XEN/PVH - Sabotage Linux

Virtual disk

sparse file right below the 8589934591 bytes limit for tar and ustar formats: 8192 - 1 MiB

mkdir -p /data/guests/sabotage/lala/
cd /data/guests/sabotage/

dd if=/dev/zero of=sabotage.btrfs bs=1M count=0 seek=8191
dd if=/dev/zero of=sabotage.reiser4 bs=1M count=0 seek=8191

# --or-- even better, just one block of 4K behind
# 8589934591 - 4096
#dd if=/dev/zero of=sabotage.reiser4 bs=8589930496 count=0 seek=1

BTRFS

mkfs.btrfs sabotage.btrfs
mount -o compress=lzo sabotage.btrfs lala/

REISER4

mkfs.reiser4 --discard --force --yes sabotage.reiser4
mount sabotage.reiser4 lala/

EXT4

dd if=/dev/zero of=sabotage.ext4 bs=1M count=0 seek=8191
mkfs.ext4 sabotage.ext4
#dumpe2fs sabotage.ext4 | grep features
#tune2fs -O ^metadata_csum sabotage.ext4
mount sabotage.ext4 lala/

Deploy core/stage1 binaries

mkdir -p /data_local/kernels/sabotage/
cd /data_local/kernels/sabotage/

assuming you’ve got a valid rootfs tarball

wget https://lab.nethence.com/nunux/sabotage-chroot.tar.gz
tar xzSf /data/kernels/sabotage/sabotage-chroot.tar.gz
mv sabotage-chroot/* lala/
rmdir sabotage-chroot/

–or– grab latest available core/stage1 from upstream

# DE
mirror=http://ftp.barfooze.de/pub/sabotage/
# FR
mirror=http://mirrors.2f30.org/sabotage/

wget $mirror/sabotage-1.1.24-x86_64-rootfs-core-1f74666.tar.xz
tar xaf /data/kernels/sabotage/sabotage-1.1.24-x86_64-rootfs-core-1f74666.tar.xz
mv sabotage-rootfs-core-1f74666/rootfs/* lala/
ls -alF sabotage-rootfs-core-1f74666/rootfs/ # all gone
rm -rf sabotage-rootfs-core-1f74666/

shared

cp -pi lala/etc/fstab lala/etc/fstab.dist
vi lala/etc/fstab

/dev/xvda1 / btrfs defaults 0 1
#/dev/xvda1 / reiser4 defaults 0 1

rm -rf lala/etc/service/tty1/
rm -rf lala/etc/service/tty2/
rm -rf lala/etc/service/tty3/
rm -rf lala/etc/service/tty4/
mv lala/etc/service/ttyS0/ lala/etc/service/hvc0/
sed -i 's/ttyS0/hvc0/g' lala/etc/service/hvc0/run

rm -rf lala/etc/service/wpa_supplicant/
rm -rf lala/opt/wpa-supplicant/

assuming some XEN DomU-capable kernel in da place. otherwise grab our kernel builds.

mkdir lala/lib/modules/
tar xzf /data/kernels/5.2.21.domureiser4.modules.tar.gz -C lala/lib/modules/

cp -pi lala/etc/rc.boot lala/etc/rc.boot.dist
chmod -x lala/etc/rc.boot.dist
vi lala/etc/rc.boot

(remove that hotplug thing line 22)
(remove call to hwclock)
(get rid of the `/tmp/` write-test condition right after rw=true)

cp -pi lala/etc/rc.shutdown lala/etc/rc.shutdown.dist
chmod -x lala/etc/rc.shutdown.dist
vi lala/etc/rc.shutdown

(remove the hwclock call from there also)

ls -lF lala/etc/rc.modules # no exist
echo modprobe tmem > lala/etc/rc.modules
chmod +x lala/etc/rc.modules

cp -pi lala/etc/rc.local lala/etc/rc.local.dist
chmod -x lala/etc/rc.local.dist
vi lala/etc/rc.local

    do_static_ip=true

    if=eth0
    ip=10.1.1.9
    nm=255.255.255.0
    gw=10.1.1.254

mv lala/etc/resolv.conf lala/etc/resolv.conf.dist
vi lala/etc/resolv.conf

nameserver 208.67.222.220
nameserver 208.67.222.222

    cp -pi lala/etc/profile lala/etc/profile.dist
    vi lala/etc/profile

    TZ="Europe/Moscow"
    #TZ="Europe/Paris"

case "$-" in *i*)
    alias ls='ls --group-directories-first --color=auto'
    alias ll='ls --group-directories-first --color=auto -alh'
    alias cp='cp -i'
    alias mv='mv -i'
    alias rm='rm -i'
    ;;
esac

du -sh lala/
# v1.1.19 ext4 174M
# v1.1.19 reiser4 454M
# v1.1.24 ext4 293M
# v1.1.24 reiser4 789M
# v1.1.24 btrfs 328M

rm -f lala/root/.ash_history

default password is sabotage but that’s already too complicated to remember

ls -lhF lala/etc/shadow
cp -pi lala/etc/shadow lala/etc/shadow.dist
chroot lala/ passwd -d root
diff -bu lala/etc/shadow.dist lala/etc/shadow

enable that alternative SSH daemon at boot-time

cat lala/var/service/dropbear/run # note that's RSA and DSS host keys
ls -lF lala/var/service/dropbear/down
rm -f lala/var/service/dropbear/down

and you’re done

umount lala/
rmdir lala/

Guest skeleton

assuming a domU kernel, as stated above

ls -lhF /data/kernels/5.2.21.domureiser4.vmlinuz
vi sabotage

kernel = "/data/kernels/5.2.21.domureiser4.vmlinuz"
root = "/dev/xvda1 ro console=hvc0 mitigations=off"
#extra = "init=/bin/mksh"
name = "sabotage"
vcpus = 2
memory = 1024
disk = ['tap:tapdisk:aio:/data/guests/sabotage/sabotage.btrfs,xvda1,w']
#disk = ['tap:tapdisk:aio:/data/guests/sabotage/sabotage.reiser4,xvda1,w']
vif = [ 'bridge=guestbr0, vifname=sabotage0',
    'bridge=guestbr0, vifname=sabotage1' ]
type = "pvh"

xl create sabotage -c

lsmod | grep tmem
free -m

# used 59

System preparation

post-installation

check connection

ping -c3 opendns.com

install a few packages

butch search htop
butch install htop

#butch search ksh
#butch install mksh
#ln -s mksh /bin/ksh

and eventually further tune your environment and MKSH shell

Template-ready

eventually make a template out of it

sync
rm -f .ash_history
^]

xl shu sabotage
cd ../
newtemplate.bash sabotage

Additional notes

just a chroot

in case you just want a chroot instead of a XEN guest

mkdir lala/
mount saboage.ext4 lala/
    mount -o bind /dev/ lala/dev/
    mount -o bind /dev/pts/ lala/dev/pts/
    mount -o bind /proc/ lala/proc/
    mount -o bind /sys/ lala/sys/
chroot lala/ /bin/mksh

and once you’re done

umount -R lala/

read-only boot

eventually mount the system read-write

mount
mount -o remount,rw /
#-n

openssh

enable some service

butch-install-service openssh /var/service/openssh/run
rm -f /var/service/openssh/down

generate some host keys otherwise the daemon won’t start

ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "root@sabotage" -N ""

TODO

check the weird timezone format
add reiser4tools for fsck to work

Additional notes

To create a user, it’s a bit specific.

adduser -s /bin/sh -G GROUPNAME -D USERNAME
# -D              Don't assign a password
chmod 700 /home/USERNAME/

Troubleshooting

/etc/rc.boot: line 23: can't create /proc/sys/kernel/hotplug: nonexistent directory

==> comment that one out

/etc/ssh/sshd_config line 6: Deprecated option UsePrivilegeSeparation

==> remove that line

Deprecated

Subsystem sftp /opt/openssh/lib/ssh/sftp-server

Resources

XEN/PVH - Sabotage Linux

Virtual disk

Deploy core/stage1 binaries

Guest skeleton

System preparation

Template-ready

Additional notes

just a chroot

read-only boot

openssh

TODO

Additional notes

Troubleshooting

Deprecated

Resources

home page

news

code repos

download

misc

history