Gaming Linux® From Scratch (OpenRC Edition) - Version #80a88

Chapter 5. Security

OpenRC-0.63

Introduction to OpenRC

OpenRC was already built in LFS/MLFS, but without Linux-PAM support. When PAM is enabled in OpenRC, it allows for user services, which some packages expect and makes using the system much easier.

OpenRC Dependencies

Recommended
Linux-PAM-1.7.2

Installation of OpenRC

Fix a script to allow a normal installation: 

sed -i '/set -u/d' tools/meson_final.sh

Install OpenRC by running the following commands: 

mkdir build &&
cd    build &&

meson setup --prefix=/usr       \
            --buildtype=release \
            .. &&
ninja

Now, as the root user: 

ninja install &&
mv -v /sbin/rc-update /bin

User services can be enabled in OpenRC with some setup. Some operations have to be done as the root user, while others have to be done for each user. Set up some groundwork as the root user: 

mkdir -pv /etc/user/{init,conf}.d

When you install a user service, you can enable it like so: 

mkdir -pv ~/.config/rc/{init,conf}.d &&
mkdir -pv ~/.config/rc/env &&
mkdir -pv ~/.config/rc/runlevels/{sysinit,boot,default,shutdown} &&
rc-update --user add <SERVICE_NAME> <RUNLEVEL>

Command Explanations

Note

Inspect meson_options.txt or meson.options for a full list of options.

Configuring elogind

Configuration Information

OpenRC and its helpers will need to associate with PAM. Help it by creating PAM configurations as the root user: 

cat >> /etc/pam.d/system-session << "EOF" &&
# Begin openrc addition

session  optional    pam_openrc.so

# End openrc addition
EOF
cat > /etc/pam.d/system-login << "EOF" &&
# Begin openrc addition

session  required   pam_env.so
session  optional   pam_elogind.so
session  optional   pam_openrc.so

# End openrc addition
EOF
cat > /etc/pam.d/openrc-user << "EOF" &&
# Begin /etc/pam.d/openrc-user

auth     required    pam_permit.so
account  required    pam_unix.so
session  required    pam_env.so
session  required    pam_limits.so
session  required    pam_unix.so
session  optional    pam_elogind.so

# End /etc/pam.d/openrc-user
EOF

for i in {start-stop,supervise}-daemon; do
cat > /etc/pam.d/$i << "EOF"
auth     sufficient   pam_permit.so
account  include      system-auth
session  optional     pam_loginuid.so
session  required     pam_limits.so
session  required     pam_env.so
session  required     pam_unix.so
EOF
done

Contents

Note

There are no new contents besides a PAM module. For the list of original contents, see the MLFS OpenRC's Contents.