Dustin C. Hatch
eb8f4c3b40
In order for users to be able to log in locally or via SSH without an authorized key, they will need to have passwords set in `/etc/shadow`. We do not really want to make all of `/etc` writable, so we will store the actual `shadow` file on the persistent data volume, in a separate Btrfs subvolume, and then bind-mount it at `/etc/shadow`. While this makes `/etc/shadow` mutable, it does not actually let the `passwd` program modify it. This is because `passwd` creates lock files and backup files in `/etc`. We will ultimately need a wrapper to "trick" `passwd` into modifying `/etc/shadow`, without making the whole `/etc` directory mutable.
72 lines
1.6 KiB
Bash
Executable File
72 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# vim: set sw=4 ts=4 sts=4 et :
|
|
|
|
cleanup() {
|
|
if [ -n "${tmpdir}" ] && [ "${tmpdir}" != / ]; then
|
|
if mountpoint -q "${tmpdir}"; then
|
|
umount "${tmpdir}"
|
|
fi
|
|
rm -rf "${tmpdir}"
|
|
unset tmpdir
|
|
fi
|
|
}
|
|
|
|
copy_var() {
|
|
dev="$1"
|
|
|
|
echo 'Copying /var contents to data volume'
|
|
mount -o subvol=var "${dev}" "${tmpdir}" || exit
|
|
cp -acuv /var/. "${tmpdir}" || exit
|
|
umount "${tmpdir}"
|
|
}
|
|
|
|
format_dev() {
|
|
dev="$1"
|
|
printf 'Creating BTRFS filesystem on %s\n' "${dev}"
|
|
mkfs.btrfs "${dev}" || exit
|
|
|
|
mount "${dev}" "${tmpdir}" || exit
|
|
btrfs subvolume create "${tmpdir}"/var || exit
|
|
chcon -t var_t "${tmpdir}"/var || exit
|
|
btrfs subvolume create "${tmpdir}"/etc || exit
|
|
chcon -t etc_t "${tmpdir}"/etc || exit
|
|
umount "${dev}" || exit
|
|
}
|
|
|
|
has_fs() {
|
|
dev="$1"
|
|
fstype=$(blkid -o value -s TYPE "${dev}")
|
|
[ -n "${fstype}" ]
|
|
}
|
|
|
|
setup_etc() {
|
|
dev="$1"
|
|
|
|
echo 'Initializing writable paths in /etc'
|
|
mount -o subvol=etc "${dev}" "${tmpdir}" || exit
|
|
if [ ! -f "${tmpdir}"/shadow ]; then
|
|
cp -ca /etc/shadow "${tmpdir}"/shadow || exit
|
|
fi
|
|
mount -o bind "${tmpdir}"/shadow /etc/shadow || exit
|
|
umount "${tmpdir}"
|
|
}
|
|
|
|
datapart=$(findfs PARTLABEL=dch-data)
|
|
if [ -b "${datapart}" ]; then
|
|
printf 'Found data partition: %s\n' "${datapart}"
|
|
else
|
|
echo 'Could not identify data partition' >&2
|
|
exit 1
|
|
fi
|
|
|
|
trap cleanup INT TERM QUIT EXIT
|
|
tmpdir=/run/storinit
|
|
mkdir -p "${tmpdir}"
|
|
|
|
if ! has_fs "${datapart}"; then
|
|
format_dev "${datapart}"
|
|
fi
|
|
|
|
setup_etc "${datapart}"
|
|
copy_var "${datapart}"
|