First Commit

external/packages/bsp/common/etc/NetworkManager/conf.d/10-override-wifi-random-mac-disable.conf

@@ -0,0 +1,5 @@
+[connection]
+wifi.mac-address-randomization=1
+
+[device]
+wifi.scan-rand-mac-address=no

external/packages/bsp/common/etc/NetworkManager/conf.d/20-override-wifi-powersave-disable.conf

@@ -0,0 +1,2 @@
+[connection]
+wifi.powersave = 2

external/packages/bsp/common/etc/NetworkManager/dispatcher.d/30-offload

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# With offloading enabled, Samba becomes completely useless - transfers to a Windows PC freezes randomly
+# Disabling offloading should solve this - all RK3399
+
+IFACE=$1
+EVENT=$2
+
+if [[ "$EVENT" != "up" ]]; then
+        exit 1
+fi
+
+if linux-version compare $(uname -r | cut -d '.' -f1,2) gt 4.4; then
+	exit 1
+fi
+
+
+ETHTOOL=/sbin/ethtool
+
+[ -f $ETHTOOL ] || exit 2
+[ -d /sys/devices/platform/fe300000.ethernet/net/$IFACE ] || exit 3
+
+$ETHTOOL -K $IFACE rx off tx off
+exit 0

external/packages/bsp/common/etc/X11/xorg.conf.d/01-orangepi-defaults.conf

@@ -0,0 +1,10 @@
+Section "Monitor"
+	Identifier		"Monitor0"
+	Option			"DPMS" "false"
+EndSection
+Section "ServerFlags"
+	Option			"BlankTime" "0"
+	Option			"StandbyTime" "0"
+	Option			"SuspendTime" "0"
+	Option			"OffTime" "0"
+EndSection

external/packages/bsp/common/etc/apt/apt.conf.d/02-orangepi-compress-indexes

@@ -0,0 +1,2 @@
+Acquire::GzipIndexes "true";
+Acquire::CompressionTypes::Order:: "gz";

external/packages/bsp/common/etc/apt/apt.conf.d/02-orangepi-periodic

@@ -0,0 +1,22 @@
+// Enable the update/upgrade script (0=disable)
+APT::Periodic::Enable "0";
+
+// Do "apt-get update" automatically every n-days (0=disable)
+APT::Periodic::Update-Package-Lists "21";
+
+// Do "apt-get upgrade --download-only" every n-days (0=disable)
+APT::Periodic::Download-Upgradeable-Packages "0";
+
+// Run the "unattended-upgrade" security upgrade script
+// every n-days (0=disabled)
+// Requires the package "unattended-upgrades" and will write
+// a log in /var/log/unattended-upgrades
+APT::Periodic::Unattended-Upgrade "7";
+
+// Do "apt-get autoclean" every n-days (0=disable)
+APT::Periodic::AutocleanInterval "120";
+
+// Define basic patterns
+Unattended-Upgrade::Origins-Pattern {
+        "origin=${distro_id},codename=${distro_codename}";
+};

external/packages/bsp/common/etc/apt/apt.conf.d/71-orangepi-no-recommends

@@ -0,0 +1,2 @@
+APT::Install-Recommends "0";
+APT::Install-Suggests "0";

external/packages/bsp/common/etc/apt/apt.conf.d/81-orangepi-no-languages

@@ -0,0 +1 @@
+Acquire::Languages "none";

external/packages/bsp/common/etc/cron.d/orangepi-truncate-logs

@@ -0,0 +1,4 @@
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+*/15 * * * * root /usr/lib/orangepi/orangepi-truncate-logs
+

external/packages/bsp/common/etc/cron.d/orangepi-updates

@@ -0,0 +1,2 @@
+@reboot root /usr/lib/orangepi/orangepi-apt-updates
+@daily root /usr/lib/orangepi/orangepi-apt-updates

external/packages/bsp/common/etc/cron.daily/orangepi-ram-logging

@@ -0,0 +1,2 @@
+#!/bin/sh
+/usr/lib/orangepi/orangepi-ramlog write >/dev/null 2>&1

external/packages/bsp/common/etc/default/orangepi-motd.dpkg-dist

@@ -0,0 +1,6 @@
+# add space-separated list of MOTD script names (without number) to exclude them from MOTD
+# Example:
+# MOTD_DISABLE="header tips updates"
+
+MOTD_DISABLE=""
+ONE_WIRE="" # yes = show 1-wire temperature sensor if attached 

external/packages/bsp/common/etc/default/orangepi-ramlog.dpkg-dist

@@ -0,0 +1,12 @@
+# configuration values for the orangepi-ram-logging service
+#
+# enable the orangepi-ram-logging service?
+ENABLED=true
+#
+# size of the tmpfs mount -- please keep in mind to adjust /etc/default/orangepi-zram-config too when increasing
+SIZE=50M
+#
+# use rsync instead of cp -r
+# requires rsync installed, may provide better performance
+# due to copying only new and changed files
+USE_RSYNC=true

external/packages/bsp/common/etc/default/orangepi-zram-config.dpkg-dist

@@ -0,0 +1,34 @@
+# configuration values for the orangepi-zram-config service
+#
+# enable the orangepi-zram-config service?
+ENABLED=true
+
+# percentage of zram used as swap compared to physically available DRAM.
+# Huge overcommitment (300) is possible and sometimes desirable. See
+# https://forum.armbian.com/topic/5565-zram-vs-swap/?do=findComment&comment=61082
+# and don't forget to adjust $MEM_LIMIT_PERCENTAGE below too.
+# ZRAM_PERCENTAGE=50
+
+# percentage of DRAM available to zram. If this amount is exceeded the zram
+# devices used for swap simply behave as if the device is full. You need to
+# adjust/increase this value only if you want to work with massive memory
+# overcommitment (ZRAM_PERCENTAGE exceeding 150 for example)
+# MEM_LIMIT_PERCENTAGE=50
+
+# create how many zram devices max for swap
+# ZRAM_MAX_DEVICES=4
+
+# Which algorithm for zram based swapping. Seems lzo is best choice on ARM:
+# https://forum.armbian.com/topic/8161-swap-on-sbc/?do=findComment&comment=61668
+# SWAP_ALGORITHM=lzo
+
+# Which algorithm to choose for zram based ramlog partition
+# RAMLOG_ALGORITHM=zstd
+
+# Which algorithm to choose for zram based /tmp
+# TMP_ALGORITHM=zstd
+
+# If defined a separate partition will be used as zram backing device. Be CAREFUL
+# which partition you assign and read starting from CONFIG_ZRAM_WRITEBACK in
+# https://www.kernel.org/doc/Documentation/blockdev/zram.txt
+# ZRAM_BACKING_DEV=/dev/nvme0n2

external/packages/bsp/common/etc/initramfs/post-update.d/99-uboot

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+. /etc/orangepi-release
+
+echo "update-initramfs: Converting to u-boot format" >&2
+tempname="/boot/uInitrd-$1"
+mkimage -A $INITRD_ARCH -O linux -T ramdisk -C gzip -n uInitrd -d $2 $tempname > /dev/null
+
+ln -sf $(basename $tempname) /boot/uInitrd > /dev/null 2>&1 || mv $tempname /boot/uInitrd
+
+exit 0

external/packages/bsp/common/etc/modprobe.d/r8723bs.conf

@@ -0,0 +1 @@
+options r8723bs rtw_power_mgnt=0 rtw_enusbss=0

external/packages/bsp/common/etc/network/interfaces.default

@@ -0,0 +1,4 @@
+source /etc/network/interfaces.d/*
+# Network is managed by Network manager
+auto lo
+iface lo inet loopback

external/packages/bsp/common/etc/profile.d/orangepi-activate-profile-sync-daemon.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+
+# acticate profile sync daemon
+
+if [ -f "${HOME}/.activate_psd" ]; then
+	rm -f ${HOME}/.activate_psd
+	/usr/bin/psd >/dev/null 2>&1
+	config_file="${HOME}/.config/psd/psd.conf"
+	if [ -f "${config_file}" ]; then
+		# test for overlayfs
+		# TODO: don't enable on btrfs
+		sed -i 's/#USE_OVERLAYFS=.*/USE_OVERLAYFS="yes"/' "${config_file}"
+		case $(/usr/bin/psd p 2>/dev/null | grep Overlayfs) in
+			*active*)
+				echo -e "\nConfigured profile sync daemon with overlayfs."
+				;;
+			*)
+				echo -e "\nConfigured profile sync daemon."
+				sed -i 's/USE_OVERLAYFS="yes"/#USE_OVERLAYFS="no"/' "${config_file}"
+				;;
+		esac
+	fi
+	systemctl --user enable psd.service >/dev/null 2>&1
+	systemctl --user start psd.service >/dev/null 2>&1
+fi

external/packages/bsp/common/etc/profile.d/orangepi-check-first-login-reboot.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+
+# only do this for interactive shells
+if [ "$-" != "${-#*i}" ]; then
+	printf "\n"
+	if [ -f "/var/run/.reboot_required" ]; then
+		printf "[\e[0;91m Kernel was updated, please reboot\x1B[0m ]\n\n"
+	fi
+fi

external/packages/bsp/common/etc/profile.d/orangepi-check-first-login.sh

@@ -0,0 +1,274 @@
+#!/bin/sh
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+
+. /etc/orangepi-release
+
+check_abort()
+{
+	echo -e "\nDisabling user account creation procedure\n"
+	rm -f /root/.not_logged_in_yet
+	trap - INT
+	exit 0
+}
+
+
+function read_password()
+{
+unset password
+prompt="$1 password: "
+while IFS= read -p "$prompt" -r -s -n 1 char
+do
+	if [[ $char == $'\0' ]]
+	then
+		break
+	fi
+	prompt='*'
+	password+="$char"
+done
+}
+
+
+set_timezone_and_locales()
+{
+
+	# Grab this machine's public IP address
+	PUBLIC_IP=`curl --max-time 5 -s https://ipinfo.io/ip`
+	if [ $? -eq 0 ]; then
+
+		# Call the geolocation API and capture the output
+		RES=$(
+				curl --max-time 5 -s http://ipwhois.app/json/${PUBLIC_IP} | \
+				jq '.timezone, .country, .country_code' | \
+				while read -r TIMEZONE; do
+					read -r COUNTRY
+					echo "${TIMEZONE},${COUNTRY},${COUNTRYCODE}" | tr --delete \"
+				done
+			)
+
+		TZDATA=$(echo ${RES} | cut -d"," -f1)
+		STATE=$(echo ${RES} | cut -d"," -f2)
+		LOCALES=$(grep territory /usr/share/i18n/locales/* | grep "$STATE" | cut -d ":" -f 1 | cut -d "/" -f 6 |  xargs -I{} grep {} /usr/share/i18n/SUPPORTED | grep "\.UTF-8" | cut -d " " -f 1)
+		CCODE=$(echo ${RES} | cut -d"," -f3 | awk '{print tolower($0)}' | xargs)
+		options=(`echo ${LOCALES}`);
+
+		# reconfigure tzdata
+		timedatectl set-timezone "${TZDATA}"
+		dpkg-reconfigure --frontend=noninteractive tzdata > /dev/null 2>&1
+
+		echo -e "Detected timezone: \x1B[92m$(LC_ALL=C timedatectl | grep "Time zone" | cut -d":" -f2 | xargs)\x1B[0m"
+		echo -e "Do you want to set locales and console keyboard automatically from your location [Y/n]"
+		read -sn1 SetLocales
+		if [ "$SetLocales" != "n" ] && [ "$SetLocales" != "N" ]; then
+
+			# when having more locales, prompt for choosing one
+			if [[ "${#options[@]}" -gt 1 ]]; then
+
+				echo -e "\nAt your location, more locales are possible:\n"
+				PS3='Please enter your choice:'
+				select opt in "${options[@]}"
+				do
+					if [[ " ${options[@]} " =~ " ${opt} " ]]; then
+						LOCALES=${opt}
+						break
+					fi
+				done
+
+			fi
+
+			# generate locales
+			sed -i 's/# '"${LOCALES}"'/'"${LOCALES}"'/' /etc/locale.gen
+			echo -e "Generating locales: \x1B[92m${LOCALES}\x1B[0m"
+			locale-gen $LOCALES > /dev/null 2>&1
+			update-locale LANG=$LOCALES LANGUAGE=$LOCALES LC=$LOCALES LC_MESSAGES=$LOCALES
+
+			# setting up keyboard
+			echo -e "Console keyboard layout: \x1B[92m$CCODE\x1B[0m"
+			sed -i "s/XKBLAYOUT=.*/XKBLAYOUT=\"$CCODE\"/" /etc/default/keyboard
+			setupcon -k --force
+		else
+
+			echo -e "You can use \x1B[92morangepi-config\x1B[0m to set locales and console keyboard."
+
+		fi
+
+	fi
+
+}
+
+
+
+add_profile_sync_settings()
+{
+	/usr/bin/psd >/dev/null 2>&1
+	config_file="${HOME}/.config/psd/psd.conf"
+	if [ -f "${config_file}" ]; then
+		# test for overlayfs
+		sed -i 's/#USE_OVERLAYFS=.*/USE_OVERLAYFS="yes"/' "${config_file}"
+		case $(/usr/bin/psd p 2>/dev/null | grep Overlayfs) in
+			*active*)
+				echo -e "\nConfigured profile sync daemon with overlayfs."
+				;;
+			*)
+				echo -e "\nConfigured profile sync daemon."
+				sed -i 's/USE_OVERLAYFS="yes"/#USE_OVERLAYFS="no"/' "${config_file}"
+				;;
+		esac
+	fi
+	systemctl --user enable psd.service >/dev/null 2>&1
+	systemctl --user start psd.service >/dev/null 2>&1
+}
+
+
+
+
+add_user()
+{
+	read -t 0 temp
+
+	while [ -f "/root/.not_logged_in_yet" ]; do
+		echo -e "\nPlease provide a username (eg. your forename): \c"
+		read -e username
+		RealUserName="$(echo "$username" | tr '[:upper:]' '[:lower:]' | tr -d -c '[:alnum:]')"
+		[ -z "$RealUserName" ] && return
+		if ! id "$RealUserName" >/dev/null 2>&1; then break; else echo -e "Username \e[0;31m$RealUserName\x1B[0m already exists on the system."; fi
+	done
+
+	while [ -f "/root/.not_logged_in_yet" ]; do
+		read_password "Create"
+		first_input=$password
+		echo ""
+		read_password "Repeat"
+		second_input=$password
+		echo ""
+                if [[ $first_input == $second_input ]]; then
+                        result="$(cracklib-check <<<"$password")"
+                        okay="$(awk -F': ' '{ print $2}' <<<"$result")"
+                        if [[ "$okay" == "OK" ]]; then
+				echo -e "\nPlease provide your real name (eg. John Doe): \c"
+		                read -e RealName
+				adduser --quiet --disabled-password --shell /bin/bash --home /home/"$RealUserName" --gecos "$RealName" "$RealUserName"
+				(echo $first_input;echo $second_input;) | passwd "$RealUserName" >/dev/null 2>&1
+				for additionalgroup in sudo netdev audio video disk tty users games dialout plugdev input bluetooth systemd-journal ssh; do
+					usermod -aG ${additionalgroup} ${RealUserName} 2>/dev/null
+				done
+				# fix for gksu in Xenial
+				touch /home/$RealUserName/.Xauthority
+				chown $RealUserName:$RealUserName /home/$RealUserName/.Xauthority
+				RealName="$(awk -F":" "/^${RealUserName}:/ {print \$5}" </etc/passwd | cut -d',' -f1)"
+				[ -z "$RealName" ] && RealName=$RealUserName
+				echo -e "\nDear \e[0;92m${RealName}\x1B[0m, your account \e[0;92m${RealUserName}\x1B[0m has been created and is sudo enabled."
+				echo -e "Please use this account for your daily work from now on.\n"
+				rm -f /root/.not_logged_in_yet
+
+				# set up profile sync daemon on desktop systems
+				which psd >/dev/null 2>&1
+				if [ $? -eq 0 ]; then
+					echo -e "${RealUserName} ALL=(ALL) NOPASSWD: /usr/bin/psd-overlay-helper" >> /etc/sudoers
+					touch /home/${RealUserName}/.activate_psd
+					chown $RealUserName:$RealUserName /home/${RealUserName}/.activate_psd
+				fi
+                                break
+			else
+                                echo -e "Rejected - \e[0;31m$okay.\x1B[0m Try again."
+                        fi
+                elif [[ -n $password ]]; then
+                        echo -e "Rejected - \e[0;31mpasswords do not match.\x1B[0m Try again."
+                fi
+        done
+
+}
+
+if [ -f /root/.not_logged_in_yet ] && [ -n "$BASH_VERSION" ] && [ "$-" != "${-#*i}" ]; then
+
+	# disable autologin
+	#rm -f /etc/systemd/system/getty@.service.d/override.conf
+	#rm -f /etc/systemd/system/serial-getty@.service.d/override.conf
+	#systemctl daemon-reload
+
+	# detect lightdm
+	#desktop_lightdm=$(dpkg-query -W -f='${db:Status-Abbrev}\n' lightdm 2>/dev/null)
+
+	echo -e "New to Orange Pi? Support: \e[1m\e[39mhttp://www.orangepi.org\x1B[0m\n"
+
+	#trap '' 2
+	#while [ -f "/root/.not_logged_in_yet" ]; do
+
+	#	read_password "New root"
+
+	#	# only allow one login. Once you enter root password, kill others.
+	#	loginfrom=$(who am i | awk '{print $2}')
+	#	who -la | grep root | grep -v "$loginfrom" | awk '{print $7}' | xargs --no-run-if-empty kill -9
+
+	#	first_input=$password
+	#	echo ""
+	#	read_password "Repeat"
+	#	second_input=$password
+	#	echo ""
+	#	if [[ $first_input == $second_input ]]; then
+	#		result="$(cracklib-check <<<"$password")"
+	#		okay="$(awk -F': ' '{ print $2}' <<<"$result")"
+	#		if [[ "$okay" == "OK" ]]; then
+	#			(echo $first_input;echo $second_input;) | passwd root >/dev/null 2>&1
+	#			set_timezone_and_locales
+	#			break
+	#			else
+	#			echo -e "Rejected - \e[0;31m$okay.\x1B[0m Try again."
+	#		fi
+	#	elif [[ -n $password ]]; then
+	#		echo -e "Rejected - \e[0;31mpasswords do not match.\x1B[0m Try again."
+	#	fi
+	#done
+	#trap - INT TERM EXIT
+
+	#trap check_abort INT
+	#while [ -f "/root/.not_logged_in_yet" ]; do
+	#	echo -e "\nCreating a new user account. Press <Ctrl-C> to abort"
+	#	[ -n "$desktop_lightdm" ] && echo "Desktop environment will not be enabled if you abort the new user creation"
+	#	add_user
+	#done
+	#trap - INT TERM EXIT
+
+	rm -f /root/.not_logged_in_yet
+
+	# check whether desktop environment has to be considered
+	#if [ -n "$desktop_lightdm" ]; then
+
+	#	# 1st run goes without login
+	#	mkdir -p /etc/lightdm/lightdm.conf.d
+	#	cat <<-EOF > /etc/lightdm/lightdm.conf.d/22-orangepi-autologin.conf
+	#	[Seat:*]
+	#	autologin-user=$RealUserName
+	#	autologin-user-timeout=0
+	#	user-session=xfce
+	#	EOF
+	#	
+	#	ln -sf /lib/systemd/system/lightdm.service /etc/systemd/system/display-manager.service
+	#	if [[ -f /var/run/resize2fs-reboot ]]; then
+	#		# Let the user reboot now otherwise start desktop environment
+	#		printf "\n\n\e[0;91mWarning: a reboot is needed to finish resizing the filesystem \x1B[0m \n"
+	#		printf "\e[0;91mPlease reboot the system now \x1B[0m \n\n"
+	#	elif [ -z "$ConfigureDisplay" ] || [ "$ConfigureDisplay" = "n" ] || [ "$ConfigureDisplay" = "N" ]; then
+	#		echo -e "\n\e[1m\e[39mNow starting desktop environment...\x1B[0m\n"
+	#		sleep 1
+	#		service lightdm start 2>/dev/null
+	#		if [ -f /root/.desktop_autologin ]; then
+	#			rm /root/.desktop_autologin
+	#		else
+	#			(sleep 20; rm /etc/lightdm/lightdm.conf.d/22-orangepi-autologin.conf) &
+	#		fi
+	#		# logout if logged at console
+	#		#[[ -n $(who -la | grep root | grep tty1) ]] && exit 1
+	#	fi
+	#else
+	#	# Display reboot recommendation if necessary
+	#	if [[ -f /var/run/resize2fs-reboot ]]; then
+	#		printf "\n\n\e[0;91mWarning: a reboot is needed to finish resizing the filesystem \x1B[0m \n"
+	#		printf "\e[0;91mPlease reboot the system now \x1B[0m \n\n"
+	#	fi
+	#fi
+fi

external/packages/bsp/common/etc/profile.d/orangepi-lang.sh

@@ -0,0 +1,4 @@
+# This should fix
+# perl: warning: Setting locale failed.
+
+export LC_ALL=$LANG

external/packages/bsp/common/etc/profile.d/orangepi-ssh-title.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+
+if [ -n "$PS1" ] && ( [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ] ); then
+ tput tsl > /dev/null
+ if [ "$?" -eq 0 ]; then
+  echo `tput tsl` `whoami`@`hostname` `tput fsl`
+ fi
+fi

external/packages/bsp/common/etc/skel/.config/htop/htoprc

@@ -0,0 +1,40 @@
+# Beware! This file is rewritten by htop when settings are changed in the interface.
+# The parser is also very primitive, and not human-friendly.
+fields=0 48 17 18 38 39 40 2 46 47 49 1
+sort_key=1
+sort_direction=1
+hide_threads=0
+hide_kernel_threads=1
+hide_userland_threads=0
+shadow_other_users=0
+show_thread_names=0
+show_program_path=1
+highlight_base_name=0
+highlight_megabytes=1
+highlight_threads=1
+tree_view=0
+header_margin=1
+detailed_cpu_time=0
+cpu_count_from_zero=0
+update_process_names=0
+account_guest_in_cpu_meter=0
+color_scheme=0
+delay=15
+left_meters=AllCPUs Memory Swap CpuTemp
+left_meter_modes=1 1 1 2
+right_meters=OrangePiversion Hostname Tasks LoadAverage Uptime CpuFreq Eth0 Eth0stat
+right_meter_modes=2 2 2 2 2 2 2 2
+# SBC hardware and Kernel specific path.
+# Editable manually.
+BoardName=
+CpuFreq_handler=
+CpuTemp_handler=
+CpuVCore_l_handler=
+CpuVCore_b_handler=
+GpuVCore_handler=
+GpuTemp_handler=
+# Wlan / Eth alias
+eth0_alias=
+eth1_alias=
+wlan0_alias=
+wlan1_alias=

external/packages/bsp/common/etc/systemd/system/logrotate.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=Rotate log files
+Documentation=man:logrotate(8) man:logrotate.conf(5)
+ConditionACPower=true
+
+[Service]
+Type=oneshot
+ExecStartPre=/usr/lib/orangepi/orangepi-ramlog write
+ExecStart=/usr/sbin/logrotate /etc/logrotate.conf
+ExecStartPost=/usr/lib/orangepi/orangepi-ramlog postrotate
+
+# performance options
+Nice=19
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+
+# hardening options
+#  details: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
+#  no ProtectHome for userdir logs
+#  no PrivateNetwork for mail deliviery
+#  no ProtectKernelTunables for working SELinux with systemd older than 235
+#  no MemoryDenyWriteExecute for gzip on i686
+PrivateDevices=true
+PrivateTmp=true
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectSystem=full
+RestrictRealtime=true

external/packages/bsp/common/etc/udev/rules.d/10-wifi-disable-powermanagement.rules

@@ -0,0 +1 @@
+KERNEL=="wlan*", ACTION=="add", RUN+="/sbin/iwconfig wlan0 power off"

external/packages/bsp/common/etc/update-motd.d/10-orangepi-header

@@ -0,0 +1,26 @@
+#!/bin/bash
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+
+# DO NOT EDIT THIS FILE but add config options to /etc/default/orangepi-motd
+# any changes will be lost on board support package update
+
+THIS_SCRIPT="header"
+MOTD_DISABLE=""
+
+[[ -f /etc/default/orangepi-motd ]] && . /etc/default/orangepi-motd
+
+for f in $MOTD_DISABLE; do
+	[[ $f == $THIS_SCRIPT ]] && exit 0
+done
+
+. /etc/os-release
+. /etc/orangepi-release
+
+KERNELID=$(uname -r)
+TERM=linux toilet -f standard -F metal $(echo $BOARD_NAME | sed 's/Orange Pi/OPi/')
+echo -e "Welcome to \e[0;91mOrange Pi \x1B[0m$(if [[ $ID == debian ]]; then echo ${PRETTY_NAME##*\(} |  sed -e 's/^.*Linux //' | sed "s/\/.*//" | sed 's|)||'; else echo -n ${VERSION_CODENAME^};fi) with \e[0;91mLinux $KERNELID\x1B[0m\n"

external/packages/bsp/common/etc/update-motd.d/30-orangepi-sysinfo

@@ -0,0 +1,207 @@
+#!/bin/bash
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+#
+
+# DO NOT EDIT THIS FILE but add config options to /etc/default/orangepi-motd
+# generate system information
+
+export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+THIS_SCRIPT="sysinfo"
+MOTD_DISABLE=""
+STORAGE=/dev/sda1
+SHOW_IP_PATTERN="^bond.*|^[ewr].*|^br.*|^lt.*|^umts.*|^lan.*"
+
+CPU_TEMP_LIMIT=45
+AMB_TEMP_LIMIT=40
+
+[[ -f /etc/default/orangepi-motd ]] && . /etc/default/orangepi-motd
+
+for f in $MOTD_DISABLE; do
+	[[ $f == $THIS_SCRIPT ]] && exit 0
+done
+
+# don't edit below here
+
+function display() {
+	# $1=name $2=value $3=red_limit $4=minimal_show_limit $5=unit $6=after $7=acs/desc{
+	# battery red color is opposite, lower number
+	if [[ "$1" == "Battery" ]]; then local great="<"; else local great=">"; fi
+	if [[ -n "$2" && "$2" > "0" && (( "${2%.*}" -ge "$4" )) ]]; then
+	printf "%-14s%s" "$1:"
+		if awk "BEGIN{exit ! ($2 $great $3)}"; then echo -ne "\e[0;91m $2"; else echo -ne "\e[0;92m $2"; fi
+		printf "%-1s%s\x1B[0m" "$5"
+		printf "%-11s%s\t" "$6"
+		return 1
+	fi
+} # display
+
+function getboardtemp() {
+	if [ -f /etc/orangepimonitor/datasources/soctemp ]; then
+		read raw_temp </etc/orangepimonitor/datasources/soctemp 2>/dev/null
+		if [ ! -z $(echo "$raw_temp" | grep -o "^[1-9][0-9]*\.\?[0-9]*$") ] && (( $(echo "${raw_temp} < 200" |bc -l) )); then
+			# Allwinner legacy kernels output degree C
+			board_temp=${raw_temp}
+		else
+			board_temp=$(awk '{printf("%d",$1/1000)}' <<<${raw_temp})
+		fi
+	elif [ -f /etc/orangepimonitor/datasources/pmictemp ]; then
+		# fallback to PMIC temperature
+		board_temp=$(awk '{printf("%d",$1/1000)}' </etc/orangepimonitor/datasources/pmictemp)
+	fi
+} # getboardtemp
+
+function batteryinfo() {
+	# Battery info for Allwinner
+	mainline_dir="/sys/power/axp_pmu"
+	legacy_dir="/sys/class/power_supply"
+	if [[ -e "$mainline_dir" ]]; then
+		read status_battery_connected < $mainline_dir/battery/connected 2>/dev/null
+		if [[ "$status_battery_connected" == "1" ]]; then
+			read status_battery_charging < $mainline_dir/charger/charging
+			read status_ac_connect < $mainline_dir/ac/connected
+			read battery_percent< $mainline_dir/battery/capacity
+			# dispay charging / percentage
+			if [[ "$status_ac_connect" == "1" && "$battery_percent" -lt "100" ]]; then
+				status_battery_text=" charging"
+			elif [[ "$status_ac_connect" == "1" && "$battery_percent" -eq "100" ]]; then
+				status_battery_text=" charged"
+			else
+				status_battery_text=" discharging"
+			fi
+		fi
+	elif [[ -e "$legacy_dir/axp813-ac" ]]; then
+		read status_battery_connected < $legacy_dir/axp20x-battery/present
+		if [[ "$status_battery_connected" == "1" ]]; then
+			status_battery_text=" "$(awk '{print tolower($0)}' < $legacy_dir/axp20x-battery/status)
+	                read status_ac_connect < $legacy_dir/axp813-ac/present
+	                read battery_percent< $legacy_dir/axp20x-battery/capacity
+		fi
+	elif [[ -e "$legacy_dir/battery" ]]; then
+		if [[ (("$(cat $legacy_dir/battery/voltage_now)" -gt "5" )) ]]; then
+			status_battery_text=" "$(awk '{print tolower($0)}' < $legacy_dir/battery/status)
+			read battery_percent <$legacy_dir/battery/capacity
+		fi
+	fi
+} # batteryinfo
+
+function ambienttemp() {
+	# define where w1 usually shows up
+        W1_DIR="/sys/devices/w1_bus_master1/"
+	if [ -f /etc/orangepimonitor/datasources/ambienttemp ]; then
+		read raw_temp </etc/orangepimonitor/datasources/ambienttemp 2>/dev/null
+		amb_temp=$(awk '{printf("%d",$1/1000)}' <<<${raw_temp})
+		echo $amb_temp
+	elif [[ -d $W1_DIR && $ONE_WIRE == yes ]]; then
+		device=$(ls -1 $W1_DIR | grep -Eo '^[0-9]{1,4}' | head -1)
+		if [[ -n $device ]]; then
+			if [[ -d ${W1_DIR}${device}/hwmon/hwmon0 ]]; then hwmon=0; else hwmon=1; fi
+			read raw_temp < ${W1_DIR}${device}/hwmon/hwmon${hwmon}/temp1_input 2>/dev/null
+			amb_temp=$(awk '{printf("%d",$1/1000)}' <<<${raw_temp})
+			echo $amb_temp
+		fi
+	else
+		# read ambient temperature from USB device if available
+		if [[ ! -f /usr/bin/temper ]]; then
+			echo ""
+			return
+		fi
+		amb_temp=$(temper -c 2>/dev/null)
+		case ${amb_temp} in
+			*"find the USB device"*)
+				echo ""
+				;;
+			*)
+				amb_temp=$(awk '{print $NF}' <<<$amb_temp |  sed 's/C//g')
+				echo -n "scale=1;${amb_temp}/1" | grep -oE "\-?[[:digit:]]+\.[[:digit:]]"
+		esac
+	fi
+} # ambienttemp
+
+#function get_ip_addresses() {
+#	# return up to 2 IPv4 address(es) comma separated
+#	hostname -I | tr " " "\n" | \
+#		grep -E "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$" | \
+#		tail -n2 | sed ':a;N;$!ba;s/\n/,/g'
+#} # get_ip_addresses
+
+function get_ip_addresses() {
+	local ips=()
+	for f in /sys/class/net/*; do
+		local intf=$(basename $f)
+		# match only interface names starting with e (Ethernet), br (bridge), w (wireless), r (some Ralink drivers use ra<number> format)
+		if [[ $intf =~ $SHOW_IP_PATTERN ]]; then
+			local tmp=$(ip -4 addr show dev $intf | awk '/inet/ {print $2}' | cut -d'/' -f1)
+			# add both name and IP - can be informative but becomes ugly with long persistent/predictable device names
+			#[[ -n $tmp ]] && ips+=("$intf: $tmp")
+			# add IP only
+			[[ -n $tmp ]] && ips+=("$tmp")
+		fi
+	done
+	echo "${ips[@]}"
+} # get_ip_addresses
+
+function storage_info() {
+	# storage info
+	RootInfo=$(df -h /)
+	root_usage=$(awk '/\// {print $(NF-1)}' <<<${RootInfo} | sed 's/%//g')
+	root_total=$(awk '/\// {print $(NF-4)}' <<<${RootInfo})
+	StorageInfo=$(df -h $STORAGE 2>/dev/null | grep $STORAGE)
+	if [[ -n "${StorageInfo}" && ${RootInfo} != *$STORAGE* ]]; then
+		storage_usage=$(awk '/\// {print $(NF-1)}' <<<${StorageInfo} | sed 's/%//g')
+		storage_total=$(awk '/\// {print $(NF-4)}' <<<${StorageInfo})
+	fi
+} # storage_info
+
+# query various systems and send some stuff to the background for overall faster execution.
+# Works only with ambienttemp and batteryinfo since A20 is slow enough :)
+amb_temp=$(ambienttemp &)
+ip_address=$(get_ip_addresses &)
+batteryinfo
+storage_info
+getboardtemp
+critical_load=$(( 1 + $(grep -c processor /proc/cpuinfo) / 2 ))
+
+# get uptime, logged in users and load in one take
+UPTIME=$(LC_ALL=C uptime)
+UPT1=${UPTIME#*'up '}
+UPT2=${UPT1%'user'*}
+users=${UPT2//*','}
+users=${users//' '}
+time=${UPT2%','*}
+time=${time//','}
+load=${UPTIME#*'load average: '}
+load=${load//','}
+
+# memory and swap
+mem_info=$(LC_ALL=C free -w 2>/dev/null | grep "^Mem" || LC_ALL=C free | grep "^Mem")
+memory_usage=$(awk '{printf("%.0f",(($2-($4+$6+$7))/$2) * 100)}' <<<${mem_info})
+memory_total=$(awk '{printf("%d",$2/1024)}' <<<${mem_info})
+swap_info=$(LC_ALL=C free -m | grep "^Swap")
+swap_usage=$( (awk '/Swap/ { printf("%3.0f", $3/$2*100) }' <<<${swap_info} 2>/dev/null || echo 0) | tr -c -d '[:digit:]')
+swap_total=$(awk '{print $(2)}' <<<${swap_info})
+
+# display info
+display "System load" "${load%% *}" "${critical_load}" "0" "" "${load#* }"
+printf "Up time:       \x1B[92m%s\x1B[0m\t\t" "$time"
+display "Local users" "${users##* }" "3" "2" ""
+echo "" # fixed newline
+display "Memory usage" "$memory_usage" "70" "0" " %" " of ${memory_total}MB"
+display "Zram usage" "$swap_usage" "75" "0" " %" " of $swap_total""Mb"
+printf "IP:            "
+printf "\x1B[92m%s\x1B[0m" "$ip_address"
+echo "" # fixed newline
+a=0;b=0;c=0
+display "CPU temp" "$board_temp" $CPU_TEMP_LIMIT "0" "°C" "" ; a=$?
+display "Ambient temp" "$amb_temp" $AMB_TEMP_LIMIT "0" "°C" "" ; b=$?
+(( ($a+$b) >0 )) && echo "" # new line only if some value is displayed
+display "Usage of /" "$root_usage" "90" "1" "%" " of $root_total"
+display "storage/" "$storage_usage" "90" "1" "%" " of $storage_total"
+display "Battery" "$battery_percent" "20" "1" "%" "$status_battery_text"
+echo ""
+echo ""

external/packages/bsp/common/etc/update-motd.d/41-orangepi-config

@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# Copyright (c) Authors: http://www.armbian.com/authors
+#
+# This file is licensed under the terms of the GNU General Public
+# License version 2. This program is licensed "as is" without any
+# warranty of any kind, whether express or implied.
+
+# DO NOT EDIT THIS FILE but add config options to /etc/default/orangepi-motd
+# any changes will be lost on board support package update
+
+THIS_SCRIPT="config"
+MOTD_DISABLE=""
+
+[[ -f /etc/default/orangepi-motd ]] && . /etc/default/orangepi-motd
+
+for f in $MOTD_DISABLE; do
+	[[ $f == $THIS_SCRIPT ]] && exit 0
+done
+
+if [[ $(( $RANDOM % 2 )) == 0 ]]; then
+	if [[ -f /usr/sbin/orangepi-config ]]; then
+		echo -e "[\e[31m General system configuration (beta)\e[0m: \e[1morangepi-config\e[0m ]\n"
+	else
+		echo -e "[\e[31m Menu-driven system configuration (beta)\e[0m: \e[1msudo dpkg -i orangepi-config.deb\e[0m ]\n"
+	fi
+fi
+
+exit 0
+