kurtbahartr

Building and installing the excalibur kernel driver on immutable distributions/spins based on Fedora Silverblue

As you may know, immutable distributions are meant to keep the entire system read-only and use overlays/separate partitions to allow writing to specific user-oriented directories. Fedora achieves this on their atomic distributions by storing the entirety of overlayed directories in /var, as can be seen with Bazzite's Bash setup: yachiyo@ward-g770-baz:/var/home/yachiyo

Due to this, you cannot install external modules directly (e.g. by copying them into /usr/lib/modules/$(uname -r)/extra) and you have to package them for use with rpm-ostree instead.

The second file in this Gist is the spec file I wrote to build the Excalibur kernel driver located in thekayrasari/excalibur given you provide the source code in rpmbuild/SOURCES directory as a tarball after setting up your environment. I'll cover everything here.

Using toolbox to create a build container

kurtbahartr

Prologue

So, you've arrived in Turkey and you want to access certain services such as Discord while roaming. But would you look at that - that service is blocked in Turkey!

It's easy to bypass on Android using an app called "Intra" (assuming you're running stock ROM or a custom ROM with proper support for such apps). However, that doesn't end here.

See, if you have a Windows system, just using GoodbyeDPI-Turkey should be enough. Use the proper dnsredir script and you're done.

However, you have a Linux system, and you need a proper stack to effectively bypass DPI.

kurtbahartr

Pulls the folder called "directory" in the internal storage to the current directory: adb pull /sdcard/directory .

Pushes the file called "text.txt" to the internal storage: adb push text.txt /sdcard/

It's possible to provide an absolute path for the requested path too. For example: adb pull /sdcard/Download/test.jpg C:\Users\Linda\Desktop\data\

Use quotation marks (") if there's space in the path: adb pull "/sdcard/Download/Quick Share" "C:\Users\Linda\Documents\backup 20250626"

Reboots the device: adb reboot

kurtbahartr

Alright, you installed your first Linux distro. You didn't want to lose data, or have Windows lying around "just in case". However, you want to be able to boot into Linux without having to go through the boot menu again and again.

You've heard from your Linux user friends that Linux has a boot manager that also detects Windows, so you want Linux to be on top of Windows.

So, you do what others have been doing for years since UEFI came to be: Boot into BIOS, head to change the boot order. But, would you look at that! Linux didn't register itself to the BIOS's boot menu!

Then you go, "Okay, I've read online that efibootmgr can get this resolved just by changing the boot order!" That's supposed to work since this is UEFI, right?

So you boot back into Linux and use efibootmgr to change the boot order. However, the next boot still boots directly into Windows. You go to the boot menu and your order customization didn't register at all.

kurtbahartr

#!/bin/bash

if [[ "$@" =~ ^-h$ ]] || [[ "$@" =~ ^-h\  ]] || [[ "$@" =~ \ -h\  ]] || [[ "$@" =~ \ -h$ ]]; then
  echo "usage: sign-mok.sh /path/to/module.ko ..."
  echo ""
  echo "kmodsign usually accepts only one module per invocation."
  echo "This script works with multiple modules because we work around this limitation with a for loop."
  exit
fi

kurtbahartr

Type       Start            End              # Pages          Attributes
Available  0000000000000000-000000000009DFFF 000000000000009E 000000000000000F
Reserved   000000000009E000-000000000009EFFF 0000000000000001 000000000000000F
BS_Data    000000000009F000-000000000009FFFF 0000000000000001 000000000000000F
Available  0000000000100000-00000000223E8FFF 00000000000222E9 000000000000000F
LoaderCode 00000000223E9000-000000002FD2FFFF 000000000000D947 000000000000000F
BS_Data    000000002FD30000-000000002FDAFFFF 0000000000000080 000000000000000F
Available  000000002FDB0000-0000000035339FFF 000000000000558A 000000000000000F
LoaderCode 000000003533A000-0000000035439FFF 0000000000000100 000000000000000F
BS_Data    000000003543A000-0000000035BA8FFF 000000000000076F 000000000000000F

kurtbahartr

Prerequirements

1. Head over to the firmware setup and switch to secure boot's setup mode. Find this in the Boot tab.
2. Microsoft's secure boot certificates. The links are in the Resources section below. Using something akin to curl and wget will return error 403-Forbidden!
3. Root access. All of the following commands must run as root.
4. (Optionally) A safe environment outside of your computer to store these keys inside.

Creating and enrolling the keys

kurtbahartr

ATTENTION!

Brunch changed the way the EFI firmware is handled within the kernel, and `/sys/firmware/efi` is now called `/sys/firmware/brunchefi`. This guide relies on the fact that the mokutil provided in the Debian repos look into the `.../efi/` directory and not the latter. If you want to proceed with this guide, you have to compile mokutil and its dependencies with the new path yourself.

Prologue

ChromeOS is something so efficient yet sometimes so locked down OS and it's what I love the most about it. It provides you flexibility while locking down things that only researchers and power users would be concerned about.

Right as I downgraded my ChromeOS system and Brunch Framework back to stable releases and doing some random research about ChromeOS (I forgot what specifically), I came across this Google support article explaining the differences between regular ChromeOS and ChromeOS Flex, out of which this specific point caught my interest: