Dustin C. Hatch
301589af22
For some reason, when OverlayFS is mounted at `/etc/ssh`, SELinux prevents access both `sshd` and `ssh-keygen` access to the files there. The AVC denials indicate that (some part of) the process is running in the `mount_t` domain, which is not allowed to read or write `sshd_key_t` files. To work around this issue, without granting `mount_t` overly-permissive access, we now configure the SSH daemon to read host keys from the persistent data volume directly, instead of "tricking" it with OverlayFS. The `ssh-keygen` tool does not read the `HostKey` options from `sshd_config`, though, so it has to be explicitly instructed to create keys in this alternate location. By using a systemd template unit with `ConditionPathExists`, we avoid regnerating the keys on every boot, since the `ssh-keygen` command is only run if the file does not already exist.
56 lines
1.1 KiB
Bash
Executable File
56 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# vim: set sw=4 ts=4 sts=4 et :
|
|
|
|
cleanup() {
|
|
if [ -n "${tmpdir}" ] && [ "${tmpdir}" != / ]; then
|
|
if mountpoint -q "${tmpdir}"; then
|
|
umount "${tmpdir}"
|
|
fi
|
|
rm -rf "${tmpdir}"
|
|
unset tmpdir
|
|
fi
|
|
}
|
|
|
|
copy_var() {
|
|
dev="$1"
|
|
|
|
echo 'Copying /var contents to data volume'
|
|
mount -o subvol=var "${dev}" "${tmpdir}"
|
|
cp -auv /var/. "${tmpdir}"
|
|
umount "${tmpdir}"
|
|
}
|
|
|
|
format_dev() {
|
|
dev="$1"
|
|
printf 'Creating BTRFS filesystem on %s\n' "${dev}"
|
|
mkfs.btrfs "${dev}" || exit
|
|
|
|
mount "${dev}" "${tmpdir}" || exit
|
|
btrfs subvolume create "${tmpdir}"/var || exit
|
|
btrfs subvolume create "${tmpdir}"/var/log || exit
|
|
umount "${dev}" || exit
|
|
}
|
|
|
|
has_fs() {
|
|
dev="$1"
|
|
fstype=$(blkid -o value -s TYPE "${dev}")
|
|
[ -n "${fstype}" ]
|
|
}
|
|
|
|
datapart=$(findfs PARTLABEL=dch-data)
|
|
if [ -b "${datapart}" ]; then
|
|
printf 'Found data partition: %s\n' "${datapart}"
|
|
else
|
|
echo 'Could not identify data partition' >&2
|
|
exit 1
|
|
fi
|
|
|
|
trap cleanup INT TERM QUIT EXIT
|
|
tmpdir=$(mktemp -d -p /run storinit.XXXXXX)
|
|
|
|
if ! has_fs "${datapart}"; then
|
|
format_dev "${datapart}"
|
|
fi
|
|
|
|
copy_var "${datapart}"
|