opnsense-ports/sysutils/beadm/files/patch-beadm
Franco Fichtner b43c0d1a19 sysutils/beadm: sync with upstream
Taken from: HardenedBSD
2017-07-11 07:30:16 +02:00

90 lines
3.1 KiB
Text

--- beadm.orig 2017-01-13 15:25:44.000000000 -0800
+++ beadm 2017-07-08 09:45:40.962588000 -0700
@@ -128,6 +128,24 @@ __be_new() { # 1=SOURCE 2=TARGET
unset NAME_NEW
unset NAME_SANITY
local SOURCE=$( echo ${1} | cut -d '@' -f 1 )
+ local ENTROPY=0
+ # secure current /boot/entropy file
+ if [ -f /boot/entropy ]
+ then
+ if ! cp -p /boot/entropy /boot/entropy.OLD 1> /dev/null 2> /dev/null
+ then
+ echo "ERROR: Can not copy current '/boot/entropy' file"
+ exit 1
+ fi
+ ENTROPY=1
+ fi
+ # create new /boot/entropy file that would be used in new boot environment
+ if ! dd if=/dev/random of=/boot/entropy bs=4096 count=1 1> /dev/null 2> /dev/null
+ then
+ echo "ERROR: Can not generate new '/boot/entropy' file"
+ exit 1
+ fi
+ # create snapshot that will be used as a base for new boot environment
if __be_snapshot ${1}
then
# create boot environment from snapshot
@@ -138,6 +156,13 @@ __be_new() { # 1=SOURCE 2=TARGET
if ! zfs list -H -o name ${FS}@${SNAPSHOT} 1> /dev/null 2> /dev/null
then
echo "ERROR: Child snapshot '${FS}@${SNAPSHOT}' does not exist"
+ if [ ${ENTROPY} -ne 0 ]
+ then
+ if ! mv /boot/entropy.OLD /boot/entropy 1> /dev/null 2> /dev/null
+ then
+ echo "WARNING: Can not bring back original '/boot/entropy' file"
+ fi
+ fi
exit 1
fi
done
@@ -146,6 +171,13 @@ __be_new() { # 1=SOURCE 2=TARGET
if zfs list -H -o name ${1}@${2##*/} 1> /dev/null 2> /dev/null
then
echo "ERROR: Snapshot '${1}@${2##*/}' already exists"
+ if [ ${ENTROPY} -ne 0 ]
+ then
+ if ! mv /boot/entropy.OLD /boot/entropy 1> /dev/null 2> /dev/null
+ then
+ echo "WARNING: Can not bring back original '/boot/entropy' file"
+ fi
+ fi
exit 1
fi
# snapshot format
@@ -153,9 +185,25 @@ __be_new() { # 1=SOURCE 2=TARGET
if ! zfs snapshot -r ${1}@${FMT} 1> /dev/null 2> /dev/null
then
echo "ERROR: Cannot create snapshot '${1}@${FMT}'"
+ if [ ${ENTROPY} -ne 0 ]
+ then
+ if ! mv /boot/entropy.OLD /boot/entropy 1> /dev/null 2> /dev/null
+ then
+ echo "WARNING: Can not bring back original '/boot/entropy' file"
+ fi
+ fi
exit 1
fi
fi
+ # bring back secured /boot/entropy.OLD file
+ if [ -f /boot/entropy.OLD ]
+ then
+ if ! mv /boot/entropy.OLD /boot/entropy 1> /dev/null 2> /dev/null
+ then
+ echo "WARNING: Can not bring back original '/boot/entropy' file"
+ fi
+ fi
+ unset ENTROPY
# clone properties of source boot environment
zfs list -H -o name -r ${SOURCE} \
| grep -v '@' \
@@ -303,7 +351,7 @@ case ${1} in
while(CMD_ZFS_LIST BENAME_BEGINS_WITH | getline) {
if($1 != BENAME_BEGINS_WITH) {
FSNAME = $1
- FSNAMES[length(FSNAME) + 1] = FSNAME
+ FSNAMES[length(FSNAMES) + 1] = FSNAME
USED = __normalize($2)
USEDBYDATASET = __normalize($3)
USEDBYSNAPSHOTS = __normalize($4)