Attachment 11392 Details for Bug 24777 – Modified mgalive-root.sh to support encrypted persistent partition

Modified mgalive-root.sh to support encrypted persistent partition

mgalive-root.sh (text/plain), 4.63 KB, created by Martin Whitaker on 2019-12-08 20:12:37 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Whitaker

Created: 2019-12-08 20:12:37 CET

Size: 4.63 KB

patch

obsolete

>#!/usr/bin/sh
>
>. /lib/dracut-lib.sh
>
>can_decrypt=0
>if [ -f /lib/dracut-crypt-lib.sh ] ; then
>    . /lib/dracut-crypt-lib.sh
>    can_decrypt=1
>fi
>
>[ -f /tmp/root.info ] && . /tmp/root.info
>
>PATH=/usr/sbin:/usr/bin:/sbin:/bin
>
>[ -z "$1" ] && exit 1
>livedev="$1"
>
># Create the live tree
>mkdir -m 0755 -p /live/distrib
>mkdir -m 0755 -p /live/media
>mkdir -m 0755 -p /live/overlay
>mkdir -m 0755 -p /live/union
>mkdir -m 0755 -p /run/mgalive/ovlsize
>
># Get the base device name
>basedev=$(echo $livedev | sed -e 's,$/dev/sd[a-z]$1,\1,g' -e 's,$/dev/mmcblk[0-9]$p1,\1,g')
># Make it available to draklive-install and mgalive-shutdown
>echo $basedev > /run/mgalive/basedev
>
># Unlock any encrypted partitions on the base device
>if [ $can_decrypt -eq 1 ] ; then
>    for dev in $(blkid -t TYPE=crypto_LUKS -o device | grep $basedev) ; do
>        ask_for_password \
>            --ply-cmd "cryptsetup open -T1 $dev crypt_${dev##/dev/}" \
>            --ply-prompt "Password ($dev)" \
>            --ply-tries 3 \
>            --tty-cmd "cryptsetup open -T3 $dev crypt_${dev##/dev/}" \
>            --tty-tries 1
>    done
>fi
>
># Get the base directory for locating the loopback file. In normal use this is
># the root directory, but a multi-boot USB stick may want to override this.
>basedir=$(getarg mgalive.basedir)
>
># Get the device or path used for persistent storage (if it exists). In normal
># use this is another partition on the same base device, but a multi-boot USB
># stick may want to override this.
>overlay=$(getarg mgalive.overlay)
>if [ -z "$overlay" ] ; then
>    overlay=$(blkid -t LABEL=mgalive-persist -o device | grep $basedev'\|'/dev/mapper)
>else
>    overlay=$livedev$overlay
>fi
>
>info "mgalive basedev is $basedev"
>info "mgalive livedev is $livedev"
>info "mgalive basedir is $basedir/"
>info "mgalive overlay is $overlay"
>
>media=$livedev
>if [ -z "$(blkid $livedev)" ] ; then
>    if strstr "$(blkid $basedev)" "iso9660" ; then
>        # This happens when we boot from a USB stick with a isohybrid partition
>        # scheme where the first sector is unclaimed, so the first partition starts
>        # at sector 1. The iso9660 filesystem starts at sector 0, so blkid doesn't
>        # detect a valid filesystem in the first partition. udev, however, links
>        # the entry in /dev/disk/by-label to the first partition, not to the raw
>        # device, and that is what we get passed in $1 (mga#3334).
>        if [ -n "$overlay" ] ; then
>            # If we mount the raw device, we can't then also mount a partition
>            # on that device. So to enable persistence, we need to extend the
>            # first partition to claim the full range  of the iso9660 filesystem.
>            ps=$(partx -go START $livedev)
>            pe=$(partx -go END   $livedev)
>            if [ $ps -eq 1 ] ; then
>                info "Extending $livedev to cover sector 0"
>                delpart $basedev 1
>                addpart $basedev 1 0 $pe
>            else
>                info "$livedev is not a valid protective partition"
>            fi
>        else
>            # If we don't have a persistent partition, take the easy option.
>            info "Using $basedev to mount the iso9660 filesystem"
>            media=$basedev
>        fi
>    else
>        info "$livedev does not contain a valid filesystem"
>    fi
>fi
>
># Mount the live media
>mount -n -o ro $media /live/media
>
># Mount the loopback filesystem
>LOOPDEV=$( losetup -f )
>if [ -e /live/media$basedir/loopbacks/distrib-lzma.sqfs ] ; then
>    # Retain support for the original draklive. Note that despite the file
>    # name, it uses xz compression.
>    losetup -r $LOOPDEV /live/media$basedir/loopbacks/distrib-lzma.sqfs
>else
>    losetup -r $LOOPDEV /live/media$basedir/loopbacks/distrib.sqfs
>fi
>mount -n -t squashfs -o ro $LOOPDEV /live/distrib
>mount -n -t squashfs -o ro $LOOPDEV /run/mgalive/ovlsize
>
># Mount the overlay filesystem
>if [ -z "$overlay" ] ; then
>    mount -n -t tmpfs -o mode=755 none /live/overlay
>else
>    mount -n -o noatime $overlay /live/overlay
>    echo 1 > /run/mgalive/persistent
>fi
># work and memory must be on same root
>mkdir -m 0755 -p /live/overlay/work
>mkdir -m 0755 -p /live/overlay/memory
>mount -n -t overlay overlay -o lowerdir=/live/distrib,upperdir=/live/overlay/memory,workdir=/live/overlay/work,noatime /live/union
>
>ln -s /live/union /dev/root
>
>printf '/bin/mount --rbind /live/union %s\n' "$NEWROOT" > $hookdir/mount/01-$$-live.sh
>printf '/bin/umount /live/union\n'                     >> $hookdir/mount/01-$$-live.sh
>
># /live will not be visible once we pivot, so schedule its cleanup now.
># This is needed to allow a persistent overlay to be shutdown cleanly.
>umount -l /live/distrib
>umount -l /live/overlay
>umount -l /live/media
>
>need_shutdown
>
>exit 0

#!/usr/bin/sh

. /lib/dracut-lib.sh

can_decrypt=0
if [ -f /lib/dracut-crypt-lib.sh ] ; then
    . /lib/dracut-crypt-lib.sh
    can_decrypt=1
fi

[ -f /tmp/root.info ] && . /tmp/root.info

PATH=/usr/sbin:/usr/bin:/sbin:/bin

[ -z "$1" ] && exit 1
livedev="$1"

# Create the live tree
mkdir -m 0755 -p /live/distrib
mkdir -m 0755 -p /live/media
mkdir -m 0755 -p /live/overlay
mkdir -m 0755 -p /live/union
mkdir -m 0755 -p /run/mgalive/ovlsize

# Get the base device name
basedev=$(echo $livedev | sed -e 's,\(/dev/sd[a-z]\)1,\1,g' -e 's,\(/dev/mmcblk[0-9]\)p1,\1,g')
# Make it available to draklive-install and mgalive-shutdown
echo $basedev > /run/mgalive/basedev

# Unlock any encrypted partitions on the base device
if [ $can_decrypt -eq 1 ] ; then
    for dev in $(blkid -t TYPE=crypto_LUKS -o device | grep $basedev) ; do
        ask_for_password \
            --ply-cmd "cryptsetup open -T1 $dev crypt_${dev##/dev/}" \
            --ply-prompt "Password ($dev)" \
            --ply-tries 3 \
            --tty-cmd "cryptsetup open -T3 $dev crypt_${dev##/dev/}" \
            --tty-tries 1
    done
fi

# Get the base directory for locating the loopback file. In normal use this is
# the root directory, but a multi-boot USB stick may want to override this.
basedir=$(getarg mgalive.basedir)

# Get the device or path used for persistent storage (if it exists). In normal
# use this is another partition on the same base device, but a multi-boot USB
# stick may want to override this.
overlay=$(getarg mgalive.overlay)
if [ -z "$overlay" ] ; then
    overlay=$(blkid -t LABEL=mgalive-persist -o device | grep $basedev'\|'/dev/mapper)
else
    overlay=$livedev$overlay
fi

info "mgalive basedev is $basedev"
info "mgalive livedev is $livedev"
info "mgalive basedir is $basedir/"
info "mgalive overlay is $overlay"

media=$livedev
if [ -z "$(blkid $livedev)" ] ; then
    if strstr "$(blkid $basedev)" "iso9660" ; then
        # This happens when we boot from a USB stick with a isohybrid partition
        # scheme where the first sector is unclaimed, so the first partition starts
        # at sector 1. The iso9660 filesystem starts at sector 0, so blkid doesn't
        # detect a valid filesystem in the first partition. udev, however, links
        # the entry in /dev/disk/by-label to the first partition, not to the raw
        # device, and that is what we get passed in $1 (mga#3334).
        if [ -n "$overlay" ] ; then
            # If we mount the raw device, we can't then also mount a partition
            # on that device. So to enable persistence, we need to extend the
            # first partition to claim the full range  of the iso9660 filesystem.
            ps=$(partx -go START $livedev)
            pe=$(partx -go END   $livedev)
            if [ $ps -eq 1 ] ; then
                info "Extending $livedev to cover sector 0"
                delpart $basedev 1
                addpart $basedev 1 0 $pe
            else
                info "$livedev is not a valid protective partition"
            fi
        else
            # If we don't have a persistent partition, take the easy option.
            info "Using $basedev to mount the iso9660 filesystem"
            media=$basedev
        fi
    else
        info "$livedev does not contain a valid filesystem"
    fi
fi

# Mount the live media
mount -n -o ro $media /live/media

# Mount the loopback filesystem
LOOPDEV=$( losetup -f )
if [ -e /live/media$basedir/loopbacks/distrib-lzma.sqfs ] ; then
    # Retain support for the original draklive. Note that despite the file
    # name, it uses xz compression.
    losetup -r $LOOPDEV /live/media$basedir/loopbacks/distrib-lzma.sqfs
else
    losetup -r $LOOPDEV /live/media$basedir/loopbacks/distrib.sqfs
fi
mount -n -t squashfs -o ro $LOOPDEV /live/distrib
mount -n -t squashfs -o ro $LOOPDEV /run/mgalive/ovlsize

# Mount the overlay filesystem
if [ -z "$overlay" ] ; then
    mount -n -t tmpfs -o mode=755 none /live/overlay
else
    mount -n -o noatime $overlay /live/overlay
    echo 1 > /run/mgalive/persistent
fi
# work and memory must be on same root
mkdir -m 0755 -p /live/overlay/work
mkdir -m 0755 -p /live/overlay/memory
mount -n -t overlay overlay -o lowerdir=/live/distrib,upperdir=/live/overlay/memory,workdir=/live/overlay/work,noatime /live/union

ln -s /live/union /dev/root

printf '/bin/mount --rbind /live/union %s\n' "$NEWROOT" > $hookdir/mount/01-$$-live.sh
printf '/bin/umount /live/union\n'                     >> $hookdir/mount/01-$$-live.sh

# /live will not be visible once we pivot, so schedule its cleanup now.
# This is needed to allow a persistent overlay to be shutdown cleanly.
umount -l /live/distrib
umount -l /live/overlay
umount -l /live/media

need_shutdown

exit 0

Actions: View

Attachments on bug 24777: 11392 | 11393 | 11470 | 11471 | 11473 | 11479