iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 set -eE -o pipefail
  19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  20
  21 # # fai's setup-storage won't do btrfs on luks,
  22 # # so we do it ourself :)
  23
  24 skiptask partition || ! type skiptask # for running not in fai
  25
  26 #### begin configuration
  27
  28 rootn=1
  29 swapn=2
  30 bootn=3
  31 bios_grubn=4
  32 boot_mib=4000
  33
  34
  35 ##### end configuration
  36
  37
  38 add-part() { # add partition suffix to $dev
  39     local d ret
  40     if [[ $# == 1 ]]; then
  41         d=$dev
  42         part=$1
  43     else
  44         d=$1
  45         part=$2
  46     fi
  47     if [[ $d == /dev/disk/by-id/* ]]; then
  48         ret=$d-part$part
  49     else
  50         ret=$d$part
  51     fi
  52     echo $ret
  53 }
  54
  55 bootdev() { add-part $@ $bootn; }
  56 rootdev() { add-part $@ $rootn; }
  57 swapdev() { add-part $@ $swapn; }
  58 bios_grubdev() { add-part $@ $bios_grubn; }
  59
  60 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
  61 crypt-name() { echo crypt_dev_${1##*/}; }
  62 root-cryptdev() { crypt-dev $(rootdev $@); }
  63 swap-cryptdev() { crypt-dev $(swapdev $@); }
  64 root-cryptname() { crypt-name $(rootdev $@); }
  65 swap-cryptname() { crypt-name $(swapdev $@); }
  66
  67
  68 ##### end function defs
  69
  70 if ifclass REPARTITION;then
  71     partition=true # force a full wipe
  72 else
  73     partition=false # change to true to force a full wipe
  74 fi
  75
  76 lastn=$bios_grubn
  77
  78
  79 hdds=()
  80 ssds=()
  81 cd /sys/block
  82 for disk in [sv]d[a-z]; do
  83     case $(cat $disk/queue/rotational) in
  84         0) ssds+=(/dev/$disk) ;;
  85         1) hdds+=(/dev/$disk) ;;
  86         *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
  87 $(cat $disk/queue/rotational)"; exit 1 ;;
  88     esac
  89 done
  90
  91 # install all ssds, or if there are none, all hdds
  92 if (( ${#ssds[@]} > 0 )); then
  93     short_devs=( ${ssds[@]} )
  94 else
  95     short_devs=( ${hdds[@]} )
  96 fi
  97
  98 # check if the partitions exist have the right filesystems
  99 #blkid="$(blkid -s TYPE)"
 100 for dev in ${short_devs[@]}; do
 101     ! $partition || break
 102     y=$(readlink -f $dev)
 103     x=($y[0-9])
 104     [[ ${#x[@]}  == "${lastn}" ]] || partition=true
 105     for (( i=1; i <= lastn; i++ )); do
 106         [[ -e ${dev}$i ]] || partition=true
 107     done
 108     # On one system, blkid is missing some partitions.
 109     # maybe we need a flag, like FUZZY_BLKID or something, so we
 110     # can check that at least some exist.
 111     # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
 112     #     echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
 113     # done
 114 done
 115
 116 if $partition && ifclass PARTITION_PROMPT; then
 117     echo "Press any key except ctrl-c to continue and partition these drives:"
 118     echo "  ${short_devs[@]}"
 119     read
 120 fi
 121
 122 devs=()
 123 shopt -s extglob
 124 for short_dev in ${short_devs[@]}; do
 125     devs+=($(devbyid $short_dev))
 126 done
 127
 128
 129
 130 boot_devs=()
 131 for dev in ${devs[@]}; do
 132     if ifclass frodo; then
 133         # I ran into a machine where the bios doesn't know about some disks,
 134         # so 1st stage of grub also doesn't know about them.
 135         # Also, grub does not support mounting degraded btrfs as far as
 136         # I can tell with some googling.
 137         # From within an arch install env, I could detect them by noting
 138         # their partitions were mixed with the next disk in /dev/disk/by-path,
 139         # and I have mixed model disks, and I could see the 8 models which showed
 140         # up in the bios, and thus see which 2 models were missing.
 141         # hdparm -I /dev/sdh will give model info in linux.
 142         # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
 143         # and I don't see another way, so I'm hardcoding them.
 144         # We still put grub on them and partition them the same, for uniformity
 145         # and in case they get moved to a system that can recognize them,
 146         # we just exclude them from the boot filesystem.
 147         cd /dev/disk/by-id/
 148         bad_disk=false
 149         for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
 150                       ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
 151             if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
 152                 bad_disk=true
 153                 break
 154             fi
 155         done
 156         $bad_disk || boot_devs+=(`bootdev`)
 157     else
 158         boot_devs+=(`bootdev`)
 159     fi
 160 done
 161
 162 if [[ ! $DISTRO ]]; then
 163     if ifclass STABLE_BOOTSTRAP; then
 164         DISTRO=debianstable_bootstrap
 165     elif ifclass STRETCH64; then
 166         DISTRO=debiantesting
 167     elif ifclass STABLE; then
 168         DISTRO=debianstable
 169     elif ifclass XENIAL64; then
 170         DISTRO=ubuntuxenial
 171     elif ifclass BELENOS64; then
 172         DISTRO=trisquelbelenos
 173     else
 174         echo "PARTITIONER ERROR: no distro class/var set" >&2
 175         exit 1
 176     fi
 177 fi
 178
 179
 180 case ${#boot_devs[@]} in
 181     # need double the space if we are raid 10, and then
 182     # might as well give some extra overhead.
 183     [4-9]*|[1-3]?*) boot_mib=$((boot_mib * 3)) ;;
 184 esac
 185
 186
 187 bpart() { # btrfs a partition
 188     case ${#@} in
 189         [1-3]) mkfs.btrfs -f $@ ;;
 190         [4-9]*|[1-3]?*) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
 191     esac
 192 }
 193
 194 first_boot_dev=${boot_devs[0]}
 195
 196 # keyfiles generated like:
 197 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
 198 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
 199
 200 if [[ ! -e $luks_dir/host-$HOSTNAME ]]; then
 201     echo "$0: error: no key for hostname at $luks_dir/host-$HOSTNAME" >&2
 202     exit 1
 203 fi
 204
 205 if ifclass tp; then
 206     lukspw=$(cat $luks_dir/traci)
 207 else
 208     lukspw=$(cat $luks_dir/ian)
 209 fi
 210 if ifclass demohost; then
 211     lukspw=x
 212 fi
 213
 214
 215 first_root_crypt=$(root-cryptdev ${devs[0]})
 216
 217 bios_grubn=4
 218 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
 219 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
 220                    awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
 221
 222 mkdir -p /tmp/fai
 223 root_devs=()
 224 for dev in ${devs[@]}; do
 225     root_devs+=(`rootdev`)
 226 done
 227 shopt -s nullglob
 228 if $partition; then
 229     for dev in ${devs[@]}; do
 230         for x in $dev[0-9]; do
 231             count_down=10
 232             # wipefs has failed, manual run works, google suggests timing issue
 233             while ! wipefs -a $x; do
 234                 sleep 2
 235                 count_down=$((count_down - 1))
 236                 (( count_down > 0 )) || exit 1
 237             done
 238         done
 239     done
 240     for dev in ${devs[@]}; do
 241         # parted will round up the disk size. Do -1 so we can have
 242         # fully 1MiB unit partitions for easy resizing of the last partition.
 243         # Otherwise we would pass in -0 for the end argument for the last partition.
 244         #
 245         # parted print error output is expected. example:
 246         # Error: /dev/vda: unrecognised disk label
 247         disk_mib=$(( $(parted -m $dev unit MiB print | \
 248                            sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
 249         root_end=$(( disk_mib - swap_mib - boot_mib /  ${#boot_devs[@]} ))
 250         swap_end=$(( root_end + swap_mib))
 251
 252         parted -s $dev mklabel gpt
 253         # MiB because parted complains about alignment otherwise.
 254         pcmd="parted -a optimal -s -- $dev"
 255         $pcmd mkpart primary "ext3" 4MiB ${root_end}MiB
 256         $pcmd mkpart primary "linux-swap" ${root_end}MiB ${swap_end}MiB
 257         $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
 258         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB.
 259         # I read something in the parted manual saying cheap flash media
 260         # likes to start at 4.
 261         $pcmd mkpart primary "" 1MiB 4MiB
 262         $pcmd set $bios_grubn bios_grub on
 263         $pcmd set $bootn boot on # generally not needed on modern systems
 264         # the mkfs failed before on a vm, which prompted me to add
 265         # sleep .1
 266         # then failed on a physical machine
 267         # with:
 268         # Device /dev/disk/by-id/foo doesn't exist or access denied,
 269         # so here we wait.
 270         secs=0
 271         while [[ ! -e `rootdev` ]] && (( secs < 10 )); do
 272             sleep 1
 273             secs=$((secs +1))
 274         done
 275         yes YES | cryptsetup luksFormat `rootdev` $luks_dir/host-$HOSTNAME \
 276                              -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 277         yes "$lukspw" | \
 278             cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 279                        `rootdev` || [[ $? == 141 ]]
 280         # background: Keyfile and password are treated just
 281         # like 2 ways to input a passphrase, so we don't actually need to have
 282         # different contents of keyfile and passphrase, but it makes some
 283         # security sense to a really big randomly generated passphrase
 284         # as much as possible, so we have both.
 285         #
 286         # This would remove the keyfile.
 287         #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 288             #                            /key/file || [[ $? == 141 ]]
 289
 290         cryptsetup luksOpen `rootdev` `root-cryptname` \
 291                    --key-file $luks_dir/host-$HOSTNAME
 292     done
 293     ls -la /dev/btrfs-control # this was probably for debugging...
 294     sleep 1
 295     bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
 296     bpart ${boot_devs[@]}
 297 else
 298     for dev in ${devs[@]}; do
 299         cryptsetup luksOpen `rootdev` `root-cryptname` \
 300                    --key-file $luks_dir/host-$HOSTNAME
 301     done
 302     sleep 1
 303 fi
 304
 305
 306 if [[ $DISTRO != debianstable_bootstrap ]]; then
 307     # bootstrap distro doesn't use separate encrypted root.
 308     mount -o subvolid=0 $first_root_crypt /mnt
 309     # systemd creates subvolumes we want to delete.
 310     s=($(btrfs subvolume list --sort=-path /mnt |
 311              sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
 312     for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 313     btrfs subvolume set-default 0 /mnt
 314     [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
 315
 316     ## create subvols ##
 317     cd /mnt
 318
 319     btrfs subvolume create root_$DISTRO
 320     [[ -e q ]] || btrfs subvolume create q
 321     chown root:1000 q
 322
 323     mkdir -p /mnt/root_$DISTRO/boot
 324     for x in q/a q/i; do
 325         mkdir -p $x
 326         chown 1000:1000 $x
 327         chmod 755 $x
 328     done
 329     # could set default like this, but no reason to.
 330     # btrfs subvolume set-default \
 331         #       $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
 332
 333     # no cow on the root filesystem. it's setup is fully scripted,
 334     # (immutable in buzzwords). if it messes up, we will just recreated it,
 335     # and we can get better perf with this.
 336     # I can't remember exactly why, but this is preferable to mounting with
 337     # -o nodatacow, I think because subvolumes inherit that.
 338     chattr -Rf +C root_$DISTRO
 339     cd /
 340     umount /mnt
 341 fi
 342
 343 mount -o subvolid=0 $first_boot_dev /mnt
 344 cd /mnt
 345 btrfs subvolume set-default 0 /mnt
 346
 347 # for libreboot systems
 348 mkdir -p /mnt/grub2
 349 cat >/mnt/grub2/libreboot_grub.cfg <<'EOF'
 350 #!/bin/sh
 351 # shebang is for editor file mode detection only
 352
 353 if [ -s $prefix/grubenv ]; then
 354     load_env
 355 fi
 356
 357 set default="0"
 358 set timeout=1
 359
 360 menuentry debianstable_bootstrap {
 361     configfile /$1/boot/grub/grub.cfg
 362 }
 363
 364 for dir in /boot_*; do
 365     if [ x$dir = x$default_subvol ]; then
 366         default=default_id
 367         menuentry $dir --id=default_id {
 368             configfile $1/grub/grub.cfg
 369         }
 370     else
 371         menuentry $dir {
 372             configfile $1/grub/grub.cfg
 373         }
 374     fi
 375 done
 376 EOF
 377
 378 if [[ $DISTRO == debianstable_bootstrap ]]; then
 379     # this is just convenience for the libreboot_grub config
 380     # so we can glob the other ones easier.
 381     boot_vol=$DISTRO
 382 else
 383     boot_vol=boot_$DISTRO
 384 fi
 385 [[ ! -e /mnt/$boot_vol ]] || btrfs subvolume delete /mnt/$boot_vol
 386 btrfs subvolume create $boot_vol
 387 cd /
 388 umount /mnt
 389 ## end create subvols ##
 390
 391
 392 if [[ $DISTRO == debianstable_bootstrap ]]; then
 393     cat > /tmp/fai/fstab <<EOF
 394 $first_boot_dev  /  btrfs  noatime,subvol=$boot_vol  0 0
 395 EOF
 396     cat >/tmp/fai/disk_var.sh <<EOF
 397 BOOT_DEVICE="${short_devs[@]}"
 398 ROOT_PARTITION=$first_boot_dev
 399 EOF
 400 else
 401     # note, the mount point /a seems to get automatically created somewhere
 402     cat > /tmp/fai/fstab <<EOF
 403 $first_root_crypt  /  btrfs  noatime,subvol=root_$DISTRO  0 0
 404 $first_root_crypt  /q  btrfs  noatime,subvol=q  0 0
 405 /q/a  /a  none  bind  0 0
 406 $first_boot_dev  /boot  btrfs  noatime,subvol=$boot_vol  0 0
 407 EOF
 408
 409     # I will avoid using uuid in the future. the other way of specifying is simpler
 410     if ifclass treetowl; then
 411         cat >> /tmp/fai/fstab <<'EOF'
 412 $first_root_crypt  /i  btrfs  noatime,subvol=i  0 0
 413 UUID=3f7b31cd-f299-40b4-a86b-7604282e2715 /i btrfs  noatime  0 2
 414 EOF
 415     fi
 416
 417     swaps=()
 418     for dev in ${devs[@]}; do
 419         swaps+=(`swap-cryptname`)
 420         cat >>/tmp/fai/crypttab <<EOF
 421 `root-cryptname`  `rootdev`  none  keyscript=/root/keyscript,discard,luks
 422 `swap-cryptname` `swapdev`  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 423 EOF
 424         cat >> /tmp/fai/fstab <<EOF
 425 `swap-cryptdev`  none  swap  sw  0 0
 426 EOF
 427     done
 428
 429     # fai would do this:
 430     #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 431
 432     # note: swaplist seems to do nothing.
 433     cat >/tmp/fai/disk_var.sh <<EOF
 434 BOOT_DEVICE="${short_devs[@]}"
 435 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
 436 # ROOT_PARTITIONS is added by me, used in arch setup.
 437 ROOT_PARTITIONS="${root_devs[@]}"
 438 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
 439 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 440 EOF
 441 fi