[Devil-linux-commit] build/config/etc/initrd linuxrc, 1.70.2.18, 1.70.2.19

[Heiko Z. <smi...@us...>]

Update of /cvsroot/devil-linux/build/config/etc/initrd
In directory sc8-pr-cvs12.sourceforge.net:/tmp/cvs-serv14627/config/etc/initrd

Modified Files:
      Tag: rel-1-2-patches
	linuxrc 
Log Message:
- updated acl_2.2.47-1
- updated attr_2.4.41
- updated bzip2-1.0.5
- updated lm_sensors-2.10.6
- updated dovecot-1.0.13
- updated openssh-5.0p1
- updated shorewall-shell-4.0.10
- updated nagios-3.0.1
- updated nagios-plugins-1.4.11
- updated nrpe-2.12
- updated nsca-2.7.2
- updated postgresql-8.3.1
- updated rsync-3.0.2
- updated smartmontools-5.38
- updated tar-1.20
- updated wget-1.11.2
- updated nagios-plugin-pgsql_include_for_8.3
- updated linux-2.4.36.4
- updated pax-linux-2.4.36.4-test1
- updated bridge-utils-1.4
- updated cyrus-imapd-2.3.12p2
- updated device-mapper.1.02.25
- updated gnupg-1.4.9
- updated krb5-1.6.3
- updated libpcap-0.9.8
- updated libpng-1.2.29
- updated lzo-2.03
- updated nmap-4.62
- updated openldap-2.4.9
- updated pcre-7.7
- updated samba-3.0.28a
- updated snort-2.8.1
- updated squid-3.0.STABLE5
- updated tcpdump-3.9.8
- updated xfsprogs_2.9.8-1
- updated open-vm-tools-2008.04.14-87182
- updated grsecurity-2.1.12-2.4.36.4-200805181025
- updated libxml2-2.6.30
- updated libxslt-1.1.24
- updated nut-2.2.2
- updated p7zip_4.57-libun7zip
- updated p7zip_4.57_src_all
- updated php-5.2.6
- updated scponly-20080308
- updated shorewall-perl-4.0.10.1
- updated shorewall-common-4.0.10.1
- updated sudo-1.6.9p16
- updated stunnel-4.24
- updated e2fsprogs-1.40.8


Index: linuxrc
===================================================================
RCS file: /cvsroot/devil-linux/build/config/etc/initrd/linuxrc,v
retrieving revision 1.70.2.18
retrieving revision 1.70.2.19
diff -u -d -r1.70.2.18 -r1.70.2.19
--- linuxrc	28 Feb 2007 20:04:29 -0000	1.70.2.18
+++ linuxrc	30 May 2008 15:00:39 -0000	1.70.2.19
@@ -13,7 +13,7 @@
 #   - starts up the real system
 #
 
-export PATH=$PATH:/sbin:/usr/sbin:/
+export PATH=$PATH:/sbin:/usr/sbin:/:/floppy
 
 # include our color definitions
 . colordefs
@@ -176,6 +176,20 @@
         return 1
 }
 
+load_failsafe_config()
+{
+	echo "Removing current configuration."		
+	mount -n -t auto -o remount,rw $DL_CONFIG_SOURCE /floppy
+	mv /floppy/$DL_CONFIG_FILE /floppy/BAD.$DL_CONFIG_FILE
+	# this part stops the system from loading the untrusted config
+	# the idea was to reboot the system, but I didn't figure out how to do that
+	# neither of the commands shutdown, halt nor exit work, so, it's just looping...
+	echo "System halted. After manual reboot, failsafe.etc.tar.bz2 will be loaded."
+	while [ 1 -gt 0 ]; do
+		false;
+	done
+}
+
 # make sure all kernel warnings get lost (seriously!)
 klogd -c 1
 
@@ -228,71 +242,105 @@
 CONFIG_SRC_LIST="$PARTITIONS_SCSI $PARTITIONS_IDE $DISCS_SCSI $CDROM_IDE $CDROM_SCSI $FLOPPIES"
 CONFIG_FILE="etc.tar.bz2"
 
-# search for configuration information
-DL_CONFIG_SOURCE=""
-DL_CONFIG_FILE=""
-until [ "$DL_CONFIG_SOURCE" != "" ] ; do
-	if [ "$CONFIG_USER" != "" ]; then
-		parse_config_cmdline $CONFIG_USER && continue
-	fi
-	if [ "$CONFIG_USER_ONLY" = "0" ]; then
-		# scan for etc.tar.bz2 on all devices
-		scan_devices_for_config $CONFIG_FILE $CONFIG_SRC_LIST && continue
+
+LOAD_FAILSAFE_CONFIG="no"
+
+# search for BAD.etc.tar.bz2
+CONFIG_FILE="BAD.etc.tar.bz2"
+if [ "$CONFIG_USER_ONLY" = "0" ]; then
+	# scan for BAD.etc.tar.bz2 on all devices
+	if scan_devices_for_config $CONFIG_FILE $CONFIG_SRC_LIST ; then
+		$RED
+		echo "----------BAD CONFIG FOUND-----------"
+		$NORMAL
+		LOAD_FAILSAFE_CONFIG="yes"
+	else
+		$GREEN
+		echo "No bad config found!"
+		$NORMAL
+		CONFIG_FILE="etc.tar.bz2"
 	fi
+fi
 
-	# no configuration has been found yet
-	for CFG_SRC in $CONFIG_SRC_LIST
-	do
-		echo -e "Looking for empty configuation media on $CFG_SRC"
-		if mount -n -t auto $CFG_SRC /floppy >/dev/null 2>&1 ; then
-			umount /floppy # in case user swaps floppy when we are accepting input
-			# offer to copy the configuration file if device is not a CD
-			if [ ! "${CFG_SRC##/*/}" = "cd" ];then
-				beep
-				$YELLOW
-				echo -e "\n*** Found empty configuration media - $CFG_SRC. ***"
-				$NORMAL
-				echo -n "Should I copy default configuration to it?"
-				if ask_yes_no ; then
-					echo -n "Would you like to probe for SCSI controllers now?"
+
+
+
+
+# only search for configuration if no bad tarball was found
+if [ "$LOAD_FAILSAFE_CONFIG" != "yes" ] ; then
+
+	# search for configuration information
+	DL_CONFIG_SOURCE=""
+	DL_CONFIG_FILE=""
+
+	until [ "$DL_CONFIG_SOURCE" != "" ] ; do
+		if [ "$CONFIG_USER" != "" ]; then
+			parse_config_cmdline $CONFIG_USER && continue
+		fi
+		if [ "$CONFIG_USER_ONLY" = "0" ]; then
+			# scan for etc.tar.bz2 on all devices
+			scan_devices_for_config $CONFIG_FILE $CONFIG_SRC_LIST && continue
+		fi
+	
+		# no configuration has been found yet
+		for CFG_SRC in $CONFIG_SRC_LIST
+		do
+			echo -e "Looking for empty configuation media on $CFG_SRC"
+			if mount -n -t auto $CFG_SRC /floppy >/dev/null 2>&1 ; then
+				umount /floppy # in case user swaps floppy when we are accepting input
+				# offer to copy the configuration file if device is not a CD
+				if [ ! "${CFG_SRC##/*/}" = "cd" ];then
+					beep
+					$YELLOW
+					echo -e "\n*** Found empty configuration media - $CFG_SRC. ***"
+					$NORMAL
+					echo -n "Should I copy default configuration to it?"
 					if ask_yes_no ; then
-						/probe_all_scsi_modules
-					fi
-					if ! /mount_cdrom /cdrom -noreboot ; then
-						$RED
-						echo -e "Cannot find CD drive - try probing for SCSI controllers"
-						$NORMAL
-						continue
+						echo -n "Would you like to probe for SCSI controllers now?"
+						if ask_yes_no ; then
+							/probe_all_scsi_modules
+						fi
+						if ! /mount_cdrom /cdrom -noreboot ; then
+							$RED
+							echo -e "Cannot find CD drive - try probing for SCSI controllers"
+							$NORMAL
+							continue
+						fi
+						mount -n -t auto $CFG_SRC /floppy >/dev/null 2>&1 || continue
+						cp -i /cdrom/config/etc.tar.bz2 /floppy/ || continue
+						umount /cdrom
+						sync
+						DL_CONFIG_SOURCE=$CFG_SRC
+						DL_CONFIG_FILE="etc.tar.bz2"
+						continue 2
+
+
 					fi
-					mount -n -t auto $CFG_SRC /floppy >/dev/null 2>&1 || continue
-					cp -i /cdrom/config/etc.tar.bz2 /floppy/ || continue
-					umount /cdrom
-					sync
-					DL_CONFIG_SOURCE=$CFG_SRC
-					DL_CONFIG_FILE="etc.tar.bz2"
-					continue 2
 				fi
 			fi
+		done
+	
+		beep 3
+		$RED
+		echo -e "Would you really like to load DL without Configuration Media?"	
+		$NORMAL
+		if ask_yes_no ; then
+			REALLY_LIVE=1
+			DL_CONFIG_SOURCE=/dev/null
+			DL_CONFIG_FILE="etc.tar.bz2"
+			export REALLY_LIVE 
+			continue 2
+		else
+			echo -e "Please insert Configuration Media and press 'ENTER'"	
+			read ANS	
 		fi
+		echo
 	done
+	unset ANS RET
+fi
+
+
 
-	beep 3
-	$RED
-	echo -e "Would you really like to load DL without Configuration Media?"	
-	$NORMAL
-	if ask_yes_no ; then
-	    REALLY_LIVE=1
-	    DL_CONFIG_SOURCE=/dev/null
-	    DL_CONFIG_FILE="etc.tar.bz2"
-	    export REALLY_LIVE 
-	    continue 2
-	else
-	    echo -e "Please insert Configuration Media and press 'ENTER'"	
-	    read ANS	
-	fi
-	echo
-done
-unset ANS RET
 
 echo $DL_CONFIG_SOURCE > /shm/DL_CONFIG_SOURCE
 echo $DL_CONFIG_FILE > /shm/DL_CONFIG_FILE
@@ -301,13 +349,19 @@
 
 mkdir -p /shm/root
 
+
 echo "Loading configuration"
+
+
+
 if [ "$REALLY_LIVE" = "1" ] ; then
     # check to see if cdrom has already been mounted
+
     if [ ! -e /cdrom/DEVIL-LINUX ] ; then
         # find the CDROM
         /mount_cdrom /cdrom
     fi
+
     tar -C /shm -xjf /cdrom/config/etc.tar.bz2
     #
     # we unmount here to be able to possibly activate run from ram
@@ -326,9 +380,31 @@
     #         the cd/image twice which is quite ugly (fl)
     #
 else 
-    tar -C /shm -xjf /floppy/$DL_CONFIG_FILE
+	if [ "$LOAD_FAILSAFE_CONFIG" != "yes" ] ; then
+		tar -C /shm -xjf /floppy/$DL_CONFIG_FILE
+	else
+		if [ ! -e /cdrom/DEVIL-LINUX ] ; then
+			# find the CDROM
+			/mount_cdrom /cdrom
+		fi
+		
+		if [ -e /cd/failsafe.etc.tar.bz2 ] ; then
+			tar -C /shm -xjf /cd/failsafe.etc.tar.bz2
+			$YELLOW
+			echo "Failsafe configuration loaded."
+			$NORMAL
+		else
+			$RED
+			echo "System halted. After a corrupted config-file had been detected during boot-up, no failsafe-config was found. Create a failsafe-config named \"failsafe.etc.tar.bz2\" on your boot-device."
+			$NORMAL
+			while [ 1 -gt 0 ]; do
+				false;
+			done
+		fi
+	fi
 fi
 
+
 # create mtab for mount
 cat /proc/mounts > /etc/mtab
 
@@ -337,39 +413,92 @@
 
 # check to see if cdrom has already been mounted
 if [ ! -e /cdrom/DEVIL-LINUX ] ; then
+
     # find the CDROM
     /mount_cdrom /cdrom
 fi
 
-DL_DEVICE=$(cat /shm/DL_DEVICE)
-export DL_DEVICE
 
-if [ -f /cdrom/config/pubring.gpg ]; then
-	$YELLOW
-	echo "checking PGP signature of configuration"
-	$NORMAL
-	if ! /bin/gpgv --homedir /cdrom/config --keyring /cdrom/config/pubring.gpg --ignore-time-conflict -q /floppy/$DL_CONFIG_FILE.sig ;then
-		$RED
-		echo
-		echo "********************************************************************************"
-		echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
-		echo "*                                                                              *"
-		echo "*           The verification of the configuration signature failed !           *"
-		echo "*                                                                              *"
-		echo "*   There is a strong possibility that somebody tempered with your system !    *"
-		echo "*                                                                              *"
-		echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
-		echo "********************************************************************************"
-		beep 6
-		$NORMAL
-		echo
-		echo -n "Do you want to continue? "
-		if ! ask_yes_no ; then
-			exit
-		fi
+
+if [ "$LOAD_FAILSAFE_CONFIG" != "yes" ] ; then
+
+	# check if pubring is either on CD-ROM or on USB
+	if [ -f /cd/pubring.gpg ] ; then
+		DL_CONFIG_PUBRING="/cd/pubring.gpg"
+	elif [ -f /cdrom/config/pubring.gpg ] ; then
+		DL_CONFIG_PUBRING="/cdrom/config/pubring.gpg"
+	else
+		DL_CONFIG_PUBRING=""
 	fi
+
+	if [ "$DL_CONFIG_PUBRING" != "" ] ; then
+
+		echo -n "Checking PGP signature of configuration..."
+
+		CURRENT_DIRECTORY=`pwd`
+		cd /floppy
+		if md5sum -c $DL_CONFIG_FILE.md5 ; then
+			cd $CURRENT_DIRECTORY
+			$YELLOW
+			echo "MD5-Sum checked successfully."
+			$NORMAL
+		
+			if /bin/gpgv --keyring $DL_CONFIG_PUBRING --ignore-time-conflict -q /floppy/$DL_CONFIG_FILE.md5.sig ; then
+				$GREEN
+				echo "SUCCESS!!"
+				$NORMAL
+			else
+				$RED
+				echo "GPG-Signature not verified."
+				echo
+				echo "********************************************************************************"
+				echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
+				echo "*                                                                              *"
+				echo "*           The signature of the configuration is not trustworthy !            *"
+				echo "*                                                                              *"
+				echo "*   There is a strong possibility that somebody tempered with your system !    *"
+				echo "*                                                                              *"
+				echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
+				echo "********************************************************************************"
+				beep 6
+				load_failsafe_config
+			fi
+		
+		else
+			cd $CURRENT_DIRECTORY
+			$RED
+			echo
+			echo "********************************************************************************"
+			echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
+			echo "*                                                                              *"
+			echo "*           The MD5-Checksum does not match the configuration !                *"
+			echo "*                                                                              *"
+			echo "*   There is a strong possibility that somebody tempered with your system !    *"
+			echo "*                                                                              *"
+			echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
+			echo "********************************************************************************"
+			beep 6
+			load_failsafe_config
+		fi	
+
+	fi
+
+else
+	$RED
+	echo
+	echo "********************************************************************************"
+	echo "*                           !!! WARNING !!!                                    *"
+	echo "*                                                                              *"
+	echo "*                   System running on FAILSAFE CONFIGURATION!                  *"
+	echo "*                  Please check your configuration immediately!                *"
+	echo "*                                                                              *"
+	echo "*      !!!  WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!!        *"
+	echo "********************************************************************************"
+	beep 6
 fi
 
+
+
 # unmount config media
 if [ "$REALLY_LIVE" != "1" ] ; then
     umount /floppy