1#!/bin/ksh 2# 3# $OpenBSD: syspatch.sh,v 1.85 2017/01/19 23:04:48 ajacoutot Exp $ 4# 5# Copyright (c) 2016 Antoine Jacoutot <ajacoutot@openbsd.org> 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19set -e 20umask 0022 21 22sp_err() 23{ 24 echo "${1}" 1>&2 && return ${2:-1} 25} 26 27usage() 28{ 29 sp_err "usage: ${0##*/} [-c | -l | -r]" 30} 31 32apply_patch() 33{ 34 local _explodir _file _files _patch=$1 _ret=0 35 [[ -n ${_patch} ]] 36 37 _explodir=${_TMP}/${_patch} 38 39 echo "Applying patch ${_patch##${_OSrev}-}" 40 fetch_and_verify "syspatch${_patch}.tgz" 41 42 trap '' INT 43 install -d ${_explodir} ${_PDIR}/${_patch} 44 45 _files="$(tar xvzphf ${_TMP}/syspatch${_patch}.tgz -C ${_explodir})" 46 checkfs ${_files} 47 48 create_rollback ${_patch} "${_files}" 49 50 # create_rollback(): tar(1) was fed with an empty list of files; that is 51 # not an error but no tarball is created; this happens if no earlier 52 # version of the files contained in the syspatch exists on the system 53 [[ ! -f ${_PDIR}/${_patch}/rollback.tgz ]] && unset _files && 54 echo "Missing set, skipping patch ${_patch##${_OSrev}-}" 55 56 for _file in ${_files}; do 57 ((_ret == 0)) || break 58 if [[ ${_file} == @(bsd|bsd.mp) ]]; then 59 install_kernel ${_explodir}/${_file} || _ret=$? 60 else 61 install_file ${_explodir}/${_file} /${_file} || _ret=$? 62 fi 63 done 64 65 if ((_ret != 0)); then 66 sp_err "Failed to apply patch ${_patch##${_OSrev}-}" 0 67 rollback_patch; return ${_ret} 68 fi 69 trap exit INT 70} 71 72# quick-and-dirty size check: 73# - assume old files are about the same size as new ones 74# - ignore new (nonexistent) files 75# - compute total size of all files per fs, simpler and less margin for error 76# - if we install a kernel, double /bsd size (duplicate it in the list) when: 77# - we are on an MP system (/bsd.mp does not exist there) 78# - /bsd.syspatchXX is not present (create_rollback will copy it from /bsd) 79checkfs() 80{ 81 local _d _df _dev _files="${@}" _sz 82 [[ -n ${_files} ]] 83 84 if echo "${_files}" | grep -qw bsd; then 85 ${_BSDMP} || [[ ! -f /bsd.syspatch${_OSrev} ]] && 86 _files="bsd ${_files}" 87 fi 88 89 eval $(cd / && 90 stat -qf "_dev=\"\${_dev} %Sd\" %Sd=\"\${%Sd:+\${%Sd}\+}%Uz\"" \ 91 ${_files}) || true # ignore nonexistent files 92 93 for _d in $(printf '%s\n' ${_dev} | sort -u); do 94 mount | grep -v read-only | grep -q "^/dev/${_d} " || 95 sp_err "Remote or read-only filesystem, aborting" 96 _df=$(df -Pk | grep "^/dev/${_d} " | tr -s ' ' | cut -d ' ' -f4) 97 _sz=$(($((_d))/1024)) 98 ((_df > _sz)) || sp_err "No space left on ${_d}, aborting" 99 done 100} 101 102create_rollback() 103{ 104 # XXX annotate new files so we can remove them if we rollback? 105 local _file _patch=$1 _rbfiles _ret=0 106 [[ -n ${_patch} ]] 107 shift 108 local _files="${@}" 109 [[ -n ${_files} ]] 110 111 for _file in ${_files}; do 112 [[ -f /${_file} ]] || continue 113 # only save the original release kernel once 114 if [[ ${_file} == bsd && ! -f /bsd.syspatch${_OSrev} ]]; then 115 install -FSp /bsd /bsd.syspatch${_OSrev} 116 fi 117 _rbfiles="${_rbfiles} ${_file}" 118 done 119 120 # GENERIC.MP: substitute bsd.mp->bsd and bsd.sp->bsd 121 if ${_BSDMP} && 122 tar -tzf ${_TMP}/syspatch${_patch}.tgz bsd >/dev/null 2>&1; then 123 tar -C / -czf ${_PDIR}/${_patch}/rollback.tgz -s '/^bsd.mp$//' \ 124 -s '/^bsd$/bsd.mp/' -s '/^bsd.sp$/bsd/' bsd.sp \ 125 ${_rbfiles} || _ret=$? 126 else 127 tar -C / -czf ${_PDIR}/${_patch}/rollback.tgz ${_rbfiles} || 128 _ret=$? 129 fi 130 131 if ((_ret != 0)); then 132 sp_err "Failed to create rollback patch ${_patch##${_OSrev}-}" 0 133 rm -r ${_PDIR}/${_patch}; return ${_ret} 134 fi 135} 136 137fetch_and_verify() 138{ 139 local _tgz=$1 140 [[ -n ${_tgz} ]] 141 142 unpriv -f "${_TMP}/${_tgz}" ftp -Vm -D "Get/Verify" -o \ 143 "${_TMP}/${_tgz}" "${_MIRROR}/${_tgz}" 144 145 (cd ${_TMP} && sha256 -qC ${_TMP}/SHA256 ${_tgz}) 146} 147 148install_file() 149{ 150 # XXX handle symlinks, dir->file, file->dir? 151 local _dst=$2 _fgrp _fmode _fown _src=$1 152 [[ -f ${_src} && -f ${_dst} ]] 153 154 eval $(stat -f "_fmode=%OMp%OLp _fown=%Su _fgrp=%Sg" ${_src}) 155 156 install -DFS -m ${_fmode} -o ${_fown} -g ${_fgrp} ${_src} ${_dst} 157} 158 159install_kernel() 160{ 161 local _bsd _kern=$1 162 [[ -n ${_kern} ]] 163 164 if ${_BSDMP}; then 165 [[ ${_kern##*/} == bsd ]] && _bsd=bsd.sp || _bsd=bsd 166 fi 167 168 install -FS ${_kern} /${_bsd:-${_kern##*/}} 169} 170 171ls_installed() 172{ 173 local _p 174 for _p in ${_PDIR}/${_OSrev}-+([[:digit:]])_+([[:alnum:]_]); do 175 [[ -f ${_p}/rollback.tgz ]] && echo ${_p##*/${_OSrev}-} 176 done | sort -V 177} 178 179ls_missing() 180{ 181 local _c _l="$(ls_installed)" _sha=${_TMP}/SHA256 182 183 # don't output anything on stdout to prevent corrupting the patch list 184 unpriv -f "${_sha}.sig" ftp -MVo "${_sha}.sig" "${_MIRROR}/SHA256.sig" \ 185 >/dev/null 186 unpriv -f "${_sha}" signify -Veq -x ${_sha}.sig -m ${_sha} -p \ 187 /etc/signify/openbsd-${_OSrev}-syspatch.pub >/dev/null 188 189 grep -Eo "syspatch${_OSrev}-[[:digit:]]{3}_[[:alnum:]_]+" ${_sha} | 190 while read _c; do _c=${_c##syspatch${_OSrev}-} && 191 [[ -n ${_l} ]] && echo ${_c} | grep -qw -- "${_l}" || echo ${_c} 192 done | sort -V 193} 194 195rollback_patch() 196{ 197 local _explodir _file _files _patch _ret=0 198 199 _patch="$(ls_installed | tail -1)" 200 [[ -n ${_patch} ]] 201 202 _explodir=${_TMP}/${_patch}-rollback 203 _patch=${_OSrev}-${_patch} 204 205 echo "Reverting patch ${_patch##${_OSrev}-}" 206 install -d ${_explodir} 207 208 _files="$(tar xvzphf ${_PDIR}/${_patch}/rollback.tgz -C ${_explodir})" 209 checkfs ${_files} ${_PDIR} # check for read-only /var/syspatch 210 211 for _file in ${_files}; do 212 ((_ret == 0)) || break 213 if [[ ${_file} == @(bsd|bsd.mp) ]]; then 214 install_kernel ${_explodir}/${_file} || _ret=$? 215 # remove the backup kernel if all kernel syspatches have 216 # been reverted; non-fatal (`-f') 217 cmp -s /bsd /bsd.syspatch${_OSrev} && 218 rm -f /bsd.syspatch${_OSrev} 219 else 220 install_file ${_explodir}/${_file} /${_file} || _ret=$? 221 fi 222 done 223 224 ((_ret == 0)) && rm -r ${_PDIR}/${_patch} || 225 sp_err "Failed to revert patch ${_patch##${_OSrev}-}" ${_ret} 226} 227 228sp_cleanup() 229{ 230 local _d _k _m 231 232 # remove non matching release /var/syspatch/ content 233 for _d in ${_PDIR}/*; do 234 [[ ${_d##*/} == ${_OSrev}-+([[:digit:]])_+([[:alnum:]]|_) ]] && 235 [[ -f ${_d}/rollback.tgz ]] || rm -r ${_d} 236 done 237 238 # remove non matching release backup kernel 239 for _k in /bsd.syspatch+([[:digit:]]); do 240 [[ -f ${_k} ]] || continue 241 [[ ${_k} == /bsd.syspatch${_OSrev} ]] || rm ${_k} 242 done 243 244 # in case a patch added a new directory (install -D) 245 for _m in /etc/mtree/{4.4BSD,BSD.x11}.dist; do 246 [[ -f ${_m} ]] && mtree -qdef ${_m} -p / -U >/dev/null 247 done 248} 249 250stripcom() { 251 local _file=$1 _line 252 [[ -f ${_file} ]] 253 254 while read _line; do 255 _line=${_line%%#*} 256 [[ -n ${_line} ]] && print -r -- "${_line}" 257 done <${_file} 258} 259 260unpriv() 261{ 262 local _file=$2 _user=_syspatch 263 264 if [[ $1 == -f && -n ${_file} ]]; then 265 >${_file} 266 chown "${_user}" "${_file}" 267 chmod 0711 ${_TMP} 268 shift 2 269 fi 270 (($# >= 1)) 271 272 eval su -s /bin/sh ${_user} -c "'$@'" 273} 274 275# XXX needs a way to match release <=> syspatch 276# only run on release (not -current nor -stable) 277set -A _KERNV -- $(sysctl -n kern.version | 278 sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q') 279((${#_KERNV[*]} > 1)) && sp_err "Unsupported release ${_KERNV[*]}" 280 281[[ $@ == @(|-[[:alpha:]]) ]] || usage; [[ $@ == @(|-(c|r)) ]] && 282 (($(id -u) != 0)) && sp_err "${0##*/}: need root privileges" 283 284(($(sysctl -n hw.ncpufound) > 1)) && _BSDMP=true || _BSDMP=false 285_MIRROR=$(stripcom /etc/installurl) || 286 sp_err "${0##*/}: no mirror configured in /etc/installurl" 287_MIRROR=${_MIRROR}/syspatch/${_KERNV[0]}/$(machine)/ 288_OSrev=${_KERNV[0]%\.*}${_KERNV[0]#*\.} 289_PDIR="/var/syspatch" 290_TMP=$(mktemp -d -p /tmp syspatch.XXXXXXXXXX) 291readonly _BSDMP _MIRROR _OSrev _PDIR _REL _TMP 292 293trap 'set +e; rm -rf "${_TMP}"' EXIT 294trap exit HUP INT TERM 295 296[[ -n ${_OSrev} ]] 297 298while getopts clr arg; do 299 case ${arg} in 300 c) ls_missing;; 301 l) ls_installed;; 302 r) rollback_patch;; 303 *) usage;; 304 esac 305done 306shift $((OPTIND -1)) 307[[ $# -ne 0 ]] && usage 308 309if ((OPTIND == 1)); then 310 for _PATCH in $(ls_missing); do 311 apply_patch ${_OSrev}-${_PATCH} 312 done 313 sp_cleanup 314fi 315