2 set -e -f ${DRY_RUN:+-n} -u
10 DESCRIPTION: ce script regroupe des fonctions utilitaires
11 pour gérer la VM des ateliers _depuis_ son hôte ;
12 il sert à la fois d'outil et de documentation.
13 Voir \`$tool/ateliers_hosted' pour les utilitaires côté VM hébergée.
14 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
16 $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$tool"/env.sh "$0")
18 TRACE # affiche les commandes avant leur exécution
19 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
23 readonly vm_dev_disk
=/dev
/mapper
/domU-$
(printf %s
"$vm_fqdn-disk" |
sed -e 's/-/--/g')
24 readonly vm_dev_disk_boot
="${vm_dev_disk}1"
26 rule_xen_config_init
() {
27 sudo
tee /etc
/xen
/$vm_fqdn.cfg
<<-EOF
28 # -*- mode: python; -*-
34 vif = ['mac=$vm_mac,bridge=$vm_bridge']
35 disk = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
36 kernel = "/usr/lib/xen-4.0/boot/hvmloader"
38 device_model = 'qemu-dm'
41 # boot on floppy (a), hard disk (c) or CD-ROM (d)
47 #vnclisten = "0.0.0.0"
53 on_poweroff = 'destroy'
59 sudo xm create
$vm_fqdn.cfg
62 sudo xm shutdown
$vm_fqdn.cfg
65 rule_disk_mount
() { # DESCRIPTION: montage du disque de la VM depuis l'hôte
66 sudo kpartx
-a -v /dev
/domU
/$vm_fqdn-disk
67 #sudo xm block-attach 0 phy:/dev/domU/$vm_fqdn-disk $vm_dev_disk w
69 rule_disk_umount
() { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
82 sudo kpartx
-d -v /dev
/domU
/$vm_fqdn-disk
83 #sudo xm block-detach 0 $vm_dev_disk
84 # XXX: DANGEREUX ; si jamais il bloque parce que le disque était encore utilisé :
85 # utiliser xm block-detach 0 $vm_dev_disk --force ;
86 # ôter les éventuels mappages LVM concernés avec dmsetup table et dmsetup remove --force ;
87 # ôter les mappages concernés dans /etc/lvm/cache/.cache,
88 # et pour bien trouver tous les mappages :
89 # % sudo find /dev -type l -exec sh -c 'printf "%s -> " "$@"; readlink "$@"' - {} \; | grep $vm_dev_disk
90 # enfin, ôter l'éventuel verrou dans /var/lock/lvm/
95 readonly vm_dev_disk_swap
="${vm_dev_disk}5"
96 readonly vm_dev_disk_root
="${vm_dev_disk}6"
97 readonly vm_dev_disk_var
="${vm_dev_disk}7"
98 readonly vm_dev_disk_home
="${vm_dev_disk}8"
101 readonly vm_lvm_pv
="${vm_dev_disk}2"
102 readonly vm_dev_disk_swap
=/dev
/$vm_lvm_vg/${vm_lvm_lv}_swap
103 readonly vm_dev_disk_root
=/dev
/$vm_lvm_vg/${vm_lvm_lv}_root
104 readonly vm_dev_disk_var
=/dev
/$vm_lvm_vg/${vm_lvm_lv}_var
105 readonly vm_dev_disk_home
=/dev
/$vm_lvm_vg/${vm_lvm_lv}_home
111 rule_disk_format
() { # DESCRIPTION: partitionnage du disque de la VM
114 sudo sfdisk
$vm_dev_disk <<-EOF
115 # partition table of $vm_dev_disk
118 ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
119 ${vm_dev_disk}2 : start= 498015, size=418927005, Id= 5
120 ${vm_dev_disk}3 : start= 0, size= 0, Id= 0
121 ${vm_dev_disk}4 : start= 0, size= 0, Id= 0
122 ${vm_dev_disk}5 : start= 498078, size= 1959867, Id=82
123 ${vm_dev_disk}6 : start= 2458008, size= 29302497, Id=83
124 ${vm_dev_disk}7 : start= 31760568, size= 9767457, Id=83
125 ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
129 sudo sfdisk
$vm_dev_disk <<-EOF
130 # partition table of $vm_dev_disk
133 ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
134 ${vm_dev_disk}2 : start= 498015, size=418927005, Id=8E
139 #sudo partprobe $vm_dev_disk
140 sudo kpartx
-u -v /dev
/domU
/$vm_fqdn-disk
143 rule_part_lvm_format
() {
145 ! sudo vgs |
grep -q "^ $vm_lvm_vg " ||
146 sudo vgremove
$vm_lvm_vg
147 sudo pvcreate
--dataalignment 512k
$vm_lvm_pv
148 sudo vgcreate
--dataalignment 512k
$vm_lvm_vg $vm_lvm_pv
149 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_swap
-L 1G
$vm_lvm_vg
150 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_root
-L 15G
$vm_lvm_vg
151 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_var
-L 5G
$vm_lvm_vg
152 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_home
-l 99%FREE
$vm_lvm_vg
155 rule_part_lvm_mount
() {
156 sudo vgchange
-a y
$vm_lvm_vg
157 sudo lvchange
-a y
$vm_lvm_lv
159 rule_part_lvm_umount
() {
160 rule_part_root_umount
162 rule_part_home_umount
163 if sudo vgs |
grep -q "^ $vm_lvm_vg "
165 sudo lvchange
-a n
$vm_lvm_vg
166 sudo vgchange
-a n
$vm_lvm_vg
170 rule_part_randomize
() { # SYNTAX: $part # NOTE: à anticiper
172 eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
174 rule_part_randomize_stat
() { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_clean
176 eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
178 rule__part_encrypted_format
() { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
179 # NOTE: la clef de chiffrement est dérivée de celle de /,
180 # / doit être déchiffrée pour que cela fonctionne.
182 eval "local dev=\$vm_dev_disk_$part"
183 test ! -e /dev
/mapper
/${vm}_root_deciphered ||
184 sudo
/bin
/sh
-c "/lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
185 cryptsetup luksFormat --hash=sha512 --key-size=512 \
186 --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev"
188 rule__part_encrypted_mount
() { # SYNTAX: $part
190 eval "local dev=\$vm_dev_disk_$part"
191 test -e /dev
/mapper
/${vm}_
${part}_deciphered ||
192 sudo
/bin
/sh
-c "/lib/cryptsetup/scripts/decrypt_derived ${vm}_root_deciphered |
193 cryptsetup luksOpen --key-file=- $dev ${vm}_${part}_deciphered"
195 rule__part_encrypted_umount
() { # SYNTAX: $part
197 eval "local dev=\$vm_dev_disk_$part"
198 test ! -e /dev
/mapper
/${vm}_
${part}_deciphered ||
199 sudo cryptsetup luksClose
${vm}_
${part}_deciphered
202 rule_part_root_format
() {
203 if ! mount |
grep -q "^$vm_dev_disk_root "
205 sudo cryptsetup luksFormat
--hash=sha512
--key-size=512 \
206 --cipher=aes-xts-essiv
:sha256
--key-file=- --align-payload=8 $vm_dev_disk_root
207 sudo cryptsetup luksOpen
--key-file=- $vm_dev_disk_root ${vm}_root_deciphered
208 sudo mke2fs
-t ext4
-c -c -m 5 -T ext4
-b $vm_e2fs_block_size \
209 -E resize
=30G
${vm_e2fs_extended_options} \
211 /dev
/mapper
/${vm}_root_deciphered
212 ! mountpoint
-q /mnt
/$vm_fqdn
213 sudo mount
-v /dev
/mapper
/${vm}_root_deciphered
/mnt
/$vm_fqdn
214 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/boot
215 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/dev
216 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/home
217 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/proc
218 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/sys
219 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/var
220 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/root
221 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/root
/tool
222 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/root
/tool
/ateliers
223 sudo umount
-v /mnt
/$vm_fqdn
224 sudo cryptsetup luksClose
${vm}_root_deciphered
227 rule_part_root_mount
() {
228 test -e /dev
/mapper
/${vm}_root_deciphered ||
229 sudo cryptsetup luksOpen
$vm_dev_disk_root ${vm}_root_deciphered
230 mountpoint
-q /mnt
/$vm_fqdn ||
231 sudo mount
-v -t ext4
/dev
/mapper
/${vm}_root_deciphered
/mnt
/$vm_fqdn
233 rule_part_root_umount
() {
234 ! mountpoint
-q /mnt
/$vm_fqdn ||
235 sudo umount
-v /mnt
/$vm_fqdn
236 ! test -e /dev
/mapper
/${vm}_root_deciphered ||
237 sudo cryptsetup luksClose
${vm}_root_deciphered
239 rule_part_root_backup_luks
() {
240 sudo cryptsetup luksHeaderBackup
$vm_dev_disk_root --header-backup-file .
/root.luks
242 rule_part_swap_format
() {
243 rule__part_encrypted_format swap
244 rule__part_encrypted_mount swap
245 sudo mkswap
-f -L ${vm}_swap
/dev
/mapper
/${vm}_swap_deciphered
246 rule__part_encrypted_umount swap
248 rule_part_boot_format
() {
249 mount |
grep -q "^$vm_dev_disk_boot " ||
250 sudo mke2fs
-t ext2
-c -c -m 5 -T small \
251 -E resize
=1G
${vm_e2fs_extended_options} \
252 -L ${vm}_boot
$vm_dev_disk_boot
254 rule_part_boot_mount
() {
255 mountpoint
-q /mnt
/$vm_fqdn
256 test -d /mnt
/$vm_fqdn/boot
257 mountpoint
-q /mnt
/$vm_fqdn/boot ||
258 sudo mount
-v -t ext2
$vm_dev_disk_boot /mnt
/$vm_fqdn/boot
260 rule_part_boot_umount
() {
261 ! mountpoint
-q /mnt
/$vm_fqdn/boot ||
262 sudo umount
-v /mnt
/$vm_fqdn/boot
264 rule_part_var_format
() {
265 rule__part_encrypted_format var
266 rule__part_encrypted_mount var
267 sudo mke2fs
-t ext4
-c -c -m 5 -T ext4
-b $vm_e2fs_block_size \
268 -E resize
=10G
${vm_e2fs_extended_options} \
270 /dev
/mapper
/${vm}_var_deciphered
271 rule__part_encrypted_umount var
273 rule_part_var_mount
() {
274 rule__part_encrypted_mount var
275 mountpoint
-q /mnt
/$vm_fqdn/var ||
276 sudo mount
-v -t ext4
/dev
/mapper
/${vm}_var_deciphered
/mnt
/$vm_fqdn/var
278 rule_part_var_umount
() {
279 ! mountpoint
-q /mnt
/$vm_fqdn/var ||
280 sudo umount
-v /mnt
/$vm_fqdn/var
281 rule__part_encrypted_umount var
283 rule_part_home_format
() {
284 rule__part_encrypted_format home
285 rule__part_encrypted_mount home
286 sudo mke2fs
-t ext4
-c -c -m 0 -T ext4
-b $vm_e2fs_block_size \
287 -E resize
=400G
${vm_e2fs_extended_options} \
289 /dev
/mapper
/${vm}_home_deciphered
290 # NOTE: -O quota pas supporté par e2fsprogs/squeeze
291 rule__part_encrypted_umount home
293 rule_part_home_mount
() {
294 rule__part_encrypted_mount home
295 mountpoint
-q /mnt
/$vm_fqdn/home ||
296 sudo mount
-v -t ext4
/dev
/mapper
/${vm}_home_deciphered
/mnt
/$vm_fqdn/home
298 rule_part_home_umount
() {
299 ! mountpoint
-q /mnt
/$vm_fqdn/home ||
300 sudo umount
-v /mnt
/$vm_fqdn/home
301 rule__part_encrypted_umount home
304 rule_debian_install
() {
308 sudo DEBOOTSTRAP_DIR
=/usr
/share
/debootstrap
/ debootstrap \
309 --arch=$vm_arch --verbose --keyring=/usr
/share
/keyrings
/debian-archive-keyring.gpg \
311 --include=$
(printf '%s,' \
345 $vm_lsb_name /mnt
/$vm_fqdn/ \
346 http
://ftp.fr.debian.org
/debian
/
352 #rule_part_home_mount
353 mountpoint
-q /mnt
/$vm_fqdn/proc ||
354 sudo mount
-t proc proc
/mnt
/$vm_fqdn/proc
355 mountpoint
-q /mnt
/$vm_fqdn/sys ||
356 sudo mount
-t sysfs sys
/mnt
/$vm_fqdn/sys
357 mountpoint
-q /mnt
/$vm_fqdn/dev ||
358 sudo mount
--bind /dev
/mnt
/$vm_fqdn/dev
359 mountpoint
-q /mnt
/$vm_fqdn/root
/tool
/ateliers ||
360 sudo mount
--bind "$tool" /mnt
/$vm_fqdn/root
/tool
/ateliers
361 sudo chroot
/mnt
/$vm_fqdn /bin
/dash || true
364 rule__chroot_clean
() {
365 ! sudo mountpoint
-q /mnt
/$vm_fqdn/root
/tool
/ateliers ||
366 sudo umount
-v /mnt
/$vm_fqdn/root
/tool
/ateliers
367 ! mountpoint
-q /mnt
/$vm_fqdn/dev ||
368 sudo umount
-v /mnt
/$vm_fqdn/dev
369 ! mountpoint
-q /mnt
/$vm_fqdn/sys ||
370 sudo umount
-v /mnt
/$vm_fqdn/sys
371 ! mountpoint
-q /mnt
/$vm_fqdn/proc ||
372 sudo umount
-v /mnt
/$vm_fqdn/proc
373 rule_part_home_umount
375 rule_part_boot_umount
376 rule_part_root_umount