Date: Wed, 4 Jun 2014 14:58:52 +0000 (UTC) From: Ollivier Robert <roberto@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r267056 - stable/10/usr.sbin/bsdinstall/scripts Message-ID: <201406041458.s54Ewqkr045130@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: roberto Date: Wed Jun 4 14:58:51 2014 New Revision: 267056 URL: http://svnweb.freebsd.org/changeset/base/267056 Log: MFC r266107,r266108,r266109: Here is a patch for the bsdinstall root-on-zfs stuff that adds optional encryption for swap, and optional gmirror for swap (which can be combined) Updates to the datasets created by zfsboot. Set compress=lz4 for the entire pool, removing it from the individual datasets Remove exec=no from /usr/src, breaks the test suite. Fix the "disks" variable reuse. It starts off being used to track the grammar for the number of disks (singular vs plural) and then it is reused as the list of available disks. Replace the variable with disks_grammar and move 'disk' and 'disks' to msg_ vars so they can be translated in the future. Submitted by: Allan Jude <freebsd@allanjude.com> Reviewed by: roberto Sponsored by: ScaleEngine Inc. Modified: stable/10/usr.sbin/bsdinstall/scripts/zfsboot Directory Properties: stable/10/ (props changed) Modified: stable/10/usr.sbin/bsdinstall/scripts/zfsboot ============================================================================== --- stable/10/usr.sbin/bsdinstall/scripts/zfsboot Wed Jun 4 13:42:19 2014 (r267055) +++ stable/10/usr.sbin/bsdinstall/scripts/zfsboot Wed Jun 4 14:58:51 2014 (r267056) @@ -108,6 +108,16 @@ f_include $BSDCFG_SHARE/variable.subr : ${ZFSBOOT_SWAP_SIZE:=2g} # +# Should we use geli(8) to encrypt the swap? +# +: ${ZFSBOOT_SWAP_ENCRYPTION=} + +# +# Should we use gmirror(8) to mirror the swap? +# +: ${ZFSBOOT_SWAP_MIRROR=} + +# # Default ZFS datasets for root zpool # # NOTE: Requires /tmp, /var/tmp, /$ZFSBOOT_BOOTFS_NAME/$ZFSBOOT_BOOTFS_NAME @@ -121,7 +131,7 @@ f_isset ZFSBOOT_DATASETS || ZFSBOOT_DATA /$ZFSBOOT_BEROOT_NAME/$ZFSBOOT_BOOTFS_NAME mountpoint=/ # Compress /tmp, allow exec but not setuid - /tmp mountpoint=/tmp,compression=lz4,exec=on,setuid=off + /tmp mountpoint=/tmp,exec=on,setuid=off # Don't mount /usr so that 'base' files go to the BEROOT /usr mountpoint=/usr,canmount=off @@ -130,17 +140,17 @@ f_isset ZFSBOOT_DATASETS || ZFSBOOT_DATA /usr/home # NB: /home is a symlink to /usr/home # Ports tree - /usr/ports compression=lz4,setuid=off + /usr/ports setuid=off # Source tree (compressed) - /usr/src compression=lz4,exec=off,setuid=off + /usr/src # Create /var and friends /var mountpoint=/var - /var/crash compression=lz4,exec=off,setuid=off - /var/log compression=lz4,exec=off,setuid=off - /var/mail compression=lz4,atime=on - /var/tmp compression=lz4,exec=on,setuid=off + /var/crash exec=off,setuid=off + /var/log exec=off,setuid=off + /var/mail atime=on + /var/tmp setuid=off " # END-QUOTE # @@ -184,6 +194,7 @@ MOUNT_TYPE='mount -t %s "%s" "%s"' PRINTF_CONF="printf '%s=\"%%s\"\\\n' %s >> \"%s\"" PRINTF_FSTAB='printf "$FSTAB_FMT" "%s" "%s" "%s" "%s" "%s" "%s" >> "%s"' SHELL_TRUNCATE=':> "%s"' +SWAP_GMIRROR_LABEL='gmirror label swap %s' UMOUNT='umount "%s"' ZFS_CREATE_WITH_OPTIONS='zfs create %s "%s"' ZFS_SET='zfs set "%s" "%s"' @@ -209,6 +220,8 @@ msg_configure_options="Configure Options msg_detailed_disk_info="gpart(8) show %s:\n%s\n\ncamcontrol(8) inquiry %s:\n%s\n\n\ncamcontrol(8) identify %s:\n%s\n" msg_disk_info="Disk Info" msg_disk_info_help="Get detailed information on disk device(s)" +msg_disk_singular="disk" +msg_disk_plural="disks" msg_encrypt_disks="Encrypt Disks?" msg_encrypt_disks_help="Use geli(8) to encrypt all data partitions" msg_error="Error" @@ -263,6 +276,10 @@ msg_select_a_disk_device="Select a disk msg_select_virtual_device_type="Select Virtual Device type:" msg_stripe_desc="Stripe - No Redundancy" msg_stripe_help="[1+ Disks] Striping provides maximum storage but no redundancy" +msg_swap_encrypt="Encrypt Swap?" +msg_swap_encrypt_help="Encrypt swap partitions with temporary keys, discarded on reboot" +msg_swap_mirror="Mirror Swap?" +msg_swap_mirror_help="Mirror swap partitions for redundancy, breaks crash dumps" msg_swap_size="Swap Size" msg_swap_size_help="Customize how much swap space is allocated to each selected disk" msg_these_disks_are_too_small="These disks are too small given the amount of requested\nswap (%s) and/or geli(8) (%s) partitions, which would\ntake 50%% or more of each of the following selected disk\ndevices (not recommended):\n\n %s\n\nRecommend changing partition size(s) and/or selecting a\ndifferent set of devices." @@ -285,15 +302,20 @@ dialog_menu_main() local prompt="$msg_configure_options" local force4k="$msg_no" local usegeli="$msg_no" + local swapgeli="$msg_no" + local swapmirror="$msg_no" [ "$ZFSBOOT_GNOP_4K_FORCE_ALIGN" ] && force4k="$msg_yes" [ "$ZFSBOOT_GELI_ENCRYPTION" ] && usegeli="$msg_yes" - local disks n + [ "$ZFSBOOT_SWAP_ENCRYPTION" ] && swapgeli="$msg_yes" + [ "$ZFSBOOT_SWAP_MIRROR" ] && swapmirror="$msg_yes" + local disks n disks_grammar f_count n $ZFSBOOT_DISKS - { [ $n -eq 1 ] && disks=disk; } || disks=disks # grammar + { [ $n -eq 1 ] && disks_grammar=$msg_disk_singular; } || + disks_grammar=$msg_disk_plural # grammar local menu_list=" '>>> $msg_install' '$msg_install_desc' '$msg_install_help' - 'T $msg_pool_type_disks' '$ZFSBOOT_VDEV_TYPE: $n $disks' + 'T $msg_pool_type_disks' '$ZFSBOOT_VDEV_TYPE: $n $disks_grammar' '$msg_pool_type_disks_help' '- $msg_rescan_devices' '*' '$msg_rescan_devices_help' @@ -309,6 +331,10 @@ dialog_menu_main() '$msg_partition_scheme_help' 'S $msg_swap_size' '$ZFSBOOT_SWAP_SIZE' '$msg_swap_size_help' + 'M $msg_swap_mirror' '$swapmirror' + '$msg_swap_mirror_help' + 'W $msg_swap_encrypt' '$swapgeli' + '$msg_swap_encrypt_help' " # END-QUOTE local defaultitem= # Calculated below local hline="$hline_alnum_arrows_punc_tab_enter" @@ -747,14 +773,14 @@ zfs_create_diskpart() return $FAILURE # NB: zpool will use the `zfs#' GPT labels - bootpart=p2 targetpart=p2 + bootpart=p2 swappart=p2 targetpart=p2 [ ${swapsize:-0} -gt 0 ] && targetpart=p3 # # Prepare boot pool if enabled (e.g., for geli(8)) # if [ "$ZFSBOOT_BOOT_POOL" ]; then - bootpart=p2 targetpart=p3 + bootpart=p2 swappart=p3 targetpart=p3 [ ${swapsize:-0} -gt 0 ] && targetpart=p4 f_eval_catch $funcname gpart \ "$GPART_ADD_LABEL_WITH_SIZE" boot$index \ @@ -781,12 +807,7 @@ zfs_create_diskpart() return $FAILURE # Pedantically nuke any old labels on the swap f_eval_catch -d $funcname zpool "$ZPOOL_LABELCLEAR_F" \ - /dev/gpt/swap$index - # Update fstab(5) - f_eval_catch $funcname printf "$PRINTF_FSTAB" \ - /dev/gpt/swap$index none swap sw 0 0 \ - $BSDINSTALL_TMPETC/fstab || - return $FAILURE + /dev/$disk$swappart fi # @@ -827,7 +848,7 @@ zfs_create_diskpart() return $FAILURE # NB: zpool will use s1a (no labels) - bootpart=s1a targetpart=s1d mbrindex=4 + bootpart=s1a swappart=s1b targetpart=s1d mbrindex=4 # # Always prepare a boot pool on MBR @@ -858,11 +879,6 @@ zfs_create_diskpart() # Pedantically nuke any old labels on the swap f_eval_catch -d $funcname zpool "$ZPOOL_LABELCLEAR_F" \ /dev/${disk}s1b - # Update fstab(5) - f_eval_catch $funcname printf "$PRINTF_FSTAB" \ - /dev/${disk}s1b none swap sw 0 0 \ - $BSDINSTALL_TMPETC/fstab || - return $FAILURE fi # @@ -879,6 +895,33 @@ zfs_create_diskpart() esac # $ZFSBOOT_PARTITION_SCHEME + # Update fstab(5) + if [ "$isswapmirror" ]; then + # This is not the first disk in the mirror, do nothing + elif [ "$ZFSBOOT_SWAP_ENCRYPTION" -a "$ZFSBOOT_SWAP_MIRROR" ]; then + f_eval_catch $funcname printf "$PRINTF_FSTAB" \ + /dev/mirror/swap.eli none swap sw 0 0 \ + $BSDINSTALL_TMPETC/fstab || + return $FAILURE + isswapmirror=1 + elif [ "$ZFSBOOT_SWAP_MIRROR" ]; then + f_eval_catch $funcname printf "$PRINTF_FSTAB" \ + /dev/mirror/swap none swap sw 0 0 \ + $BSDINSTALL_TMPETC/fstab || + return $FAILURE + isswapmirror=1 + elif [ "$ZFSBOOT_SWAP_ENCRYPTION" ]; then + f_eval_catch $funcname printf "$PRINTF_FSTAB" \ + /dev/$disk${swappart}.eli none swap sw 0 0 \ + $BSDINSTALL_TMPETC/fstab || + return $FAILURE + else + f_eval_catch $funcname printf "$PRINTF_FSTAB" \ + /dev/$disk$swappart none swap sw 0 0 \ + $BSDINSTALL_TMPETC/fstab || + return $FAILURE + fi + return $SUCCESS } @@ -893,10 +936,12 @@ zfs_create_boot() local zroot_name="$1" local zroot_vdevtype="$2" local zroot_vdevs= # Calculated below + local swap_devs= # Calculated below local boot_vdevs= # Used for geli(8) and/or MBR layouts shift 2 # poolname vdev_type local disks="$*" disk - local bootpart targetpart # Set by zfs_create_diskpart() below + local isswapmirror + local bootpart targetpart swappart # Set by zfs_create_diskpart() below # # Pedantic checks; should never be seen @@ -968,7 +1013,8 @@ zfs_create_boot() local n=0 for disk in $disks; do zfs_create_diskpart $disk $n || return $FAILURE - # Now $bootpart and $targetpart are set (suffix for $disk) + # Now $bootpart, $targetpart, and $swappart are set (suffix + # for $disk) # Forced 4k alignment support using Geom NOP (see gnop(8)) if [ "$ZFSBOOT_GNOP_4K_FORCE_ALIGN" ]; then @@ -1087,13 +1133,24 @@ zfs_create_boot() return $FAILURE f_eval_catch -d $funcname umount "$UMOUNT" /mnt # tmpfs fi + # + # Create the gmirror(8) GEOMS for swap + # + if [ "$ZFSBOOT_SWAP_MIRROR" ]; then + for disk in $disks; do + swap_devs="$swap_devs $disk$swappart" + done + f_eval_catch $funcname gmirror "$SWAP_GMIRROR_LABEL" \ + "$swap_devs" || return $FAILURE + fi # # Create the ZFS root pool with desired type and disk devices # f_dprintf "$funcname: Creating root pool..." f_eval_catch $funcname zpool "$ZPOOL_CREATE_WITH_OPTIONS" \ - "-o altroot=$BSDINSTALL_CHROOT -m none -f" \ + "-o altroot=$BSDINSTALL_CHROOT -O compress=lz4 + -m none -f" \ "$zroot_name" "$zroot_vdevtype" "$zroot_vdevs" || return $FAILURE @@ -1212,6 +1269,14 @@ zfs_create_boot() $BSDINSTALL_TMPETC/rc.conf.zfs || return $FAILURE f_eval_catch $funcname echo "$ECHO_APPEND" 'zfs_load=\"YES\"' \ $BSDINSTALL_TMPBOOT/loader.conf.zfs || return $FAILURE + f_eval_catch $funcname echo "$ECHO_APPEND" \ + 'kern.geom.label.gptid.enable=\"0\"' \ + $BSDINSTALL_TMPBOOT/loader.conf.zfs || return $FAILURE + + if [ "$ZFSBOOT_SWAP_MIRROR" ]; then + f_eval_catch $funcname echo "$ECHO_APPEND" 'geom_mirror_load=\"YES\"' \ + $BSDINSTALL_TMPBOOT/loader.conf.gmirror || return $FAILURE + fi # We're all done unless we should go on for boot pool [ "$ZFSBOOT_BOOT_POOL" ] || return $SUCCESS @@ -1445,6 +1510,22 @@ while :; do "$ZFSBOOT_SWAP_SIZE" && ZFSBOOT_SWAP_SIZE="${input:-0}" ;; + ?" $msg_swap_mirror") + # Toggle the variable referenced both by the menu and later + if [ "$ZFSBOOT_SWAP_MIRROR" ]; then + ZFSBOOT_SWAP_MIRROR= + else + ZFSBOOT_SWAP_MIRROR=1 + fi + ;; + ?" $msg_swap_encrypt") + # Toggle the variable referenced both by the menu and later + if [ "$ZFSBOOT_SWAP_ENCRYPTION" ]; then + ZFSBOOT_SWAP_ENCRYPTION= + else + ZFSBOOT_SWAP_ENCRYPTION=1 + fi + ;; esac done
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201406041458.s54Ewqkr045130>