-
Notifications
You must be signed in to change notification settings - Fork 0
/
bilibop-lockfs
executable file
·433 lines (379 loc) · 12.7 KB
/
bilibop-lockfs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
#!/bin/sh
PREREQ=""
prereqs()
{
echo "$PREREQ"
}
case $1 in
prereqs)
prereqs
exit 0
;;
esac
# Lock root filesystem by mounting it readonly with aufs or overlayfs, and
# modify fstab on the fly to prepare to automatically lock other filesystems
# later in the boot process.
# We assume that /proc, /sys and /dev are correctly mounted.
# /proc/cmdline will be parsed several times. We call 'cat' only one time:
readonly CMDLINE="$(cat /proc/cmdline)"
# Initialize METHOD with an arbitrary string:
METHOD="union filesystem"
# Set verbosity from boot commandline:
for param in ${CMDLINE}
do
case "${param}" in
quiet)
quiet="y"
break
;;
esac
done
# do not enable lockfs by default unless the user requests it on the boot mode, also there's a bug that unless "nolockfs" is added on the boot parameters, an OS that has its root partition in encrypted luks mode will become unusable
BILIBOP_LOCKFS="false"
# Load functions:
. /scripts/functions
. /usr/lib/bilibop/lockfs.sh
get_bilibop_variables ${rootmnt}
# Check if BILIBOP_LOCKFS is overridden from the boot commandline. To use
# lockfs in single-user mode, it is necessary to use 'lockfs=force'.
for param in ${CMDLINE}
do
case "${param}" in
single|S|1)
single="true"
;;
[02-6])
single="false"
;;
nolockfs)
BILIBOP_LOCKFS="false"
_force="false"
;;
lockfs)
BILIBOP_LOCKFS="true"
;;
lockfs=*)
BILIBOP_LOCKFS="true"
for opt in $(IFS=',' ; echo ${param#lockfs=})
do
case "${opt}" in
default)
BILIBOP_LOCKFS_POLICY=""
BILIBOP_LOCKFS_WHITELIST=""
BILIBOP_LOCKFS_SIZE=""
BILIBOP_LOCKFS_SWAP_POLICY=""
BILIBOP_LOCKFS_NOTIFY_POLICY=""
BILIBOP_LOCKFS_UNION_METHOD=""
BILIBOP_LOCKFS_PATH_PREFIX=""
_force="false"
SIZE=""
;;
force)
_force="true"
;;
hard|soft)
BILIBOP_LOCKFS_POLICY="${opt}"
;;
aufs|overlay)
BILIBOP_LOCKFS_UNION_METHOD="${opt}"
;;
:*)
BILIBOP_LOCKFS_PATH_PREFIX="${opt#:}"
;;
[1-9]*)
SIZE="$(printf ${opt} | grep '^[1-9][0-9]*[KkMmGg%]\?$')"
;;
all)
BILIBOP_LOCKFS_WHITELIST=""
;;
-/*)
BILIBOP_LOCKFS_WHITELIST="${BILIBOP_LOCKFS_WHITELIST:+${BILIBOP_LOCKFS_WHITELIST} }${opt#-}"
;;
esac
done
;;
noswap)
BILIBOP_LOCKFS_SWAP_POLICY="hard"
;;
esac
done
# 'lockfs=force' boot option is available only for single-user sessions:
if [ "${single}" = "true" ]
then BILIBOP_LOCKFS="false"
[ "${_force}" = "true" ] &&
BILIBOP_LOCKFS="true"
fi
# Collect information that will be used later:
BILIBOP_ROOT="$(underlying_device_from_file ${rootmnt})"
BILIBOP_PART="$(underlying_partition ${BILIBOP_ROOT})"
BILIBOP_DISK="$(physical_hard_disk ${BILIBOP_PART})"
# Check if the drive is physically locked (write protected); if it is the case,
# this will override several variables.
if is_physically_locked ${BILIBOP_DISK##*/}; then
mkdir -p "${BILIBOP_RUNDIR}"
cat >${BILIBOP_RUNDIR}/plocked <<EOF
# It seems that ${BILIBOP_DISK} is physically locked.
BILIBOP_LOCKFS="true"
BILIBOP_LOCKFS_POLICY="hard"
BILIBOP_LOCKFS_SWAP_POLICY="hard"
BILIBOP_LOCKFS_WHITELIST=""
BILIBOP_LOCKFS_FALLBACK_POLICY="ro"
EOF
. ${BILIBOP_RUNDIR}/plocked
fi
# Now, if BILIBOP_LOCKFS is not explicitly set to "true" or "false", then
# check the sysfs 'removable' flag to know what to do.
case "${BILIBOP_LOCKFS}" in
true)
log_warning_msg "Impermutability: Locking filesystem."
;;
false)
# Undo what has been done before (in the init-top script)
# and exit
undo_readonly_dm_settings
log_warning_msg "Impermutability: Nothing to do."
case "${BILIBOP_LOCKFS_NOTIFY_POLICY}" in
never|lockfs) ;;
*) plymouth_message "Impermutability is disabled" ;;
esac
exit 0
;;
*)
if is_removable ${BILIBOP_DISK}
then log_warning_msg "Impermutability: Locking filesystem."
else
# Undo what has been done before (in the init-top script)
# and exit
undo_readonly_dm_settings
log_warning_msg "Impermutability: Nothing to do."
case "${BILIBOP_LOCKFS_NOTIFY_POLICY}" in
never|lockfs) ;;
*) plymouth_message "Impermutability is disabled" ;;
esac
exit 0
fi
;;
esac
# Exit if ${rootmnt} is already mounted as an aufs/overlayfs branch (by fsprotect, overlayroot?):
if is_aufs_mountpoint -q "${rootmnt}"
then log_warning_msg "Impermutability: Root filesystem is already mounted as aufs..."
log_failure_msg "Impermutability: Exit."
plymouth_message "Impermutability: ERROR"
exit 0
elif is_overlay_mountpoint -q "${rootmnt}"
then log_warning_msg "Impermutability: Root filesystem is already mounted as overlayfs..."
log_failure_msg "Impermutability: Exit."
plymouth_message "Impermutability: ERROR"
exit 0
fi
# Preselect the aufs or overlay module:
if [ "${BILIBOP_LOCKFS_UNION_METHOD}" = "overlay" ]; then
tryfirst="overlay"
fallback="aufs"
else
tryfirst="aufs"
fallback="overlay"
fi
# Load the aufs or overlay module:
if modprobe ${tryfirst} >/dev/null 2>&1 &&
grep -q "[[:blank:]]${tryfirst}$" /proc/filesystems
then METHOD="${tryfirst}"
elif modprobe ${fallback} >/dev/null 2>&1 &&
grep -q "[[:blank:]]${fallback}$" /proc/filesystems
then METHOD="${fallback}"
else
log_failure_msg "Impermutability: No unionfs (${tryfirst}, ${fallback}) kernel support."
log_failure_msg "Impermutability: Exit."
plymouth_message "Impermutability: ERROR"
exit 1
fi
# If BILIBOP_LOCKFS_POLICY is not explicitly set to 'soft', then apply a hard
# policy: set readonly branch as 'rr' (real readonly) instead of just 'ro' and
# set the root device and all its parent devices until the whole disk itself
# as readonly, with blockdev(8):
if [ "${BILIBOP_LOCKFS_POLICY}" = "soft" ]
then RO="ro"
else RO="rr"
blockdev_root_subtree ro ${BILIBOP_ROOT} ${BILIBOP_DISK}
BILIBOP_LOCKFS_POLICY="hard"
fi
# Determine tmpfs size for the writable branch:
if [ -z "${SIZE}" ]
then
for size in ${BILIBOP_LOCKFS_SIZE}
do
case "${size}" in
/=[1-9]*)
SIZE="$(printf ${size#/=} | grep '^[1-9][0-9]*[KkMmGg%]\?$')"
break
;;
esac
done
fi
log_begin_msg "Impermutability: Setting up ${METHOD} branches"
# Protect ${rootmnt}/usr if it is a mountpoint.
preserve_usr
# Prepare directories. This is a key point. The goal is to get a
# directory tree easy to understand: with the readonly branch beside
# the writable one, in a directory with explicit name. Also, since
# information parsed from /proc/mounts are out of sync (overlay, but
# also aufs with brs=0), make that the final mountpoints seen from
# the running system are the same than the initial mountpoints in
# the initramfs environment. In other words, be consistent to mitigate
# the out-of-sync issue.
# For aufs, we need (or want) two mountpoints to build the third one:
# /aufs/ro + /aufs/rw -> /tmp/union -> $rootmnt
# For overlay, we also need two mountpoints, but three directories, as
# follows:
# - lowerdir is the mountpoint of the readonly branch; can be anywhere
# - upperdir and workdir must reside on the same mount
# - upperdir and workdir cannot be a subdirectory of the other
# This means that neither upperdir nor workdir can be a mountpoint.
# So the design of bilibop-lockfs is to use a tmpfs mountpoint (/overlay)
# to create all that is needed into: not only upperdir and workdir, but
# also lowerdir:
# /overlay/ro + /overlay/rw + /overlay/.rw -> /tmp/union -> $rootmnt
UNIONFS="/tmp/union"
BASEDIR="/${BILIBOP_LOCKFS_PATH_PREFIX:-${METHOD}}"
HOSTDIR="${BASEDIR}/ro"
preset_branches ${METHOD}
if ! mount -t tmpfs -o mode=0755${SIZE:+,size=${SIZE}} tmpfs ${TEMPDIR}
then
# Don't forget to undo what has been done before !
[ "${BILIBOP_LOCKFS_POLICY}" = "soft" ] ||
blockdev_root_subtree rw ${BILIBOP_ROOT} ${BILIBOP_DISK}
log_failure_msg "Impermutability: Error occured when setting ${METHOD} writable branch."
log_failure_msg "Impermutability: Exit."
plymouth_message "Impermutability: ERROR"
exit 1
fi
# HOSTDIR may be a subdirectory of TEMPDIR (for overlay), so now we can create it:
[ -d "${HOSTDIR}" ] || mkdir "${HOSTDIR}"
# Set mount options, depending on the union fs type:
if [ "${METHOD}" = "aufs" ]
then UNIONFS_OPTS="br:${TEMPDIR}=rw:${HOSTDIR}=${RO}"
elif [ "${METHOD}" = "overlay" ]
then UNIONFS_OPTS="lowerdir=${LOWERDIR},upperdir=${UPPERDIR},workdir=${WORKDIR}"
[ -d "${UPPERDIR}" ] || mkdir "${UPPERDIR}"
[ -d "${WORKDIR}" ] || mkdir "${WORKDIR}"
fi
# Now do the job:
mount -o bind ${rootmnt} ${HOSTDIR}
if mount -t ${METHOD} -o ${UNIONFS_OPTS} ${METHOD} ${UNIONFS}
then
umount ${rootmnt}
mount -o move ${UNIONFS} ${rootmnt}
move_mounts
else
# Again, don't forget to undo what has been done before:
[ "${BILIBOP_LOCKFS_POLICY}" = "soft" ] ||
blockdev_root_subtree rw ${BILIBOP_ROOT} ${BILIBOP_DISK}
umount ${HOSTDIR}
umount ${TEMPDIR}
_log_msg "failed.\n"
log_failure_msg "Impermutability: Persistent root filesystem is writable."
plymouth_message "Impermutability: ERROR"
exit 1
fi
# Create a file to say the root filesystem is locked:
[ -d "${BILIBOP_RUNDIR}" ] || mkdir "${BILIBOP_RUNDIR}"
>${BILIBOP_RUNDIR}/lock
log_end_msg
log_success_msg "Impermutability: Root filesystem is now locked (${BILIBOP_LOCKFS_POLICY} policy)."
case "${BILIBOP_LOCKFS_NOTIFY_POLICY}" in
never|nolockfs) ;;
*) plymouth_message "Impermutability: ${BILIBOP_LOCKFS_POLICY} policy is enabled" ;;
esac
# Avoid filesystems check:
>${rootmnt}/fastboot
# This is for the case LVM is used for something else than $ROOT and $resume,
# and cryptsetup is not used (no /conf/conf.d/cryptroot in the initrd); in
# such a case, only $ROOT and $resume are activated from initrd; others are
# activated from the system with an initscript; but:
# 1. if BILIBOP_LOCKFS_POLICY is 'hard', this initscript will have no effect
# 2. we need to make devices available before parsing ${rootmnt}/etc/fstab
activate_bilibop_lv
# Rebuild fstab to automatically mount other filesystems as readonly aufs
# branches:
log_warning_msg "Impermutability: Modifying temporary static filesystem table (fstab)."
FSTAB="${rootmnt}/etc/fstab"
>>${FSTAB} # touch the file
comment="# Original line commented by Impermutability:"
replace="# ...and replaced by:"
# Comment the line about the root filesystem, which must not be managed later
# by initscripts or whatever:
sed -i "s|^\s*[^[:blank:]]\+\s\+/\s.*|\n${comment}\n#&\n|" ${FSTAB}
# Add /etc/fstab to the list of files that have been modified. This is not
# needed now, but will be used by further purposes (as the ability to sync
# on the readonly branch the files that have been modified on the writable
# branch, but those listed in ${BILIBOP_RUNDIR}/lock):
lock_file "/etc/fstab"
# Now parse fstab and modify some entries (and optionally modify crypttab
# too):
parse_and_modify_fstab
# Avoid breakage of read-only settings by LVM tools:
if [ -f "/etc/lvm/bilibop" ] &&
[ "${BILIBOP_LOCKFS_POLICY}" != "soft" ]
then
eval $(grep '^[[:blank:]]*LVM_SYSTEM_DIR=' ${rootmnt}/etc/environment)
LVM_CONF="${rootmnt}${LVM_SYSTEM_DIR:=/etc/lvm}/lvm.conf"
initialize_lvm_conf
set_readonly_lvm_settings
blacklist_bilibop_devices
>>${LVM_CONF}
lock_file "${LVM_SYSTEM_DIR}/lvm.conf"
fi
# Process /usr related stuff
if [ "${HAS_USR}" = "true" ]
then mount -o move /tmp/preserve_usr ${rootmnt}/usr
fi
# fstab has already been parsed and modified, so if /usr is whitelisted with
# an obvious token (matching its fstab record), it should be skipped there.
if grep -Eq '\s/usr\s+lockfs\s' ${rootmnt}/etc/fstab
then
BASEDIR="${BASEDIR}/usr"
HOSTDIR="${BASEDIR}/ro"
preset_branches ${METHOD}
mount -t tmpfs -o mode=0755${SIZE:+,size=${SIZE}} tmpfs ${TEMPDIR}
preset_options ${METHOD}
mount -o move ${rootmnt}/usr ${HOSTDIR}
if mount -t ${METHOD} -o ${UNIONFS_OPTS} ${METHOD} ${UNIONFS}
then mount -o move ${UNIONFS} ${rootmnt}/usr
move_mounts
else mount -o move ${HOSTDIR} ${rootmnt}/usr
fi
fi
# Now modify some other files, or execute specific actions if wanted by the
# sysadmin: set the hostname, modify MAC addresses, set autologin, and so on.
# For example:
# touch ${rootmnt}/* ${rootmnt}/bin/* ${rootmnt}/sbin/*
# find ${rootmnt}/etc ${rootmnt}/root -type f -xdev -exec touch {} \;
# find ${rootmnt} -type d -xdev -exec touch {} \;
# find ${rootmnt}/lib -xdev -exec touch {} \;
# and maybe more would allow the admin to rescue the session even if the
# device is wildly unplugged.
# TODO: this is Still In Development
# Maybe we have to provide a sample file (skeleton) including instructions to
# write a script that can be executed both from the initramfs environment or
# from the running system.
# XXX: is it standards compliant ?
for param in ${CMDLINE}
do
case "${param}" in
config)
BILIBOP_LOCKFS_RUN_SCRIPTS="true"
;;
noconfig)
BILIBOP_LOCKFS_RUN_SCRIPTS="false"
;;
esac
done
[ "${BILIBOP_LOCKFS_RUN_SCRIPTS}" = "true" ] &&
if [ -d "${rootmnt}/etc/bilibop/lockfs.d" ]
then
for exe in ${rootmnt}/etc/bilibop/lockfs.d/[0-9][0-9]_[a-z]*[a-z].sh
do
[ -x "${exe}" ] && ${exe} ${rootmnt}
done
fi
: