Initial commit
This commit is contained in:
@@ -0,0 +1,22 @@
|
||||
vesperprofiled (1.0.0-1) trixie; urgency=medium
|
||||
|
||||
* Initial release for VesperOS 10.0 "Rainier".
|
||||
* Unified binary: profile daemon + ZTE client in one process.
|
||||
* Profile service: 55 payload types, CMS/PKCS#7 signature verification,
|
||||
PBKDF2-SHA256 removal password hashing, D-Bus system service.
|
||||
* WiFi/Ethernet: NetworkManager keyfile-based (no nmcli exec), full
|
||||
802.1X EAP support (TLS/PEAP/TTLS/EAP-FAST), WPA3-SAE, proxy.
|
||||
* ZTE client: DMI UUID/serial, board serial, machine-id, permanent MACs,
|
||||
EFI GUID, TPM detection. Priority-ordered primary serial derivation.
|
||||
SHA-256 hardware fingerprint for fuzzy server-side matching.
|
||||
* ZTE deferred enrollment: watches NetworkManager StateChanged and
|
||||
PropertiesChanged D-Bus signals; checks current state at startup.
|
||||
* Preinstalled profile support: applies profiles from
|
||||
/etc/vesperprofiled/preinstalled/ before cloud-init runs.
|
||||
* first-boot payload: suppresses GNOME Initial Setup and cloud-init
|
||||
wizard modules; writes cloud-init drop-in before cloud-init starts.
|
||||
* systemd ordering: Before=cloud-init-local.service ensures preinstalled
|
||||
profiles and ZTE drops are in place before cloud-init runs.
|
||||
* AppArmor profile included.
|
||||
|
||||
-- oxmc <packages@oxmc.me> Sun, 19 Apr 2026 00:00:00 +0000
|
||||
@@ -0,0 +1,17 @@
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
|
||||
# The following line should be removed in trixie or trixie+1
|
||||
deb-systemd-helper unmask 'vesperprofiled.service' >/dev/null || true
|
||||
|
||||
# was-enabled defaults to true, so new installations run enable.
|
||||
if deb-systemd-helper --quiet was-enabled 'vesperprofiled.service'; then
|
||||
# Enables the unit on first installation, creates new
|
||||
# symlinks on upgrades if the unit file has changed.
|
||||
deb-systemd-helper enable 'vesperprofiled.service' >/dev/null || true
|
||||
else
|
||||
# Update the statefile to add new symlinks (if any), which need to be
|
||||
# cleaned up on purge. Also remove old symlinks.
|
||||
deb-systemd-helper update-state 'vesperprofiled.service' >/dev/null || true
|
||||
fi
|
||||
fi
|
||||
# End automatically added section
|
||||
@@ -0,0 +1,5 @@
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ -z "${DPKG_ROOT:-}" ] && [ "$1" = upgrade ] && [ -d /run/systemd/system ] ; then
|
||||
deb-systemd-invoke stop 'vesperprofiled.service' >/dev/null || true
|
||||
fi
|
||||
# End automatically added section
|
||||
@@ -0,0 +1 @@
|
||||
3a272b0b159fbe1f2432ddef9ebc077884e5069b
|
||||
@@ -0,0 +1,13 @@
|
||||
Package: vesperprofiled-dbgsym
|
||||
Package-Type: ddeb
|
||||
Source: vesperprofiled
|
||||
Version: 1.0.0-1
|
||||
Auto-Built-Package: debug-symbols
|
||||
Architecture: amd64
|
||||
Maintainer: oxmc <packages@oxmc.me>
|
||||
Installed-Size: 955
|
||||
Depends: vesperprofiled (= 1.0.0-1)
|
||||
Section: debug
|
||||
Priority: optional
|
||||
Description: debug symbols for vesperprofiled
|
||||
Build-Ids: 3a272b0b159fbe1f2432ddef9ebc077884e5069b
|
||||
@@ -0,0 +1 @@
|
||||
5ef0e80bb06ea08211fa57c6228a7a02 usr/lib/debug/.build-id/3a/272b0b159fbe1f2432ddef9ebc077884e5069b.debug
|
||||
BIN
Binary file not shown.
+1
@@ -0,0 +1 @@
|
||||
vesperprofiled
|
||||
Vendored
+22
@@ -0,0 +1,22 @@
|
||||
vesperprofiled (1.0.0-1) trixie; urgency=medium
|
||||
|
||||
* Initial release for VesperOS 10.0 "Rainier".
|
||||
* Unified binary: profile daemon + ZTE client in one process.
|
||||
* Profile service: 55 payload types, CMS/PKCS#7 signature verification,
|
||||
PBKDF2-SHA256 removal password hashing, D-Bus system service.
|
||||
* WiFi/Ethernet: NetworkManager keyfile-based (no nmcli exec), full
|
||||
802.1X EAP support (TLS/PEAP/TTLS/EAP-FAST), WPA3-SAE, proxy.
|
||||
* ZTE client: DMI UUID/serial, board serial, machine-id, permanent MACs,
|
||||
EFI GUID, TPM detection. Priority-ordered primary serial derivation.
|
||||
SHA-256 hardware fingerprint for fuzzy server-side matching.
|
||||
* ZTE deferred enrollment: watches NetworkManager StateChanged and
|
||||
PropertiesChanged D-Bus signals; checks current state at startup.
|
||||
* Preinstalled profile support: applies profiles from
|
||||
/etc/vesperprofiled/preinstalled/ before cloud-init runs.
|
||||
* first-boot payload: suppresses GNOME Initial Setup and cloud-init
|
||||
wizard modules; writes cloud-init drop-in before cloud-init starts.
|
||||
* systemd ordering: Before=cloud-init-local.service ensures preinstalled
|
||||
profiles and ZTE drops are in place before cloud-init runs.
|
||||
* AppArmor profile included.
|
||||
|
||||
-- oxmc <packages@oxmc.me> Sun, 19 Apr 2026 00:00:00 +0000
|
||||
Vendored
+65
@@ -0,0 +1,65 @@
|
||||
Source: vesperprofiled
|
||||
Section: admin
|
||||
Priority: optional
|
||||
Maintainer: oxmc <packages@oxmc.me>
|
||||
Build-Depends:
|
||||
debhelper-compat (= 13),
|
||||
cmake (>= 3.18),
|
||||
libssl-dev (>= 3.0),
|
||||
libyaml-dev,
|
||||
libdbus-1-dev,
|
||||
libsystemd-dev,
|
||||
libcurl4-openssl-dev,
|
||||
pkg-config
|
||||
Standards-Version: 4.7.0
|
||||
Homepage: https://vesperos.oxmc.me
|
||||
Vcs-Git: https://git.oxmc.me/vesperos/vesperprofiled.git
|
||||
|
||||
Package: vesperprofiled
|
||||
Architecture: any
|
||||
Depends:
|
||||
${shlibs:Depends},
|
||||
${misc:Depends},
|
||||
vesperprofiled-config-schema (>= 1.0.0),
|
||||
libssl3 (>= 3.0),
|
||||
libyaml-0-2,
|
||||
libdbus-1-3,
|
||||
libsystemd0,
|
||||
libcurl4,
|
||||
dbus,
|
||||
network-manager,
|
||||
ca-certificates
|
||||
Recommends:
|
||||
cloud-init,
|
||||
nftables,
|
||||
network-manager-strongswan,
|
||||
network-manager-l2tp,
|
||||
libnss3-tools,
|
||||
libpam-pwquality,
|
||||
libpam-faillock,
|
||||
unattended-upgrades,
|
||||
dconf-cli,
|
||||
tpm2-tools
|
||||
Suggests:
|
||||
vesper-zte-server,
|
||||
vesperos-ca
|
||||
Description: VesperOS configuration profile daemon with Zero-Touch Enrollment
|
||||
vesperprofiled is the unified device management daemon for VesperOS.
|
||||
It ships as a single binary containing two subsystems:
|
||||
.
|
||||
Profile Service — parses, verifies, and applies .vconfig configuration
|
||||
profiles. Profiles are YAML files optionally wrapped in a CMS/PKCS#7
|
||||
signed envelope. Which payload types are accepted is controlled by the
|
||||
installed vesperprofiled-config-schema package, allowing OEMs to restrict
|
||||
the available configuration surface for their platform.
|
||||
.
|
||||
ZTE Client — Zero-Touch Enrollment. Collects hardware identity (DMI UUID,
|
||||
system/board serial, machine-id, permanent MAC addresses, EFI GUID) and
|
||||
queries a ZTE lookup server on first internet connection. If the device is
|
||||
registered, the signed MDM enrollment profile is downloaded and installed
|
||||
automatically. Deferred enrollment is fully supported: if no network is
|
||||
available at first boot, the ZTE client enrolls on first connectivity.
|
||||
.
|
||||
The profile service is exposed as a D-Bus system service at
|
||||
me.oxmc.vesperos.ProfileService. The ZTE client runs as a background
|
||||
thread in the same process.
|
||||
Vendored
+1
@@ -0,0 +1 @@
|
||||
vesperprofiled
|
||||
Vendored
+3
@@ -0,0 +1,3 @@
|
||||
vesperprofiled-dbgsym_1.0.0-1_amd64.ddeb debug optional automatic=yes
|
||||
vesperprofiled_1.0.0-1_amd64.buildinfo admin optional
|
||||
vesperprofiled_1.0.0-1_amd64.deb admin optional
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
configure)
|
||||
# Data directories
|
||||
install -d -m 0700 /var/lib/vesperprofiled
|
||||
install -d -m 0700 /var/lib/vesperprofiled/profiles
|
||||
install -d -m 0755 /etc/vesperprofiled
|
||||
install -d -m 0755 /etc/vesperprofiled/preinstalled
|
||||
|
||||
# AppArmor
|
||||
if command -v aa-enabled >/dev/null 2>&1 && aa-enabled >/dev/null 2>&1; then
|
||||
if command -v apparmor_parser >/dev/null 2>&1; then
|
||||
apparmor_parser -r /etc/apparmor.d/vesperprofiled || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# D-Bus reload
|
||||
if [ -d /run/dbus ] && command -v dbus-send >/dev/null 2>&1; then
|
||||
dbus-send --system \
|
||||
--dest=org.freedesktop.DBus \
|
||||
--type=method_call \
|
||||
/org/freedesktop/DBus \
|
||||
org.freedesktop.DBus.ReloadConfig 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# systemd
|
||||
if command -v systemctl >/dev/null 2>&1 && \
|
||||
systemctl is-system-running --quiet 2>/dev/null; then
|
||||
systemctl daemon-reload
|
||||
systemctl enable vesperprofiled.service
|
||||
systemctl start vesperprofiled.service || true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
#DEBHELPER#
|
||||
exit 0
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
purge)
|
||||
rm -rf /var/lib/vesperprofiled
|
||||
rm -rf /etc/vesperprofiled
|
||||
# Remove all managed config drops
|
||||
rm -f /etc/apt/apt.conf.d/99-vesperos-update
|
||||
rm -f /etc/apt/apt.conf.d/99-vesperos-proxy
|
||||
rm -f /etc/NetworkManager/conf.d/vesperos-proxy.conf
|
||||
rm -f /etc/systemd/timesyncd.conf.d/vesperos.conf
|
||||
rm -f /etc/systemd/resolved.conf.d/vesperos-dns.conf
|
||||
rm -f /etc/security/pwquality.conf.d/vesperos.conf
|
||||
rm -f /etc/security/faillock.conf.d/vesperos.conf
|
||||
rm -f /etc/nftables.d/vesperos.nft
|
||||
rm -f /etc/profile.d/vesperos-proxy.sh
|
||||
rm -f /etc/cloud/cloud.cfg.d/99-vesperos-mdm.cfg
|
||||
rm -f /etc/cloud/cloud.cfg.d/99-vesperos-firstboot.cfg
|
||||
rm -f /etc/dconf/db/local.d/00-vesperos-wallpaper
|
||||
rm -f /etc/dconf/db/local.d/00-vesperos-screensaver
|
||||
rm -f /etc/dconf/db/local.d/00-vesperos-firstboot
|
||||
rm -f /etc/dconf/db/local.d/locks/vesperos-wallpaper
|
||||
rm -f /etc/dconf/db/local.d/locks/vesperos-screensaver
|
||||
rm -rf /usr/local/share/ca-certificates/vesperos
|
||||
rm -rf /etc/ssl/private/vesperos
|
||||
command -v update-ca-certificates >/dev/null 2>&1 && \
|
||||
update-ca-certificates --fresh 2>/dev/null || true
|
||||
command -v dconf >/dev/null 2>&1 && \
|
||||
dconf update 2>/dev/null || true
|
||||
dbus-send --system --dest=org.freedesktop.DBus \
|
||||
--type=method_call /org/freedesktop/DBus \
|
||||
org.freedesktop.DBus.ReloadConfig 2>/dev/null || true
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl daemon-reload || true
|
||||
fi
|
||||
;;
|
||||
remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl daemon-reload || true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
#DEBHELPER#
|
||||
exit 0
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
remove|upgrade|deconfigure)
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl stop vesperprofiled.service 2>/dev/null || true
|
||||
systemctl disable vesperprofiled.service 2>/dev/null || true
|
||||
fi
|
||||
if command -v apparmor_parser >/dev/null 2>&1 && \
|
||||
[ -f /etc/apparmor.d/vesperprofiled ]; then
|
||||
apparmor_parser -R /etc/apparmor.d/vesperprofiled 2>/dev/null || true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
#DEBHELPER#
|
||||
exit 0
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
#!/usr/bin/make -f
|
||||
export DH_VERBOSE = 1
|
||||
export DEB_BUILD_MAINT_OPTIONS = hardening=+all
|
||||
|
||||
%:
|
||||
dh $@ --buildsystem=cmake --builddirectory=obj-$(DEB_HOST_GNU_TYPE)
|
||||
|
||||
override_dh_auto_configure:
|
||||
dh_auto_configure -- \
|
||||
-DCMAKE_BUILD_TYPE=Release \
|
||||
-DCMAKE_INSTALL_PREFIX=/usr \
|
||||
-DCMAKE_INSTALL_SYSCONFDIR=/etc \
|
||||
-DCMAKE_INSTALL_LOCALSTATEDIR=/var
|
||||
|
||||
override_dh_auto_install:
|
||||
dh_auto_install
|
||||
install -Dm 0644 dbus/me.oxmc.vesperos.ProfileService.conf \
|
||||
debian/vesperprofiled/etc/dbus-1/system.d/me.oxmc.vesperos.ProfileService.conf
|
||||
install -Dm 0644 apparmor/vesperprofiled \
|
||||
debian/vesperprofiled/etc/apparmor.d/vesperprofiled
|
||||
install -d -m 0755 debian/vesperprofiled/etc/vesperprofiled
|
||||
install -d -m 0755 debian/vesperprofiled/etc/vesperprofiled/preinstalled
|
||||
install -d -m 0700 debian/vesperprofiled/var/lib/vesperprofiled/profiles
|
||||
install -Dm 0640 zte.conf.example \
|
||||
debian/vesperprofiled/etc/vesperprofiled/zte.conf.example
|
||||
|
||||
override_dh_installsystemd:
|
||||
dh_installsystemd --name=vesperprofiled --no-start
|
||||
Vendored
+1
@@ -0,0 +1 @@
|
||||
3.0 (native)
|
||||
Vendored
+1
@@ -0,0 +1 @@
|
||||
dh_installsystemd
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ "$1" = remove ] && [ -d /run/systemd/system ] ; then
|
||||
systemctl --system daemon-reload >/dev/null || true
|
||||
fi
|
||||
# End automatically added section
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ "$1" = "purge" ]; then
|
||||
if [ -x "/usr/bin/deb-systemd-helper" ]; then
|
||||
deb-systemd-helper purge 'vesperprofiled.service' >/dev/null || true
|
||||
fi
|
||||
fi
|
||||
# End automatically added section
|
||||
Vendored
+3
@@ -0,0 +1,3 @@
|
||||
shlibs:Depends=libc6 (>= 2.38), libcurl4t64 (>= 7.16.2), libdbus-1-3 (>= 1.9.14), libgcc-s1 (>= 3.3.1), libssl3t64 (>= 3.0.0), libstdc++6 (>= 11), libsystemd0, libyaml-0-2
|
||||
misc:Depends=
|
||||
misc:Pre-Depends=
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
/etc/apparmor.d/vesperprofiled
|
||||
/etc/dbus-1/system.d/me.oxmc.vesperos.ProfileService.conf
|
||||
/etc/vesperprofiled/zte.conf.example
|
||||
Vendored
+31
@@ -0,0 +1,31 @@
|
||||
Package: vesperprofiled
|
||||
Version: 1.0.0-1
|
||||
Architecture: amd64
|
||||
Maintainer: oxmc <packages@oxmc.me>
|
||||
Installed-Size: 245
|
||||
Depends: libc6 (>= 2.38), libcurl4t64 (>= 7.16.2), libdbus-1-3 (>= 1.9.14), libgcc-s1 (>= 3.3.1), libssl3t64 (>= 3.0.0), libstdc++6 (>= 11), libsystemd0, libyaml-0-2, vesperprofiled-config-schema (>= 1.0.0), libssl3 (>= 3.0), libcurl4, dbus, network-manager, ca-certificates
|
||||
Recommends: cloud-init, nftables, network-manager-strongswan, network-manager-l2tp, libnss3-tools, libpam-pwquality, libpam-faillock, unattended-upgrades, dconf-cli, tpm2-tools
|
||||
Suggests: vesper-zte-server, vesperos-ca
|
||||
Section: admin
|
||||
Priority: optional
|
||||
Homepage: https://vesperos.oxmc.me
|
||||
Description: VesperOS configuration profile daemon with Zero-Touch Enrollment
|
||||
vesperprofiled is the unified device management daemon for VesperOS.
|
||||
It ships as a single binary containing two subsystems:
|
||||
.
|
||||
Profile Service — parses, verifies, and applies .vconfig configuration
|
||||
profiles. Profiles are YAML files optionally wrapped in a CMS/PKCS#7
|
||||
signed envelope. Which payload types are accepted is controlled by the
|
||||
installed vesperprofiled-config-schema package, allowing OEMs to restrict
|
||||
the available configuration surface for their platform.
|
||||
.
|
||||
ZTE Client — Zero-Touch Enrollment. Collects hardware identity (DMI UUID,
|
||||
system/board serial, machine-id, permanent MAC addresses, EFI GUID) and
|
||||
queries a ZTE lookup server on first internet connection. If the device is
|
||||
registered, the signed MDM enrollment profile is downloaded and installed
|
||||
automatically. Deferred enrollment is fully supported: if no network is
|
||||
available at first boot, the ZTE client enrolls on first connectivity.
|
||||
.
|
||||
The profile service is exposed as a D-Bus system service at
|
||||
me.oxmc.vesperos.ProfileService. The ZTE client runs as a background
|
||||
thread in the same process.
|
||||
Vendored
+3
@@ -0,0 +1,3 @@
|
||||
af865abb638806188b22085ca4d5fe77 usr/lib/systemd/system/vesperprofiled.service
|
||||
f1b630bbe5f876dbba858c4b3fd38d5e usr/sbin/vesperprofiled
|
||||
5af38dfb23cecbc388fed5881748e63b usr/share/doc/vesperprofiled/changelog.Debian.gz
|
||||
+56
@@ -0,0 +1,56 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
configure)
|
||||
# Data directories
|
||||
install -d -m 0700 /var/lib/vesperprofiled
|
||||
install -d -m 0700 /var/lib/vesperprofiled/profiles
|
||||
install -d -m 0755 /etc/vesperprofiled
|
||||
install -d -m 0755 /etc/vesperprofiled/preinstalled
|
||||
|
||||
# AppArmor
|
||||
if command -v aa-enabled >/dev/null 2>&1 && aa-enabled >/dev/null 2>&1; then
|
||||
if command -v apparmor_parser >/dev/null 2>&1; then
|
||||
apparmor_parser -r /etc/apparmor.d/vesperprofiled || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# D-Bus reload
|
||||
if [ -d /run/dbus ] && command -v dbus-send >/dev/null 2>&1; then
|
||||
dbus-send --system \
|
||||
--dest=org.freedesktop.DBus \
|
||||
--type=method_call \
|
||||
/org/freedesktop/DBus \
|
||||
org.freedesktop.DBus.ReloadConfig 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# systemd
|
||||
if command -v systemctl >/dev/null 2>&1 && \
|
||||
systemctl is-system-running --quiet 2>/dev/null; then
|
||||
systemctl daemon-reload
|
||||
systemctl enable vesperprofiled.service
|
||||
systemctl start vesperprofiled.service || true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
|
||||
# The following line should be removed in trixie or trixie+1
|
||||
deb-systemd-helper unmask 'vesperprofiled.service' >/dev/null || true
|
||||
|
||||
# was-enabled defaults to true, so new installations run enable.
|
||||
if deb-systemd-helper --quiet was-enabled 'vesperprofiled.service'; then
|
||||
# Enables the unit on first installation, creates new
|
||||
# symlinks on upgrades if the unit file has changed.
|
||||
deb-systemd-helper enable 'vesperprofiled.service' >/dev/null || true
|
||||
else
|
||||
# Update the statefile to add new symlinks (if any), which need to be
|
||||
# cleaned up on purge. Also remove old symlinks.
|
||||
deb-systemd-helper update-state 'vesperprofiled.service' >/dev/null || true
|
||||
fi
|
||||
fi
|
||||
# End automatically added section
|
||||
|
||||
exit 0
|
||||
+58
@@ -0,0 +1,58 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
purge)
|
||||
rm -rf /var/lib/vesperprofiled
|
||||
rm -rf /etc/vesperprofiled
|
||||
# Remove all managed config drops
|
||||
rm -f /etc/apt/apt.conf.d/99-vesperos-update
|
||||
rm -f /etc/apt/apt.conf.d/99-vesperos-proxy
|
||||
rm -f /etc/NetworkManager/conf.d/vesperos-proxy.conf
|
||||
rm -f /etc/systemd/timesyncd.conf.d/vesperos.conf
|
||||
rm -f /etc/systemd/resolved.conf.d/vesperos-dns.conf
|
||||
rm -f /etc/security/pwquality.conf.d/vesperos.conf
|
||||
rm -f /etc/security/faillock.conf.d/vesperos.conf
|
||||
rm -f /etc/nftables.d/vesperos.nft
|
||||
rm -f /etc/profile.d/vesperos-proxy.sh
|
||||
rm -f /etc/cloud/cloud.cfg.d/99-vesperos-mdm.cfg
|
||||
rm -f /etc/cloud/cloud.cfg.d/99-vesperos-firstboot.cfg
|
||||
rm -f /etc/dconf/db/local.d/00-vesperos-wallpaper
|
||||
rm -f /etc/dconf/db/local.d/00-vesperos-screensaver
|
||||
rm -f /etc/dconf/db/local.d/00-vesperos-firstboot
|
||||
rm -f /etc/dconf/db/local.d/locks/vesperos-wallpaper
|
||||
rm -f /etc/dconf/db/local.d/locks/vesperos-screensaver
|
||||
rm -rf /usr/local/share/ca-certificates/vesperos
|
||||
rm -rf /etc/ssl/private/vesperos
|
||||
command -v update-ca-certificates >/dev/null 2>&1 && \
|
||||
update-ca-certificates --fresh 2>/dev/null || true
|
||||
command -v dconf >/dev/null 2>&1 && \
|
||||
dconf update 2>/dev/null || true
|
||||
dbus-send --system --dest=org.freedesktop.DBus \
|
||||
--type=method_call /org/freedesktop/DBus \
|
||||
org.freedesktop.DBus.ReloadConfig 2>/dev/null || true
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl daemon-reload || true
|
||||
fi
|
||||
;;
|
||||
remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl daemon-reload || true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ "$1" = remove ] && [ -d /run/systemd/system ] ; then
|
||||
systemctl --system daemon-reload >/dev/null || true
|
||||
fi
|
||||
# End automatically added section
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ "$1" = "purge" ]; then
|
||||
if [ -x "/usr/bin/deb-systemd-helper" ]; then
|
||||
deb-systemd-helper purge 'vesperprofiled.service' >/dev/null || true
|
||||
fi
|
||||
fi
|
||||
# End automatically added section
|
||||
|
||||
exit 0
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
# Automatically added by dh_installsystemd/13.14.1ubuntu5
|
||||
if [ -z "${DPKG_ROOT:-}" ] && [ "$1" = upgrade ] && [ -d /run/systemd/system ] ; then
|
||||
deb-systemd-invoke stop 'vesperprofiled.service' >/dev/null || true
|
||||
fi
|
||||
# End automatically added section
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
case "$1" in
|
||||
remove|upgrade|deconfigure)
|
||||
if command -v systemctl >/dev/null 2>&1; then
|
||||
systemctl stop vesperprofiled.service 2>/dev/null || true
|
||||
systemctl disable vesperprofiled.service 2>/dev/null || true
|
||||
fi
|
||||
if command -v apparmor_parser >/dev/null 2>&1 && \
|
||||
[ -f /etc/apparmor.d/vesperprofiled ]; then
|
||||
apparmor_parser -R /etc/apparmor.d/vesperprofiled 2>/dev/null || true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
|
||||
exit 0
|
||||
+130
@@ -0,0 +1,130 @@
|
||||
# /etc/apparmor.d/vesperprofiled
|
||||
# AppArmor MAC profile for the vesperprofiled daemon.
|
||||
# Installed by the vesperprofiled Debian package.
|
||||
|
||||
#include <tunables/global>
|
||||
|
||||
/usr/sbin/vesperprofiled {
|
||||
#include <abstractions/base>
|
||||
#include <abstractions/nameservice>
|
||||
|
||||
# D-Bus (system bus access)
|
||||
#include <abstractions/dbus-strict>
|
||||
|
||||
# Own binary
|
||||
/usr/sbin/vesperprofiled mr,
|
||||
|
||||
# ── Profile store ─────────────────────────────────────────────────────────
|
||||
/var/lib/vesperprofiled/ rw,
|
||||
/var/lib/vesperprofiled/** rw,
|
||||
|
||||
# ── Config directories (profile drop-ins written here) ───────────────────
|
||||
/etc/vesperprofiled/ rw,
|
||||
/etc/vesperprofiled/** rw,
|
||||
/etc/NetworkManager/conf.d/ rw,
|
||||
/etc/NetworkManager/conf.d/** rw,
|
||||
/etc/NetworkManager/system-connections/ rw,
|
||||
/etc/NetworkManager/system-connections/** rw,
|
||||
/etc/apt/apt.conf.d/ rw,
|
||||
/etc/apt/apt.conf.d/** rw,
|
||||
/etc/cloud/cloud.cfg.d/ rw,
|
||||
/etc/cloud/cloud.cfg.d/** rw,
|
||||
/etc/systemd/timesyncd.conf.d/ rw,
|
||||
/etc/systemd/timesyncd.conf.d/** rw,
|
||||
/etc/systemd/resolved.conf.d/ rw,
|
||||
/etc/systemd/resolved.conf.d/** rw,
|
||||
/etc/security/pwquality.conf.d/ rw,
|
||||
/etc/security/pwquality.conf.d/** rw,
|
||||
/etc/security/faillock.conf.d/ rw,
|
||||
/etc/security/faillock.conf.d/** rw,
|
||||
/etc/nftables.d/ rw,
|
||||
/etc/nftables.d/** rw,
|
||||
/etc/ldap/ rw,
|
||||
/etc/ldap/** rw,
|
||||
/etc/nslcd.conf rw,
|
||||
/etc/profile.d/ rw,
|
||||
/etc/profile.d/** rw,
|
||||
/etc/dconf/db/local.d/ rw,
|
||||
/etc/dconf/db/local.d/** rw,
|
||||
/etc/ssl/private/vesperos/ rw,
|
||||
/etc/ssl/private/vesperos/** rw,
|
||||
/usr/local/share/ca-certificates/vesperos/ rw,
|
||||
/usr/local/share/ca-certificates/vesperos/** rw,
|
||||
/var/lib/gnome-initial-setup/ rw,
|
||||
/var/lib/gnome-initial-setup/** rw,
|
||||
|
||||
# ── Schema (read only — owned by vesperprofiled-config-schema) ────────────
|
||||
/usr/share/vesperprofiled/schema/ r,
|
||||
/usr/share/vesperprofiled/schema/* r,
|
||||
|
||||
# ── TLS / certificate paths (explicit — no abstractions/openssl on Debian) ─
|
||||
/etc/ssl/certs/ r,
|
||||
/etc/ssl/certs/** r,
|
||||
/etc/ssl/openssl.cnf r,
|
||||
/usr/lib/ssl/openssl.cnf r,
|
||||
/usr/share/ca-certificates/ r,
|
||||
/usr/share/ca-certificates/** r,
|
||||
/etc/vesperprofiled/profile_ca.pem r,
|
||||
|
||||
# ── D-Bus service registration ────────────────────────────────────────────
|
||||
dbus (send, receive, bind)
|
||||
bus=system
|
||||
name="me.oxmc.vesperos.ProfileService",
|
||||
dbus (send)
|
||||
bus=system
|
||||
interface="org.freedesktop.DBus"
|
||||
member="RequestName",
|
||||
dbus (send)
|
||||
bus=system
|
||||
interface="org.freedesktop.NetworkManager",
|
||||
dbus (receive)
|
||||
bus=system
|
||||
interface="org.freedesktop.NetworkManager",
|
||||
|
||||
# ── Executables called by payload handlers ────────────────────────────────
|
||||
/usr/sbin/update-ca-certificates Px,
|
||||
/usr/bin/dconf Px,
|
||||
/usr/bin/gsettings Px,
|
||||
/sbin/nft Px,
|
||||
/usr/sbin/nslcd Px,
|
||||
/usr/bin/pk12util Px,
|
||||
/bin/systemctl Px,
|
||||
/usr/bin/cloud-init Px,
|
||||
# nmcli is no longer used (WiFi/Ethernet use keyfiles directly),
|
||||
# but keep read access for diagnostics
|
||||
/usr/bin/nmcli ix,
|
||||
|
||||
# ── Network (ZTE HTTPS lookups via libcurl) ───────────────────────────────
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network inet dgram, # DNS resolution
|
||||
|
||||
# ── /proc and system info ─────────────────────────────────────────────────
|
||||
@{PROC}/@{pid}/status r,
|
||||
@{PROC}/sys/kernel/hostname r,
|
||||
/sys/class/dmi/id/ r,
|
||||
/sys/class/dmi/id/* r,
|
||||
/sys/class/net/ r,
|
||||
/sys/class/net/** r,
|
||||
/sys/firmware/efi/ r,
|
||||
/sys/firmware/efi/** r,
|
||||
/sys/class/tpm/ r,
|
||||
/etc/machine-id r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
# ── Logging ───────────────────────────────────────────────────────────────
|
||||
/run/systemd/journal/socket w,
|
||||
/run/systemd/notify w,
|
||||
/dev/log w,
|
||||
|
||||
# ── Lock file (ZTE enrollment serialisation) ──────────────────────────────
|
||||
/run/vesperprofiled/ rw,
|
||||
/run/vesperprofiled/** rw,
|
||||
|
||||
# ── Deny sensitive paths ──────────────────────────────────────────────────
|
||||
deny /home/** rw,
|
||||
deny /root/** rw,
|
||||
deny /boot/** rw,
|
||||
deny network raw,
|
||||
deny network packet,
|
||||
}
|
||||
+58
@@ -0,0 +1,58 @@
|
||||
<!DOCTYPE busconfig PUBLIC
|
||||
"-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
|
||||
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
||||
<!--
|
||||
/etc/dbus-1/system.d/me.oxmc.vesperos.ProfileService.conf
|
||||
D-Bus system bus policy for vesperprofiled.
|
||||
|
||||
Installed by the debian package postinst.
|
||||
Grants root the ability to own the service name and allows
|
||||
local system accounts to call its methods.
|
||||
-->
|
||||
<busconfig>
|
||||
|
||||
<!-- The daemon itself owns this name -->
|
||||
<policy user="root">
|
||||
<allow own="me.oxmc.vesperos.ProfileService"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"/>
|
||||
<allow receive_sender="me.oxmc.vesperos.ProfileService"/>
|
||||
</policy>
|
||||
|
||||
<!-- Admin group members can call all methods -->
|
||||
<policy group="sudo">
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"/>
|
||||
</policy>
|
||||
|
||||
<!-- The vesperos installer UI (runs as current user) can install profiles.
|
||||
InstallProfile requires PolicyKit authorization (see the .policy file). -->
|
||||
<policy at_console="true">
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="InstallProfile"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="ListProfiles"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="GetProfileInfo"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="IsDeviceManaged"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="IsSupervised"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="GetPayloadsOfType"/>
|
||||
<allow send_destination="me.oxmc.vesperos.ProfileService"
|
||||
send_interface="me.oxmc.vesperos.IProfileService"
|
||||
send_member="RemoveProfile"/>
|
||||
</policy>
|
||||
|
||||
<!-- Block everyone else by default -->
|
||||
<policy context="default">
|
||||
<deny send_destination="me.oxmc.vesperos.ProfileService"/>
|
||||
</policy>
|
||||
|
||||
</busconfig>
|
||||
@@ -0,0 +1,34 @@
|
||||
# /etc/vesperprofiled/zte.conf
|
||||
# VesperOS Zero-Touch Enrollment configuration
|
||||
# ─────────────────────────────────────────────────────────────────────────
|
||||
# This file is read by vesper-zte on startup.
|
||||
# Lines beginning with # are comments.
|
||||
# All settings are optional — defaults are shown.
|
||||
|
||||
# ZTE lookup server URL.
|
||||
# Default: https://zte.vesperos.oxmc.me (oxmc hosted, public)
|
||||
# Set this to your own server for self-hosted ZTE.
|
||||
#
|
||||
# server_url=https://zte.vesperos.oxmc.me
|
||||
|
||||
# Disable ZTE entirely on this device.
|
||||
# Set to "1" to prevent automatic enrollment.
|
||||
# Can also be set by writing "disabled" to /var/lib/vesperprofiled/zte_state.json
|
||||
#
|
||||
# disabled=0
|
||||
|
||||
# Maximum number of enrollment retry attempts before giving up.
|
||||
# 0 = retry indefinitely on every connectivity event.
|
||||
#
|
||||
# max_retries=0
|
||||
|
||||
# Delay between enrollment retries in seconds.
|
||||
# The actual delay uses exponential backoff up to this maximum.
|
||||
#
|
||||
# retry_max_delay=300
|
||||
|
||||
# TLS CA bundle for verifying the ZTE server certificate.
|
||||
# Override if you use a private CA for your self-hosted ZTE server.
|
||||
# The server certificate must chain to this CA.
|
||||
#
|
||||
# ca_bundle=/etc/ssl/certs/ca-certificates.crt
|
||||
@@ -0,0 +1,55 @@
|
||||
[Unit]
|
||||
Description=VesperOS Profile Daemon (profiles + Zero-Touch Enrollment)
|
||||
Documentation=https://vesperos.oxmc.me/docs/vesperprofiled
|
||||
|
||||
# Must run before cloud-init so preinstalled profiles (WiFi, MDM drop-ins,
|
||||
# first-boot config) are on disk when cloud-init starts.
|
||||
Before=cloud-init-local.service cloud-init.service
|
||||
After=local-fs.target dbus.service systemd-udev-settle.service
|
||||
|
||||
# Start after NetworkManager so ZTE can immediately check current
|
||||
# connectivity state rather than waiting for a StateChanged signal.
|
||||
After=NetworkManager.service
|
||||
# But don't hard-require NM — ZTE degrades gracefully if NM isn't present.
|
||||
Wants=NetworkManager.service
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
NotifyAccess=main
|
||||
|
||||
ExecStart=/usr/sbin/vesperprofiled
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
|
||||
User=root
|
||||
Group=root
|
||||
|
||||
# Restart the whole daemon (profile service + ZTE watcher) on crash.
|
||||
Restart=on-failure
|
||||
RestartSec=5s
|
||||
TimeoutStartSec=60
|
||||
|
||||
RuntimeDirectory=vesperprofiled
|
||||
RuntimeDirectoryMode=0750
|
||||
StateDirectory=vesperprofiled
|
||||
StateDirectoryMode=0700
|
||||
|
||||
# Writable paths — profile daemon writes config drops, ZTE writes state
|
||||
ReadWritePaths=/etc /var/lib/vesperprofiled /run/vesperprofiled \
|
||||
/var/lib/gnome-initial-setup
|
||||
|
||||
SystemCallFilter=@system-service @file-system @network-io @process
|
||||
SystemCallErrorNumber=EPERM
|
||||
|
||||
NoNewPrivileges=false
|
||||
PrivateTmp=true
|
||||
ProtectKernelLogs=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=vesperprofiled
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
WantedBy=cloud-init.target
|
||||
BIN
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user