mirror of
https://github.com/kairos-io/kairos-agent.git
synced 2025-06-03 01:44:53 +00:00
b5869b4017
* Fix hooks under encrypted partitions We had a mess of mounting and unmounting things around when we try to copy things to persistent. Part of the changes (using the by-label to mount the persistent) are due to the change in kcrypt. As we set the same label to the encrypted fs and unencrypted fs, our utils.Mount could get mistaken and return the first hit, which usually its the encrypted one, and we cannot mount that one. This patch brings it up to date. - Makes bundles and logs hooks work when we have encrypted persistent. It didnt work before. - Makes both workflows the same. - Locks everything once its over, to not leave encrypted parts around - Mounts OEM so kcrypt can read the config if we are using a remote server for encryption - Mounts by label so there is not a change of getting the wrong device - Uses the mount syscall directly. The util can mistake and return the actual encrypted part if they both have the same label and finds it first --------- Signed-off-by: Itxaka <itxaka@kairos.io>
50 lines
1.3 KiB
Go
50 lines
1.3 KiB
Go
package hook
|
|
|
|
import (
|
|
"github.com/kairos-io/kairos-agent/v2/pkg/config"
|
|
"github.com/kairos-io/kairos-agent/v2/pkg/constants"
|
|
v1 "github.com/kairos-io/kairos-agent/v2/pkg/types/v1"
|
|
"github.com/kairos-io/kairos-sdk/machine"
|
|
kcrypt "github.com/kairos-io/kcrypt/pkg/lib"
|
|
"path/filepath"
|
|
"syscall"
|
|
)
|
|
|
|
type Kcrypt struct{}
|
|
|
|
func (k Kcrypt) Run(c config.Config, _ v1.Spec) error {
|
|
if len(c.Install.Encrypt) == 0 {
|
|
return nil
|
|
}
|
|
c.Logger.Logger.Info().Msg("Running encrypt hook")
|
|
|
|
// We need to unmount the persistent partition to encrypt it
|
|
// we dont know the state here so we better try
|
|
err := machine.Umount(filepath.Join("/dev/disk/by-label", constants.PersistentLabel)) //nolint:errcheck
|
|
if err != nil {
|
|
c.Logger.Errorf("could not unmount persistent partition: %s", err)
|
|
return err
|
|
}
|
|
|
|
// Config passed during install ends up here, so we need to read it
|
|
_ = machine.Mount("COS_OEM", "/oem")
|
|
defer func() {
|
|
err := syscall.Unmount(constants.OEMPath, 0)
|
|
if err != nil {
|
|
c.Logger.Errorf("could not unmount Oem partition: %s", err)
|
|
}
|
|
}()
|
|
|
|
for _, p := range c.Install.Encrypt {
|
|
_, err := kcrypt.Luksify(p, c.Logger)
|
|
if err != nil {
|
|
c.Logger.Errorf("could not encrypt partition: %s", err)
|
|
if c.FailOnBundleErrors {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
c.Logger.Logger.Info().Msg("Finished encrypt hook")
|
|
return nil
|
|
}
|