1#!/bin/ksh
2#
3# $OpenBSD: syspatch.sh,v 1.168 2023/12/13 17:50:23 ajacoutot Exp $
4#
5# Copyright (c) 2016, 2017 Antoine Jacoutot <ajacoutot@openbsd.org>
6#
7# Permission to use, copy, modify, and distribute this software for any
8# purpose with or without fee is hereby granted, provided that the above
9# copyright notice and this permission notice appear in all copies.
10#
11# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19set -e
20umask 0022
21export PATH=/usr/bin:/bin:/usr/sbin:/sbin
22
23err()
24{
25	echo "${0##*/}: ${1}" 1>&2
26	return ${2:-1}
27}
28
29usage()
30{
31	echo "usage: ${0##*/} [-c | -l | -R | -r]" 1>&2
32	return 1
33}
34
35apply_patch()
36{
37	local _edir _file _files _kernel _patch=$1 _rc=0 _s _upself=false
38	[[ -n ${_patch} ]]
39
40	_edir=${_TMP}/${_patch}
41
42	fetch_and_verify "syspatch${_patch}.tgz"
43
44	trap '' INT
45	echo "Installing patch ${_patch##${_OSrev}-}"
46	install -d ${_edir} ${_PDIR}/${_patch}
47
48	_kernel=$(sysctl -n kern.osversion)
49	[[ ${_kernel%#*} == "GENERIC.MP" ]] &&
50		_s="-s @usr/share/relink/kernel/GENERIC/.*@@g" ||
51		_s="-s @usr/share/relink/kernel/GENERIC.MP/.*@@g"
52	_files="$(tar -xvzphf ${_TMP}/syspatch${_patch}.tgz -C ${_edir} \
53		${_s})" || { rm -r ${_PDIR}/${_patch}; return 1; }
54
55	checkfs ${_files}
56	create_rollback ${_patch} "${_files}"
57
58	for _file in ${_files}; do
59		((_rc == 0)) || break
60		[[ ${_file} == usr/sbin/syspatch ]] && _upself=true
61		install_file ${_edir}/${_file} /${_file} || _rc=$?
62	done
63
64	if ((_rc != 0)); then
65		err "Failed to apply patch ${_patch##${_OSrev}-}" 0
66		rollback_patch; return ${_rc}
67	fi
68	# don't fill up /tmp when installing multiple patches at once; non-fatal
69	rm -rf ${_edir} ${_TMP}/syspatch${_patch}.tgz
70	trap exit INT
71
72	echo ${_files} | grep -Eqv \
73		'(^|[[:blank:]]+)usr/share/relink/kernel/GENERI(C|C.MP)/[[:print:]]+([[:blank:]]+|$)' ||
74		_KARL=true
75
76	(! ${_upself} || err "updated itself, run it again to install \
77missing patches" 2)
78}
79
80# quick-and-dirty filesystem status and size checks:
81# - assume old files are about the same size as new ones
82# - ignore new (nonexistent) files
83# - ignore rollback tarball: create_rollback() will handle the failure
84# - compute total size of all files per fs, simpler and less margin for error
85#   (instead of computing before installing each file)
86checkfs()
87{
88	local _d _dev _df _files="${@}" _sz
89	[[ -n ${_files} ]]
90
91	set +e # ignore errors due to:
92	# - nonexistent files (i.e. syspatch is installing new files)
93	# - broken interpolation due to bogus devices like remote filesystems
94	eval $(cd / &&
95		stat -qf "_dev=\"\${_dev} %Sd\";
96			local %Sd=\"\${%Sd:+\${%Sd}\+}%Uz\"" ${_files}) \
97			2>/dev/null
98	set -e
99
100	for _d in $(printf '%s\n' ${_dev} | sort -u); do
101		[[ ${_d} != "??" ]] || err "Unsupported filesystem, aborting"
102		mount | grep -v read-only | grep -q "^/dev/${_d} " ||
103			err "Read-only filesystem, aborting"
104		_df=$(df -Pk | grep "^/dev/${_d} " | tr -s ' ' | cut -d ' ' -f4)
105		_sz=$(($((_d))/1024))
106		((_df > _sz)) || err "No space left on ${_d}, aborting"
107	done
108}
109
110create_rollback()
111{
112	# XXX annotate new files so we can remove them if we rollback?
113	local _file _patch=$1 _rbfiles _rc=0
114	[[ -n ${_patch} ]]
115	shift
116	local _files="${@}"
117	[[ -n ${_files} ]]
118
119	for _file in ${_files}; do
120		[[ -f /${_file} ]] && _rbfiles="${_rbfiles} ${_file}"
121	done
122
123	tar -C / -czf ${_PDIR}/${_patch}/rollback.tgz ${_rbfiles} || _rc=$?
124
125	if ((_rc != 0)); then
126		err "Failed to create rollback patch ${_patch##${_OSrev}-}" 0
127		rm -r ${_PDIR}/${_patch}; return ${_rc}
128	fi
129}
130
131fetch_and_verify()
132{
133	local _tgz=$1 _title="Get/Verify"
134	[[ -n ${_tgz} ]]
135
136	[[ -t 0 ]] || echo "${_title} ${_tgz}"
137	unpriv -f "${_TMP}/${_tgz}" ftp -N syspatch -VD "${_title}" -o \
138		"${_TMP}/${_tgz}" "${_MIRROR}/${_tgz}"
139
140	(cd ${_TMP} && sha256 -qC ${_TMP}/SHA256 ${_tgz})
141}
142
143install_file()
144{
145	# XXX handle hard link, dir->file, file->dir?
146	local _dst=$2 _fgrp _fmode _fown _src=$1
147	[[ -f ${_src} && -f ${_dst} ]]
148
149	if [[ -h ${_src} ]]; then
150		ln -sf $(readlink ${_src}) ${_dst}
151	else
152		eval $(stat -f "_fmode=%OMp%OLp _fown=%Su _fgrp=%Sg" ${_src})
153		install -DFp -m ${_fmode} -o ${_fown} -g ${_fgrp} ${_src} \
154			${_dst}
155	fi
156}
157
158ls_installed()
159{
160	local _p
161	for _p in ${_PDIR}/${_OSrev}-+([[:digit:]])_+([[:alnum:]_-]); do
162		[[ -f ${_p}/rollback.tgz ]] && echo ${_p##*/${_OSrev}-}
163	done
164}
165
166ls_missing()
167{
168	local _c _f _cmd _l="$(ls_installed)" _p _sha=${_TMP}/SHA256
169
170	# don't output anything on stdout to prevent corrupting the patch list
171	unpriv -f "${_sha}.sig" ftp -N syspatch -MVo "${_sha}.sig" \
172		"${_MIRROR}/SHA256.sig" >/dev/null
173	unpriv -f "${_sha}" signify -Veq -x ${_sha}.sig -m ${_sha} -p \
174		/etc/signify/openbsd-${_OSrev}-syspatch.pub >/dev/null
175
176	# sig file less than 3 lines long doesn't list any patch (new release)
177	(($(grep -c ".*" ${_sha}.sig) < 3)) && return
178
179	set -o pipefail
180	grep -Eo "syspatch${_OSrev}-[[:digit:]]{3}_[[:alnum:]_-]+" ${_sha} |
181		while read _c; do _c=${_c##syspatch${_OSrev}-} &&
182		[[ -n ${_l} ]] && echo ${_c} | grep -qw -- "${_l}" || echo ${_c}
183	done | while read _p; do
184		_cmd="ftp -N syspatch -MVo - \
185			${_MIRROR}/syspatch${_OSrev}-${_p}.tgz"
186		unpriv "${_cmd}" | tar tzf - | while read _f; do
187			# no earlier version of _all_ files contained in the tgz
188			# exists on the system, it means a missing set: skip it
189			[[ -f /${_f} ]] || continue && echo ${_p} && pkill -u \
190				_syspatch -xf "${_cmd}" || true && break
191		done
192	done | sort -V # only used as a buffer to display all patches at once
193	set +o pipefail
194}
195
196rollback_patch()
197{
198	local _edir _file _files _patch _rc=0
199
200	_patch="$(ls_installed | tail -1)"
201	[[ -n ${_patch} ]] || return 0 # nothing to rollback
202
203	_edir=${_TMP}/${_patch}-rollback
204	_patch=${_OSrev}-${_patch}
205
206	trap '' INT
207	echo "Reverting patch ${_patch##${_OSrev}-}"
208	install -d ${_edir}
209
210	_files="$(tar xvzphf ${_PDIR}/${_patch}/rollback.tgz -C ${_edir})"
211	checkfs ${_files} ${_PDIR} # check for read-only /var/syspatch
212
213	for _file in ${_files}; do
214		((_rc == 0)) || break
215		install_file ${_edir}/${_file} /${_file} || _rc=$?
216	done
217
218	((_rc != 0)) || rm -r ${_PDIR}/${_patch} || _rc=$?
219	((_rc == 0)) ||
220		err "Failed to revert patch ${_patch##${_OSrev}-}" ${_rc}
221	rm -rf ${_edir} # don't fill up /tmp when using `-R'; non-fatal
222	trap exit INT
223
224	echo ${_files} | grep -Eqv \
225		'(^|[[:blank:]]+)usr/share/relink/kernel/GENERI(C|C.MP)/[[:print:]]+([[:blank:]]+|$)' ||
226		_KARL=true
227}
228
229trap_handler()
230{
231	set +e # we're trapped
232	rm -rf "${_TMP}"
233
234	# in case a patch added a new directory (install -D)
235	if [[ -n ${_PATCHES} ]]; then
236		mtree -qdef /etc/mtree/4.4BSD.dist -p / -U >/dev/null
237		[[ -f /var/sysmerge/xetc.tgz ]] &&
238			mtree -qdef /etc/mtree/BSD.x11.dist -p / -U >/dev/null
239	fi
240
241	if ${_KARL}; then
242		echo -n "Relinking to create unique kernel..."
243		if /usr/libexec/reorder_kernel; then
244			echo " done; reboot to load the new kernel"
245		else
246			echo " failed!\n!!! \"/usr/libexec/reorder_kernel\" \
247must be run manually to install the new kernel"
248			exit 1
249		fi
250	fi
251
252	${_PATCH_APPLIED} && echo "Errata can be reviewed under ${_PDIR}"
253}
254
255unpriv()
256{
257	local _file=$2 _rc=0 _user=_syspatch
258
259	if [[ $1 == -f && -n ${_file} ]]; then
260		>${_file}
261		chown "${_user}" "${_file}"
262		chmod 0711 ${_TMP}
263		shift 2
264	fi
265	(($# >= 1))
266
267	eval su -s /bin/sh ${_user} -c "'$@'" || _rc=$?
268
269	[[ -n ${_file} ]] && chown root "${_file}"
270
271	return ${_rc}
272}
273
274# only run on release (not -current nor -stable)
275set -A _KERNV -- $(sysctl -n kern.version |
276	sed 's/^OpenBSD \([1-9][0-9]*\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
277((${#_KERNV[*]} > 1)) && err "Unsupported release: ${_KERNV[0]}${_KERNV[1]}"
278
279[[ $@ == @(|-[[:alpha:]]) ]] || usage; [[ $@ == @(|-(c|R|r)) ]] &&
280	(($(id -u) != 0)) && err "need root privileges"
281[[ $@ == @(|-(R|r)) ]] && pgrep -qxf '/bin/ksh .*reorder_kernel' &&
282	err "cannot apply patches while reorder_kernel is running"
283
284_OSrev=${_KERNV[0]%.*}${_KERNV[0]#*.}
285[[ -n ${_OSrev} ]]
286
287_MIRROR=$(while read _line; do _line=${_line%%#*}; [[ -n ${_line} ]] &&
288	print -r -- "${_line}"; done </etc/installurl | tail -1) 2>/dev/null
289[[ ${_MIRROR} == @(file|ftp|http|https)://* ]] ||
290	_MIRROR=https://cdn.openbsd.org/pub/OpenBSD
291_MIRROR="${_MIRROR}/syspatch/${_KERNV[0]}/$(machine)"
292
293_PATCH_APPLIED=false
294_PDIR="/var/syspatch"
295_TMP=$(mktemp -d -p ${TMPDIR:-/tmp} syspatch.XXXXXXXXXX)
296_KARL=false
297
298readonly _KERNV _MIRROR _OSrev _PDIR _TMP
299
300trap 'trap_handler' EXIT
301trap exit HUP INT TERM
302
303while getopts clRr arg; do
304	case ${arg} in
305		c) ls_missing ;;
306		l) ls_installed ;;
307		R) while [[ -n $(ls_installed) ]]; do rollback_patch; done ;;
308		r) rollback_patch ;;
309		*) usage ;;
310	esac
311done
312shift $((OPTIND - 1))
313(($# != 0)) && usage
314
315# default action: apply all patches
316if ((OPTIND == 1)); then
317	# remove non matching release /var/syspatch/ content
318	for _D in ${_PDIR}/{.[!.],}*; do
319		[[ -e ${_D} ]] || continue
320		[[ ${_D##*/} == ${_OSrev}-+([[:digit:]])_+([[:alnum:]_-]) ]] &&
321			[[ -f ${_D}/rollback.tgz ]] || rm -r ${_D}
322	done
323	_PATCHES=$(ls_missing) # can't use errexit in a for loop
324	[[ -n ${_PATCHES} ]] || exit 2
325	for _PATCH in ${_PATCHES}; do
326		apply_patch ${_OSrev}-${_PATCH}
327		_PATCH_APPLIED=true
328	done
329fi
330