diff options
author | Andrew Cady <d@jerkface.net> | 2016-04-18 23:47:06 -0400 |
---|---|---|
committer | Andrew Cady <d@jerkface.net> | 2016-04-18 23:47:06 -0400 |
commit | d71f14f8128477c0ae533612896fbe2990d73eae (patch) | |
tree | 12d86cc751e4d39d1b0a173d3f1c3920903b164a |
init
-rw-r--r-- | notes.txt | 176 | ||||
-rw-r--r-- | update-initramfs.conf | 30 |
2 files changed, 206 insertions, 0 deletions
diff --git a/notes.txt b/notes.txt new file mode 100644 index 0000000..1e4f296 --- /dev/null +++ b/notes.txt | |||
@@ -0,0 +1,176 @@ | |||
1 | initramfs-tools launches, as pid 1, a script called /init which is used to call | ||
2 | all of the various configured scripts which are installed into | ||
3 | '/etc/initramfs-tools/scripts'. | ||
4 | |||
5 | Some of this scripts are executed in subshells, thus they cannot contain the | ||
6 | final 'pivot_root' (or actually 'switch_root' now), but some of the scripts are | ||
7 | sourced from the pid1 'sh' process. | ||
8 | |||
9 | There is an environment variable called 'BOOT' which is set to 'local' by | ||
10 | default and which can be overriden on the kernel command line. The pid1 process | ||
11 | will source a file named with the value of the 'BOOT' variable: | ||
12 | |||
13 | # Always load local and nfs (since these might be needed for /etc or | ||
14 | # /usr, irrespective of the boot script used to mount the rootfs). | ||
15 | . /scripts/local | ||
16 | . /scripts/nfs | ||
17 | . /scripts/${BOOT} | ||
18 | |||
19 | The BOOT script is used to define functions that will be called within pid1; | ||
20 | particularly (from '/scripts/local', for example): | ||
21 | |||
22 | |||
23 | mountroot() | ||
24 | { | ||
25 | local_mount_root | ||
26 | } | ||
27 | |||
28 | mount_top() | ||
29 | { | ||
30 | # Note, also called directly in case it's overridden. | ||
31 | local_top | ||
32 | } | ||
33 | |||
34 | mount_premount() | ||
35 | { | ||
36 | # Note, also called directly in case it's overridden. | ||
37 | local_premount | ||
38 | } | ||
39 | |||
40 | mount_bottom() | ||
41 | { | ||
42 | # Note, also called directly in case it's overridden. | ||
43 | local_bottom | ||
44 | } | ||
45 | |||
46 | |||
47 | Thus, it should be possible to add a script '/script/samizdat' which overrides | ||
48 | one of these functions, and then add a BOOT=samizdat parameter. | ||
49 | |||
50 | (Note: the 'local' versions of these scripts merely call 'run_scripts' on | ||
51 | directories named like '/scripts/local-premount' etc. -- 'run_scripts' runs | ||
52 | scripts in new processes, it does not source them from pid 1. But see below.) | ||
53 | |||
54 | Almost certainly, the samizdat script should simply define the function 'mountroot'. | ||
55 | |||
56 | Note: if it was desired not to have to set a kernel parameter, it would also be | ||
57 | possible to 'trick' the system into executing code as pid1 through any script | ||
58 | called with 'run_scripts' (such as a file placed in '/scripts/local-bottom'). | ||
59 | |||
60 | A script called with 'run_scripts' will run in a separate process, but after | ||
61 | each script is called, pid1 will source the file '/conf/param.conf'. | ||
62 | |||
63 | Thus, to overwrite the mountroot() function, something like this should suffice: | ||
64 | |||
65 | cat > /conf/mountroot-override <<EOF | ||
66 | |||
67 | mountroot() | ||
68 | { | ||
69 | # ... | ||
70 | } | ||
71 | EOF | ||
72 | |||
73 | echo '. /conf/mountroot-override' >> /conf/param.conf | ||
74 | |||
75 | Or even just: | ||
76 | |||
77 | echo BOOT=samizdat >> /conf/mountroot-override | ||
78 | |||
79 | |||
80 | |||
81 | |||
82 | |||
83 | |||
84 | This is probably the approach to take: | ||
85 | |||
86 | Create two scripts: | ||
87 | |||
88 | /etc/initramfs-tools/scripts/local-bottom/samizdat | ||
89 | /etc/initramfs-tools/scripts/samizdat | ||
90 | |||
91 | The first script just does: | ||
92 | |||
93 | echo BOOT=samizdat >> /conf/param.conf | ||
94 | |||
95 | The second script calls out to the existing samizdat initrd code. It can even | ||
96 | 'exec' the original samizdat 'init', although it probably shouldn't. | ||
97 | |||
98 | |||
99 | |||
100 | |||
101 | |||
102 | |||
103 | Another idea: | ||
104 | |||
105 | |||
106 | The first script waits for a samizdat read-only ISO, then configures the rest | ||
107 | of the boot process: | ||
108 | |||
109 | * Find the btrfs seed filesystem on the ISO | ||
110 | * Mount it as a loop device | ||
111 | * Add a ramfs to it, making it read-write | ||
112 | * Chroot into this system and run code to interact with the user and determine what to do: | ||
113 | * Find existing encrypted LUKS partitions | ||
114 | * Find existing encrypted GPG keys | ||
115 | * Allow the user to decrypt GPG keys -- saving the password in order to restart GPG agent | ||
116 | * Allow the user to create a new LUKS partition or choose an existing one | ||
117 | * If successful: | ||
118 | |||
119 | echo BOOT=samizdat >> /conf/param.conf | ||
120 | echo SAMIZDAT_LUKS_DEV=... >> /conf/param.conf # unencrypted dm dev | ||
121 | echo SAMIZDAT_GPG_ID=... >> /conf/param.conf # record the user we've authenticated as | ||
122 | |||
123 | The second script does the rest of the work: | ||
124 | |||
125 | * ... | ||
126 | |||
127 | |||
128 | |||
129 | |||
130 | |||
131 | |||
132 | |||
133 | |||
134 | |||
135 | |||
136 | |||
137 | |||
138 | |||
139 | |||
140 | |||
141 | grepping for param.conf: | ||
142 | |||
143 | /usr/share/initramfs-tools/scripts/local-top/cryptroot: # Apparently ROOT is already set in /conf/param.conf for | ||
144 | /usr/share/initramfs-tools/scripts/local-top/cryptroot: if [ -f /conf/param.conf ] && grep -q "^ROOT=" /conf/param.conf; then | ||
145 | /usr/share/initramfs-tools/scripts/local-top/cryptroot: NEWROOT=$(sed -n 's/^ROOT=//p' /conf/param.conf) | ||
146 | /usr/share/initramfs-tools/scripts/local-top/cryptroot: echo "ROOT=$NEWROOT" >>/conf/param.conf | ||
147 | /usr/share/initramfs-tools/hook-functions: echo "[ -e /conf/param.conf ] && . /conf/param.conf" >> ${initdir}/ORDER | ||
148 | /usr/share/initramfs-tools/hook-functions: if [ -e /conf/param.conf ]; then | ||
149 | /usr/share/initramfs-tools/hook-functions: . /conf/param.conf | ||
150 | |||
151 | Relevant instances of 'run_scripts': | ||
152 | |||
153 | Definition: | ||
154 | |||
155 | /usr/share/initramfs-tools/scripts/functions:run_scripts() | ||
156 | |||
157 | Uses in pid1: | ||
158 | |||
159 | /usr/share/initramfs-tools/init:run_scripts /scripts/init-top | ||
160 | /usr/share/initramfs-tools/init:run_scripts /scripts/init-premount | ||
161 | /usr/share/initramfs-tools/init:run_scripts /scripts/init-bottom | ||
162 | |||
163 | Uses in 'local': | ||
164 | |||
165 | /usr/share/initramfs-tools/scripts/local: run_scripts /scripts/local-top | ||
166 | /usr/share/initramfs-tools/scripts/local: run_scripts /scripts/local-block "$@" | ||
167 | /usr/share/initramfs-tools/scripts/local: run_scripts /scripts/local-premount | ||
168 | /usr/share/initramfs-tools/scripts/local: run_scripts /scripts/local-bottom | ||
169 | |||
170 | Note that 'local' is unconditionally executed in init: | ||
171 | |||
172 | |||
173 | |||
174 | Panic hooks: | ||
175 | |||
176 | /usr/share/initramfs-tools/scripts/functions: run_scripts /scripts/panic | ||
diff --git a/update-initramfs.conf b/update-initramfs.conf new file mode 100644 index 0000000..ce86f30 --- /dev/null +++ b/update-initramfs.conf | |||
@@ -0,0 +1,30 @@ | |||
1 | # | ||
2 | # Configuration file for update-initramfs(8) | ||
3 | # | ||
4 | |||
5 | # | ||
6 | # update_initramfs [ yes | all | no ] | ||
7 | # | ||
8 | # Default is yes | ||
9 | # If set to all update-initramfs will update all initramfs | ||
10 | # If set to no disables any update to initramfs beside kernel upgrade | ||
11 | |||
12 | update_initramfs=yes | ||
13 | |||
14 | # | ||
15 | # backup_initramfs [ yes | no ] | ||
16 | # | ||
17 | # Default is no | ||
18 | # If set to no leaves no .bak backup files. | ||
19 | |||
20 | backup_initramfs=no | ||
21 | |||
22 | if [ "$SAMIZDAT_UPDATE_INITRAMFS_ROOT" ]; then | ||
23 | STATEDIR="$SAMIZDAT_UPDATE_INITRAMFS_ROOT"/var/lib/initramfs-tools | ||
24 | BOOTDIR="$SAMIZDAT_UPDATE_INITRAMFS_ROOT"/boot | ||
25 | test -d "$SAMIZDAT_UPDATE_INITRAMFS_ROOT" || { | ||
26 | echo "$0: Error: not a directory: ${SAMIZDAT_UPDATE_INITRAMFS_ROOT}" >&2 | ||
27 | exit 1 | ||
28 | } | ||
29 | mkdir -p "$STATEDIR" "$BOOTDIR" | ||
30 | fi | ||