1#!/bin/ksh 2# 3# $OpenBSD: syspatch.sh,v 1.168 2023/12/13 17:50:23 ajacoutot Exp $ 4# 5# Copyright (c) 2016, 2017 Antoine Jacoutot <ajacoutot@openbsd.org> 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19set -e 20umask 0022 21export PATH=/usr/bin:/bin:/usr/sbin:/sbin 22 23err() 24{ 25 echo "${0##*/}: ${1}" 1>&2 26 return ${2:-1} 27} 28 29usage() 30{ 31 echo "usage: ${0##*/} [-c | -l | -R | -r]" 1>&2 32 return 1 33} 34 35apply_patch() 36{ 37 local _edir _file _files _kernel _patch=$1 _rc=0 _s _upself=false 38 [[ -n ${_patch} ]] 39 40 _edir=${_TMP}/${_patch} 41 42 fetch_and_verify "syspatch${_patch}.tgz" 43 44 trap '' INT 45 echo "Installing patch ${_patch##${_OSrev}-}" 46 install -d ${_edir} ${_PDIR}/${_patch} 47 48 _kernel=$(sysctl -n kern.osversion) 49 [[ ${_kernel%#*} == "GENERIC.MP" ]] && 50 _s="-s @usr/share/relink/kernel/GENERIC/.*@@g" || 51 _s="-s @usr/share/relink/kernel/GENERIC.MP/.*@@g" 52 _files="$(tar -xvzphf ${_TMP}/syspatch${_patch}.tgz -C ${_edir} \ 53 ${_s})" || { rm -r ${_PDIR}/${_patch}; return 1; } 54 55 checkfs ${_files} 56 create_rollback ${_patch} "${_files}" 57 58 for _file in ${_files}; do 59 ((_rc == 0)) || break 60 [[ ${_file} == usr/sbin/syspatch ]] && _upself=true 61 install_file ${_edir}/${_file} /${_file} || _rc=$? 62 done 63 64 if ((_rc != 0)); then 65 err "Failed to apply patch ${_patch##${_OSrev}-}" 0 66 rollback_patch; return ${_rc} 67 fi 68 # don't fill up /tmp when installing multiple patches at once; non-fatal 69 rm -rf ${_edir} ${_TMP}/syspatch${_patch}.tgz 70 trap exit INT 71 72 echo ${_files} | grep -Eqv \ 73 '(^|[[:blank:]]+)usr/share/relink/kernel/GENERI(C|C.MP)/[[:print:]]+([[:blank:]]+|$)' || 74 _KARL=true 75 76 (! ${_upself} || err "updated itself, run it again to install \ 77missing patches" 2) 78} 79 80# quick-and-dirty filesystem status and size checks: 81# - assume old files are about the same size as new ones 82# - ignore new (nonexistent) files 83# - ignore rollback tarball: create_rollback() will handle the failure 84# - compute total size of all files per fs, simpler and less margin for error 85# (instead of computing before installing each file) 86checkfs() 87{ 88 local _d _dev _df _files="${@}" _sz 89 [[ -n ${_files} ]] 90 91 set +e # ignore errors due to: 92 # - nonexistent files (i.e. syspatch is installing new files) 93 # - broken interpolation due to bogus devices like remote filesystems 94 eval $(cd / && 95 stat -qf "_dev=\"\${_dev} %Sd\"; 96 local %Sd=\"\${%Sd:+\${%Sd}\+}%Uz\"" ${_files}) \ 97 2>/dev/null 98 set -e 99 100 for _d in $(printf '%s\n' ${_dev} | sort -u); do 101 [[ ${_d} != "??" ]] || err "Unsupported filesystem, aborting" 102 mount | grep -v read-only | grep -q "^/dev/${_d} " || 103 err "Read-only filesystem, aborting" 104 _df=$(df -Pk | grep "^/dev/${_d} " | tr -s ' ' | cut -d ' ' -f4) 105 _sz=$(($((_d))/1024)) 106 ((_df > _sz)) || err "No space left on ${_d}, aborting" 107 done 108} 109 110create_rollback() 111{ 112 # XXX annotate new files so we can remove them if we rollback? 113 local _file _patch=$1 _rbfiles _rc=0 114 [[ -n ${_patch} ]] 115 shift 116 local _files="${@}" 117 [[ -n ${_files} ]] 118 119 for _file in ${_files}; do 120 [[ -f /${_file} ]] && _rbfiles="${_rbfiles} ${_file}" 121 done 122 123 tar -C / -czf ${_PDIR}/${_patch}/rollback.tgz ${_rbfiles} || _rc=$? 124 125 if ((_rc != 0)); then 126 err "Failed to create rollback patch ${_patch##${_OSrev}-}" 0 127 rm -r ${_PDIR}/${_patch}; return ${_rc} 128 fi 129} 130 131fetch_and_verify() 132{ 133 local _tgz=$1 _title="Get/Verify" 134 [[ -n ${_tgz} ]] 135 136 [[ -t 0 ]] || echo "${_title} ${_tgz}" 137 unpriv -f "${_TMP}/${_tgz}" ftp -N syspatch -VD "${_title}" -o \ 138 "${_TMP}/${_tgz}" "${_MIRROR}/${_tgz}" 139 140 (cd ${_TMP} && sha256 -qC ${_TMP}/SHA256 ${_tgz}) 141} 142 143install_file() 144{ 145 # XXX handle hard link, dir->file, file->dir? 146 local _dst=$2 _fgrp _fmode _fown _src=$1 147 [[ -f ${_src} && -f ${_dst} ]] 148 149 if [[ -h ${_src} ]]; then 150 ln -sf $(readlink ${_src}) ${_dst} 151 else 152 eval $(stat -f "_fmode=%OMp%OLp _fown=%Su _fgrp=%Sg" ${_src}) 153 install -DFp -m ${_fmode} -o ${_fown} -g ${_fgrp} ${_src} \ 154 ${_dst} 155 fi 156} 157 158ls_installed() 159{ 160 local _p 161 for _p in ${_PDIR}/${_OSrev}-+([[:digit:]])_+([[:alnum:]_-]); do 162 [[ -f ${_p}/rollback.tgz ]] && echo ${_p##*/${_OSrev}-} 163 done 164} 165 166ls_missing() 167{ 168 local _c _f _cmd _l="$(ls_installed)" _p _sha=${_TMP}/SHA256 169 170 # don't output anything on stdout to prevent corrupting the patch list 171 unpriv -f "${_sha}.sig" ftp -N syspatch -MVo "${_sha}.sig" \ 172 "${_MIRROR}/SHA256.sig" >/dev/null 173 unpriv -f "${_sha}" signify -Veq -x ${_sha}.sig -m ${_sha} -p \ 174 /etc/signify/openbsd-${_OSrev}-syspatch.pub >/dev/null 175 176 # sig file less than 3 lines long doesn't list any patch (new release) 177 (($(grep -c ".*" ${_sha}.sig) < 3)) && return 178 179 set -o pipefail 180 grep -Eo "syspatch${_OSrev}-[[:digit:]]{3}_[[:alnum:]_-]+" ${_sha} | 181 while read _c; do _c=${_c##syspatch${_OSrev}-} && 182 [[ -n ${_l} ]] && echo ${_c} | grep -qw -- "${_l}" || echo ${_c} 183 done | while read _p; do 184 _cmd="ftp -N syspatch -MVo - \ 185 ${_MIRROR}/syspatch${_OSrev}-${_p}.tgz" 186 unpriv "${_cmd}" | tar tzf - | while read _f; do 187 # no earlier version of _all_ files contained in the tgz 188 # exists on the system, it means a missing set: skip it 189 [[ -f /${_f} ]] || continue && echo ${_p} && pkill -u \ 190 _syspatch -xf "${_cmd}" || true && break 191 done 192 done | sort -V # only used as a buffer to display all patches at once 193 set +o pipefail 194} 195 196rollback_patch() 197{ 198 local _edir _file _files _patch _rc=0 199 200 _patch="$(ls_installed | tail -1)" 201 [[ -n ${_patch} ]] || return 0 # nothing to rollback 202 203 _edir=${_TMP}/${_patch}-rollback 204 _patch=${_OSrev}-${_patch} 205 206 trap '' INT 207 echo "Reverting patch ${_patch##${_OSrev}-}" 208 install -d ${_edir} 209 210 _files="$(tar xvzphf ${_PDIR}/${_patch}/rollback.tgz -C ${_edir})" 211 checkfs ${_files} ${_PDIR} # check for read-only /var/syspatch 212 213 for _file in ${_files}; do 214 ((_rc == 0)) || break 215 install_file ${_edir}/${_file} /${_file} || _rc=$? 216 done 217 218 ((_rc != 0)) || rm -r ${_PDIR}/${_patch} || _rc=$? 219 ((_rc == 0)) || 220 err "Failed to revert patch ${_patch##${_OSrev}-}" ${_rc} 221 rm -rf ${_edir} # don't fill up /tmp when using `-R'; non-fatal 222 trap exit INT 223 224 echo ${_files} | grep -Eqv \ 225 '(^|[[:blank:]]+)usr/share/relink/kernel/GENERI(C|C.MP)/[[:print:]]+([[:blank:]]+|$)' || 226 _KARL=true 227} 228 229trap_handler() 230{ 231 set +e # we're trapped 232 rm -rf "${_TMP}" 233 234 # in case a patch added a new directory (install -D) 235 if [[ -n ${_PATCHES} ]]; then 236 mtree -qdef /etc/mtree/4.4BSD.dist -p / -U >/dev/null 237 [[ -f /var/sysmerge/xetc.tgz ]] && 238 mtree -qdef /etc/mtree/BSD.x11.dist -p / -U >/dev/null 239 fi 240 241 if ${_KARL}; then 242 echo -n "Relinking to create unique kernel..." 243 if /usr/libexec/reorder_kernel; then 244 echo " done; reboot to load the new kernel" 245 else 246 echo " failed!\n!!! \"/usr/libexec/reorder_kernel\" \ 247must be run manually to install the new kernel" 248 exit 1 249 fi 250 fi 251 252 ${_PATCH_APPLIED} && echo "Errata can be reviewed under ${_PDIR}" 253} 254 255unpriv() 256{ 257 local _file=$2 _rc=0 _user=_syspatch 258 259 if [[ $1 == -f && -n ${_file} ]]; then 260 >${_file} 261 chown "${_user}" "${_file}" 262 chmod 0711 ${_TMP} 263 shift 2 264 fi 265 (($# >= 1)) 266 267 eval su -s /bin/sh ${_user} -c "'$@'" || _rc=$? 268 269 [[ -n ${_file} ]] && chown root "${_file}" 270 271 return ${_rc} 272} 273 274# only run on release (not -current nor -stable) 275set -A _KERNV -- $(sysctl -n kern.version | 276 sed 's/^OpenBSD \([1-9][0-9]*\.[0-9]\)\([^ ]*\).*/\1 \2/;q') 277((${#_KERNV[*]} > 1)) && err "Unsupported release: ${_KERNV[0]}${_KERNV[1]}" 278 279[[ $@ == @(|-[[:alpha:]]) ]] || usage; [[ $@ == @(|-(c|R|r)) ]] && 280 (($(id -u) != 0)) && err "need root privileges" 281[[ $@ == @(|-(R|r)) ]] && pgrep -qxf '/bin/ksh .*reorder_kernel' && 282 err "cannot apply patches while reorder_kernel is running" 283 284_OSrev=${_KERNV[0]%.*}${_KERNV[0]#*.} 285[[ -n ${_OSrev} ]] 286 287_MIRROR=$(while read _line; do _line=${_line%%#*}; [[ -n ${_line} ]] && 288 print -r -- "${_line}"; done </etc/installurl | tail -1) 2>/dev/null 289[[ ${_MIRROR} == @(file|ftp|http|https)://* ]] || 290 _MIRROR=https://cdn.openbsd.org/pub/OpenBSD 291_MIRROR="${_MIRROR}/syspatch/${_KERNV[0]}/$(machine)" 292 293_PATCH_APPLIED=false 294_PDIR="/var/syspatch" 295_TMP=$(mktemp -d -p ${TMPDIR:-/tmp} syspatch.XXXXXXXXXX) 296_KARL=false 297 298readonly _KERNV _MIRROR _OSrev _PDIR _TMP 299 300trap 'trap_handler' EXIT 301trap exit HUP INT TERM 302 303while getopts clRr arg; do 304 case ${arg} in 305 c) ls_missing ;; 306 l) ls_installed ;; 307 R) while [[ -n $(ls_installed) ]]; do rollback_patch; done ;; 308 r) rollback_patch ;; 309 *) usage ;; 310 esac 311done 312shift $((OPTIND - 1)) 313(($# != 0)) && usage 314 315# default action: apply all patches 316if ((OPTIND == 1)); then 317 # remove non matching release /var/syspatch/ content 318 for _D in ${_PDIR}/{.[!.],}*; do 319 [[ -e ${_D} ]] || continue 320 [[ ${_D##*/} == ${_OSrev}-+([[:digit:]])_+([[:alnum:]_-]) ]] && 321 [[ -f ${_D}/rollback.tgz ]] || rm -r ${_D} 322 done 323 _PATCHES=$(ls_missing) # can't use errexit in a for loop 324 [[ -n ${_PATCHES} ]] || exit 2 325 for _PATCH in ${_PATCHES}; do 326 apply_patch ${_OSrev}-${_PATCH} 327 _PATCH_APPLIED=true 328 done 329fi 330