils (arch wiki)]

[[Category:Power Management]]
[[category: Desktop]]

Suspend on LID close

2019-11-09T08:02:30Z

Innsill: + link pm-utils (arch wiki)

This article explains how to make your laptop go to Suspend when closing the LID.

This can be done via <code>acpid</code> with a hook in {{path|/etc/acpi/LID/00000080}}:

'''a) with pm-utils:'''
{{cmd|apk add pm-utils}}
{{cat|/etc/acpi/LID/00000080|#!/bin/sh
exec pm-suspend
}}

'''b) with this raw variant:'''
{{cat|/etc/acpi/LID/00000080|#!/bin/sh
echo mem > /sys/power/state
}}

Make the hook executable:
{{cmd|chmod +x /etc/acpi/LID/00000080}}

And that should be it. Make sure that the acpid daemon is running:
{{cmd|/etc/init.d/acpid start}}

= =
* [https://unix.stackexchange.com/questions/484550/pm-suspend-vs-systemctl-suspend pm-suspend vs systemd...]
* [http://archive.fo/Bcqlz pm-utils (arch wiki)]

[[Category:Power Management]]
[[category: Desktop]]

Suspend on LID close

2019-11-09T07:27:56Z

Innsill:

This article explains how to make your laptop go to Suspend when closing the LID.

This can be done via <code>acpid</code> with a hook in {{path|/etc/acpi/LID/00000080}}:

'''a) with pm-utils:'''
{{cmd|apk add pm-utils}}
{{cat|/etc/acpi/LID/00000080|#!/bin/sh
exec pm-suspend
}}

'''b) with this raw variant:'''
{{cat|/etc/acpi/LID/00000080|#!/bin/sh
echo mem > /sys/power/state
}}

Make the hook executable:
{{cmd|chmod +x /etc/acpi/LID/00000080}}

And that should be it. Make sure that the acpid daemon is running:
{{cmd|/etc/init.d/acpid start}}

= =
* [https://unix.stackexchange.com/questions/484550/pm-suspend-vs-systemctl-suspend pm-suspend vs systemd...]

[[Category:Power Management]]
[[category: Desktop]]

User:Innsill/dwm-starter (x86-64)

2019-11-08T08:53:08Z

Innsill:

... ???

{{TOC right}}
'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''

= setup-alpine =
'''{{c| setup-alpine}}''' ...none, none, none,...

* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot


= setup-disk =
* BOOTLOADER=grub '''{{c| setup-disk /mnt}}'''
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
echo "ff ALL = (ALL) NOPASSWD: /usr/sbin/hdparm -Y /dev/sda" >> /etc/sudoers.d/ff

chmod 400 /etc/sudoers.d/ff

echo "sudo hdparm -Y /dev/sda" >> /home/ff/.profile

= X =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

User:Innsill/dwm-starter (x86-64)

2019-11-06T10:04:26Z

Innsill:

... ???

{{TOC right}}
'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''

= setup-alpine =
'''{{c| setup-alpine}}''' ...none, none, none,...

* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot


= setup-disk =
* BOOTLOADER=grub '''{{c| setup-disk /mnt}}'''
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

{{c| hdparm -Y /dev/sda}}

rc-update ...

= X =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

Kernels

2019-11-06T09:51:25Z

Innsill:

Alpine Linux has [//pkgs.alpinelinux.org/packages?name=linux-*&branch=edge several kernels] designed to suit different situations.

* [//git.alpinelinux.org/aports/tree/main/linux-vanilla linux-vanilla] is the stock modular kernel and is configured for a generous selection of hardware.
* linux-virt ([//git.alpinelinux.org/aports/tree/main/linux-vanilla linux-vanilla], see the -virt configs) is recommended for Alpine Linux guests, and disables most hardware in favor of a commonly-virtualized subset of drivers.
* [//git.alpinelinux.org/aports/tree/main/linux-rpi linux-rpi] is optimized for the Raspberry Pi.

For installing a custom kernel, see [[Custom Kernel]]. To select a specific kernel or firmware packages during installation from the Alpine ISO, simply install the desired kernel flavor and firmware packages with <code>apk add</code> before running <code>setup-alpine</code>.

== Firmware ==

The [//pkgs.alpinelinux.org/package/edge/main/x86/linux-firmware linux-firmware] meta-package is included in the [[Installation|default installation]], and depends on all firmware. This is a large download, and you may be better served by installing [//pkgs.alpinelinux.org/packages?name=linux-firmware-*&branch=edge only the firmwares you need], or [//pkgs.alpinelinux.org/package/edge/main/x86/linux-firmware-none linux-firmware-none] if you do not require any firmware. If you're unsure which firmware you need, boot up with no firmware installed and run <code>dmesg | grep firmware</code> to get an idea. Be aware that most firmware is nonfree.

[[category:Kernel]]

Category:Kernel

2019-11-06T09:37:27Z

Innsill: + category: Development

[[category: Development]]

Radeon Video

2019-11-05T09:03:56Z

Innsill: + link KMS

{{TOC right}}

The following instructions are for modern AMD GPU chipsets covered by the radeon driver.

== Setup Xorg/udev ==

# Run the <code>[[Alpine setup scripts#setup-xorg-base|setup-xorg-base]]</code> script.
# Install the Xorg AMD video drivers: {{Cmd|# apk add xf86-video-ati}}
# For newer devices, use: {{Cmd|# apk add xf86-video-amdgpu}}
# Enable [[#Kernel Modesetting (KMS)]]. Specifically, the <code>fbcon</code> module is necessary, or leaving Xorg (via <code>Ctrl+Alt+F1</code> or quitting) will result in a black screen until the machine is power cycled. If you have already launch Xorg and don't want to experience this effect, you can <code>modprobe fbcon</code> while Xorg is running.

== Kernel Modesetting (KMS) ==

To enable [[KMS]] at boot:
# Add the <code>radeon</code> and <code>fbcon</code> modules to {{Path|/etc/modules}}: {{Cmd|$ echo radeon >> /etc/modules $ echo fbcon >> /etc/modules}}
# Install <code>mkinitfs</code>: {{Cmd|apk add mkinitfs}}
# Enable the <code>kms</code> feature in the <code>mkinitfs</code> configuration by adding it to the <var>features</var> variable, e.g., {{cat|/etc/mkinitfs/mkinitfs.conf|features{{=}}"keymap cryptsetup kms ata base ide scsi usb virtio ext4"}}
# Run <code>mkinitfs</code>.
# Reboot to test the configuration.

== Troubleshooting ==
=== Fixing MESA-LOADER errors===
{{Obsolete|Alpine no longer ships with the ''linux-hardened'' kernel}}

The ''linux-hardened'' kernel package places restrictions on sysfs and will prevent the MESA-LOADER from working as a normal user even if added to the video group.

See https://bugs.alpinelinux.org/issues/7265

Either switch to the ''linux-vanilla'' package or apply the '''grsec_sysfs_restrict=0''' kernel parameter to allow normal users to access hardware acceleration on the desktop.

=== Fixing a frozen X11 when invoking startx ===

You may need to set the AccelMethod to exa not glamor which is the default for the driver.

{{cat|/etc/X11/xorg.conf|
Section "Device"
Option "AccelMethod" "exa"
Identifier "Card0"
Driver "radeon"
BusID "PCI:1:0:0"
EndSection}}

= =
* [https://wiki.archlinux.org/index.php/ATI archlinux.org / ATI]
* [https://wiki.archlinux.org/index.php/Xorg archlinux.org / Xorg]

[[Category:Drivers]]

KMS

2019-11-05T09:03:04Z

Innsill: Redirected page to Kernel Modesetting

#REDIRECT [[Kernel Modesetting]]

Kernel Modesetting

2019-11-05T09:01:57Z

Innsill: + link

{{Expand|Needs nVidia driver information}}

; Intel
: See [[Intel_Video#Kernel_Modesetting_(KMS)]]
; Radeon
: See [[Radeon_Video#Kernel_Modesetting_(KMS)]]
; nVidia
: {{Todo|Find out how KMS works with nVidia drivers}}

= =
* [https://wiki.archlinux.org/index.php/Kernel_mode_setting Kernel mode setting] archlinux.org

[[Category:Kernel]]

User:Innsill/dwm-starter (x86-64)

2019-11-04T09:41:48Z

Innsill:

... ???

'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot

* BOOTLOADER=grub setup-disk /mnt
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

{{c| hdparm -Y /dev/sda}}

= =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

User:Innsill/dwm-starter (x86-64)

2019-11-04T09:32:44Z

Innsill:

... ???

'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot

* BOOTLOADER=grub setup-disk /mnt
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
* {{c| X -configure}}
** {{c| vi xorg.conf.new}}

Section "Device"
Identifier "Card0"
Driver "[[amdgpu]]"
BusID "PCI:0:17:0"
EndSection

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

Amdgpu

2019-11-04T09:32:10Z

Innsill: Redirected page to Radeon Video

#REDIRECT [[Radeon Video]]

User:Innsill/dwm-starter (x86-64)

2019-11-03T08:04:19Z

Innsill:

... ???

'''[https://alpinelinux.org/downloads/ alpine-extended-3.10.3-x86_64.iso]'''
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot

* BOOTLOADER=grub setup-disk /mnt
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

User:Innsill/dwm-starter (x86-64)

2019-11-03T08:01:43Z

Innsill:

... ???
* alpine-extended-3.10.3-x86_64.iso
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot

* BOOTLOADER=grub setup-disk /mnt
* {{c| mount /dev/ /mnt/dev/ --bind}} {{c| mount -t proc none /mnt/proc}} {{c| mount -o bind /sys /mnt/sys}} chroot /mnt grub-install /dev/sda

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

Template:C

2019-11-03T07:44:21Z

Innsill: Created page with "<code>{{{1}}}</code><noinclude>category: abc-template</noinclude>"

<code>{{{1}}}</code><noinclude>[[category: abc-template]]</noinclude>

Radeon Video

2019-11-03T06:56:59Z

Innsill: + links

{{TOC right}}

The following instructions are for modern AMD GPU chipsets covered by the radeon driver.

== Setup Xorg/udev ==

# Run the <code>[[Alpine setup scripts#setup-xorg-base|setup-xorg-base]]</code> script.
# Install the Xorg AMD video drivers: {{Cmd|# apk add xf86-video-ati}}
# For newer devices, use: {{Cmd|# apk add xf86-video-amdgpu}}
# Enable [[#Kernel Modesetting (KMS)]]. Specifically, the <code>fbcon</code> module is necessary, or leaving Xorg (via <code>Ctrl+Alt+F1</code> or quitting) will result in a black screen until the machine is power cycled. If you have already launch Xorg and don't want to experience this effect, you can <code>modprobe fbcon</code> while Xorg is running.

== Kernel Modesetting (KMS) ==

To enable KMS at boot:
# Add the <code>radeon</code> and <code>fbcon</code> modules to {{Path|/etc/modules}}: {{Cmd|$ echo radeon >> /etc/modules $ echo fbcon >> /etc/modules}}
# Install <code>mkinitfs</code>: {{Cmd|apk add mkinitfs}}
# Enable the <code>kms</code> feature in the <code>mkinitfs</code> configuration by adding it to the <var>features</var> variable, e.g., {{cat|/etc/mkinitfs/mkinitfs.conf|features{{=}}"keymap cryptsetup kms ata base ide scsi usb virtio ext4"}}
# Run <code>mkinitfs</code>.
# Reboot to test the configuration.

== Troubleshooting ==
=== Fixing MESA-LOADER errors===
{{Obsolete|Alpine no longer ships with the ''linux-hardened'' kernel}}

The ''linux-hardened'' kernel package places restrictions on sysfs and will prevent the MESA-LOADER from working as a normal user even if added to the video group.

See https://bugs.alpinelinux.org/issues/7265

Either switch to the ''linux-vanilla'' package or apply the '''grsec_sysfs_restrict=0''' kernel parameter to allow normal users to access hardware acceleration on the desktop.

=== Fixing a frozen X11 when invoking startx ===

You may need to set the AccelMethod to exa not glamor which is the default for the driver.

{{cat|/etc/X11/xorg.conf|
Section "Device"
Option "AccelMethod" "exa"
Identifier "Card0"
Driver "radeon"
BusID "PCI:1:0:0"
EndSection}}

= =
* [https://wiki.archlinux.org/index.php/ATI archlinux.org / ATI]
* [https://wiki.archlinux.org/index.php/Xorg archlinux.org / Xorg]

[[Category:Drivers]]

Category:Drivers

2019-11-03T06:43:15Z

Innsill: + category: Installation

These pages contain information about drivers for video and other hardware.

[[category: Installation]]

Alpine Linux in a chroot

2019-11-03T06:40:23Z

Innsill: + category: System Administration

{{TOC right}}

Inside the chroot environment, you can build, debug, and run alpine packages or develop things. It's the most knowed way to do so if not wants to trash your main Alpine system.

This document explains how to set up an [[Alpine_newbie#Developer|Alpine build environment]] in a chroot under a host Linux distro, can also be used to install Alpine Linux from a non-Alpine Linux livecd.

== Requirements ==

* Working Linux instalation where to perform all the process
* Linux kernel 2.6.22, with <code>wget</code> and <code>chroot</code> installed
* target media with at least 100M, 900MB for more complete solution as minimum
* internet connection

== Prerequisites ==

The variables below:

*'''${chroot_dir}''' = Should point to the chroot directory where you
*'''${mirror}''' = Should be replaced with [http://nl.alpinelinux.org/alpine/MIRRORS.txt one of the available Alpine Linux mirrors].
*'''${arch}''' = Should be the cpu architecture like x86 (i386) or amd64(x86_64)..

== Set up APK ==

Download the latest apk static package (replace <tt>${version}</tt> with actual version):

{{Cmd|wget ${mirror}/latest-stable/main/${arch}/apk-tools-static-${version}.apk}}

.apk packages are just gzipped tarballs, unpack using:
{{Cmd|tar -xzf apk-tools-static-*.apk}}

== Install the alpine base installation onto the chroot ==

{{Cmd|./sbin/apk.static -X ${mirror}/latest-stable/main -U --allow-untrusted --root ${chroot_dir} --initdb add alpine-base}}

== Set up the chroot ==

Before made and enter into the chrooted system must be prepared with device nodes and tempfs :

===== Method 1.A fast way: using bind mount =====

{{Note|Mounts with bind, can mount in read-only the /dev at the alpine chroot so due limited will not touch the access time of the host system}}

{{Cmd|mount /dev/ /alpine/dev/ --bind
mount -o remount,ro,bind /alpine/dev
}}

If you need SCSI or R/W access only do the first command, mounting with "ro" makes more secure your chroot.

===== Method 1.B manual way: creating need nodes =====

{{Warning|Manually creating devices will only provide those representation that you have created.. for auto availability use bind mounts}}

{{Cmd|mknod -m 666 ${chroot_dir}/dev/full c 1 7
mknod -m 666 ${chroot_dir}/dev/ptmx c 5 2
mknod -m 644 ${chroot_dir}/dev/random c 1 8
mknod -m 644 ${chroot_dir}/dev/urandom c 1 9
mknod -m 666 ${chroot_dir}/dev/zero c 1 5
mknod -m 666 ${chroot_dir}/dev/tty c 5 0}}

If you need SCSI disc access:

{{Cmd|mknod -m 666 ${chroot_dir}/dev/sda b 8 0
mknod -m 666 ${chroot_dir}/dev/sda1 b 8 1
mknod -m 666 ${chroot_dir}/dev/sda2 b 8 2
mknod -m 666 ${chroot_dir}/dev/sda3 b 8 3
mknod -m 666 ${chroot_dir}/dev/sda4 b 8 4
mknod -m 666 ${chroot_dir}/dev/sda5 b 8 5
mknod -m 666 ${chroot_dir}/dev/sda6 b 8 6
mknod -m 666 ${chroot_dir}/dev/sdb b 8 16
mknod -m 666 ${chroot_dir}/dev/sdb1 b 8 17
mknod -m 666 ${chroot_dir}/dev/sdb2 b 8 18
mknod -m 666 ${chroot_dir}/dev/sdb3 b 8 19
mknod -m 666 ${chroot_dir}/dev/sdb4 b 8 20
mknod -m 666 ${chroot_dir}/dev/sdb5 b 8 21
mknod -m 666 ${chroot_dir}/dev/sdb6 b 8 22}}

==== Made available proc and sys fs ====

{{Cmd|mount -t proc none ${chroot_dir}/proc
mount -o bind /sys ${chroot_dir}/sys}}

==== Make networking resolution access ====

A resolv.conf is needed for name resolution:

{{Cmd|cp /etc/resolv.conf ${chroot_dir}/etc/
mkdir -p ${chroot_dir}/root}}

If you don't want to copy the resolv.conf from the local machine, you can create a new one using OpenDNS servers (or any other):
{{Cmd|echo -e 'nameserver 8.8.8.8\nnameserver 2620:0:ccc::2' > ${chroot_dir}/etc/resolv.conf}}

==== prepare the apk sources software ====

Set up APK mirror (replace <tt>${branch}</tt> with the latest stable branch name, e.g. v3.3):

{{Cmd|mkdir -p ${chroot_dir}/etc/apk
echo "${mirror}/${branch}/main" > ${chroot_dir}/etc/apk/repositories}}

== Entering your chroot ==

{{Warning|At this point, Alpine has been succesfully installed onto the chroot directory '''but still not able to boot it'''. }}

{{Cmd|chroot ${chroot_dir} /bin/bash -l}}

==== Perform init process ====

Need to add some minimal initscripts to appropriate runlevels:

{{Cmd|rc-update add devfs sysinit
rc-update add dmesg sysinit
rc-update add mdev sysinit

rc-update add hwclock boot
rc-update add modules boot
rc-update add sysctl boot
rc-update add hostname boot
rc-update add bootmisc boot
rc-update add syslog boot

rc-update add mount-ro shutdown
rc-update add killprocs shutdown
rc-update add savecache shutdown}}

= Troubleshooting =

== hardened kernels or alpine as chroot host ==

If you are using Alpine as a Native build system you will have to make sure that chroot can run chmod. Add following to <code>/etc/sysctl.conf</code>

<code>kernel.grsecurity.chroot_deny_chmod = 0</code>

Then run the following command

<code>sysctl -p</code>

== chroot: cannot run command ' ... Exec format error ==

This usually indicates that you booted with one architecture (e.g. armf) and are trying to chroot into another (e.g. x86_64). If you plans to make chroot into another installation must use same arch for both host and hosted chrooted!

Note that with '''one exception you can run 32 bit x86 chroot in x86_64, but not viceversa'''!

== WARNING: Ignoring APKINDEX.xxxx.tar.gz ==

Make sure <code>${chroot_dir}/etc/apk/repositories</code> is valid and inside the chroot run:

<code>apk update</code>

= External links =

* You can also use script [https://github.com/alpinelinux/alpine-chroot-install/ alpine-chroot-install]
* https://web.archive.org/web/20190808203313/https://isc.sans.edu/forums/diary/Forensic+use+of+mount+bind/22854/
* Alpine Linux in a chroot on Fedora : http://git.alpinelinux.org/cgit/user/fab/scripts/tree/alpine-chroot.sh script
* Alpine Linux aarch64 in a chroot on AWS Linux : https://gist.github.com/emolitor/0567e51c0ce04f4b025fc78d2cf0b4f1 script

[[Category:Installation]]
[[category: System Administration]]

User:Innsill/dwm-starter (x86-64)

2019-11-02T22:40:48Z

Innsill:

... ???
* alpine-extended-3.10.3-x86_64.iso
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -t btrfs -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot

* BOOTLOADER=grub setup-disk /mnt
*... chroot /mnt grub-install /dev/sda

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

User:Innsill/dwm-starter (x86-64)

2019-11-02T11:01:45Z

Innsill:

... ???
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L RC100 /dev/nvme0n1p2 mkfs.ext3 -L OLD_HDD /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot
* swapon /dev/sda1 swapon /dev/nvme0n1p1
* ./setup-disk /mnt
*...

= =
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, m.2, NVMe] gh.de
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCIe 3] gh.de
* [https://gh.de/asus-m4a78lt-m-90-mibbj0-g0eay00z-a495831.html ASUS M4A78LT-M PCIe 2]

User:Innsill/dwm-starter (x86-64)

2019-11-02T10:47:08Z

Innsill: Created page with "... ??? * lsblk * wipefs /dev/nvme0n1 * __________________________________________________ fdisk /dev/nvme0n1 ** '''o''' - clear out any partitions ** '''n''' *** '''p''..."

... ???
* lsblk
* wipefs /dev/nvme0n1
* __________________________________________________ fdisk /dev/nvme0n1
** '''o''' - clear out any partitions
** '''n'''
*** '''p''' - primary '''1''' - first partition on the drive +16G '''t''' - 82 Linux swap ...
** '''n''' ... '''enter''' - to accept the default ending sectors
** ...
* __________________________________________________ fdisk /dev/sda
** ... '''a''' - toggle a bootable flag ...
* __________________________________________________ mkfs.btrfs -L rc100 /dev/nvme0n1p2 mkfs.ext3 -L old_hdd /dev/sda2 wipefs /dev/nvme0n1p2 wipefs /dev/sda2
* __________________________________________________ mount -o compress /dev/nvme0n1p2 /mnt mkdir /mnt/boot mount /dev/sda2 /mnt/boot
* swapon /dev/sda1 swapon /dev/nvme0n1p1
* ./setup-disk /mnt
*...

= =
* [https://gh.de/delock-pci-express-x16-x4-x8-card-to-1x-nvme-m-2-key-m-for-server-90303-a1985030.html DeLOCK PCI.3 Express Card to NVMe M.2] gh.de
* [https://gh.de/toshiba-ocz-rc100-120gb-thn-rc10z1200g8-a1831493.html Toshiba OCZ RC100 120GB, M.2] gh.de

Setting up disks manually

2019-11-02T08:59:45Z

Innsill: + link

{{Draft|Some information on this page may be incomplete or outdate.}}

You may have complex needs that aren't handled automatically by the [[Alpine Setup Scripts]]. In those cases, you'll need to prepare your disks manually.

It is possible to have one or more of RAID, encryption, and/or LVM on your {{Path|/}} (root) volume. However, the Alpine init script only knows how to handle them when they're layered in that order, and your initram and extlinux.conf file in the {{Path|/boot}} partition are configured properly.

Your {{Path|/boot}} cannot reside on an encrypted or LVM volume, at least not with Alpine's default bootloader (extlinux). (Grub2 can deal with {{Path|/boot}} being on an LVM volume.) The usual practice is to create a small partition for {{Path|/boot}}, and then devote the rest of your disk to a separate partition on which you layer one or more of RAID, encryption, and/or LVM.

Sometimes {{Path|/boot}} is also setup as a mirrored (RAID1) volume, however this is just for post-init access. That way, when you write a new kernel or bootloader config file to {{Path|/boot}}, it gets written to multiple physical partitions. During the pre-init, bootloader phase, only one of those partitions will be read from.

So, typical setups might look like this:

<pre>
One-disk system
---------------
+------------------------------------------------+
| small partition (32--100M), holding |
| only /boot, filesystem needn't be journaled |
+------------------------------------------------+
| rest of disk in second partition |
| +------------------------------------------+ |
| | cryptsetup volume | |
| | +-------------------------------------+ | |
| | | LVM PV, containing single VG, | | |
| | | containing multiple LVs, holding | | |
| | | /, /home, swap, etc | | |
| | +-------------------------------------+ | |
| +------------------------------------------+ |
+------------------------------------------------+

Two-disk system
---------------
+------------------------------------------------+ +------------------------------------------------+
| small partition (32--100M), holding | | small partition (32--100M), holding | These 2 partitions might
| only /boot, filesystem needn't be journaled | | only /boot, filesystem needn't be journaled | form a mirrored (RAID1)
+------------------------------------------------+ +------------------------------------------------+ volume
| rest of disk in second partition | | rest of disk in second partition |
| T================================================================================================T | These 2 partitions form
| T +--------------------------------------------------------------------------------------------+ T | a second mirrored
| T | cryptsetup volume | T | (RAID1) volume
| T | +---------------------------------------------------------------------------------------+ | T |
| T | | LVM PV, containing single VG, | | T |
| T | | containing multiple LVs, holding | | T |
| T | | /, /home, swap, etc | | T |
| T | +---------------------------------------------------------------------------------------+ | T |
| T +--------------------------------------------------------------------------------------------+ T |
| T================================================================================================T |
| | | |
+------------------------------------------------+ +------------------------------------------------+

</pre>

In a three-disk system, the {{Path|/boot}} would still be RAID1, but the larger partition might in that case be RAID5.

=== RAID ===
<code>setup-disk</code> will automatically build a RAID array if you supply the '''-r''' switch, or if you specify more than one device.

If you instead want to build your RAID array manually, see [[Setting up a software RAID array]]. Then you can add additional layers of encryption and/or LVM, or just assemble the RAID array, and supply the {{Path|/dev/mdi}} device directly to [[setup-disk]]. When you're finished, be sure to disassemble the RAID array before rebooting.

If <code>setup-disk</code> sees that you're using RAID---either because you gave it the <code>-r</code> switch, or multiple devices, or a {{Path|/dev/mdi}} device---then it will setup your initramfs and extlinux.conf file properly. However, in other cases, such as when you're also using encryption, or you invoke <code>setup-disk</code> with a mounted directory argument, these might not be properly setup for RAID. In that case, you may need to manually edit/rebuild them. The following assumes that <code>$MNT</code> holds the root directory you're installing into:

{{Cmd|1=echo "/sbin/mdadm" > $MNT/etc/mkinitfs/files.d/raid
echo "/etc/mdadm.conf" >> $MNT/etc/mkinitfs/files.d/raid
# edit $MNT/etc/mkinitfs/mkinitfs.conf to make sure features="..."
# includes raid (this field is space-separated and quoted)
mkinitfs -c $MNT/etc/mkinitfs/mkinitfs.conf -b $MNT
# edit $MNT/etc/update-extlinux.conf to make sure modules=... contains
# raid1 or raid456 (whichever your / is on; this field is comma-separated)
# also check the root= setting
extlinux --raid --install $MNT/boot --update
}}

{{Todo|Does adding the <code>--update</code> option to <code>extlinux ...</code> suffice to make {{Path|/boot/extlinux.conf}} be regenerated? Or do we need to manually tweak that file, or run <code>update-extlinux</code>, as well?}}

You might also need to manually tweak {{Path|$MNT/etc/fstab}}. And you might need to copy {{Path|/usr/share/syslinux/mbr.bin}} to your disk's MBR.

=== Encryption ===

See [[Setting up encrypted volumes with LUKS]]. Then you can add an additional layer of LVM, or just unlock the volume you've created (using <code>cryptsetup luksOpen ...</code>), and supply the {{Path|/dev/mapper/something}} device directly to [[setup-disk]]. When you're finished, be sure to relock the volume (using <code>cryptsetup luksClose ...</code>) before rebooting.

If you install your {{Path|/}} (root) on an encrypted volume, you'll need to manually edit/rebuild your initram and your extlinux.conf file. The following assumes that <code>$MNT</code> holds the root directory you're installing into, that you've created the cryptvolume on the device {{Path|/dev/md2}}, and that you want to unlock the encrypted volume into a virtual volume named "crypt":

{{Cmd|1=# edit $MNT/etc/mkinitfs/mkinitfs.conf to make sure features="..."
# includes cryptsetup (this field is space-separated and quoted)
mkinitfs -c $MNT/etc/mkinitfs/mkinitfs.conf -b $MNT
# edit $MNT/etc/update-extlinux.conf to make sure default_kernel_opts="..."
# contains cryptroot=/dev/md1 and cryptdm=crypt (this field is also space-separated and quoted)
# also check the root= setting
extlinux --install $MNT/boot --update
}}

{{Todo|Does adding the <code>--update</code> option to <code>extlinux ...</code> suffice to make {{Path|/boot/extlinux.conf}} be regenerated? Or do we need to manually tweak that file, or run <code>update-extlinux</code>, as well?}}

You might also need to manually tweak {{Path|$MNT/etc/fstab}}.

=== LVM ===
<code>setup-disk</code> will automatically build and use volumes in a LVM group if you supply the '''-L''' switch.

If you instead want to build your LVM system manually, see [[Setting up Logical Volumes with LVM]]. Then <code>vgchange -ay</code>, format and mount your volumes, and supply the root mountpoint to [[setup-disk]]. When you're finished, be sure to
{{Cmd|umount ...
vgchange -an}}
before rebooting.

If <code>setup-disk</code> sees that you're using LVM---perhaps because you gave it the <code>-L</code> switch---then it will setup your initram and extlinux.conf file properly. However, in other cases, these might not be properly setup. In that case, you may need to manually edit/rebuild them. The following assumes that <code>$MNT</code> holds the root directory you're installing into:

{{Cmd|1=# edit $MNT/etc/mkinitfs/mkinitfs.conf to make sure features="..."
# includes lvm (this field is space-separated and quoted)
mkinitfs -c $MNT/etc/mkinitfs/mkinitfs.conf -b $MNT
# edit $MNT/etc/update-extlinux.conf to make sure root= is set correctly
extlinux --install $MNT/boot --update
}}

{{Todo|Does adding the <code>--update</code> option to <code>extlinux ...</code> suffice to make {{Path|/boot/extlinux.conf}} be regenerated? Or do we need to manually tweak that file, or run <code>update-extlinux</code>, as well?}}

You might also need to manually tweak {{Path|$MNT/etc/fstab}}.

=== Custom partitioning ===
<code>setup-disk</code> will by default set up a root parition, a separate /boot partition and a swap. If you want a different layout you can manually create the parititions, filesystems and mount them up on {{Path|/mnt}} (or any other mount point) and then run:

{{Cmd|setup-disk /mnt}}

<code>setup-disk</code> will install your running system on the mounted root, detect your file system layout and generate a fstab. You are responsible for making the proper partition bootable and make sure the MBR is ok for extlinux.

See also [https://github.com/itoffshore/alpine-linux-scripts setup-partitions]

=== Dual-booting ===
See [[Installing Alpine on HDD dualbooting|Install to HDD with dual-boot]]

=== Other needs ===
* [[Installing Alpine Linux in a chroot]]
* [[Replacing non-Alpine Linux with Alpine remotely]]





== Setting up swap ==

# create partition with type "linux swap" (82) (If you're going to use an LVM logical volume for swap, skip this step and <code>lvcreate</code> that instead.)
# <code>mkswap /dev/sda2</code>
# <code>echo -e "/dev/sda2 none swap sw 0 0" >> /mnt/etc/fstab</code>
# <code>swapon /dev/sda2</code> (or <code>rc-service swap start</code>)

Then {{Cmd|free -m}} will show how much swap space is available (in MB).

If you prefer maximum speed, you don't need configure any raid devices for swap. Just add 2 swap partitions on different disks and linux will stripe them automatically. The downside is that at the moment one disk fails, the system will go down. For better reliability, put swap on RAID1.

{{Todo|Instructions for cryptswap?}}

= =
* [https://beta.docs.alpinelinux.org/user-handbook/0.1a/Installing/manual.html#_finalizing beta.docs.alpinelinux.org] ''([http://archive.md/2KQPQ archive])''

[[Category:Installation]]
[[Category:Storage]]

Alpine Package Keeper

2019-11-01T14:55:15Z

Innsill: + link Vivek Gite

{{TOC right}}

Because Alpine Linux is designed to run from RAM, package management involves two phases:
* Installing / Upgrading / Deleting packages on a running system.
* Restoring a system to a previously configured state (e.g. after reboot), including all previously installed packages and locally modified configuration files. '''(RAM-Based Installs Only)'''
 
'''apk''' is the tool used to install, upgrade, or delete software on a running system. 
'''lbu''' is the tool used to capture the data necessary to restore a system to a previously configured state.

This page documents the [https://git.alpinelinux.org/apk-tools/ apk tool] - See the [[Alpine_local_backup|Alpine Local Backup page]] for the lbu tool.

= Overview =

The '''apk''' tool has the following applets:

{|
| [[#Add a Package|add]]
| Add new packages or upgrade packages to the running system
|-
| [[#Remove a Package|del]]
| Delete packages from the running system
|-
| fix
| Attempt to repair or upgrade an installed package
|-
| [[#Update the Package list|update]]
| Update the index of available packages
|-
| [[#Info on Packages|info]]
| Prints information about installed or available packages
|-
| [[#Search for Packages|search]]
| Search for packages or descriptions with wildcard patterns
|-
| [[#Upgrade a Running System|upgrade]]
| Upgrade the currently installed packages
|-
| [[#Cache Maintenance|cache]]
| Maintenance operations for locally cached package repository
|-
| version
| Compare version differences between installed and available packages
|-
| index
| create a repository index from a list of packages
|-
| fetch
| download (but not install) packages
|-
| audit
| List changes to the file system from pristine package install state
|-
| verify
| Verify a package signature
|-
| dot
| Create a [http://graphviz.org/ graphviz] graph description for a given package
|-
| [[#apk_policy|policy]]
| Display the repository that updates a given package, plus repositories that also offer the package
|-
| stats
| Display statistics, including number of packages installed and available, number of directories and files, etc.
|-
| manifest
| Display checksums for files contained in a given package
|}

= Packages and Repositories =

Software packages for Alpine Linux are digitally signed tar.gz archives containing programs, configuration files, and dependency metadata. They have the extension <code>.apk</code>, and are often called "a-packs".

The packages are stored in one or more ''repositories''. A repository is simply a directory with a collection of *.apk files. The directory must include a special index file, named {{Path|APKINDEX.tar.gz}} to be considered a repository.

The '''apk''' utility can install packages from multiple repositories. The list of repositories to check is stored in {{Path|/etc/apk/repositories}}, one repository per line. If you booted from a USB stick ({{Path|/media/sda1}}) or CD-ROM ({{Path|/media/cdrom}}), your repository file probably looks something like this:

{{Cat|/etc/apk/repositories|/media/sda1/apks/}}

In addition to local repositories, the '''apk''' utility uses '''busybox wget''' to fetch packages using ''http:'', ''https:'' or ''ftp:'' protocols. The following is a valid repository file:

{{Cat|/etc/apk/repositories|
/media/sda1/apks
http://dl-3.alpinelinux.org/alpine/v2.6/main
https://dl-3.alpinelinux.org/alpine/v2.6/main
ftp://dl-3.alpinelinux.org/alpine/v2.6/main
}}

{{Note| A list of public repositories is in [https://git.alpinelinux.org/cgit/aports/tree/main/alpine-mirrors/mirrors.yaml mirrors.yaml] in the alpine-mirrors git repository. Accepted protocols vary.}}

== Repository pinning ==

You can specify additional "tagged" repositories in {{Path|/etc/apk/repositories}}:

{{Cat|/etc/apk/repositories|
http://nl.alpinelinux.org/alpine/v3.7/main
http://nl.alpinelinux.org/alpine/v3.7/community
@edge http://nl.alpinelinux.org/alpine/edge/main
@edgecommunity http://nl.alpinelinux.org/alpine/edge/community
@testing http://nl.alpinelinux.org/alpine/edge/testing
}}

After which you can "pin" dependencies to these tags using:

{{cmd|apk add stableapp newapp@edge bleedingapp@testing}}

Apk will now by default only use the untagged repositories, but adding a tag to specific package:

1. will prefer the repository with that tag for the named package, even if a later version of the package is available in another repository

2. ''allows'' pulling in dependencies for the tagged package from the tagged repository (though it ''prefers'' to use untagged repositories to satisfy dependencies if possible)

== Commandline repository options ==

By default, the '''apk''' utility will use the system repositories for all operations. This behavior can be overridden by the following options:

{|
| --repositories-file REPOFILE
| Override the system repositories by specifying a repositories file.
|-
| <nowiki>-X|--repository REPO</nowiki>
| Specify a supplemental repository that will be used in addition to the system repositories. This option can be provided multiple times.
|}

= Update the Package list =

Remote repositories change as packages are added and upgraded. To get the latest list of available packages, use the ''update'' command. The command downloads the {{Path|APKINDEX.tar.gz}} from each repository and stores it in the local cache, typically {{Path|/var/cache/apk/}}, {{Path|/var/lib/apk/}} or {{Path|/etc/apk/cache/}}.

{{Cmd|apk update}}



{{Tip|If using remote repositories, it is a good idea to do an '''update''' just before doing an '''add''' or '''upgrade''' command. That way you know you are using the latest software available.}}

= Add a Package =

Use '''add''' to install packages from a repository. Any necessary dependencies are also installed. If you have multiple repositories, the '''add''' command installs the newest package.

{{Cmd|apk add openssh
apk add openssh openntp vim}}

If you only have the main repository enabled in your configuration, apk will not include packages from the other repositories. To install a package from the edge/testing repository without changing your repository configuration file, use the command below. This will tell apk to use that particular repository.

{{cmd|apk add cherokee --update-cache --repository http://dl-3.alpinelinux.org/alpine/edge/testing/ --allow-untrusted}}

{{Note|Be careful when using third-party or the testing repository. Your system can go down.}}

= Add a local Package =

To install a locally available apk package, for example if this device has no internet access but you can upload apk packages directly to it, use the '''--allow-untrusted''' flag:

{{cmd|apk add --allow-untrusted /path/to/file.apk}}

Note that multiple packages can be given. When installing a local package, all dependencies should also be specified. For example:

{{cmd|apk add --allow-untrusted /var/tig-2.2-r0.apk /var/git-2.11.1-20.apk}}

= Remove a Package =
Use '''del''' to remove a package (and dependencies that are no longer needed.)

{{cmd|apk del openssh
apk del openssh openntp vim}}

= Upgrade a Running System =

To upgrade ''all'' the packages of a running system, use '''upgrade''':

{{cmd|apk update
apk upgrade
}}

For example, the procedure on a system that has various [https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management#Repository_pinning repositories pinned] might display as follows:

# apk update
fetch http://dl-3.alpinelinux.org/alpine/v3.6/main/x86_64/APKINDEX.tar.gz
fetch http://dl-3.alpinelinux.org/alpine/v3.6/community/x86_64/APKINDEX.tar.gz
fetch http://dl-3.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
fetch http://dl-3.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
fetch http://dl-3.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz
v3.6.2-191-gf98d79930f [http://dl-3.alpinelinux.org/alpine/v3.6/main]
v3.6.2-190-ga5d68c47df [http://dl-3.alpinelinux.org/alpine/v3.6/community]
v3.6.0-4618-g0bf77c9821 [http://dl-3.alpinelinux.org/alpine/edge/main]
v3.6.0-4605-g85ed51dd83 [http://dl-3.alpinelinux.org/alpine/edge/community]
v3.6.0-4624-g11f1b9c8ab [http://dl-3.alpinelinux.org/alpine/edge/testing]
OK: 20118 distinct packages available

# apk upgrade
(1/2) Upgrading extra-cmake-modules@testing (5.38.0-r0 -> 5.39.0-r0)
(2/2) Upgrading extra-cmake-modules-doc@testing (5.38.0-r0 -> 5.39.0-r0)
Executing mdocml-apropos-1.14.1-r0.trigger
OK: 2635 MiB in 803 packages

To upgrade ''only a few'' packages, use the '''add''' command with the ''-u'' or ''--upgrade'' option:

{{cmd|apk update
apk add --upgrade busybox
}}

{{Note|Remember that when you reboot your machine, the remote repository will not be available until after networking is started. This means packages newer than your local boot media will likely not be installed after a reboot. To make an "upgrade" persist over a reboot, use a [[#Local Cache|local cache]].}}

= Search for Packages =
The '''search''' command searches the repository Index files for installable packages.

The return format is '''Package'''-'''Version'''. Omit '''Version''' for ''apk add '''Package'''''

Examples:
* To list all packages available, along with their descriptions: {{cmd|apk search -v}}
* To list all packages are part of the ACF system: {{cmd|apk search -v 'acf*' }}
* To list all packages that list NTP as part of their description, use the ''-d'' or ''--description'' option: {{cmd|apk search -v --description 'NTP' }}

= Information on Packages =

== apk info ==

The '''info''' command provides information on the contents of packages, their dependencies, and which files belong to a package.

For a given package, each element can be chosen (for example, ''-w'' to show just the webpage information), or all information displayed with the ''-a'' command.

Example: {{cmd|apk info -a zlib}}

'''zlib-1.2.5-r1 description:'''
A compression/decompression Library

'''zlib-1.2.5-r1 webpage:'''
<nowiki>http://zlib.net</nowiki>

'''zlib-1.2.5-r1 installed size:'''
94208

'''zlib-1.2.5-r1 depends on:'''
libc0.9.32

'''zlib-1.2.5-r1 is required by:'''
libcrypto1.0-1.0.0-r0
apk-tools-2.0.2-r4
openssh-client-5.4_p1-r2
openssh-5.4_p1-r2
libssl1.0-1.0.0-r0
freeswitch-1.0.6-r6
atop-1.25-r0

'''zlib-1.2.5-r1 contains:'''
lib/libz.so.1.2.5
lib/libz.so.1
lib/libz.so

'''zlib-1.2.5-r1 triggers:'''

As shown in the example you can determine
* The '''description''' of the package (''-d'' or ''--description'')
* The '''webpage''' where the application is hosted (''-w'' or ''--webpage'')
* The '''size''' the package will require once installed (in bytes) (''-s'' or ''--size'')
* What packages are required to use this one ('''depends''') (''-R'' or ''--depends'')
* What packages require this one to be installed ('''required by''') (''-r'' or ''--rdepends'')
* The '''contents''' of the package, that is, which files it installs (''-L'' or ''--contents'')
* Any '''triggers''' this package sets. (''-t'' or ''--triggers'') Listed here are directories that are watched; if a change happens to the directory, then the trigger script is run at the end of the apk add/delete. For example, doing a depmod once after installing all packages that add kernel modules.

{{Tip|The '''info''' command is also useful to determine which package a file belongs to. For example: {{cmd|apk info --who-owns /sbin/lbu}} will display

/sbin/lbu is owned by alpine-conf-x.x-rx
}}

=== Listing installed packages ===

To list all installed packages, use:

<pre>apk info</pre>

To list all installed packages in alphabetical order, with a description of each, do:

<pre>apk -vv info|sort</pre>

== apk policy ==

To display the repository a package was installed from and will be updated from, plus any [https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management#Repository_pinning tagged] or enabled repositories where it is also offered, if any, for this architecture - its '''policy''':

apk policy ''package''

For example:
<pre>
$ apk policy vlc
vlc policy:
2.2.6-r1:
lib/apk/db/installed
http://dl-3.alpinelinux.org/alpine/v3.7/community
3.0.0_rc2-r1:
@edgecommunity http://dl-3.alpinelinux.org/alpine/edge/community
</pre>

= Additional apk Commands =
In progress...

= Local Cache =

{{:Local_APK_cache}}

= Advanced APK Usage =

== Holding a specific package back ==

In certain cases, you may want to upgrade a system, but keep a specific package at a back level. It is possible to add "sticky" or versioned dependencies. For instance, to hold the ''asterisk'' package to the 1.6.2 level or lower:
{{cmd|1=apk add asterisk=1.6.0.21-r0}}
or
{{cmd|apk add 'asterisk<1.6.1'}}

after which a {{cmd|apk upgrade}}

will upgrade the entire system, keeping the asterisk package at the 1.6.0 or lower level

To later upgrade to the current version,

{{cmd|apk add 'asterisk>1.6.1'}}

will ensure that 1.6.1 is the minimum version used.

You can also use "fuzzy" version matching to pin the version to a major/minor release. For example:

{{cmd|1=apk add 'asterisk=~1.6'}}

will match any version of asterisk that starts with 1.6 (such as 1.6.0.21-r0 or 1.6.9.31-r9) <ref>[https://git.alpinelinux.org/apk-tools/commit/?id=693b4bcdb0f22904a521a7c8ac4f13e697dc4d71 Alpine source commit message]</ref>

= Troubleshooting =

== "apk-tools is old" ==

'''apk update''', '''apk upgrade''' or '''apk add''' may report the following:
WARNING: This apk-tools is OLD! Some packages might not function properly

This may happen if you are running Alpine Linux stable version with a certain edge/main, edge/community or testing package(s) also installed. One resolution is to consider upgrading {{pkg|apk-tools}}. If edge is already [https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management#Repository_pinning tagged] in your repositories, then try:

<pre>sudo apk add --upgrade apk-tools@edge</pre>

= =
* [https://www.cyberciti.biz/faq/10-alpine-linux-apk-command-examples/ 10 Alpine Linux apk Command Examples] Vivek Gite 2019

[[Category:Package Manager]]

Firefox

2019-11-01T13:25:19Z

Innsill: + link

Firefox is a popular,open-source [https://en.wikipedia.org/wiki/Web_browser web browser].

==Installation==
To install Firefox, firstly enable the [[Enable_Community_Repository|Community repository]], then type in the terminal:

{{Cmd|apk add firefox-esr}}
{{Tip|To play flash videos and games in Firefox, check [[Installing_Adobe_flash_player_for_Firefox|Installing Adobe flash player for Firefox]] page.}}

== Stability ==

If [https://support.mozilla.org/en-US/questions/1175046 tabs crash], then try disabling hardware acceleration, in the Preferences - Performance menu.

= =
* [https://pkgs.alpinelinux.org/contents?file=firefox pkgs.alpinelinux.org]
* [https://git.alpinelinux.org/aports/log/?id=05e5fbf809000e016eee3fdfdaffb6e39a4956fd&qt=grep&q=firefox git.alpinelinux.org] - git repositories for alpine
* [https://stackoverflow.com/questions/51806403/installation-of-firefox-from-alpine-edge Installation of Firefox from Alpine Edge]

[[category: Web Browser]]

Enable Community Repository

2019-11-01T13:01:19Z

Innsill: + link

Starting with Alpine Linux version 3.3, there is a new repository called '''community'''. Many packages have been moved from the main repository to community to indicate that they are not guaranteed to be supported beyond six months. If you are using any of these packages, be sure to add the community repository.

Edit the {{Path|/etc/apk/repositories}} file using an editor ({{Pkg|nano}} for instance) and add (or uncomment) a line like:

'''http://dl-cdn.alpinelinux.org/alpine/edge/community'''

After adding the community repository, obtain the latest index of available packages:
{{Cmd|apk update}}

{{Tip|Adding the <code>-U</code>/<code>--update-cache</code> to another apk command, as in <code>apk add -U ...</code> or <code>apk upgrade -U</code>, has the same effect as running <code>apk update</code> before the other apk command.}}

= =
* [https://superuser.com/questions/1055060/how-to-install-a-specific-package-version-in-alpine How to install a specific package version in Alpine?]

[[Category:Package Manager]]

Setting up a laptop

2019-11-01T07:53:37Z

Innsill: + category: desktop

{{Draft}}

This guide is about a project to create a '''secured laptop'''. For this project we take in consideration ways to extend battery life. It covers tools and daemons that are must haves for a laptop setup.

== Guide features ==

*Deniable full disk encryption
*Two factor authentication (physical object (USB key), mind)
*Encrypted swap and hibernation
*Encrypted home on top of encrypted drive
*Memory sanitation
*Dynamic power modes
*Feature keys support

== Rubberhose Attack ==

Just a reminder that all attacks are subjected to the Rubberhose Attack dilemma, you either give up your encryption keys or be tortured with a rubberhose with the possibly of death. See [https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis Wikipedia article]. We try to present [https://en.wikipedia.org/wiki/Deniable_encryption deniable encryption (Wikipedia)] to avoid a rubberhose attack scenario. In this article we use the words plausible deniability interchangeably with deniable encryption. To achieve this we use a facade and require no metadata fingerprints to expose or hint of encrypted or hidden containers or hint as in detect of existence of an encrypted disk. The keys should be stored using steganography where we dilute the randomness into the facade. It also requires you not to brag about encryption or mention it because that is an invitation for the attacker to torture the victim. Deniable encryption requires you not put encrypted as an entry title to your bootloader. There shouldn't be an entry for your facade bootloader to the encrypted drive.

== Why full disk? ==

The full disk encryption provides sort of some plausible deniability or a valid alibi that you didn't encrypt it. Is the drive just random noise, broken, or is it really encrypted? The other reason is that it implies that everything is protected.

But there could be problems if not done right. For example, cryptsetup does leave a plaintext marking or some hints by default that it has been encrypted when using luks/luks2 mode if a detached header with option <code>--header <path></code> is not presented.[https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/][http://man7.org/linux/man-pages/man8/cryptsetup.8.html] To gain credibility that we didn't really do the encryption, you have to wipe the +3 MiB region based on the number of key slots used; or store the headers on an external device.

If you did deniable encryption incorrectly, it is possible to erase and restore the header. This presents an opportunity to improve obfuscation. When you pull out the USB key, it should erase the header but store it on the USB key atomically as in completely. If you plug in the USB key, it will restore back the header. cryptsetup has luks actions luksHeaderBackup and luksHeaderRestore to do this.

== Starting at the beginning ==

Grab a USB thumb drive with Alpine. Set it up as usual but don't let it touch your drive yet. Then, install all the tools into memory ramdisk but not in the hard drive yet. The hard drive will be obliterated.

You will then install Alpine using the steps:

First you need WiFi, to get it run do the command below but say no or skip the hard drive setup stuff:

setup-alpine

Then, you need to install some tools into RAM temporarly:
apk add e2fsprogs grub grub-bios grub-efi mkinitfs nano

== Randomizing the drive with pseudorandom urandom entropy ==

The first part is to erase the drive with random noise but in practical time. There are many techniques to do this but should be done in one day or two minimum.

You can use shred or dd to accomplish this depending on your needs and the availability of entropy. Some techniques take longer. Cryptologist Bruce Schneier recommended 7 times with specified pattern. See [https://en.wikipedia.org/wiki/Data_erasure Wikipedia Article]. For practical purposes, we just do it random in one pass. It should be random so that the facade of random noise hides the encrypted data which resembles noise.

To list the drives on the system do <code>fdisk -l</code>.

'''IMPORTANT: make sure you wipe the right specific drive.'''

To wipe the disk with random entropy do:

dd if=/dev/urandom of=/dev/sda

== Creating GPG keys ==

'''As of this time, Alpine's mkinitfs does only one factor authentication with passphrase.''' You need to manually edit the initramfs-init.in in mkinitfs to support two factor authentication using cryptsetup.

After you have scrambled the drive, you want to create your GPG keys. You will use these keys to set the password(s) for your cryptsetup-luks partitions. These keys should be stored on a USB thumb drive or other memory device but should not be on the USB boot thumb drive or on the encrypted drive. The key should be a random 128 bit key wrapped in GPG and protected with a password.

If you are using x, you need to do <code>sudo apk add pinentry-gtk</code> to display password prompt properly for the next step.

To install openssl and gpg do:

apk add openssl gnupg

Then, to generate a key:

openssl rand -base64 128 | gpg --symmetric --cipher-algo aes --armor > /mnt/usb/2a667ec72774b0d5

(Make sure your usb is mounted on /mnt/usb first.)

The long file name comes from <code>openssl rand 8 -hex</code> so that we enhance plausible deniability. The attacker cannot determine the purpose of the key. Is it used for GitHub? for Email?

The first part will produce 128 random bytes in wrap it in base64. The random data will be piped to gpg which will wrap it in AES as ciphertext which again gets wrapped in base64 ascii armor. For every partition including swap in some cases, you should create more gpg keys and store them in your USB thumb drives. After you have produced your gpg keys, you will then use them as a password for cryptsetup/luks.

You can replace aes above with the ones listed in <code>gpg --version</code>.

There should be a password generated for the swap. This is to resume for your hibernate. If you don't want to hibernate, then password is not required and all you need to do is to create/format the partition each time you boot without a password or with a one time random password.

== Hiding the keys using steganography ==

''WARNING:'' This section is considered experimental. It requires the tool and the dependencies to be placed on another USB separate from the key files, the bootloaders, and encrypted disks. The tool and dependencies need to be packaged together. We decentralize these components so that the attacker doesn't connect the dots easily or immediately jumps to the conclusion for the requirements to decrypt. Steghide automatically uses 128-bit AES in CBC mode to encrypt data. This can be change if you don't like or trust AES with the -e option. Use <code>steghide encinfo</code> for other ciphers and modes.

Fortunately, Alpine has a package for steganography called steghide. To install steghide do:

apk add steghide

You will place the keyfile in an image file. The facade image file should be large enough that there is no apparent discernible difference between the original and the modified. Do not use a small image with a small filesize.

As mentioned previously luks headers could be 3MB large or more and an jpeg image file is not suitable. Use another format like .au/.wav or another steganography utility that handles mp3s. The mp3/wav should be fairly large enough to dilute the header. So, something with long content is suitable.

There are two basic commands to use with steghide embed and extract,

To embed do:

steghide embed -ef key.gpg -cf image.jpg

To extract do:

steghide extract -xf key.gpg -sf image.jpg

To get a file list of files to ship out, use:

apk info -L libgcc libmcrypt libmhash libstdc++ libjpeg-turbo steghide

== Full disk encryption with with cryptsetup-luks volumes ==

=== Partitioning scheme ===

This section presents a conceptual layout. It should not be a knee-jerk approval to automatically use the partition tool which would compromise your plausible deniability.

For the facade, we use an Ubuntu Live CD (or less skilled distro) to present the impression that we are not sophisticated or tech savvy enough to implement encryption. Windows is also acceptable even better. The immutable Live CD and immutable partition ensures that you are not compromised by a third party attacker that implants evidence.

There could be possibly two bootloaders, one for the facade and the other to the encrypted drive stored on an external device.

==== Luks ====

Plausible deniability only works if you can demonstrate no existence of partitions 2, 3, 4 and no fingerprints/plaintext introduced by cfdisk and cryptsetup-luks. Use something like TestDisk, fdisk -l, or gparted and a disk editor (hex editor for disks).

{| cellpadding="5" border="1" class="wikitable"
!#
!Name
!Mount point
!Notes
|-
| 1
| facade
| /
| (optional) The facade partition contains a pristine normal operating system or Ubuntu Live CD image to lure the attacker in attempt to boost the confidence of the attacker convincing them that there is no encryption on the device.
|-
| 2
| swap
|
| It should be the same size as your ram for x86_64. Rationale: it should contain the whole ram image.
|-
| 3
| root
| /
|
|-
| 4
| rescue
| /
| This should contain the Alpine image.
|-
|}

==== Plain dm-crypt ====

Plausible deniability only works if you are able to present #2 as being unused space or untampered. To check use something like TestDisk, gparted and a disk editor (hex editor for disks).

{| cellpadding="5" border="1" class="wikitable"
!#
!Name
!Mount point
!Notes
|-
| 1
| facade
| /
| (optional) The facade partition contains a pristine normal operating system or Ubuntu Live CD image to lure the attacker in attempt to boost the confidence of the attacker convincing them that there is no encryption on the device.
|-
| 2
| vgroot
|
|
|-
| 2_1
| vgroot-root
| /
|
|-
| 2_2
| vgroot-swap
|
| It should be the same size as your ram for x86_64. Rationale: it should contain the whole ram image.
|-
| 2_3
| vgroot-rescue
| /
| This should contain the Alpine image.
|-
|}

=== Installing cryptsetup ===

To install cryptsetup you need the package below

apk add cryptsetup

=== Choosing ciphers ===

When you create your luks drives, you need to decide on the type of ciphers and hashing techniques to use. The ciphers that you want to use are ones are up to you, but it should be one that is hasn't been cracked yet or has not suffered a lot of cryptanalysis attacks. The ones that you might want to use is AES which is hardware accelerated in some Intel CPUs that have the AES-NI cpuflag which you can check by <code>cat /proc/cpuinfo</code>. Also consider the ciphers that are SIMD optimized such as serpent and twofish that are available in the Linux kernel. Also consider ciphers that are unpopular but known to be secure such as Blowfish (which Wikipedia claims to be attacked and the author recommended Twofish).[https://en.wikipedia.org/wiki/Cipher_security_summary] If it is hardware accelerated, it will save battery life and minimize CPU usage.

For some ciphers weakness also see [https://en.wikipedia.org/wiki/Cipher_security_summary Cipher security summary (Wikipedia)].

For some hash function weaknesses also see [https://en.wikipedia.org/wiki/Hash_function_security_summary Hash function security summary (Wikipedia)].

Generally speaking, the swap partition should use a fast cipher. You want to lower the latency or delay of the memory subsystem as a consequence of being encrypted.

'''IMPORTANT:''' Please read the [[Setting_up_a_laptop#Important_notes | Important notes]] section for details about the problems with AES encryption.

If you don't trust AES shills and endorsed by the NSA, you can try another different one. Another advantage of using a public vetted cipher is that it provides confidence that it works.

Something like KHAZAD wouldn't work on <code>cryptsetup benchmark</code>. KHAZAD itself is insecure. Wikipedia reported 5 out of 8 rounds been cracked.[https://en.wikipedia.org/wiki/KHAZAD]

For AES-128 7 out of 10, AES-192 8 out of 12, AES-256-bit 9 out 14 rounds have been cracked according to Wikipedia.[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard]

'''IMPORTANT: Do not use sha1 as the hashing algorithm.''' It already has already been compromised.

=== Getting the available ciphers ===

To check the availability of a cipher or hash function use:
find $(find /lib/modules -name "crypto" -type d) -type f -name "*.ko" | sort

To check if a cipher is loaded and passed its own tests use:
cat /proc/crypto

To test some popular ciphers and hashes do:

cryptsetup benchmark

The top set is associated with the hashing algorithms. The bottom set are the ciphers. Use the commands below but replace the cipher and/or hash algorithm with your preferences.

<code>cryptsetup benchmark</code> actually doesn't show all the ciphers like Anubis. The cipher should also have CBC and/or XTS block cipher mode of operation to encrypt larger block sizes. AES for example has a block size of 128.

To test if the unpopular but uncracked cipher works use sometime like:
cryptsetup benchmark --cipher anubis

=== General steps for cryptsetup ===

==== Original method with fdisk with no plausible deniability ====

In this method <code>--type luks</code> is implied which generates metadata.

If you want plausible deniability for luks, you need to pass <code>--header <path></code> to all the luks commands, where <code><path></code> is a unix path like /mnt/usb/d6ae10eda66704c8. The random name comes from <code>openssl rand -hex 8</code>. The header is transferred to the external device (but no mention of the key slot area but ciphertext being transferred) in the man page. The information in that file should be obfuscated with encryption if there is plaintext or fingerprint in it just in case. Then, it should be decrypted when reused.

You need to install cfdisk if you prefer the interactive ncurses console method:

apk add cfdisk

{|| cellpadding="5" border="1" class="wikitable"
!#
!Step
!Command
|-
| 1
| Use cfdisk to create partitions. Make two partitions--a system partition and a swap partition
| <code><nowiki>cfdisk</nowiki></code>
|-
| 2
| Create and format the luks device
| <code><nowiki>cryptsetup --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/sda1 /mnt/usb/2a667ec72774b0d5</nowiki></code>
|-
| 3
| Open the luks device
| <code><nowiki>cryptsetup --key-file /mnt/usb/2a667ec72774b0d5 luksOpen /dev/sda1 root</nowiki></code>
|-
| 4
| Format the decrypted drive with filesystem
| <code>mkfs.ext4 /dev/mapper/root</code>
|-
| 5
| Create the mount point
| <code>mkdir -p /mnt/root</code>
|-
| 6
| Mount the root partition
| <code>mount /dev/mapper/root /mnt/root</code>
|-
| 7
| Create swap
| cryptsetup -c blowfish -h sha256 -d /dev/urandom --key-file /mnt/usb/59022506d9f4a714 create swap /dev/sda2
|-
| 8
| Use swap
| mkswap /dev/mapper/swap && swapon /dev/mapper/swap
|}

==== Improved method with plausible deniability ====

This method requires lvm2. To install:

apk add lvm2

{|| cellpadding="5" border="1" class="wikitable"
!#
!Step
!Command
|-
| 1
| Open the ''plain dm-crypt'' device generating no metadata
| <code><nowiki>cryptsetup open --type plain --cipher aes-cbc-essiv:sha256 --key-size 256 --key-file /mnt/usb/2a667ec72774b0d5 /dev/sda root</nowiki></code>
|-
| 2
| Physical volume create with LVM
| <code><nowiki>pvcreate /dev/mapper/pvroot</nowiki></code>
|-
| 3
| Volume group create with LVM
| <code><nowiki>vgcreate vgroot /dev/mapper/pvroot</nowiki></code>
|-
| 4
| Logical volume create the swap volume with LVM
| <code><nowiki>lvcreate -L 4G vgroot -n swap</nowiki></code>
|-
| 5
| Logical volume create the root volume with LVM
| <code><nowiki>lvcreate -L 2T vgroot -n root</nowiki></code>
|-
| 6
| Logical volume create the rescue volume with LVM
| <code><nowiki>lvcreate -L 110M vgroot -n rescue</nowiki></code>
|-
| 7
| Format the root volume with filesystem
| <code>mkfs.ext4 /dev/mapper/vgroot-root</code>
|-
| 8
| Format the swap volume and activate it
| <code>mkswap /dev/mapper/vgroot-swap && swapon /dev/mapper/vgroot-swap</code>
|-
| 9
| Format the rescue volume with filesystem
| <code>mkfs.ext4 /dev/mapper/vgroot-rescue</code>
|-
| 10
| Create mount point for root volume
| <code>mkdir -p /mnt/root</code>
|-
| 11
| Mount the root volume
| <code>mount /dev/mapper/vgroot-root /mnt/root</code>
|-
|}

=== Configuring OpenRC dmcrypt and setting up fstab ===

You need to tell OpenRC init scripts to decrypt the volumes. See <code>/etc/conf.d/dmcrypt</code>.

You need to add the service to boot well because it needs to decrypt the root volume before OpenRC starts running commands from it. So you need to do:

rc-update add dmcrypt boot

==== /etc/init.d/dmcrypt ====
The dmcrypt OpenRC service will attempt to decrypt the drive using information provided in ''/etc/conf.d/dmcrypt''.

For ''luks'':

{{Cat|/etc/conf.d/dmcrypt|<nowiki>
# Mounting root may not be necessary since it is already mounted.
target=root
source='/dev/sda1'
key='/mnt/usb/2a667ec72774b0d5'

swap=swap
source='/dev/sda2'
key='/mnt/usb/59022506d9f4a714'
</nowiki>}}

For ''plain dm-crypt'':

{{Cat|/etc/conf.d/dmcrypt|<nowiki>
# Mounting root is likely not required since you already mounted it before OpenRC starts to do its thing.
target=root
source='/dev/sda'
key='/mnt/usb/2a667ec72774b0d5'
options='--type plain --cipher aes-cbc-essiv:sha256 --key-size 256'

swap=swap
source='/dev/sda2'
key='/mnt/usb/59022506d9f4a714'
pre_mount='vgchange -ay vgroot ; lvchange -ay vgroot/swap'
</nowiki>}}

dm-crypt will just mount the encrypted ''plain dm-crypt'' drive or the ''luks'' partition. What you need to do next is set up fstab located at /etc/fstab. Examples are shown below.

==== /etc/fstab ====

To mount ''plain dm-crypt'' device with fstab:

{{Cat|/etc/fstab|
/dev/sdb /boot ext4 defaults 0 0
/dev/mapper/root / ext4 defaults 0 1
/dev/mapper/swap none swap sw 0 0
}}

To mount ''lvm'' volumes with fstab:

{{Cat|/etc/fstab|
/dev/sdb /boot ext4 defaults 0 0
/dev/mapper/vgroot-root / ext4 defaults 0 1
/dev/mapper/vgroot-swap none swap sw 0 0
}}

=== How to recover from a bad setup ===

Many times you will not get it right perfectly the first try. To recover from this situation, you need to reopen the ''plain dm-crypt'' drive or the ''luks'' drive and then remount everything back.

To recover from ''luks'':
cryptsetup --key-file /mnt/usb/2a667ec72774b0d5 luksOpen /dev/sda1 root
mkdir -p /mnt/root
mount /dev/mapper/root /mnt/root

To recover from the ''plain dm-crypt'':
cryptsetup open --type plain --cipher aes-cbc-essiv:sha256 --key-size 256 --key-file /mnt/usb/2a667ec72774b0d5 /dev/sda root
vgchange -ay vgroot
lvchange -ay vgroot/root
mkdir -p /mnt/root
mount /dev/mapper/vgroot-swap /mnt/root

== Next step: Full blown Alpine installation ==

We will setup the /mnt/root encrypted partition:
apk add --root=/mnt/root --initdb $(cat /etc/apk/world)

Then, enable edge repositories in both files including community and testing:
nano /etc/apk/repositories /mnt/root/etc/apk/repositories

Then, copy the necessary files:
cp /etc/resolv.conf /mnt/root/etc

Then, install the basic utils:
apk add --root=/mnt/root dhcpcd chrony networkmanager wireless-tools wpa_supplicant
apk add --root=/mnt/root grub mkinitfs e2fsprogs grub-bios grub-efi
apk add --root=/mnt/root sudo nano
apk add --root=/mnt/root linux-hardened

Then, you need to mount your usb on to /boot:
mount /dev/sdb /boot

Edit grub:
nano /boot/grub/grub.cfg

Then, install grub on the usb:
grub-install --force /dev/sdb

Then, prepare chroot:
mount --bind /dev /mnt/root/dev
mount --bind /sys /mnt/root/sys
cp /etc/reslov.conf /mnt/root/etc

Then, chroot:
chroot /mnt/root /bin/sh

Set the root administrator password:
passwd

The root password should be very difficult to deter you from using it and force you to use sudo

Edit sudo so that wheel group has administrative :
EDITOR=nano visudo

Set:
## Uncomment to allow members of group wheel to execute any command
%wheel ALL=(ALL) ALL

Then, add wheel (administrator) user:
useradd -m myname
usermod -a -G video,audio,wheel myname

log in that user:
su myname

Then, update and upgrade it
sudo apk update
sudo apk upgrade

Then, setup xorg:
sudo setup-xorg-base
sudo apk search xf86-video | sort
# pick your video driver
sudo apk add xf86-video-adi
# pick your opengl driver
sudo apk search mesa-dri* | sort
sudo apk add mesa-dri-ati

Then, keep piling on:
sudo apk add firefox dwm xfce4-terminal alsa-utils keepassx xfce4 xchat
sudo apk add font-noto-emoji terminus-font leafpad xsetroot # See [[Emojis]] to complete installation
sudo apk add xf86-input-mouse xf86-input-keyboard

Then, set the desktop:
nano .xinitrc

Put both but comment with a # one of them if you don't want it,
#while true; do xsetroot -name "$( date +"%a %b %d %I:%M:%S %Y" )" ; sleep 1; done &
#exec dwm
exec xfce4-session

For the above xsetroot statement used to provide information in the statusbar for dwm, consider adding information about the battery level. This information can be found in sysfs at /sys/class/power_supply/BAT0/.

sync
sudo reboot

== Hacking mkinitfs to support cryptsetup with GPG keys ==

This section describes how to assemble a custom initscript chain in multiple parts. It could be extended with three-factor authentication which adds biometrics along side with mind and physical object.

Most entry to secure systems are not fully automated or do not allow things to quickly pass through freely and often guarded. This process may seem like a hassle, but it should dissuade the rubberhosers from jumping to the conclusion of the possibility of the existence of a encrypted drive.

Here is the steps required so that the facade initscripts and dependencies are free from encryption.
* You will separate and archive cryptsetup, ciphers kernel modules, hash function kernel modules, and any additional obfuscation dependencies, and another continuation initscript discussed below. You need to make sure that you copy /etc/mkinitfs/mkinitfs.conf to your home directory and strip out those features without those modules.
* You will hide this archive in a mp3 file with another tool you will package or you can use steghide's .au/.wav support, but .au seems too conspicuous or strange by current trends.

Here we try to clean up the facade so that it presents itself as free without cryptography. You need the following changes to your initramfs to avoid a sensitive rubberhoser:
* You will delete everything in the custom initramfs-init referring to encryption. This includes cryptroot, cryptdm, crypt-anything, etc init options.
* You need to delete references in nlplug-findfs to cryptsetup and recompile the mkinitfs package.
* You could program the init script to boot into a facade partition but drop into sh if a hidden special keypress sequence is met.

You need to create a custom init continuation script:
* Your initscript should drop into single mode which you will mount the encrypted path manually.
* You will manually steg-unhide the encrypted archive hidden in the mp3 file and extract it to the ramdisk.
* You will run the custom init continuation script manually.
* This custom init continuation will automate the process of extracting the gpg keys from another device and image files into the ramdisk. This will then automate the mounting of the encrypted drive. This resume continuation script should handle both cold boot and hibernate.
* You will finish resuming running the other half of mkinitfs-init or specifically where the points after where it typically will mount cryptsetup and hibernate devices.

If you use a USB keyboard, you will unlock the encrypted devices in early userspace. You will need to either compile the USB keyboard drivers in the kernel or you need to add additional modules when generating the mkinitfs. You will need the hid, hid-generic, ehci-hcd, uhci-hcd, usbcore driver and add those paths in a customized <code>/etc/mkinitfs/features.d/usb-keyboard.modules</code>. It should be separate from usb.modules because apk updates may overwrite it. Use the <code>lsmod</code> utility from the kmod package to find what drivers your USB keyboard uses.

You need to generate the final mkinitfs.
First you need the kernelversion to pass into mkinitfs. To obtain that information do <code>ls /lib/modules</code> which will show some folders. Once you found it pass it to mkinitrafs by doing and replacing kernelversion below:

sudo mkinitramfs -i $HOMEDIR/initramfs-init -c "$HOMEDIR"/mkinitfs.conf kernelversion

The $HOMEDIR should be replaced with the full path if you are not root.

== Install the bootloader in the USB thumb drive ==

To install grub, you need to install grub on the ramdisk first on the host.

apk add grub

To get a list of partitions

fdisk -l

Mount the boot partition in /boot

mount /dev/sdb /boot

Make changes to grub's configuration

nano /boot/grub/grub.cfg

'''You need to customize the initramfs in order to use GPG keys since there is no support from it.'''

The steps here below assumes that these custom initramfs features have been implemented.

The following boot loader settings is '''not sufficient''' for deniable encryption because it exposes the fact that an encrypted drive exists because an attacker can discover that encryption was used through the edit option of the grub menu. To protect yourself from a rubberhose attack, you really need to customize the initramfs so that references to anything mentioning encryption, ciphers, hashing are not explicitly mentioned. These configurations should be considered an intermediate form for used in debugging purposes. In addition, the attacker just can inspect grub.cfg files directly.

The following are just examples to just get it working but should be modified so that it doesn't hint to the rubberhoser of a hidden partition or encrypted partitions.

The entry should look like:

For 'luks'

{{cat|/boot/grub/grub.cfg|<nowiki>
default=0
timeout=0

menuentry 'Windows 10' {
set root=(hd0,2)
chainloader +1
}

menuentry 'Alpine Linux' {
set root=(hd1,1)
linux /vmlinuz-hardened root=/dev/mapper/root rw modules=sd-mod,usb-storage,ext4,dm-crypt,aes-x86_64,sha256-mb cryptroot=/dev/sda1 cryptdm=root
initrd /initramfs-hardened
}

menuentry 'Alpine Linux (Rescue)' {
set root=(hd1,1)
linux /vmlinuz-hardened root=/dev/mapper/root rw modules=sd-mod,usb-storage,ext4,dm-crypt,aes-x86_64,sha256-mb cryptroot=/dev/sda4 cryptdm=root
initrd /initramfs-hardened
}

if keystatus; then
if keystatus --ctrl; then
set timeout=-1
else
set timeout=0
fi
fi
</nowiki>}}

For 'plain dm-crypt':

The stock mkinitfs may not support plain dm-crypt. It looks like it only supports luks. Customization of the initramfs is required.

{{cat|/boot/grub/grub.cfg|<nowiki>
default=0
timeout=0

menuentry 'Windows 10' {
set root=(hd0,2)
chainloader +1
}

menuentry 'Alpine Linux' {
set root=(hd1,1)
linux /vmlinuz-hardened root=/dev/mapper/vgroot-root rw modules=sd-mod,usb-storage,ext4,dm-crypt,dm-mod,dm-snapshot,aes-x86_64,sha256-mb cryptroot=/dev/sda cryptdm=root
initrd /initramfs-hardened
}

menuentry 'Alpine Linux (Rescue)' {
set root=(hd1,1)
linux /vmlinuz-hardened root=/dev/mapper/vgroot-rescue rw modules=sd-mod,usb-storage,ext4,dm-crypt,dm-mod,dm-snapshot,aes-x86_64,sha256-mb cryptroot=/dev/sda cryptdm=rescue
initrd /initramfs-hardened
}

if keystatus; then
if keystatus --ctrl; then
set timeout=-1
else
set timeout=0
fi
fi
</nowiki>}}

The source code of grub could possibly be modified and recompiled to use other non-standard keys. See [https://github.com/lemenkov/grub2/blob/master/grub-core/commands/keystatus.c]. Ideally, it should be not so obvious or accessible for the attacker.

The above grub.cfg is applied to the USB bootloader. For the facade bootloader, you just want the Windows 10 or Ubuntu entry, nothing more.

For the modules parameter, you need to add your crypto modules.
Use <code>find /lib/modules/ -name "*aes*"</code> where aes is the basename for your cipher or hash algorithm
Use <code>blkid</code> to obtain the UUID of your device

Install it to your USB thumb drive

grub-install /dev/sdb

== Home mounting with eCryptfs ==

We use eCryptfs to encrypt home. The rationale for having another encrypted file system is that if you leave your laptop unattended on break or accidentally leave your USB key in, your data will not be accessible. The other rationale is that if another person wants to use your computer, you can just log off and the data will be kept hidden and encrypted. When you log off due to inactivity, your home directory will be unmounted and encrypted. eCryptfs will encrypt/decrypt the filename and the contents and will sit on top of ext4 which sits on top of luks.

To install ecryptfs-utils:

sudo apk add ecryptfs-utils

This does one factor authentication mostly with just the password, but it should be modified to use the USB key too. You need to reconfigure pam with the pam_usb.so which is not in Alpine aports.

You need to use the pam_ecryptfs PAM module.

== Locking it down ==

Many times you will leave your laptop behind with people you trust. The following tools will help lock down the system.

=== physlock ===

This will auto lock the tty and when you return will prompt for password.

To install physlock:

sudo apk add physlock

It is currently bugged. See [https://bugs.alpinelinux.org/issues/3282]. physlock likely doesn't do two-factor authentication but it should.

You need to create custom script that will monitor idle time in TTY then call physlock. You load this script when you log on.

=== xscreensaver ===

This will lock you out of xserver

To install xscreensaver:

sudo apk add xscreensaver

=== USB key udev rule ===

You need to add a new udev rule that will suspend-to-ram or hibernate and log off once you pull the USB key. When you come back on, you should do 2 factor authentication to restore back everything. Hibernation and suspend-to-ram might mitigate cold-boot attack (but unlikely see notes at the bottom of the page) to extract plaintext private data and encryption keys in memory.

To find out the details of your USB do:

udevadm monitor --udev -p

The output should look like:

<pre>
UDEV [181762.722853] add /devices/pci0000:00/0000:00:13.2/usb2/2-5/2-5:1.0/host6/target6:0:0/6:0:0:0/block/sdc (block)
ACTION=add
DEVLINKS=/dev/disk/by-id/usb-Kingston_MSFT_NORB_MSFTLAKDA300EB3021790009-0:0 /dev/disk/by-path/pci-0000:00:13.2-usb-0:5:1.0-scsi-0:0:0:0 /dev/disk/by-uuid/5A96-03E4
DEVNAME=/dev/sdc
DEVPATH=/devices/pci0000:00/0000:00:13.2/usb2/2-5/2-5:1.0/host6/target6:0:0/6:0:0:0/block/sdc
DEVTYPE=disk
ID_BUS=usb
ID_FS_TYPE=vfat
ID_FS_USAGE=filesystem
ID_FS_UUID=5A96-03E4
ID_FS_UUID_ENC=5A96-03E4
ID_FS_VERSION=FAT32
ID_INSTANCE=0:0
ID_MODEL=MSFT_NORB
ID_MODEL_ENC=MSFT\x20NORB\x20\x20\x20\x20\x20\x20\x20
ID_MODEL_ID=1645
ID_PATH=pci-0000:00:13.2-usb-0:5:1.0-scsi-0:0:0:0
ID_PATH_TAG=pci-0000_00_13_2-usb-0_5_1_0-scsi-0_0_0_0
ID_REVISION=PMAP
ID_SERIAL=Kingston_MSFT_NORB_MSFTLAKDA300EB3021790009-0:0
ID_SERIAL_SHORT=MSFTLAKDA300EB3021790009
ID_TYPE=disk
ID_USB_DRIVER=usb-storage
ID_USB_INTERFACES=:080650:
ID_USB_INTERFACE_NUM=00
ID_VENDOR=Kingston
ID_VENDOR_ENC=Kingston
ID_VENDOR_ID=0951
MAJOR=8
MINOR=32
SEQNUM=2027
SUBSYSTEM=block
USEC_INITIALIZED=1762722168
</pre>

You want to extract the <code>ID_SERIAL_SHORT=MSFTLAKDA300EB3021790009</code> or whatever is associated with your USB thumb drive.

You need pm-utils for ps-suspend. So to install it do:

sudo apk add pm-utils

You will create a udev rules so that when you pull out the USB, it will suspend-to-ram or you can use your own script. To do that create a file with the following contents:

{{Cat|/etc/udev/rules.d/50-usb-thumb-drive.rules|<nowiki>

ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_SERIAL_SHORT}=="MSFTLAKDA300EB3021790009", RUN+="/usr/sbin/pm-suspend"

</nowiki>}}

== Extending battery life ==

'''WARNING: If you do not use the proper mitigation for cold boot attack, you are better off auto-shutdowning the laptop instead of using suspend or hibernate.'''

=== ACPI ===

ACPI is a good daemon to use to execute certain scripts when laptop events are triggered.

To install ACPI do:

apk add acpi

The events to pay attention to are:

{| cellpadding="5" border="1" class="wikitable"
! Event
! ACPI Event
! What your script should do
|-
| lid close
|
| log off ttys and suspend-to-ram. ALSA should either set the volume to 0 for the sound card or the sound driver be unloaded. It might be a good idea to kill or mute any music or movie players if the sound loops loudly after lid open.
|-
| lid open
|
| lock all ttys and all xservers should be locked, possibly reinitialize ALSA and the sound system.
|-
| tapped power button
|
| lock all ttys and suspend-to-ram
|-
| held power button
|
| hibernate
|-
| unplugged power
|
| should switch to 'conservative' cpufreq governor at above 25% power ; 'powersave' governor at 25%. set hdparam spindown rate lower.
|-
| plugged power
|
| should switch to 'performance' governor. disable hdparam spindown.
|}

The purpose of the power governor is to regulate the running frequency (GHz) of the processor.

Certain event handlers are are managed through laptop-mode-tools. If you don't want the dependency, then you could write ACPI handler scripts.

<code>acpi_listen</code> can be used to retrieve the event name.

TODO: put scripts below

=== Adjusting the backlight dynamically ===

The backlight may be controlled using sysfs. The setting is a descendant of <code>/sys/class/backlight/</code>. The feature may allow you to echo a value to it. Use trial and error to discover the values.

The adjustment of the backlight should be function of battery life. So if it is like 33% battery life, you want to run it near lowest settings but readable. For 50 percent battery energy maybe 40% light. For 90% battery maybe 75% light.

=== hdparm ===

To install hdparam do:

sudo apk add hdparm

The settings that laptop-mode-tools messes with is the <code>-S</code> or the spindown timeout. It was also hinted that acoustic setting <code>-M</code> is associated with the speed meaning that louder is faster and quieter is slower which could contribute to the amount of energy used or reduced.

Again you want something like laptop-mode-tools or ACPI to dynamically adjust the settings based on ACPI events.

=== laptop-mode-tools ===

This is currently not in aports but worthy mentioning. It should really be packaged. This is a set of scripts to define a power policies. You can manage all the settings in one place here like the hard drive idle spindown time, CPU governor control, dynamic LCD backlight behavior based on running on battery or AC power supply.

=== cpufreqd ===

This is a useful daemon for regulating power.

To install cpufreqd do:

sudo apk add cpufreqd

Make sure you add the service:

sudo rc-update add cpufreqd

=== LCD screen refresh rate ===

The refresh rate sets the maximum framerate. The more frames pushed the more energy consumed on the battery. You want this adjusted dynamically per certain events. For gaming, you want it to be the highest as possible for the laptop and vsync off. For battery use and traveling, you want it capped at 60 FPS/60 Hz or lower but dynamically adjust when you plug in the AC power supply. You can adjust the framerate with xrandr. For movies and YouTube, you want 60FPS and vsync on.

== Hacking the kernel ==

You should refer to the [[Custom Kernel]] page for details.

== Hibernation ==

See [[Custom_Kernel#Hibernation_to_prevent_data_loss|Hibernation to prevent data loss]].

== WiFi management ==

Since you are using WiFi, you need a better WiFi management to quickly find open access WiFi access points. We don't have all day to debug complexities of WiFi settings while away from home.

To install NetworkManager do:

sudo apk add networkmanager

To find WiFi access points use the <code>nmtui</code> ncurses interface.

You also need other programs so install them as well:

apk add wpa-supplicant dhcpcd chrony macchanger wireless-tools iputils

What these programs do:

* wpa-supplicant -- for WPA encryption
* dhcpcd -- for getting a dynamic IP address
* chrony -- for fixing the time with the atomic clock
* wireless-tools -- for additional information
* macchanger -- for protecting against WiFi access discrimination or increased anonymity. (optional)
* iputils -- for the ping command (optional)

You also need to add those services:

rc-update add chrony
rc-update add wpa-supplicant
rc-update add dhcpcd
rc-update add networkmanager

To start the services manually (or just reboot):

/etc/init.d/chrony start
/etc/init.d/wpa-supplicant start
/etc/init.d/dhcpcd start
/etc/init.d networkmanager start

== Additional tools ==

=== actkbd ===

To control the sound with fn function keys, you need this daemon. It is currently not in aports. You could override the design and meaning of those keys with your own scripts and utilities. This daemon gives you that freedom.

If your laptop contains a brightness key, you want to set that up with this program. See also [[Setting_up_a_laptop#Adjusting_the_backlight_dynamically | Adjusting the backlight dynamically]].

=== secure-delete ===

Want to prevent cold-boot attack or decrypted keys in memory falling in the wrong hands? This maybe could work who knows? From research from cold boot attack, the data can actually stay in memory in minutes, just enough time for a hacker to copy the contents of the memory to a USB thumb drive.

To install secure-delete do:

sudo apk add secure-delete

smem only works for unused ram.[https://github.com/gordonrs/thc-secure-delete] If you use the vanilla kernel, this may work. If you use grsecurity, it will automatically sanitize memory if you enable it (but not enabled by default in the Alpine hardened kernel) when the memory page is freed.[https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options#Sanitize_all_freed_memory]

Close all important programs then call smem.

You call smem in your shutdown script or auto-logoff script.

You can call create a OpenRC shutdown script to run smem when most programs and services are closed. This will erase all your sensitive plaintext private data just in case.

You may want to create a wrapper script to call smem after your program closes.

You need to write a custom script that does the following:
* kill all running processes associated with your user account
* auto logoff terminals
* for the last terminal closed including all idle xservers, unmount your user home
* (optional) use smem to wipe all your plaintext private data in memory after all closed programs in case of cold boot attack

=== Sharing presentations over HDMI ===

If you want to use your laptop to share presentation over HDMI connection, you need libxinerama and xrandr.

To install libxinerama and xrandr do:

sudo apk add libxinerama xrandr

== Important notes ==

If you lose or break your USB key, that is it and you cannot decrypt your drive. It would be wise to make a backup of it.

By default, suspend-to-ram or hibernate will not sufficiently clear the AES encryption keys off ram in those phases which would invite a cold boot attack. This has been covered by the TRESOR kernel patch.[https://en.wikipedia.org/wiki/TRESOR][https://www1.cs.fau.de/tresor] This patch hasn't been updated since the 4.x kernel series.[https://www1.cs.fau.de/tresor]. This patch currently only works on 32-bit x86 Linux with SSE and MMX, and on processors with the AES-NI instruction set for x86_64 Linux. TRESOR doesn't work with DMA attack, but it can be mitigated by disabling DMA.[https://old.iseclab.org/papers/acsac2012dma.pdf] The 32-bit version of TRESOR has only a key size of 128. The AES-NI version of TRESOR has a largest key size of 256 bit. See [[Setting_up_a_laptop#Choosing_ciphers | Choosing ciphers]] for the number of rounds cracked.

Loop-Amnesia works with LoopAES and is only for 64 bit Linux and only supports 128 bit keys but can result in data loss if their recommendations are not followed. [http://moongate.ydns.eu/amnesia.html]

Please read the Wikipedia article on Cold Boot Attack especially the mitigation section.[https://en.wikipedia.org/wiki/Cold_boot_attack] Full disk encryption will not protect your data especially for older hardware if you do not have the proper mitigation (implying not full proof) prerequisites such as a patched kernel, memory scrambling, permanent memory module mounting for example.

If you have a different but fully encrypted device like iPad, you still can be rubberhosed or interrogated with a perfect deniable encrypted laptop. This guide doesn't protect you from that possibility. If you do not want to be rubberhosed, don't possess those devices.

Additional tips to mitigate against a DMA Attack to exfiltrate encryption keys:

Disable DMA in the BIOS and set the password for the BIOS according to Wikipedia.[https://en.wikipedia.org/wiki/DMA_attack]

Blacklist kernel modules that use DMA and any unused expansion modules (FireWire, CardBus, ExpressCard, Thunderbolt, USB 3.0, PCI Express and hotplug modules) that use DMA.

You may need a custom (or customize a) BIOS or use Intel TXT or TPM which will authenticate the boot devices or boot from specific serial numbers not just any. For cold boot attack, it is not required to remove the RAM but to to slow down the rate of decay of the RAM module with liquid air in addition an USB thumb drive containing an encryption key retriever bypassing the operating system.[https://youtu.be/XfUlRsE3ymQ]

[[Category:Installation]]
[[category: desktop]]

Firefox

2019-11-01T07:40:46Z

Innsill: > category: Web Browser

Category:Web Browser

2019-11-01T07:40:05Z

Innsill: + category:Desktop

[[category: Desktop]]

User:Innsill/firefox-starter (x86-64 )

2019-10-31T19:19:02Z

Innsill:

# '''[[Create a Bootable USB]]''' https://alpinelinux.org/downloads/
#* alpine-standard-3.10.3-x86_64.iso
#* alpine-standard-3.10.3-x86_64.iso.sha256
#** sha256sum --check alpine-standard-3.10.3-x86_64.iso.sha256
#* lsblk
#* sudo dd if=alpine-standard-3.10.3-x86_64.iso of=/dev/sdX
#
# '''[[Alpine setup scripts]]''' find / -name setup* -print | sort
#* setup-alpine
#* setup-xorg-base
#
# '''[https://pkgs.alpinelinux.org/packages?name=firefox-esr&branch=v3.10&repo=community&arch=x86_64 Firefox]'''
#* vi /etc/apk/repositories
#* apk update && apk upgrade
#* apk add firefox-esr
#** apk list ttf-* | sort
#** TTFS=$(apk search -q ttf- | grep -v '\-doc')
#** apk add $TTFS
#
# 
#* adduser ff
#* su ff -
#** $vi .profile {{cat |/home/ff/.profile |<nowiki>startx</nowiki>}}
#** $vi .xinitrc {{cat |/home/ff/.xinitrc |<nowiki>exec firefox</nowiki>}}
#** $exit
#* vi /etc/inittab {{cat |/etc/inittab |<nowiki>tty1::respawn:/bin/login -f ff
tty2::respawn:/sbin/getty 38400 tty2
#tty3::respawn:/sbin/getty 38400 tty3
</nowiki>}}
#* Ctrl+Alt-F2 (login ff)
#* Ctrl+Alt-F1 (root, [[Sound Setup]])
#
# '''[[Connecting to a wireless access point]]''' ip link set eth0 down
#* apk add wireless-tools wpa_supplicant
#* ip link set wlan0 up
#* iwconfig wlan0 essid ...id
#* wpa_passphrase ...id ...phrase > /etc/wpa_supplicant/wpa_supplicant.conf {{cat |/etc/wpa_supplicant/wpa_supplicant.conf |<nowiki>network={
ssid="...id"
scan_ssid=1
psk=...}</nowiki>}}
#* wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf
#* udhcp -i wlan0
#** vi /etc/network/interfaces {{cat |/etc/network/interfaces |<nowiki>auto wlan0
iface wlan0 inet dhcp</nowiki>}}
#** rc-update add wpa_supplicant boot

= =
* [https://dev.to/nesterow/setup-minimal-kiosk-environment-with-alpine-linux-27b Raspberry Pi. Setup minimal kiosk environment with Alpine Linux] Anton Nesterov 2019
* [[MATE]]

User:Innsill/firefox-starter (x86-64 )

2019-10-31T12:26:37Z

Innsill:

# '''[[Create a Bootable USB]]''' https://alpinelinux.org/downloads/
#* alpine-standard-3.10.3-x86_64.iso
#* alpine-standard-3.10.3-x86_64.iso.sha256
#** sha256sum --check alpine-standard-3.10.3-x86_64.iso.sha256
#* lsblk
#* sudo dd if=alpine-standard-3.10.3-x86_64.iso of=/dev/sdX
#
# '''[[Alpine setup scripts]]''' find / -name setup* -print | sort
#* setup-alpine
#* setup-xorg-base
#
# '''[https://pkgs.alpinelinux.org/contents?file=firefox Firefox ?]''' '''________________Version 68.2.0-r0 broken: error relocating /usr/lib/firefox'''
#* vi /etc/apk/repositories
#* apk update && apk upgrade
#* apk add firefox-esr
#** apk list ttf-* | sort
#** TTFS=$(apk search -q ttf- | grep -v '\-doc')
#** apk add $TTFS
#
# 
#* adduser ff
#* su ff -
#** $vi .profile {{cat |/home/ff/.profile |<nowiki>startx</nowiki>}}
#** $vi .xinitrc {{cat |/home/ff/.xinitrc |<nowiki>exec firefox</nowiki>}}
#** $exit
#* vi /etc/inittab {{cat |/etc/inittab |<nowiki>tty1::respawn:/bin/login -f ff
tty2::respawn:/sbin/getty 38400 tty2
#tty3::respawn:/sbin/getty 38400 tty3
</nowiki>}}
#* Ctrl+Alt-F2 (login ff)
#* Ctrl+Alt-F1 (root, [[Sound Setup]])
#
# '''[[Connecting to a wireless access point]]''' ip link set eth0 down
#* apk add wireless-tools wpa_supplicant
#* ip link set wlan0 up
#* iwconfig wlan0 essid ...id
#* wpa_passphrase ...id ...phrase > /etc/wpa_supplicant/wpa_supplicant.conf {{cat |/etc/wpa_supplicant/wpa_supplicant.conf |<nowiki>network={
ssid="...id"
scan_ssid=1
psk=...}</nowiki>}}
#* wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf
#* udhcp -i wlan0
#** vi /etc/network/interfaces {{cat |/etc/network/interfaces |<nowiki>auto wlan0
iface wlan0 inet dhcp</nowiki>}}
#** rc-update add wpa_supplicant boot

= =
* [https://dev.to/nesterow/setup-minimal-kiosk-environment-with-alpine-linux-27b Raspberry Pi. Setup minimal kiosk environment with Alpine Linux] Anton Nesterov 2019
* [[MATE]]

Firefox

2019-10-31T11:42:36Z

Innsill: + link

Alpine on ARM

2019-10-31T09:29:49Z

Innsill: + link

{{TOC right}}
{{Draft}}
{{Style}}
{{Move|ARM SOCs}}

(this page is WIP, most info are incomplete and some might be incorrect)
==Supported SoCs==
Currently Alpine supports armv6/armhf arch on the following SoCs
(This is taken from the DTBs which Alpine includes)
{| class="wikitable collapsible"
| am335x-base0033
| am335x-bone
| am335x-boneblack
| am335x-evm
| am335x-evmsk
| am335x-nano
| am335x-pepper
| am3517-craneboard
| am3517-evm
| am3517_mt_ventoux
| am437x-gp-evm
|-
| am437x-sk-evm
| am43x-epos-evm
| exynos4210-origen
| exynos4210-smdkv310
| exynos4210-trats
| exynos4210-universal_c210
| exynos4412-odroidu3
| exynos4412-odroidx
| exynos4412-odroidx2
| exynos4412-origen
| exynos4412-smdk4412
| exynos4412-tiny4412
|-
| exynos4412-trats2
| exynos5250-arndale
| exynos5250-smdk5250
| exynos5250-snow
| exynos5260-xyref5260
| exynos5410-smdk5410
| exynos5420-arndale-octa
| exynos5420-peach-pit
| exynos5420-smdk5420
| exynos5440-sd5v1
| exynos5440-ssdk5440
| exynos5800-peach-pi
|-
| imx1-ads
| imx1-apf9328
| imx25-eukrea-mbimxsd25-baseboard-cmo-qvga
| imx25-eukrea-mbimxsd25-baseboard-dvi-svga
| imx25-eukrea-mbimxsd25-baseboard-dvi-vga
| imx25-eukrea-mbimxsd25-baseboard
| imx25-karo-tx25
| imx25-pdk
| imx27-apf27
| imx27-apf27dev
| imx27-eukrea-mbimxsd27-baseboard
| imx27-pdk
|-
| imx27-phytec-phycard-s-rdk
| imx27-phytec-phycore-rdk
| imx31-bug
| imx35-eukrea-mbimxsd35-baseboard
| imx35-pdk
| imx50-evk
| imx51-apf51
| imx51-apf51dev
| imx51-babbage
| imx51-digi-connectcore-jsk
| imx51-eukrea-mbimxsd51-baseboard
| imx53-ard
|-
| imx53-m53evk
| imx53-mba53
| imx53-qsb
| imx53-qsrb
| imx53-smd
| imx53-tx53-x03x
| imx53-tx53-x13x
| imx53-voipac-bsb
| imx6dl-aristainetos_4
| imx6dl-aristainetos_7
| imx6dl-cubox-i
| imx6dl-dfi-fs700-m60
|-
| imx6dl-gw51xx
| imx6dl-gw52xx
| imx6dl-gw53xx
| imx6dl-gw54xx
| imx6dl-gw552x
| imx6dl-hummingboard
| imx6dl-nitrogen6x
| imx6dl-phytec-pbab01
| imx6dl-rex-basic
| imx6dl-riotboard
| imx6dl-sabreauto
| imx6dl-sabrelite
|-
| imx6dl-sabresd
| imx6dl-tx6dl-comtft
| imx6dl-tx6u-801x
| imx6dl-tx6u-811x
| imx6dl-wandboard-revb1
| imx6dl-wandboard
| imx6q-arm2
| imx6q-cm-fx6
| imx6q-cubox-i
| imx6q-dfi-fs700-m60
| imx6q-dmo-edmqmx6
| imx6q-gk802
|-
| imx6q-gw51xx
| imx6q-gw52xx
| imx6q-gw53xx
| imx6q-gw5400-a
| imx6q-gw54xx
| imx6q-gw552x
| imx6q-hummingboard
| imx6q-nitrogen6x
| imx6q-phytec-pbab01
| imx6q-rex-pro
| imx6q-sabreauto
| imx6q-sabrelite
|-
| imx6q-sabresd
| imx6q-sbc6x
| imx6q-tx6q-1010-comtft
| imx6q-tx6q-1010
| imx6q-tx6q-1020-comtft
| imx6q-tx6q-1020
| imx6q-tx6q-1110
| imx6q-udoo
| imx6q-wandboard-revb1
| imx6q-wandboard
| imx6sl-evk
| imx6sx-sdb
|-
| omap3-beagle-xm-ab
| omap3-beagle-xm
| omap3-beagle
| omap3-cm-t3517
| omap3-cm-t3530
| omap3-cm-t3730
| omap3-devkit8000
| omap3-evm-37xx
| omap3-evm
| omap3-gta04a3
| omap3-gta04a4
| omap3-gta04a5
|-
| omap3-ha-lcd
| omap3-ha
| omap3-igep0020
| omap3-igep0030
| omap3-ldp
| omap3-lilly-dbb056
| omap3-n9
| omap3-n900
| omap3-n950
| omap3-overo-alto35
| omap3-overo-chestnut43
| omap3-overo-gallop43
|-
| omap3-overo-palo43
| omap3-overo-storm-alto35
| omap3-overo-storm-chestnut43
| omap3-overo-storm-gallop43
| omap3-overo-storm-palo43
| omap3-overo-storm-summit
| omap3-overo-storm-tobi
| omap3-overo-summit
| omap3-overo-tobi
| omap3-sbc-t3517
| omap3-sbc-t3530
| omap3-sbc-t3730
|-
| omap3-thunder
| omap3-zoom3
| omap3430-sdp
| omap4-duovero-parlor
| omap4-panda-a4
| omap4-panda-es
| omap4-panda
| omap4-sdp-es23plus
| omap4-sdp
| omap4-var-dvk-om44
| omap4-var-stk-om44
| omap5-cm-t54
|-
| omap5-sbc-t54
| omap5-uevm
| qcom-apq8064-cm-qs600
| qcom-apq8064-ifc6410
| qcom-apq8074-dragonboard
| qcom-apq8084-ifc6540
| qcom-apq8084-mtp
| qcom-ipq8064-ap148
| qcom-msm8660-surf
| qcom-msm8960-cdp
| qcom-msm8974-sony-xperia-honami
| sun4i-a10-a1000
|-
| sun4i-a10-ba10-tvbox
| sun4i-a10-cubieboard
| sun4i-a10-hackberry
| sun4i-a10-inet97fv2
| sun4i-a10-mini-xplus
| sun4i-a10-olinuxino-lime
| sun4i-a10-pcduino
| sun5i-a10s-olinuxino-micro
| sun5i-a10s-r7-tv-dongle
| sun5i-a13-hsg-h702
| sun5i-a13-olinuxino-micro
| sun5i-a13-olinuxino
|-
| sun6i-a31-app4-evb1
| sun6i-a31-colombus
| sun6i-a31-hummingbird
| sun6i-a31-m9
| sun7i-a20-cubieboard2
| sun7i-a20-cubietruck
| sun7i-a20-hummingbird
| sun7i-a20-i12-tvbox
| sun7i-a20-olinuxino-lime
| sun7i-a20-olinuxino-micro
| sun7i-a20-pcduino3
| sun8i-a23-ippo-q8h-v5
|-
| vexpress-v2p-ca15-tc1
| vexpress-v2p-ca15_a7
| vexpress-v2p-ca5s
| vexpress-v2p-ca9
| vf610-colibri-eval-v3
| vf610-cosmic
| vf610-twr
|}
===Install Alpine on supported SoCs===
(If anyone has any of the above device and has successfully install Alpine on it, please consider to add the missing info)

==Unupported SoCs==
If you have an armv6/armv7 SoC which is not listed above but is supported by mainline uboot/kernel then it's still possible to install Alpine
===Requiremnets===
* Alpine's forked uboot to support tarballs (fabled?)
* serial console
* crosscompiler/toolchain if you can not compile natively
===The embedded world===
A lot of the SoCs have their own way of doing things, although they use uboot and Linux kernel but often they are heavily modified to suit easy flashing of "ROMs" or other unknown reasons, e.g. Rockchip's notion "partition" are neither DOS nor GPT partitions.
We are to discuss to install Alpine in a more standard way like x86 with either DOS or GPT partitions. You will most likely have to install/flash the mainline uboot, which can be non-destructive if you use external storage.

====Storage====
One can load uboot from the following block devices if it's supported.
* NAND
* eMMC
* SD card
* USB

====Power on====
Some SoCs need both SPL and uboot, you need to check uboot for your board. Most (if not all) boards boots from the internal storage first (either NAND or eMMC) you will have to check documentation of your board if you wish to boot the SPL/uboot from SD/USB.

One can view SPL+uboot as BIOS and boot-loader on PC. Think that you could put the BIOS on an external storage :D

Once you have loaded the "standard" uboot, things are more or less like on x86.

====Partitioning====
Either DOS or GPT patitions should work, start of the first partition should be on block 2048 so there are space for SPL/uboot and marked bootable (with
the MBR bootable flag, or GPT legacy_bios_bootable attribute).
* SPL starts at block 64 (please consult the docs for your board)
* uboot starts at block 256 (please consult the docs for your board)
Just dd SPL and boot with the correct offset to the media you wish to boot

====Booting Linux kernel====
* uboot uses extlinux.conf file to locate the kernel/initramfs/... just like syslinx, you need to put that file on the partitions which is marked bootable in the /boot directory
* there should be an extra line "FDTDIR" which points to the DTBs
e.g.
<pre>
label Fedora (3.17.0-0.rc4.git2.1.fc22.armv7hl) 22 (Rawhide)
kernel /boot/vmlinuz-3.17.0-0.rc4.git2.1.fc22.armv7hl
append ro root=UUID=8eac677f-8ea8-4270-8479-d5ddbb797450 console=ttyS0,115200n8 LANG=en_US.UTF-8 drm.debug=0xf
fdtdir /boot/dtb-3.17.0-0.rc4.git2.1.fc22.armv7hl
initrd /boot/initramfs-3.17.0-0.rc4.git2.1.fc22.armv7hl.img
</pre>

==Using QEMU==
<pre>
qemu-system-arm -M vexpress-a9 -kernel zImage -initrd initramfs-grsec -dtb vexpress-v2p-ca9.dtb -hda hda.img -serial stdio
</pre>

==See also==
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]

== ==
* [http://www.armadeus.org/wiki/index.php?title=Kernel-with-device-tree dtb (Device Tree Binary)]
* [https://forum.odroid.com/viewtopic.php?t=30459 Odroid-C2] 2018 ''([https://archlinuxarm.org/platforms/armv8/amlogic/odroid-c2 ARMv8, AArch64]; [https://forum.odroid.com/viewtopic.php?f=138&t=32608 Alpine Linux custom build])''
* [https://cusdeb.com/ CusDeb.com] - bootstrap SD-card images for single-board computers online; ''([https://github.com/tolstoyevsky/pieman Pieman])''
* [https://kernelci.org/soc/ <s>Available</s> SoCs]

[[Category:Hardware]]
[[category:ARM]]

Bootloaders

2019-10-31T08:46:04Z

Innsill: + link

By default Alpine uses Syslinux as bootloader.
This page shows the basic steps you need to perform, if you for any reason want to switch bootloaders or apply some manual configuration.

= Installing Syslinux =

If you want to switch from another bootloader back to Syslinux, or if you for some reason want to install Syslinux manually, the following steps are required.

Install the <code>syslinux</code> package:

<pre>apk add syslinux</pre>

If you're using GPT partitions, install the GPT MBR onto the drive you want to install the bootloader on (in this case <code>/dev/sda</code>):

<pre>dd bs=440 count=1 conv=notrunc if=/usr/share/syslinux/gptmbr.bin of=/dev/sda</pre>

Or if you're using DOS partitions, install the DOS MBR instead:

<pre>dd bs=440 count=1 conv=notrunc if=/usr/share/syslinux/mbr.bin of=/dev/sda</pre>



Next install the required Syslinux binaries. Despite being called <code>extlinux</code>, Syslinux supports booting from FAT12/16/32, NTFS, ext2/3/4, Btrfs, XFS, and UFS/FFS filesystems.

<pre>extlinux --install /boot</pre>

The configuration file is located in <code>/boot/extlinux.conf</code>.
Alpine ships with a script called <code>update-extlinux</code> which automatically (re)generates this file, for example on updates to Syslinux.
The settings for this script can be found in <code>/etc/update-extlinux.conf</code>, including the option to disable automatic overwriting of <code>/boot/extlinux.conf</code>.
You can also place additional menu entries in the <code>/etc/update-extlinux.d/</code> directory, e.g. for dual booting.

== EFI ==

{{Todo|Work in progress. This should at least get you started.}}

Assuming <code>/mnt</code> is a FAT32 partition of type EF00 and <code>/boot</code> belongs to the rootfs created after running <code>setup-disk</code>:

<pre>
mkdir -p /mnt/EFI/syslinux
cp /usr/share/syslinux/efi64/* /mnt/EFI/syslinux/
cp /boot/extlinux.conf /mnt/EFI/syslinux/syslinux.cfg
cp /boot/vmlinuz* /mnt/
cp /boot/initramfs* /mnt/
</pre>

You may need to modify <code>/mnt/EFI/syslinux/syslinux.cfg</code> to change the paths to absolute paths (just add a / in front of the vmlinuz/initramfs entries),
or copy the files to <code>/mnt/EFI/syslinux</code> instead (XXX: untested).

= GRUB =

To install GRUB in BIOS mode, (optionally) remove the Syslinux package and install the required GRUB packages:

<pre>apk del syslinux
apk add grub grub-bios</pre>

For EFI, install Grub's EFI package instead. Note that <code>/boot</code> has to be an EFI compatible filesystem like FAT32.

<pre>apk add grub-efi</pre>

Next install the MBR and GRUB binaries to disk for BIOS mode:

<pre>grub-install /dev/vda</pre>

For EFI mode:

<pre>grub-install --target=x86_64-efi --efi-directory=/boot</pre>

GRUB ships with an automatic config generator, including some automatic detection of other operating systems installed on the device:

<pre>grub-mkconfig -o /boot/grub/grub.cfg</pre>

This script can be configured via the <code>/etc/default/grub</code> file.
See [https://www.gnu.org/software/grub/manual/html_node/Simple-configuration.html] for a list of available options.

= =
* [https://www.denx.de/wiki/U-Boot/ReleaseCycle U-Boot Release Cycle]

[[Category:Installation]]
[[Category:Booting]]

Manually editing a existing apkovl

2019-10-31T08:12:54Z

Innsill: Category:Storage > category: LBU

{{TOC right}}

You might end up in a situation when you find it necessary to edit a apkovl (without having to boot a box using the apkovl itself).

== Unpack the apkovl ==
Unpack the apkovl into a temp dir.
{{Cmd|mkdir /tmp/testbox
tar -xvzf testbox.apkovl.tar.gz -C /tmp/testbox/}}

== Make your modifications ==
Now do your modifications in '/tmp/testbox/' 
* Edit files/folders
* Add files/folders
* Remove files/folders
* etc.

== Pack the apkovl ==
When your modifications are done you should pack your apkovl
{{Cmd|cd /tmp/testbox
tar -czf /tmp/testbox.apkovl.tar.gz *}}

== Replace the original apkovl ==
Now you have a new/modified apkovl. 
Replace your original apkovl (on your media) with '/tmp/testbox.apkovl.tar.gz' and boot your Alpine.

[[Category:LBU]]

Include:Upgrading Alpine environmentvars

2019-10-31T08:10:02Z

Innsill: Category:Storage > category: LBU

=== Setup environment variables ===
To make the documentation a bit more "generic" we start by setting some environment variables.
{{Cmd|vi /etc/lbu/lbu.conf}}
Make sure that the variable <code>LBU_MEDIA</code> is not commented (by removing the leading '#').

You also need to set a appropriate value for your <code>LBU_MEDIA</code>. The media you choose will be the media where you store your settings/configuration.

{{Note|Even if you have you alpine installed on CF, HD or USB you can still choose to save your config on some other media that suits your needs. But remember that both the media where you have your Alpine system AND the media where you have your config need to be in your box when booting it.}}

Examples:
LBU_MEDIA=usb
or:
LBU_MEDIA=sda1

Now that you have your {{Path|/etc/lbu/lbu.conf}} configured for your needs, we will set the environment variables (note the leading <code>.</code>).
{{Cmd|. /etc/lbu/lbu.conf}}

You can test if your environment variable was set:
{{Cmd|echo $LBU_MEDIA}}
It should output something like <code>usb</code>, <code>sda1</code>, or whatever you just configured.

=== Back up your config ===
Before starting to upgrade, it's wise to save your configuration.
{{Cmd|lbu ci}}

[[category:LBU]]

Back Up a Flash Memory Installation

2019-10-31T08:07:34Z

Innsill: Category:Storage > category: LBU

If you have installed Alpine Linux on flash memory, such as a CF card or USB stick, you may wish to create a backup.

This procedure may also be used to migrate an Alpine Linux installation from one form of flash media to another.

== Install Alpine Linux on the backup medium ==

Follow the instructions at [[Create a Bootable USB]] to install Alpine Linux on the backup medium (CF/USB). Install the same version of Alpine Linux as you have on the running system (you can determine this using the command "cat /etc/alpine-release").

== Copy over the cache directory ==

If you have [[Alpine Linux package management#Local_Cache |enabled APK caching]] for packages that are downloaded over the Internet, then you should copy over the "cache" directory from the running system to your backup medium.

For example, if the backup medium is labeled "sdb" (use the command "dmesg" to see what name your recently inserted device has recieved), and the system is booted from USB, you would run:

{{Cmd|mount -t vfat /dev/sdb1 /mnt
cp -a /media/usbdisk/cache /mnt/
umount /mnt}}

== Copy over the configuration overlay file (apkovl) ==

All the custom configuration of your system is stored in a file named HOSTNAME.apkovl.tar.gz, where HOSTNAME is the locally configured hostname of the system (see the file /etc/hostname).

Simply copy this file to the root of your backup medium.

For example, if the backup medium is labeled "sdb" (use the command "dmesg" to see what name your recently inserted device has recieved), and the system is booted from USB, you would run:

{{Cmd|mount -t vfat /dev/sdb1 /mnt
cp -a /media/usbdisk/*.apkovl.tar.gz /mnt/
umount /mnt}}

[[Category:LBU]]
[[Category:Installation]]

Alpine local backup

2019-10-31T08:00:54Z

Innsill: Category:Storage > category: LBU

When you boot Alpine Linux in a run-from-RAM configuration, Alpine itself only loads a few required packages. But you probably want to do some personal adjustments (e.g., [[Alpine_package_management|installing a package]] or doing some configuration). Since everything in RAM will get lost next time the box is rebooted or shut down, you will need to permanently save those modifications and adjustments. This is where <code>lbu</code> comes in handy!

__TOC__

{{Note|If you installed Alpine on HDD you don't need to use <code>lbu</code>. All your modifications have already been directly written to your HDD. However, <code>lbu</code> can still be useful for some maintenance tasks.}}

The first thing you need to know is this: '''By default <code>lbu</code> only cares about modifications in {{Path|/etc}} and its subfolders, with the exception of {{Path|/etc/init.d}}!''' 
Please have a look at [[#Include_special_files.2Ffolders_to_the_apkovl|lbu include]] to save files/folders located elsewhere than in {{Path|/etc}}.

Alpine has the following tools for permanently storing your modifications:
* lbu
* lbu commit ''(Same as 'lbu ci')''
* lbu package ''(Same as 'lbu pkg')''
* lbu status ''(Same as 'lbu st')''
* lbu list ''(Same as 'lbu ls')''
* lbu diff
* lbu include ''(Same as 'lbu inc' or 'lbu add')''
* lbu exclude ''(Same as 'lbu ex' or 'lbu delete')''
* lbu list-backup ''(Same as 'lbu lb')''
* lbu revert

In the below examples you will find some characters with special meaning:
* '''|''' = '''or''' ''('lbu commit|ci' means that you can type ether 'lbu commit' or 'lbu ci')''
* '''[ ]''' = '''optional''' ''(In 'lbu commit|ci [-nv]' you can just skip the '-n', '-v' or '-nv' part if you don't want it)''

== Committing your changes ==
When you "commit" or save changes you've made to your system, <code>lbu</code> will generate a file named something like {{Path|<var>myboxname</var>.apkovl.tar.gz}} ''('myboxname' will be the same as the hostname)''.
This file (that contains your modifications) is called your "apkovl".
You will need to save your apkovl on some suitable media (floppy, usb, cf, other).
<pre>
usage: lbu commit|ci [-nv] [<media>]

Options:
-d Remove old apk overlay files.
-e Protect configuration with a password.
-n Don't commit, just show what would have been committed.
-p <password> Give encryption password on the command-line
-v Verbose mode.

The following values for <media> is supported: floppy usb
If <media> is not specified, the environment variable LBU_MEDIA will be used.

Password protection will use aes-256-cbc encryption. Other ciphers can be
used by setting the DEFAULT_CIPHER or ENCRYPTION environment variables.
For possible ciphers, try: openssl -v

The password used to encrypt the file, can either be specified with the -p
option or using the PASSWORD environment variable.

The environment variables can also be set in /etc/lbu/lbu.conf
</pre>

=== Create a apkovl elsewhere than on your configured media ===

To "commit" changes, but overriding the destination of the generated apkovl file, use <code>lbu package</code> instead of <code>lbu commit</code>:

<pre>
usage: lbu package|pkg -v [<dirname>|<filename>]

Options:
-v Verbose mode.

If <dirname> is a directory, a package named <hostname>.apkovl.tar.gz will
be created in the specified directory.

If <filename> is specified, and is not a directory, a package with the
specified name will be created.

If neither <dirname> nor <filename> is specified, a package named
<hostname>.apkovl.tar.gz will be created in current work directory.
</pre>

=== Use SSH to create an apkovl on a different host ===

To create an apkovl of client on a centralized server, use <code>lbu package</code> with {{Path|-}} as the apkovl name:

On the server:
<pre>
ssh root@client "lbu package -" >client.apkovl.tar.gz
</pre>

== Check what will be added to your apkovl ==

<code>lbu status</code> lists what will be saved the next time you run <code>lbu commit</code>. Its default output is incremental, that is, to only show what files have changed since the last commit; but this can be overridden with the <code>-a</code> flag:

<pre>
usage: lbu status|st [-av]

Options:
-a Compare all files, not just since last commit.
-v Also show include and exclude lists.
</pre>

Another option is <code>lbu list</code>. This works like <code>lbu status -a</code> but the format of the output is a bit different. (It's strictly equivalent to <code>lbu package -v /dev/null</code>).

usage: lbu list|ls

A third option is <code>lbu diff</code>. This shows the same incremental changes that <code>lbu status</code> (without <code>-a</code>) does, but in a different format.

usage: lbu diff

== Include special files/folders to the apkovl ==
Assume that you have some files that you want to permanently save, but they are located somewhere else than in {{Path|/etc}}. 
It could be {{Path|/root/.ssh/authorized_keys}} (used by <code>sshd</code> to authenticate ssh-users). Such files/folders can be added to lbu's ''include'' list with the following command:

<pre>
usage: lbu include|inc|add [-rv] <file> ...
lbu include|inc|add [-v] -l

Options:
-l List contents of include list.
-r Remove specified file(s) from include list instead of adding.
-v Verbose mode.
</pre>

{{Note|This information used to be maintained in {{Path|/etc/lbu/include}}; now it's instead maintained together with the ''exclude'' list in {{Path|/etc/apk/protected_paths.d/lbu.list}}. Either way, the command <code>lbu include</code> only modifies lbu's configuration; you will need to run <code>lbu commit</code> to actually create/modify your apkovl.}}

== Exclude specific files/folders from the apkovl ==
Assume that you have some files located in {{Path|/etc}} or one of its subfolders that you ''do not'' want to permanently save.
It could be some log file or status file that for some reason isn't in {{Path|/var/log/}} but in some location that would otherwise be tracked by <code>lbu</code>.
Such files/folders can be added to lbu's ''exclude'' list by manually editing that file or using the following command:
<pre>
usage: lbu exclude|ex|delete [-rv] <file> ...
lbu exclude|ex|delete [-v] -l

Options:
-l List contents of exclude list.
-r Remove specified file(s) from exclude list instead of adding.
-v Verbose mode.
</pre>
{{Note|As stated above, this information is now maintained in {{Path|/etc/apk/protected_paths.d/lbu.list}}. The command <code>lbu exclude</code> also only modifies lbu's configuration; you will need to run <code>lbu commit</code> to actually create/modify your apkovl.}}

== Execute a script as part of a backup ==

Sometimes it is necessary to run a script before or after a backup. Scripts in two optional directories allow for this:

/etc/lbu/pre-package.d
/etc/lbu/post-package.d

Files in those directories are run using run-script rules (meaning they must have the executable bit set, they are run in alphabetical order, and cannot contain an extension: {{Path|runme}} works, but {{Path|runme.sh}} does not.)

The scripts in {{Path|pre-package.d}} are run before the apkovl is created; scripts in {{Path|post-package.d}} are run after the apkovl is created.

=== Example ===

Rather than adding the raw database directories to {{Path|/etc/lbu/include}}, you can do a "database dump". For purposes of example, we use {{Pkg|postgresql}}:

* Create {{Path|/etc/lbu/pre-package.d/sqldump}} with the following contents: <pre>pg_dumpall -U postgres | gzip -c >/root/pgdatabases.gz</pre>
* Mark the file executable: <code>chmod +x /etc/lbu/pre-package.d/sqldump</code>
* Create {{Path|/etc/lbu/post-package.d/sqldumpdelete}} with the following contents: <pre>rm -f /root/pgdatabases.gz</pre>
* Mark the file executable: <code>chmod +x /etc/lbu/post-package.d/sqldumpdelete</code>
* Finally, add the database dump file to the list of files to back up: <code>lbu include root/pgdatabases.gz</code>

Now whenever you do a <code>lbu commit</code>, the sql databases are dumped and gzipped to {{Path|/root/pgdatabases.gz}}, and then the temporary file is deleted at the end of the lbu commit.

On a catastrophic restore, the databases are not automatically restored (that's not lbu's responsibility), but you will find a complete database dump in the {{Path|/root}} directory, where it can be restored manually.

== Multiple Backups ==
Lbu can now keep backups so you can revert to older, good known config.
Set BACKUP_LIMIT in {{Path|/etc/lbu/lbu.conf}} to the number of backups you want
to keep.

You can list the current backups with:

{{Cmd|lbu list-backup [<media>]}}

and you can revert to an older with:

{{Cmd|lbu revert <filename> [<media>]}}

Nothing is written to your main system when "reverting"; this only affects which apkovl is considered active. If you've set BACKUP_LIMIT, then the previously active apkovl will be backed up before being overwritten.

== See also ==
* [[Back Up a Flash Memory Installation]]
* [[Manually editing a existing apkovl]]

[[Category:Installation]]

[[Category:Booting]]
[[Category:Package Manager]]
[[category: LBU]]

Category:Diskless

2019-10-31T08:00:39Z

Innsill: Created page with "category: Storage"

[[category: Storage]]

Alpine on ARM

2019-10-30T21:34:02Z

Innsill: + link dtb

{{TOC right}}
{{Draft}}
{{Style}}
{{Move|ARM SOCs}}

(this page is WIP, most info are incomplete and some might be incorrect)
==Supported SoCs==
Currently Alpine supports armv6/armhf arch on the following SoCs
(This is taken from the DTBs which Alpine includes)
{| class="wikitable collapsible"
| am335x-base0033
| am335x-bone
| am335x-boneblack
| am335x-evm
| am335x-evmsk
| am335x-nano
| am335x-pepper
| am3517-craneboard
| am3517-evm
| am3517_mt_ventoux
| am437x-gp-evm
|-
| am437x-sk-evm
| am43x-epos-evm
| exynos4210-origen
| exynos4210-smdkv310
| exynos4210-trats
| exynos4210-universal_c210
| exynos4412-odroidu3
| exynos4412-odroidx
| exynos4412-odroidx2
| exynos4412-origen
| exynos4412-smdk4412
| exynos4412-tiny4412
|-
| exynos4412-trats2
| exynos5250-arndale
| exynos5250-smdk5250
| exynos5250-snow
| exynos5260-xyref5260
| exynos5410-smdk5410
| exynos5420-arndale-octa
| exynos5420-peach-pit
| exynos5420-smdk5420
| exynos5440-sd5v1
| exynos5440-ssdk5440
| exynos5800-peach-pi
|-
| imx1-ads
| imx1-apf9328
| imx25-eukrea-mbimxsd25-baseboard-cmo-qvga
| imx25-eukrea-mbimxsd25-baseboard-dvi-svga
| imx25-eukrea-mbimxsd25-baseboard-dvi-vga
| imx25-eukrea-mbimxsd25-baseboard
| imx25-karo-tx25
| imx25-pdk
| imx27-apf27
| imx27-apf27dev
| imx27-eukrea-mbimxsd27-baseboard
| imx27-pdk
|-
| imx27-phytec-phycard-s-rdk
| imx27-phytec-phycore-rdk
| imx31-bug
| imx35-eukrea-mbimxsd35-baseboard
| imx35-pdk
| imx50-evk
| imx51-apf51
| imx51-apf51dev
| imx51-babbage
| imx51-digi-connectcore-jsk
| imx51-eukrea-mbimxsd51-baseboard
| imx53-ard
|-
| imx53-m53evk
| imx53-mba53
| imx53-qsb
| imx53-qsrb
| imx53-smd
| imx53-tx53-x03x
| imx53-tx53-x13x
| imx53-voipac-bsb
| imx6dl-aristainetos_4
| imx6dl-aristainetos_7
| imx6dl-cubox-i
| imx6dl-dfi-fs700-m60
|-
| imx6dl-gw51xx
| imx6dl-gw52xx
| imx6dl-gw53xx
| imx6dl-gw54xx
| imx6dl-gw552x
| imx6dl-hummingboard
| imx6dl-nitrogen6x
| imx6dl-phytec-pbab01
| imx6dl-rex-basic
| imx6dl-riotboard
| imx6dl-sabreauto
| imx6dl-sabrelite
|-
| imx6dl-sabresd
| imx6dl-tx6dl-comtft
| imx6dl-tx6u-801x
| imx6dl-tx6u-811x
| imx6dl-wandboard-revb1
| imx6dl-wandboard
| imx6q-arm2
| imx6q-cm-fx6
| imx6q-cubox-i
| imx6q-dfi-fs700-m60
| imx6q-dmo-edmqmx6
| imx6q-gk802
|-
| imx6q-gw51xx
| imx6q-gw52xx
| imx6q-gw53xx
| imx6q-gw5400-a
| imx6q-gw54xx
| imx6q-gw552x
| imx6q-hummingboard
| imx6q-nitrogen6x
| imx6q-phytec-pbab01
| imx6q-rex-pro
| imx6q-sabreauto
| imx6q-sabrelite
|-
| imx6q-sabresd
| imx6q-sbc6x
| imx6q-tx6q-1010-comtft
| imx6q-tx6q-1010
| imx6q-tx6q-1020-comtft
| imx6q-tx6q-1020
| imx6q-tx6q-1110
| imx6q-udoo
| imx6q-wandboard-revb1
| imx6q-wandboard
| imx6sl-evk
| imx6sx-sdb
|-
| omap3-beagle-xm-ab
| omap3-beagle-xm
| omap3-beagle
| omap3-cm-t3517
| omap3-cm-t3530
| omap3-cm-t3730
| omap3-devkit8000
| omap3-evm-37xx
| omap3-evm
| omap3-gta04a3
| omap3-gta04a4
| omap3-gta04a5
|-
| omap3-ha-lcd
| omap3-ha
| omap3-igep0020
| omap3-igep0030
| omap3-ldp
| omap3-lilly-dbb056
| omap3-n9
| omap3-n900
| omap3-n950
| omap3-overo-alto35
| omap3-overo-chestnut43
| omap3-overo-gallop43
|-
| omap3-overo-palo43
| omap3-overo-storm-alto35
| omap3-overo-storm-chestnut43
| omap3-overo-storm-gallop43
| omap3-overo-storm-palo43
| omap3-overo-storm-summit
| omap3-overo-storm-tobi
| omap3-overo-summit
| omap3-overo-tobi
| omap3-sbc-t3517
| omap3-sbc-t3530
| omap3-sbc-t3730
|-
| omap3-thunder
| omap3-zoom3
| omap3430-sdp
| omap4-duovero-parlor
| omap4-panda-a4
| omap4-panda-es
| omap4-panda
| omap4-sdp-es23plus
| omap4-sdp
| omap4-var-dvk-om44
| omap4-var-stk-om44
| omap5-cm-t54
|-
| omap5-sbc-t54
| omap5-uevm
| qcom-apq8064-cm-qs600
| qcom-apq8064-ifc6410
| qcom-apq8074-dragonboard
| qcom-apq8084-ifc6540
| qcom-apq8084-mtp
| qcom-ipq8064-ap148
| qcom-msm8660-surf
| qcom-msm8960-cdp
| qcom-msm8974-sony-xperia-honami
| sun4i-a10-a1000
|-
| sun4i-a10-ba10-tvbox
| sun4i-a10-cubieboard
| sun4i-a10-hackberry
| sun4i-a10-inet97fv2
| sun4i-a10-mini-xplus
| sun4i-a10-olinuxino-lime
| sun4i-a10-pcduino
| sun5i-a10s-olinuxino-micro
| sun5i-a10s-r7-tv-dongle
| sun5i-a13-hsg-h702
| sun5i-a13-olinuxino-micro
| sun5i-a13-olinuxino
|-
| sun6i-a31-app4-evb1
| sun6i-a31-colombus
| sun6i-a31-hummingbird
| sun6i-a31-m9
| sun7i-a20-cubieboard2
| sun7i-a20-cubietruck
| sun7i-a20-hummingbird
| sun7i-a20-i12-tvbox
| sun7i-a20-olinuxino-lime
| sun7i-a20-olinuxino-micro
| sun7i-a20-pcduino3
| sun8i-a23-ippo-q8h-v5
|-
| vexpress-v2p-ca15-tc1
| vexpress-v2p-ca15_a7
| vexpress-v2p-ca5s
| vexpress-v2p-ca9
| vf610-colibri-eval-v3
| vf610-cosmic
| vf610-twr
|}
===Install Alpine on supported SoCs===
(If anyone has any of the above device and has successfully install Alpine on it, please consider to add the missing info)

==Unupported SoCs==
If you have an armv6/armv7 SoC which is not listed above but is supported by mainline uboot/kernel then it's still possible to install Alpine
===Requiremnets===
* Alpine's forked uboot to support tarballs (fabled?)
* serial console
* crosscompiler/toolchain if you can not compile natively
===The embedded world===
A lot of the SoCs have their own way of doing things, although they use uboot and Linux kernel but often they are heavily modified to suit easy flashing of "ROMs" or other unknown reasons, e.g. Rockchip's notion "partition" are neither DOS nor GPT partitions.
We are to discuss to install Alpine in a more standard way like x86 with either DOS or GPT partitions. You will most likely have to install/flash the mainline uboot, which can be non-destructive if you use external storage.

====Storage====
One can load uboot from the following block devices if it's supported.
* NAND
* eMMC
* SD card
* USB

====Power on====
Some SoCs need both SPL and uboot, you need to check uboot for your board. Most (if not all) boards boots from the internal storage first (either NAND or eMMC) you will have to check documentation of your board if you wish to boot the SPL/uboot from SD/USB.

One can view SPL+uboot as BIOS and boot-loader on PC. Think that you could put the BIOS on an external storage :D

Once you have loaded the "standard" uboot, things are more or less like on x86.

====Partitioning====
Either DOS or GPT patitions should work, start of the first partition should be on block 2048 so there are space for SPL/uboot and marked bootable (with
the MBR bootable flag, or GPT legacy_bios_bootable attribute).
* SPL starts at block 64 (please consult the docs for your board)
* uboot starts at block 256 (please consult the docs for your board)
Just dd SPL and boot with the correct offset to the media you wish to boot

====Booting Linux kernel====
* uboot uses extlinux.conf file to locate the kernel/initramfs/... just like syslinx, you need to put that file on the partitions which is marked bootable in the /boot directory
* there should be an extra line "FDTDIR" which points to the DTBs
e.g.
<pre>
label Fedora (3.17.0-0.rc4.git2.1.fc22.armv7hl) 22 (Rawhide)
kernel /boot/vmlinuz-3.17.0-0.rc4.git2.1.fc22.armv7hl
append ro root=UUID=8eac677f-8ea8-4270-8479-d5ddbb797450 console=ttyS0,115200n8 LANG=en_US.UTF-8 drm.debug=0xf
fdtdir /boot/dtb-3.17.0-0.rc4.git2.1.fc22.armv7hl
initrd /boot/initramfs-3.17.0-0.rc4.git2.1.fc22.armv7hl.img
</pre>

==Using QEMU==
<pre>
qemu-system-arm -M vexpress-a9 -kernel zImage -initrd initramfs-grsec -dtb vexpress-v2p-ca9.dtb -hda hda.img -serial stdio
</pre>

==See also==
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]

== ==
* [http://www.armadeus.org/wiki/index.php?title=Kernel-with-device-tree dtb (Device Tree Binary)]
* [https://forum.odroid.com/viewtopic.php?t=30459 Odroid-C2] 2018 ''([https://archlinuxarm.org/platforms/armv8/amlogic/odroid-c2 ARMv8, AArch64])''
* [https://forum.odroid.com/viewtopic.php?f=138&t=32608 Alpine Linux custom build] 2018
* [https://cusdeb.com/ CusDeb.com] - Bootstrap SD-card images for single-board computers online; [https://github.com/tolstoyevsky/pieman Pieman]

[[Category:Hardware]]
[[category:ARM]]