2 set -e -f ${DRY_RUN:+-n} -u
9 DESCRIPTION: ce script regroupe des fonctions utilitaires
10 pour gérer la VM des ateliers _depuis_ son hôte ;
11 il sert à la fois d'outil et de documentation.
12 Voir \`$tool/ateliers_hosted' pour les utilitaires côté VM hébergée.
13 SYNTAX: $0 \$RULE \${RULE}_SYNTAX
15 $(sed -ne 's/^rule_\([^_][^ ]*\) () {\( *#.*\|\)/\t\1\2/p' "$0")
17 TRACE # affiche les commandes avant leur exécution
18 $(sed -ne 's/^readonly \([^ ][^ =]*\).*}\( *#.*\|\)$/\t$\1\2/p' "$tool"/env.sh "$0")
22 readonly vm_dev_disk
="/dev/xvda"
23 readonly vm_dev_disk_boot
="${vm_dev_disk}1"
25 rule_xen_config_init
() {
26 sudo
tee /etc
/xen
/$vm_fqdn.cfg
<<-EOF
27 # -*- mode: python; -*-
33 vif = ['mac=$vm_mac,bridge=$vm_bridge']
34 disk = ['phy:/dev/domU/$vm_fqdn-disk,hda,w']
35 kernel = "/usr/lib/xen-4.0/boot/hvmloader"
37 device_model = 'qemu-dm'
40 # boot on floppy (a), hard disk (c) or CD-ROM (d)
46 #vnclisten = "0.0.0.0"
52 on_poweroff = 'destroy'
58 sudo xm create
$vm_fqdn.cfg
61 sudo xm shutdown
$vm_fqdn.cfg
64 rule_disk_mount
() { # DESCRIPTION: montage du disque de la VM depuis l'hôte
65 sudo xm block-attach
0 phy
:/dev
/domU
/$vm_fqdn-disk $vm_dev_disk w
66 # NOTE: on pourrait utiliser kpartx à la place je pense ; détail.
68 rule_disk_umount
() { # DESCRIPTION: démontage du disque de la VM depuis l'hôte
81 sudo xm block-detach
0 $vm_dev_disk
86 readonly vm_dev_disk_swap
="${vm_dev_disk}5"
87 readonly vm_dev_disk_root
="${vm_dev_disk}6"
88 readonly vm_dev_disk_var
="${vm_dev_disk}7"
89 readonly vm_dev_disk_home
="${vm_dev_disk}8"
92 readonly vm_lvm_pv
="${vm_dev_disk}2"
93 readonly vm_lvm_vg
=$vm
94 readonly vm_lvm_dev
=$
(printf %s
$vm_lvm_vg |
sed -e 's/-/--/g')
95 readonly vm_lvm_lv
=$vm
96 readonly vm_dev_disk_swap
=/dev
/mapper
/$vm_lvm_dev-${vm_lvm_lv}_swap
97 readonly vm_dev_disk_root
=/dev
/mapper
/$vm_lvm_dev-${vm_lvm_lv}_root
98 readonly vm_dev_disk_var
=/dev
/mapper
/$vm_lvm_dev-${vm_lvm_lv}_var
99 readonly vm_dev_disk_home
=/dev
/mapper
/$vm_lvm_dev-${vm_lvm_lv}home
105 rule_disk_format
() { # DESCRIPTION: partitionnage du disque de la VM
108 sudo sfdisk
$vm_dev_disk <<-EOF
109 # partition table of $vm_dev_disk
112 ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
113 ${vm_dev_disk}2 : start= 498015, size=418927005, Id= 5
114 ${vm_dev_disk}3 : start= 0, size= 0, Id= 0
115 ${vm_dev_disk}4 : start= 0, size= 0, Id= 0
116 ${vm_dev_disk}5 : start= 498078, size= 1959867, Id=82
117 ${vm_dev_disk}6 : start= 2458008, size= 29302497, Id=83
118 ${vm_dev_disk}7 : start= 31760568, size= 9767457, Id=83
119 ${vm_dev_disk}8 : start= 41528088, size=377896932, Id=83
123 sudo sfdisk
$vm_dev_disk <<-EOF
124 # partition table of $vm_dev_disk
127 ${vm_dev_disk}1 : start= 63, size= 497952, Id=83, bootable
128 ${vm_dev_disk}2 : start= 498015, size=418927005, Id=8E
133 sudo partprobe
$vm_dev_disk
136 rule_part_lvm_format
() {
138 ! sudo vgs |
grep -q "^ $vm_lvm_vg " ||
139 sudo vgremove
$vm_lvm_vg
140 sudo pvcreate
--dataalignment 512k
$vm_lvm_pv
141 sudo vgcreate
--dataalignment 512k
$vm_lvm_vg $vm_lvm_pv
142 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_swap
-L 1G
$vm_lvm_vg
143 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_root
-L 15G
$vm_lvm_vg
144 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_var
-L 5G
$vm_lvm_vg
145 sudo lvcreate
--contiguous y
-n ${vm_lvm_lv}_home
-l 99%FREE
$vm_lvm_vg
148 rule_part_lvm_mount
() {
149 sudo vgchange
-a y
$vm_lvm_vg
150 sudo lvchange
-a y
$vm_lvm_lv
152 rule_part_lvm_umount
() {
153 rule_part_root_umount
155 rule_part_home_umount
156 if sudo vgs |
grep -q "^ $vm_lvm_vg "
158 sudo lvchange
-a n
$vm_lvm_vg
159 sudo vgchange
-a n
$vm_lvm_vg
163 rule_part_randomize
() { # SYNTAX: $part # NOTE: à anticiper
165 eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
167 rule_part_randomize_stat
() { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_clean
169 eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
171 rule__part_encrypted_format
() { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
172 # NOTE: la clef de chiffrement est dérivée de celle de /,
173 # / doit être déchiffrée pour que cela fonctionne.
175 eval "local dev=\$vm_dev_disk_$part"
176 test ! -e /dev
/mapper
/${vm}_root_deciphered ||
177 sudo
/lib
/cryptsetup
/scripts
/decrypt_derived
${vm}_root_deciphered |
178 sudo cryptsetup luksFormat
--hash=sha512
--key-size=512 \
179 --cipher=aes-xts-essiv
:sha256
--key-file=- --align-payload=8 $dev
181 rule__part_encrypted_mount
() { # SYNTAX: $part
183 eval "local dev=\$vm_dev_disk_$part"
184 test ! -e /dev
/mapper
/${vm}_root_deciphered ||
185 sudo
/lib
/cryptsetup
/scripts
/decrypt_derived
${vm}_root_deciphered |
186 sudo cryptsetup luksOpen
--key-file=- $dev ${vm}_
${part}_deciphered
188 rule__part_encrypted_umount
() { # SYNTAX: $part
190 eval "local dev=\$vm_dev_disk_$part"
191 test ! -e /dev
/mapper
/${vm}_
${part}_deciphered ||
192 sudo cryptsetup luksClose
${vm}_
${part}_deciphered
195 rule_part_root_format
() {
196 if ! mount |
grep -q "^$vm_dev_disk_root "
198 sudo cryptsetup luksFormat
--hash=sha512
--key-size=512 \
199 --cipher=aes-xts-essiv
:sha256
--key-file=- --align-payload=8 $vm_dev_disk_root
200 sudo cryptsetup luksOpen
--key-file=- $vm_dev_disk_root ${vm}_root_deciphered
201 sudo mke2fs
-t ext4
-c -c -m 5 -T ext4
-b $vm_e2fs_block_size \
202 -E resize
=15G
${vm_e2fs_extended_options} \
204 /dev
/mapper
/${vm}_root_deciphered
205 ! mountpoint
-q /mnt
/$vm_fqdn
206 sudo mount
-v /dev
/mapper
/${vm}_root_deciphered
/mnt
/$vm_fqdn
207 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/boot
208 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/dev
209 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/home
210 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/proc
211 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/sys
212 mk_dir mod
=0770 own
=root
:root
/mnt
/$vm_fqdn/var
213 sudo umount
-v /mnt
/$vm_fqdn
216 rule_part_root_mount
() {
217 test -e /dev
/mapper
/${vm}_root_deciphered ||
218 sudo cryptsetup luksOpen
$vm_dev_disk_root ${vm}_root_deciphered
219 ! mountpoint
-q /mnt
/$vm_fqdn ||
220 sudo mount
-v /dev
/mapper
/${vm}_root_deciphered
/mnt
/$vm_fqdn
222 rule_part_root_umount
() {
223 ! mountpoint
-q /mnt
/$vm_fqdn ||
224 sudo umount
-v /mnt
/$vm_fqdn
225 ! test -e /dev
/mapper
/${vm}_root_deciphered ||
226 sudo cryptsetup luksClose
${vm}_root_deciphered
228 rule_part_swap_format
() {
229 rule__part_encrypted_format swap
230 rule__part_encrypted_mount swap
231 sudo mkswap
-f -L ${vm}_swap
/dev
/mapper
/${vm}_swap_deciphered
232 rule__part_encrypted_umount swap
234 rule_part_boot_format
() {
235 mount |
grep -q "^$vm_dev_disk_boot " ||
236 sudo mke2fs
-t ext2
-c -c -m 5 -T small \
237 -E resize
=1G
${vm_e2fs_extended_options} \
238 -L ${vm}_boot
$vm_dev_disk_boot
240 rule_part_boot_mount
() {
241 mountpoint
-q /mnt
/$vm_fqdn
242 test -d /mnt
/$vm_fqdn/boot
243 mountpoint
-q /mnt
/$vm_fqdn/boot ||
244 sudo mount
-v $vm_dev_disk_boot /mnt
/$vm_fqdn/boot
246 rule_part_boot_umount
() {
247 ! mountpoint
-q /mnt
/$vm_fqdn/boot ||
248 sudo umount
-v /mnt
/$vm_fqdn/boot
250 rule_part_var_format
() {
251 rule__part_encrypted_format var
252 rule__part_encrypted_mount var
253 sudo mke2fs
-t ext4
-c -c -m 5 -T ext4
-b $vm_e2fs_block_size \
254 -E resize
=10G
${vm_e2fs_extended_options} \
256 /dev
/mapper
/${vm}_var_deciphered
257 rule__part_encrypted_umount var
259 rule_part_var_mount
() {
260 rule__part_encrypted_mount var
261 mountpoint
-q /mnt
/$vm_fqdn/var ||
262 sudo mount
-v /dev
/mapper
/${vm}_var_deciphered
/mnt
/$vm_fqdn/var
264 rule_part_var_umount
() {
265 ! mountpoint
-q /mnt
/$vm_fqdn/var ||
266 sudo umount
-v /mnt
/$vm_fqdn/var
267 rule__part_encrypted_umount var
269 rule_part_home_format
() {
270 rule__part_encrypted_format home
271 rule__part_encrypted_mount home
272 sudo mke2fs
-t ext4
-c -c -m 0 -T ext4
-b $vm_e2fs_block_size \
273 -E resize
=400G
${vm_e2fs_extended_options} \
276 /dev
/mapper
/${vm}_home_deciphered
277 rule__part_encrypted_umount home
279 rule_part_home_mount
() {
280 rule__part_encrypted_mount home
281 mountpoint
-q /mnt
/$vm_fqdn/home ||
282 sudo mount
-v /dev
/mapper
/${vm}_home_deciphered
/mnt
/$vm_fqdn/home
284 rule_part_home_umount
() {
285 ! mountpoint
-q /mnt
/$vm_fqdn/home ||
286 sudo umount
-v /mnt
/$vm_fqdn/home
287 rule__part_encrypted_umount home
290 rule_debian_install
() {
291 sudo DEBOOTSTRAP_DIR
=/usr
/share
/debootstrap
/ debootstrap \
292 --arch=$vm_arch --verbose --keyring=/usr
/share
/keyrings
/debian-archive-keyring.gpg \
294 --include=$
(printf '%s,' \
328 $vm_lsb_name /mnt
/$vm_fqdn/ \
329 http
://ftp.fr.debian.org
/debian
/
335 #rule_part_home_mount
336 mountpoint
-q /mnt
/$vm_fqdn/proc ||
337 mount
-t proc proc
/mnt
/$vm_fqdn/proc
338 mountpoint
-q /mnt
/$vm_fqdn/sys ||
339 mount
-t sysfs sys
/mnt
/$vm_fqdn/sys
340 mountpoint
-q /mnt
/$vm_fqdn/dev ||
341 mount
--bind /dev
/mnt
/$vm_fqdn/dev
342 sudo chroot
/mnt
/$vm_fqdn /bin
/bash || true
345 rule__chroot_clean
() {
346 umount
-v /mnt
/$vm_fqdn/dev
347 umount
-v /mnt
/$vm_fqdn/sys
348 umount
-v /mnt
/$vm_fqdn/proc
349 #rule_part_home_umount
351 rule_part_root_umount
352 rule_part_boot_umount