iankelling.org Git - automated-distro-installer/blob - fai/config/hooks/partition.DEFAULT

   1 #!/bin/bash -x
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 set -eE -o pipefail
  19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  20
  21 # # fai's setup-storage won't do btrfs on luks,
  22 # # so we do it ourself :)
  23
  24 skiptask partition || ! type skiptask # for running not in fai
  25
  26 #### begin configuration
  27
  28 rootn=1
  29 swapn=2
  30 bootn=3
  31 bios_grubn=4
  32 boot_mib=1500
  33
  34
  35 ##### end configuration
  36
  37
  38 add-part() {
  39     local d ret
  40     if [[ $# == 1 ]]; then
  41         d=$dev
  42         part=$1
  43     else
  44         d=$1
  45         part=$2
  46     fi
  47     if [[ $d == /dev/disk/by-id/* ]]; then
  48         ret=$d-part$part
  49     else
  50         ret=$d$part
  51     fi
  52     echo $ret
  53 }
  54
  55 bootdev() { add-part $@ $bootn; }
  56 rootdev() { add-part $@ $rootn; }
  57 swapdev() { add-part $@ $swapn; }
  58 bios_grubdev() { add-part $@ $bios_grubn; }
  59
  60 crypt-dev() { echo /dev/mapper/crypt_dev_${1##*/}; }
  61 crypt-name() { echo crypt_dev_${1##*/}; }
  62 root-cryptdev() { crypt-dev $(rootdev $@); }
  63 swap-cryptdev() { crypt-dev $(swapdev $@); }
  64 root-cryptname() { crypt-name $(rootdev $@); }
  65 swap-cryptname() { crypt-name $(swapdev $@); }
  66
  67
  68 ##### end function defs
  69
  70 if ifclass REPARTITION;then
  71     partition=true # force a full wipe
  72 else
  73     partition=false # change to true to force a full wipe
  74 fi
  75
  76 lastn=$bios_grubn
  77
  78
  79 hdds=()
  80 ssds=()
  81 cd /sys/block
  82 for disk in [sv]d[a-z]; do
  83     case $(cat $disk/queue/rotational) in
  84         0) ssds+=(/dev/$disk) ;;
  85         1) hdds+=(/dev/$disk) ;;
  86         *) echo "$0: error: unknown /sys/block/$disk/queue/rotational: \
  87 $(cat $disk/queue/rotational)"; exit 1 ;;
  88     esac
  89 done
  90
  91 # install all ssds, or if there are none, all hdds
  92 if (( ${#ssds[@]} > 0 )); then
  93     short_devs=( ${ssds[@]} )
  94 else
  95     short_devs=( ${hdds[@]} )
  96 fi
  97
  98 # check if the partitions exist have the right filesystems
  99 #blkid="$(blkid -s TYPE)"
 100 for dev in ${short_devs[@]}; do
 101     ! $partition || break
 102     y=$(readlink -f $dev)
 103     x=($y[0-9])
 104     [[ ${#x[@]}  == "${lastn}" ]] || partition=true
 105     for (( i=1; i <= lastn; i++ )); do
 106         [[ -e ${dev}$i ]] || partition=true
 107     done
 108     # On one system, blkid is missing some partitions.
 109     # maybe we need a flag, like FUZZY_BLKID or something, so we
 110     # can check that at least some exist.
 111     # for x in "`rootdev`: TYPE=\"crypto_LUKS\"" "`bootdev`: TYPE=\"btrfs\""; do
 112     #     echo "$blkid" | grep -Fx "$x" &>/dev/null || partition=true
 113     # done
 114 done
 115
 116 if $partition && ifclass PARTITION_PROMPT; then
 117     echo "Press any key except ctrl-c to continue and partition these drives:"
 118     echo "  ${short_devs[@]}"
 119     read
 120 fi
 121
 122 devs=()
 123 shopt -s extglob
 124 for short_dev in ${short_devs[@]}; do
 125     devs+=($(devbyid $short_dev))
 126 done
 127
 128
 129
 130 boot_devs=()
 131 for dev in ${devs[@]}; do
 132     if ifclass frodo; then
 133         # I ran into a machine where the bios doesn't know about some disks,
 134         # so 1st stage of grub also doesn't know about them.
 135         # Also, grub does not support mounting degraded btrfs as far as
 136         # I can tell with some googling.
 137         # From within an arch install env, I could detect them by noting
 138         # their partitions were mixed with the next disk in /dev/disk/by-path,
 139         # and I have mixed model disks, and I could see the 8 models which showed
 140         # up in the bios, and thus see which 2 models were missing.
 141         # hdparm -I /dev/sdh will give model info in linux.
 142         # However, in fai on jessie, /dev/disk/by-path dir doesn't exist,
 143         # and I don't see another way, so I'm hardcoding them.
 144         # We still put grub on them and partition them the same, for uniformity
 145         # and in case they get moved to a system that can recognize them,
 146         # we just exclude them from the boot filesystem.
 147         cd /dev/disk/by-id/
 148         bad_disk=false
 149         for id in ata-TOSHIBA_MD04ACA500_8539K4TQFS9A \
 150                       ata-TOSHIBA_MD04ACA500_Y5IFK6IJFS9A; do
 151             if [[ $(readlink -f $id) == "$(readlink -f $dev)" ]]; then
 152                 bad_disk=true
 153                 break
 154             fi
 155         done
 156         $bad_disk || boot_devs+=(`bootdev`)
 157     else
 158         boot_devs+=(`bootdev`)
 159     fi
 160 done
 161
 162 if [[ ! $DISTRO ]]; then
 163     if ifclass STABLE; then
 164         DISTRO=debianstable
 165     else
 166         DISTRO=debiantesting
 167     fi
 168 fi
 169
 170
 171
 172 case ${#boot_devs[@]} in
 173     # need double the space if we are raid 10, and then
 174     # might as well give some extra overhead.
 175     [4-9]*|[1-3]?*) boot_mib=$((boot_mib * 3)) ;;
 176 esac
 177
 178
 179 bpart() { # btrfs a partition
 180     case ${#@} in
 181         [1-3]) mkfs.btrfs -f $@ ;;
 182         [4-9]*|[1-3]?*) mkfs.btrfs -f -m raid10 -d raid10 $@ ;;
 183     esac
 184 }
 185
 186 first_boot_dev=${boot_devs[0]}
 187
 188 # keyfiles generated like:
 189 # head -c 2048 /dev/urandom | od | s dd of=/q/root/luks/host-demohost
 190 luks_dir=${LUKS_DIR:-/var/lib/fai/config/distro-install-common/luks}
 191
 192 if [[ ! -e $luks_dir/host-$HOSTNAME ]]; then
 193     echo "$0: error: no key for hostname at $luks_dir/host-$HOSTNAME" >&2
 194     exit 1
 195 fi
 196
 197 if ifclass tp; then
 198     lukspw=$(cat $luks_dir/traci)
 199 else
 200     lukspw=$(cat $luks_dir/ian)
 201 fi
 202 if ifclass demohost; then
 203     lukspw=x
 204 fi
 205
 206
 207 first_root_crypt=$(root-cryptdev ${devs[0]})
 208
 209 bios_grubn=4
 210 # 1.5 x based on https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-disk-partitioning-setup-x86.html#sect-custom-partitioning-x86
 211 swap_mib=$(( $(grep ^MemTotal: /proc/meminfo | \
 212                    awk '{print $2}') * 3/(${#devs[@]} * 2 ) / 1024 ))
 213
 214 mkdir -p /tmp/fai
 215 root_devs=()
 216 for dev in ${devs[@]}; do
 217     root_devs+=(`rootdev`)
 218 done
 219 shopt -s nullglob
 220 if $partition; then
 221     for dev in ${devs[@]}; do
 222         for x in $dev[0-9]; do
 223             count_down=10
 224             # wipefs has failed, manual run works, google suggests timing issue
 225             while ! wipefs -a $x; do
 226                 sleep 2
 227                 count_down=$((count_down - 1))
 228                 (( count_down > 0 )) || exit 1
 229             done
 230         done
 231     done
 232     for dev in ${devs[@]}; do
 233         # parted will round up the disk size. Do -1 so we can have
 234         # fully 1MiB unit partitions for easy resizing of the last partition.
 235         # Otherwise we would pass in -0 for the end argument for the last partition.
 236         #
 237         # parted print error output is expected. example:
 238         # Error: /dev/vda: unrecognised disk label
 239         disk_mib=$(( $(parted -m $dev unit MiB print | \
 240                            sed -nr "s#^/dev/[^:]+:([0-9]+).*#\1#p") - 1))
 241         root_end=$(( disk_mib - swap_mib - boot_mib /  ${#boot_devs[@]} ))
 242         swap_end=$(( root_end + swap_mib))
 243
 244         parted -s $dev mklabel gpt
 245         # gpt ubuntu cloud image uses ~4. fai uses 1 MiB.
 246         # I read something in the parted manual saying cheap flash media
 247         # likes to start at 4.
 248         # MiB because parted complains about alignment otherwise.
 249         pcmd="parted -a optimal -s -- $dev"
 250         $pcmd mkpart primary "ext3" 4MiB ${root_end}MiB
 251         $pcmd mkpart primary "linux-swap" ${root_end}MiB ${swap_end}MiB
 252         $pcmd mkpart primary "" ${swap_end}MiB ${disk_mib}MiB
 253         $pcmd mkpart primary "" 1MiB 4MiB
 254         $pcmd set $bios_grubn bios_grub on
 255         $pcmd set $bootn boot on # generally not needed on modern systems
 256         # the mkfs failed before on a vm, which prompted me to add
 257         # sleep .1
 258         # then failed on a physical machine
 259         # with:
 260         # Device /dev/disk/by-id/foo doesn't exist or access denied,
 261         # so here we wait.
 262         secs=0
 263         while [[ ! -e `rootdev` ]] && (( secs < 10 )); do
 264             sleep 1
 265             secs=$((secs +1))
 266         done
 267         yes YES | cryptsetup luksFormat `rootdev` $luks_dir/host-$HOSTNAME \
 268                              -c aes-cbc-essiv:sha256 -s 256 || [[ $? == 141 ]]
 269         yes "$lukspw" | \
 270             cryptsetup luksAddKey --key-file $luks_dir/host-$HOSTNAME \
 271                        `rootdev` || [[ $? == 141 ]]
 272         # background: Keyfile and password are treated just
 273         # like 2 ways to input a passphrase, so we don't actually need to have
 274         # different contents of keyfile and passphrase, but it makes some
 275         # security sense to a really big randomly generated passphrase
 276         # as much as possible, so we have both.
 277         #
 278         # This would remove the keyfile.
 279         #    yes 'test' | cryptsetup luksRemoveKey /dev/... \
 280             #                            /key/file || [[ $? == 141 ]]
 281
 282         cryptsetup luksOpen `rootdev` `root-cryptname` \
 283                    --key-file $luks_dir/host-$HOSTNAME
 284     done
 285     ls -la /dev/btrfs-control
 286     sleep 1
 287     bpart $(for dev in ${devs[@]}; do root-cryptdev; done)
 288     bpart ${boot_devs[@]}
 289 else
 290     for dev in ${devs[@]}; do
 291         cryptsetup luksOpen `rootdev` `root-cryptname` \
 292                    --key-file $luks_dir/host-$HOSTNAME
 293     done
 294     sleep 1
 295 fi
 296
 297 mount -o subvolid=0 $first_root_crypt /mnt
 298 # systemd creates subvolumes we want to delete.
 299 s=($(btrfs subvolume list --sort=-path /mnt |
 300          sed -rn "s#^.*path\s*(root_$DISTRO/\S+)\s*\$#\1#p"))
 301 for subvol in ${s[@]}; do btrfs subvolume delete /mnt/$subvol; done
 302 btrfs subvolume set-default 0 /mnt
 303 [[ ! -e /mnt/root_$DISTRO ]] || btrfs subvolume delete /mnt/root_$DISTRO
 304
 305 ## create subvols ##
 306 cd /mnt
 307 btrfs subvolume create root_$DISTRO
 308 [[ -e q ]] || btrfs subvolume create q
 309 chown root:1000 q
 310
 311 mkdir -p /mnt/root_$DISTRO/boot
 312 for x in q/a q/i; do
 313     mkdir -p $x
 314     chown 1000:1000 $x
 315     chmod 755 $x
 316 done
 317 # could set default like this, but no reason to.
 318 # btrfs subvolume set-default \
 319     #       $(btrfs subvolume list . | grep "root_$DISTRO$" | awk '{print $2}') .
 320 chattr -Rf +C root_$DISTRO
 321 cd /
 322 umount /mnt
 323 mount -o subvolid=0 $first_boot_dev /mnt
 324 cd /mnt
 325 btrfs subvolume set-default 0 /mnt
 326 [[ ! -e /mnt/boot_$DISTRO ]] || btrfs subvolume delete /mnt/boot_$DISTRO
 327 btrfs subvolume create boot_$DISTRO
 328 cd /
 329 umount /mnt
 330 ## end create subvols ##
 331
 332
 333 # note, the mount point /a seems to get automatically created somewhere
 334 cat > /tmp/fai/fstab <<EOF
 335 $first_root_crypt  /  btrfs  noatime,subvol=root_$DISTRO  0 0
 336 $first_root_crypt  /q  btrfs  noatime,subvol=q  0 0
 337 /q/a  /a  none  bind  0 0
 338 $first_boot_dev  /boot  btrfs  noatime,subvol=boot_$DISTRO  0 0
 339 EOF
 340
 341
 342 # these 2 are alternative ways to identify a subvol, i think i prefer the 2nd.
 343 if ifclass treetowl; then
 344     cat >> /tmp/fai/fstab <<'EOF'
 345 $first_root_crypt  /i  btrfs  noatime,subvol=i  0 0
 346 UUID=3f7b31cd-f299-40b4-a86b-7604282e2715 /i btrfs  noatime  0 2
 347 EOF
 348 fi
 349 if ifclass frodo; then
 350     cat >> /tmp/fai/fstab <<'EOF'
 351 $first_root_crypt  /i  btrfs  noatime,subvol=i  0 0
 352 EOF
 353 fi
 354
 355 swaps=()
 356 for dev in ${devs[@]}; do
 357     swaps+=(`swap-cryptname`)
 358     cat >>/tmp/fai/crypttab <<EOF
 359 `root-cryptname`  `rootdev`  none  keyscript=/root/keyscript,discard,luks
 360 `swap-cryptname` `swapdev`  /dev/urandom  swap,cipher=aes-xts-plain64,size=256,hash=ripemd160
 361 EOF
 362     cat >> /tmp/fai/fstab <<EOF
 363 `swap-cryptdev`  none  swap  sw  0 0
 364 EOF
 365 done
 366
 367 # fai would do this:
 368 #BOOT_DEVICE=\${BOOT_DEVICE:-"${devs[0]}"}
 369
 370 # swaplist seems to do nothing.
 371
 372 cat >/tmp/fai/disk_var.sh <<EOF
 373 # ROOT_PARTITIONS is added by me, used in arch setup.
 374 ROOT_PARTITIONS="${root_devs[@]}"
 375 ROOT_PARTITION=\${ROOT_PARTITION:-$first_root_crypt}
 376 BOOT_PARTITION=\${BOOT_PARTITION:-$first_boot_dev}
 377 BOOT_DEVICE="${short_devs[@]}"
 378 SWAPLIST=\${SWAPLIST:-"${swaps[@]}"}
 379 EOF