X-Git-Url: http://git.grml.org/?a=blobdiff_plain;f=scripts%2Flive-helpers;h=a0510ce92ded5b0304a85131f42c86009ad4b488;hb=11492e8c656455a7d7ba0219d0018b282792a9d4;hp=f13be57fffbb0f89b6a5ac86b3e7df59a61fc5b4;hpb=2c55cb63431dcecab209ed5c4f477fd8681b8530;p=live-boot-grml.git

diff --git a/scripts/live-helpers b/scripts/live-helpers
index f13be57..a0510ce 100644
--- a/scripts/live-helpers
+++ b/scripts/live-helpers
@@ -832,15 +832,23 @@ probe_for_gpt_name ()
 	local snapshots="${2}"
 	local dev="${3}"
 
-	if ! is_gpt_device ${dev} || \
-	   ( echo ${PERSISTENT_ENCRYPTION} | grep -qve "\<luks\>" && \
-	     /sbin/cryptsetup isLuks ${dev} > /dev/null 2>&1 )
+	local gpt_dev="${dev}"
+	if is_active_luks_mapping ${dev}
+	then
+		# if $dev is an opened luks device, we need to check
+		# GPT stuff on the backing device
+		gpt_dev=$(get_luks_backing_device "${dev}")
+	fi
+
+	if ! is_gpt_device ${gpt_dev}
 	then
 		return
 	fi
+
+	local gpt_name=$(get_gpt_name ${gpt_dev})
 	for label in ${overlays} ${snapshots}
 	do
-		if [ "$(get_gpt_name ${dev})" = "${label}" ]
+		if [ "${gpt_name}" = "${label}" ]
 		then
 			echo "${label}=${dev}"
 		fi
@@ -936,18 +944,16 @@ find_persistent_media ()
 	do
 		local result=""
 
-		local real_dev=""
 		local luks_device=""
 		# Check if it's a luks device; we'll have to open the device
 		# in order to probe any filesystem it contains, like we do
 		# below. do_custom_mounts() also depends on that any luks
 		# device already has been opened.
 		if echo ${PERSISTENT_ENCRYPTION} | grep -qe "\<luks\>" && \
-		   /sbin/cryptsetup isLuks ${dev} >/dev/null 2>&1
+		   is_luks_partition ${dev}
 		then
 			if luks_device=$(open_luks_device "${dev}")
 			then
-				real_dev="${dev}"
 				dev="${luks_device}"
 			else
 				# skip $dev since we failed/chose not to open it
@@ -962,15 +968,7 @@ find_persistent_media ()
 		# Probe for matching GPT partition names or filesystem labels
 		if echo ${PERSISTENT_STORAGE} | grep -qe "\<filesystem\>"
 		then
-			local gpt_dev="${dev}"
-			if [ -n "${luks_device}" ]
-			then
-				# When we probe GPT partitions we need to look
-				# at the real device, not the virtual, opened
-				# luks device
-				gpt_dev="${real_dev}"
-			fi
-			result=$(probe_for_gpt_name "${overlays}" "${snapshots}" ${gpt_dev})
+			result=$(probe_for_gpt_name "${overlays}" "${snapshots}" ${dev})
 			if [ -n "${result}" ]
 			then
 				ret="${ret} ${result}"
@@ -998,7 +996,7 @@ find_persistent_media ()
 
 		# Close luks device if it isn't used
 		if [ -z "${result}" ] && [ -n "${luks_device}" ] && \
-		   /sbin/cryptsetup status "${luks_device}" 1> /dev/null 2>&1
+		   is_active_luks_mapping "${luks_device}"
 		then
 			/sbin/cryptsetup luksClose "${luks_device}"
 		fi
@@ -1028,17 +1026,22 @@ get_mac ()
 	echo ${mac}
 }
 
-is_luks()
+is_luks_partition ()
 {
-    devname="${1}"
-    if [ -x /sbin/cryptsetup ]
-    then
-	/sbin/cryptsetup isLuks "${devname}" 2>/dev/null || ret=${?}
-	return ${ret}
-    else
-	return 1
-    fi
+	device="${1}"
+	/sbin/cryptsetup isLuks "${device}" 1>/dev/null 2>&1
+}
 
+is_active_luks_mapping ()
+{
+	device="${1}"
+	/sbin/cryptsetup status "${device}" 1>/dev/null 2>&1
+}
+
+get_luks_backing_device () {
+	device=${1}
+	cryptsetup status ${device} 2> /dev/null | \
+		awk '{if ($1 == "device:") print $2}'
 }
 
 removable_dev ()
@@ -1225,8 +1228,9 @@ get_custom_mounts ()
 	# Side-effect: leaves $devices with live.persist mounted in ${rootmnt}/live/persistent
 	# Side-effect: prints info to file $custom_mounts
 
-	local devices="${1}"
-	local custom_mounts="${2}" # print result to this file
+	local custom_mounts=${1}
+	shift
+	local devices=${@}
 
 	local bindings="/tmp/bindings.list"
 	local links="/tmp/links.list"
@@ -1272,19 +1276,20 @@ get_custom_mounts ()
 				continue
 			fi
 
-			if echo ${dest} | grep -qe "^[^/]"
+			if [ -z "${dest}" ]
 			then
-				options="${dest}"
 				dest="${source}"
-			elif [ -z "${dest}" ]
+			fi
+
+			if trim_path ${source} | grep -q -e "^[^/]" -e "^\(.*/\)\?\.\.\?\(/.*\)\?$"
 			then
-				dest="${source}"
+				log_warning_msg "Skipping unsafe custom mount with source ${source}: the source must be an absolute path w.r.t. the persistent media root and cannot contain \".\" or \"..\""
+				continue
 			fi
 
-			if echo ${dest} | grep -qe "^/\+$\|^/\+live\(/.*\)\?$"
+			if trim_path ${dest} | grep -q -e "^[^/]" -e "^/$" -e "^/live\(/.*\)\?$" -e "^/\(.*/\)\?\.\.\?\(/.*\)\?$"
 			then
-				# mounting on / or /live could cause trouble
-				log_warning_msg "Skipping unsafe custom mount on ${dest}"
+				log_warning_msg "Skipping unsafe custom mount with desination ${dest}: the destination must be an absolute path containing neither \".\" nor \"..\", and cannot be /live (or any sub-directory therein) or / (for the latter, use ${root_overlay_label}-type persistence instead)"
 				continue
 			fi
 
@@ -1301,8 +1306,8 @@ get_custom_mounts ()
 			done
 
 			# ensure that no multiple-/ occur in paths
-			local full_source="$(echo ${backing}/${source}/ | sed -e 's|/\+|/|g')"
-			local full_dest="$(echo ${rootmnt}/${dest}/ | sed -e 's|/\+|/|g')"
+			local full_source="$(trim_path ${backing}/${source})"
+			local full_dest="$(trim_path ${rootmnt}/${dest})"
 			device_used="yes"
 			if echo ${options} | grep -qe "\<linkfiles\>";
 			then
@@ -1368,7 +1373,7 @@ do_custom_mounts ()
 			# FIXME: this should really be handled by
 			# live-config since we don't know for sure
 			# which uid a certain user has until then
-			if echo ${dest} | grep -qe "^${rootmnt}/*home/\+[^/]\+"
+			if trim_path ${dest} | grep -qe "^${rootmnt}/*home/[^/]\+"
 			then
 				path="/"
 				for dir in $(echo ${dest} | sed -e 's|/\+| |g')
@@ -1449,6 +1454,8 @@ do_custom_mounts ()
 				cow_dir="/live/cow/${dest}"
 			fi
 			mkdir -p ${cow_dir}
+			chown --reference "${source}" "${cow_dir}"
+			chmod --reference "${source}" "${cow_dir}"
 			do_union ${dest} ${cow_dir} ${source} ${rofs_dest_backing}
 		fi
 
@@ -1481,6 +1488,6 @@ fix_home_rw_compatibility ()
 	if [ ! -r "${include_list}" ]
 	then
 		echo "# home-rw backwards compatibility:
-. /home" > "${include_list}"
+/ /home" > "${include_list}"
 	fi
 }