From 6bfcb080bf5b0eb0ed7bf9d908c298d664570bf1 Mon Sep 17 00:00:00 2001 From: Sean Whitton Date: Sat, 11 Jun 2016 20:35:09 +0900 Subject: Exoscale.distroKernel --- src/Propellor/Property/HostingProvider/Exoscale.hs | 23 ++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 src/Propellor/Property/HostingProvider/Exoscale.hs (limited to 'src/Propellor/Property/HostingProvider') diff --git a/src/Propellor/Property/HostingProvider/Exoscale.hs b/src/Propellor/Property/HostingProvider/Exoscale.hs new file mode 100644 index 00000000..afa3e1b7 --- /dev/null +++ b/src/Propellor/Property/HostingProvider/Exoscale.hs @@ -0,0 +1,23 @@ +-- | Maintainer: Sean Whitton + +module Propellor.Property.HostingProvider.Exoscale ( + distroKernel, +) where + +import Propellor.Base +import qualified Propellor.Property.Grub as Grub +import qualified Propellor.Property.Apt as Apt +import qualified Propellor.Property.Reboot as Reboot + +-- | Current Exoshare Debian image doesn't install GRUB, so this property makes +-- sure GRUB is installed and we're running the distro's kernel +-- +-- We reboot after doing this because 'Sbuild.built' will fail to set up an +-- overlay-type chroot on an old kernel +distroKernel :: Architecture -> Property DebianLike +distroKernel arch = Grub.installed' Grub.PC + `before` Apt.installed ["linux-image-" ++ arch] + `before` Grub.boots "/dev/vda" + `before` Grub.mkConfig + `before` Reboot.now + `flagFile` "/etc/propellor-grub" -- cgit v1.2.3 From 11b82cdaf22402d500d82671fb26550137e8a168 Mon Sep 17 00:00:00 2001 From: Sean Whitton Date: Sat, 11 Jun 2016 22:30:53 +0900 Subject: attempt to fix Exoscale.distroKernel flag file --- src/Propellor/Property/HostingProvider/Exoscale.hs | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'src/Propellor/Property/HostingProvider') diff --git a/src/Propellor/Property/HostingProvider/Exoscale.hs b/src/Propellor/Property/HostingProvider/Exoscale.hs index afa3e1b7..f7d676d0 100644 --- a/src/Propellor/Property/HostingProvider/Exoscale.hs +++ b/src/Propellor/Property/HostingProvider/Exoscale.hs @@ -15,9 +15,10 @@ import qualified Propellor.Property.Reboot as Reboot -- We reboot after doing this because 'Sbuild.built' will fail to set up an -- overlay-type chroot on an old kernel distroKernel :: Architecture -> Property DebianLike -distroKernel arch = Grub.installed' Grub.PC - `before` Apt.installed ["linux-image-" ++ arch] - `before` Grub.boots "/dev/vda" - `before` Grub.mkConfig - `before` Reboot.now - `flagFile` "/etc/propellor-grub" +distroKernel arch = combineProperties "boots distro kernel" $ props + & Grub.installed' Grub.PC + & Apt.installed ["linux-image-" ++ arch] + & Grub.boots "/dev/vda" + & flagFile + (Grub.mkConfig `before` Reboot.now) + "/etc/propellor-distro-kernel" -- cgit v1.2.3 From 397204fb1910fad31ead2ed1ba1e226f088856c5 Mon Sep 17 00:00:00 2001 From: Sean Whitton Date: Sat, 11 Jun 2016 23:00:39 +0900 Subject: include more in flag file --- src/Propellor/Property/HostingProvider/Exoscale.hs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/Propellor/Property/HostingProvider') diff --git a/src/Propellor/Property/HostingProvider/Exoscale.hs b/src/Propellor/Property/HostingProvider/Exoscale.hs index f7d676d0..a123c54a 100644 --- a/src/Propellor/Property/HostingProvider/Exoscale.hs +++ b/src/Propellor/Property/HostingProvider/Exoscale.hs @@ -18,7 +18,9 @@ distroKernel :: Architecture -> Property DebianLike distroKernel arch = combineProperties "boots distro kernel" $ props & Grub.installed' Grub.PC & Apt.installed ["linux-image-" ++ arch] - & Grub.boots "/dev/vda" + -- only these ones are not idempotent so need flag file & flagFile - (Grub.mkConfig `before` Reboot.now) + (Grub.boots "/dev/vda" + `before` Grub.mkConfig + `before` Reboot.now) "/etc/propellor-distro-kernel" -- cgit v1.2.3 From 5423d7a5e25907d126944921fff0fba2451cf11b Mon Sep 17 00:00:00 2001 From: Sean Whitton Date: Sun, 12 Jun 2016 09:41:23 +0900 Subject: factor out reboot code from DigitalOcean.hs --- .../Property/HostingProvider/DigitalOcean.hs | 25 +------------- src/Propellor/Property/Reboot.hs | 38 +++++++++++++++++++++- 2 files changed, 38 insertions(+), 25 deletions(-) (limited to 'src/Propellor/Property/HostingProvider') diff --git a/src/Propellor/Property/HostingProvider/DigitalOcean.hs b/src/Propellor/Property/HostingProvider/DigitalOcean.hs index c1e0ffc9..084faa36 100644 --- a/src/Propellor/Property/HostingProvider/DigitalOcean.hs +++ b/src/Propellor/Property/HostingProvider/DigitalOcean.hs @@ -7,8 +7,6 @@ import qualified Propellor.Property.Apt as Apt import qualified Propellor.Property.File as File import qualified Propellor.Property.Reboot as Reboot -import Data.List - -- | Digital Ocean does not provide any way to boot -- the kernel provided by the distribution, except using kexec. -- Without this, some old, and perhaps insecure kernel will be used. @@ -25,25 +23,4 @@ distroKernel = propertyList "digital ocean distro kernel hack" $ props [ "LOAD_KEXEC=true" , "USE_GRUB_CONFIG=true" ] `describe` "kexec configured" - & check (not <$> runningInstalledKernel) Reboot.now - `describe` "running installed kernel" - -runningInstalledKernel :: IO Bool -runningInstalledKernel = do - kernelver <- takeWhile (/= '\n') <$> readProcess "uname" ["-r"] - when (null kernelver) $ - error "failed to read uname -r" - kernelimages <- concat <$> mapM kernelsIn ["/", "/boot/"] - when (null kernelimages) $ - error "failed to find any installed kernel images" - findVersion kernelver <$> - readProcess "file" ("-L" : kernelimages) - --- | File output looks something like this, we want to unambiguously --- match the running kernel version: --- Linux kernel x86 boot executable bzImage, version 3.16-3-amd64 (debian-kernel@lists.debian.org) #1 SMP Debian 3.1, RO-rootFS, swap_dev 0x2, Normal VGA -findVersion :: String -> String -> Bool -findVersion ver s = (" version " ++ ver ++ " ") `isInfixOf` s - -kernelsIn :: FilePath -> IO [FilePath] -kernelsIn d = filter ("vmlinu" `isInfixOf`) <$> dirContents d + & Reboot.toDistroKernel diff --git a/src/Propellor/Property/Reboot.hs b/src/Propellor/Property/Reboot.hs index 5b854fa3..b1d76613 100644 --- a/src/Propellor/Property/Reboot.hs +++ b/src/Propellor/Property/Reboot.hs @@ -1,7 +1,13 @@ -module Propellor.Property.Reboot where +module Propellor.Property.Reboot ( + now, + atEnd, + toDistroKernel, +) where import Propellor.Base +import Data.List + now :: Property Linux now = tightenTargets $ cmdProperty "reboot" [] `assume` MadeChange @@ -28,3 +34,33 @@ atEnd force resultok = property "scheduled reboot at end of propellor run" $ do rebootparams | force = [Param "--force"] | otherwise = [] + +-- | Reboots immediately if a kernel other than the distro-installed kernel is +-- running. +-- +-- This will only work if you have taken measures to ensure that the other +-- kernel won't just get booted again. See 'Propellor.Property.DigitalOcean' +-- for an example. +toDistroKernel :: Property DebianLike +toDistroKernel = check (not <$> runningInstalledKernel) now + `describe` "running installed kernel" + +runningInstalledKernel :: IO Bool +runningInstalledKernel = do + kernelver <- takeWhile (/= '\n') <$> readProcess "uname" ["-r"] + when (null kernelver) $ + error "failed to read uname -r" + kernelimages <- concat <$> mapM kernelsIn ["/", "/boot/"] + when (null kernelimages) $ + error "failed to find any installed kernel images" + findVersion kernelver <$> + readProcess "file" ("-L" : kernelimages) + +-- | File output looks something like this, we want to unambiguously +-- match the running kernel version: +-- Linux kernel x86 boot executable bzImage, version 3.16-3-amd64 (debian-kernel@lists.debian.org) #1 SMP Debian 3.1, RO-rootFS, swap_dev 0x2, Normal VGA +findVersion :: String -> String -> Bool +findVersion ver s = (" version " ++ ver ++ " ") `isInfixOf` s + +kernelsIn :: FilePath -> IO [FilePath] +kernelsIn d = filter ("vmlinu" `isInfixOf`) <$> dirContents d -- cgit v1.2.3 From e20599639212ca6223f94a88dbff6641ed54234f Mon Sep 17 00:00:00 2001 From: Sean Whitton Date: Sun, 12 Jun 2016 09:47:23 +0900 Subject: re-organise Exoscale.distroKernel --- src/Propellor/Property/HostingProvider/Exoscale.hs | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) (limited to 'src/Propellor/Property/HostingProvider') diff --git a/src/Propellor/Property/HostingProvider/Exoscale.hs b/src/Propellor/Property/HostingProvider/Exoscale.hs index a123c54a..6bf19cbc 100644 --- a/src/Propellor/Property/HostingProvider/Exoscale.hs +++ b/src/Propellor/Property/HostingProvider/Exoscale.hs @@ -5,6 +5,7 @@ module Propellor.Property.HostingProvider.Exoscale ( ) where import Propellor.Base +import qualified Propellor.Property.File as File import qualified Propellor.Property.Grub as Grub import qualified Propellor.Property.Apt as Apt import qualified Propellor.Property.Reboot as Reboot @@ -15,12 +16,13 @@ import qualified Propellor.Property.Reboot as Reboot -- We reboot after doing this because 'Sbuild.built' will fail to set up an -- overlay-type chroot on an old kernel distroKernel :: Architecture -> Property DebianLike -distroKernel arch = combineProperties "boots distro kernel" $ props - & Grub.installed' Grub.PC - & Apt.installed ["linux-image-" ++ arch] - -- only these ones are not idempotent so need flag file - & flagFile - (Grub.boots "/dev/vda" - `before` Grub.mkConfig - `before` Reboot.now) - "/etc/propellor-distro-kernel" +distroKernel arch = go `flagFile` theFlagFile + where + go = combineProperties "boots distro kernel" $ props + & Apt.installed ["grub2", "linux-image-" ++ arch] + & Grub.boots "/dev/vda" + & Grub.mkConfig + -- Since we're rebooting we have to manually create the flagfile + & File.hasContent theFlagFile [""] + & Reboot.toDistroKernel + theFlagFile = "/etc/propellor-distro-kernel" -- cgit v1.2.3 From 5e65dc8abe3237fdc189d8a80d3eb3e193369011 Mon Sep 17 00:00:00 2001 From: Sean Whitton Date: Sun, 12 Jun 2016 13:34:23 +0900 Subject: improve Exoscale prop haddock --- src/Propellor/Property/HostingProvider/Exoscale.hs | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'src/Propellor/Property/HostingProvider') diff --git a/src/Propellor/Property/HostingProvider/Exoscale.hs b/src/Propellor/Property/HostingProvider/Exoscale.hs index 6bf19cbc..c6244d46 100644 --- a/src/Propellor/Property/HostingProvider/Exoscale.hs +++ b/src/Propellor/Property/HostingProvider/Exoscale.hs @@ -10,11 +10,15 @@ import qualified Propellor.Property.Grub as Grub import qualified Propellor.Property.Apt as Apt import qualified Propellor.Property.Reboot as Reboot --- | Current Exoshare Debian image doesn't install GRUB, so this property makes --- sure GRUB is installed and we're running the distro's kernel +-- | The current Exoshare Debian image doesn't install GRUB, so this property +-- makes sure GRUB is installed and correctly configured -- --- We reboot after doing this because 'Sbuild.built' will fail to set up an --- overlay-type chroot on an old kernel +-- In case an old, insecure kernel is running, we check for an old kernel +-- version and reboot immediately if one is found. +-- +-- Note that we ignore anything after the first hyphen when considering whether +-- the running kernel's version is older than the Debian-supplied kernel's +-- version. distroKernel :: Architecture -> Property DebianLike distroKernel arch = go `flagFile` theFlagFile where -- cgit v1.2.3