#!/bin/sh
set -e -f ${DRY_RUN:+-n} -u
tool=${0%/*}
-. "$tool"/lib/functions.sh
+. "$tool"/lib/rule.sh
. "$tool"/etc/vm.sh
rule_help () { # SYNTAX: [--hidden]
)
}
-rule_vm_init () {
- mk_reg mod=644 own=root:root /etc/xen/$vm_fqdn.cfg <<-EOF
+rule_vm_configure () {
+ sudo install -m 644 -u root -g root /dev/stdin /etc/xen/$vm_fqdn.cfg <<-EOF
# -*- mode: python; -*-
# DOC: http://wiki.xen.org/wiki/Xen_Linux_PV_on_HVM_drivers
import os, re
rule vm_attach
}
rule_vm_attach () {
- cat <<-EOF
- NOTE: Ctrl-] pour se détacher de la console
- EOF
+ assert '! pgrep -f "sudo xm console $vm_fqdn"'
+ info 'Ctrl-] pour se détacher de la console'
sudo xm console $vm_fqdn
}
rule_vm_stop () {
}
rule_part_randomize () { # SYNTAX: $part # NOTE: à anticiper
- local part=$1
+ local part="$1"
eval "sudo dd if=/dev/urandom of=\$vm_dev_disk_$part"
}
rule_part_randomize_stat () { # SYNTAX: $part # DESCRIPTION: fait afficher la progression de rule_part_randomize
- local part=$1
+ local part="$1"
eval "pkill -USR1 -f \"^dd if=/dev/urandom of=\$vm_dev_disk_$part\""
}
rule__part_encrypted_format () { # SYNTAX: $part # DESCRIPTION: formatage d'une partition distincte de /
# NOTE: la clef de chiffrement est dérivée de celle de /,
# / doit être déchiffrée pour que cela fonctionne.
- local part=$1
- eval "local dev=\$vm_dev_disk_$part"
+ local part="$1"
+ eval "local dev=\"\$vm_dev_disk_$part\""
test ! -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
cryptsetup luksFormat --hash=sha512 --key-size=512 \
--cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $dev"
}
rule__part_encrypted_mount () { # SYNTAX: $part
- local part=$1
- eval "local dev=\$vm_dev_disk_$part"
+ local part="$1"
+ eval "local dev=\"\$vm_dev_disk_$part\""
test -e /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
sudo /bin/sh -c "/lib/cryptsetup/scripts/decrypt_derived ${vm_lvm_lv}_root_deciphered |
cryptsetup luksOpen --key-file=- $dev ${vm_lvm_lv}_${part}_deciphered"
}
rule__part_encrypted_umount () { # SYNTAX: $part
- local part=$1
- eval "local dev=\$vm_dev_disk_$part"
+ local part="$1"
+ eval "local dev=\"\$vm_dev_disk_$part\""
test ! -e /dev/mapper/${vm_lvm_lv}_${part}_deciphered ||
sudo cryptsetup luksClose ${vm_lvm_lv}_${part}_deciphered
}
if ! mount | grep -q "^$vm_dev_disk_root "
then
sudo cryptsetup luksFormat --hash=sha512 --key-size=512 \
- --cipher=aes-xts-essiv:sha256 --key-file=- --align-payload=8 $vm_dev_disk_root
- sudo cryptsetup luksOpen --key-file=- $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
+ --cipher=aes-xts-essiv:sha256 --align-payload=8 $vm_dev_disk_root
+ sudo cryptsetup luksOpen $vm_dev_disk_root ${vm_lvm_lv}_root_deciphered
sudo mke2fs -t ext4 -c -c -m 5 -T ext4 -b $vm_e2fs_block_size \
-E resize=30G${vm_e2fs_extended_options} \
-L ${vm_lvm_lv}_root \
! test -e /dev/mapper/${vm_lvm_lv}_root_deciphered ||
sudo cryptsetup luksClose ${vm_lvm_lv}_root_deciphered
}
-rule_part_root_backup_luks () {
- sudo cryptsetup luksHeaderBackup $vm_dev_disk_root --header-backup-file ./root.luks
- }
rule_part_swap_format () {
rule _part_encrypted_format swap
rule _part_encrypted_mount swap
(help);;
(*)
assert 'test "$(hostname --fqdn)" = "$vm_host"' vm_host
- ${TRACE:+set -x}
;;
esac
rule $rule "$@"