XEN/PVH - Sabotage Linux

sabotage | build chroot | docker image | pkg build | xen guest

tested on slack150

Virtual disk

sparse file right below the 8589934591 bytes limit for tar and ustar formats: 8192 - 1 MiB

mkdir -p /data/guests/sabotage/lala/
cd /data/guests/sabotage/

casual sparse-vdisk

dd if=/dev/zero of=sabotage.btrfs bs=1M count=0 seek=8191
dd if=/dev/zero of=sabotage.reiser4 bs=1M count=0 seek=8191

# --or-- even better, just one block of 4K behind
# 8589934591 - 4096
#dd if=/dev/zero of=sabotage.reiser4 bs=8589930496 count=0 seek=1

# btrfs
mkfs.btrfs sabotage.btrfs
mount -o compress=lzo sabotage.btrfs lala/

# reiser4
mkfs.reiser4 --discard --force --yes sabotage.reiser4
mount sabotage.reiser4 lala/

# ext4
dd if=/dev/zero of=sabotage.ext4 bs=1M count=0 seek=8191
mkfs.ext4 sabotage.ext4
#dumpe2fs sabotage.ext4 | grep features
#tune2fs -O ^metadata_csum sabotage.ext4

dnc-based

guest=sabotage-feb-2024

dnc-list-slots.bash
dnc-new-resource-template.bash pmr3 pmr1 SLOT-HERE $guest

#mkfs.ext4 /dev/drbd/by-res/$guest/0
mkfs.reiser4 --discard --yes /dev/drbd/by-res/$guest/0

ready

mount sabotage.reiser4 lala/
mount /dev/drbd/by-res/$guest/0 lala/

Deploy core/stage1 binaries

assuming you’ve got a rootfs tarball already

mkdir -p /data_local/kernels/sabotage/
cd /data_local/kernels/sabotage/

wget https://lab.nethence.com/sabotage-stage1.tar.gz
tar xzpSf sabotage-stage1.tar.gz
mv -f sabotage/* /data/guests/$guest/lala/
rmdir sabotage/
#rm -rf /data_local/kernels/sabotage/

cd /data/guests/$guest/

    cp -pi lala/etc/fstab lala/etc/fstab.dist
    vi lala/etc/fstab

/dev/xvda1 / reiser4 defaults 0 1
#/dev/xvda1 / btrfs defaults 0 1
#/dev/xvda1 / ext4 defaults 0 1

proc /proc proc defaults 0 0
devpts /dev/pts devpts defaults 0 0
shm /dev/shm tmpfs nodev,nosuid 0 0

    mv -i lala/etc/service/ttyS0/ lala/etc/service/hvc0/
    sed -i 's/ttyS0/hvc0/g' lala/etc/service/hvc0/run

rm -f lala/var/service/ttyS0
ln -s ../../etc/service/hvc0 lala/var/service/hvc0

    rm -rf lala/etc/service/tty1/
    rm -rf lala/etc/service/tty2/
    rm -rf lala/etc/service/tty3/
    rm -rf lala/etc/service/tty4/

    rm -rf lala/etc/service/wpa_supplicant/
    rm -rf lala/opt/wpa-supplicant/

    [[ ! -f lala/etc/rc.boot.dist ]] && mv -i lala/etc/rc.boot lala/etc/rc.boot.dist
    sed '/hotplug/d; /hwclock/d' lala/etc/rc.boot.dist > lala/etc/rc.boot
    chmod -x lala/etc/rc.boot.dist
    chmod +x lala/etc/rc.boot

vi lala/etc/rc.boot

/rw= (get rid of the `/tmp/` write-test conditions)

    [[ ! -f lala/etc/rc.shutdown.dist ]] &&  mv -i lala/etc/rc.shutdown lala/etc/rc.shutdown.dist
    sed '/hwclock/d' lala/etc/rc.shutdown.dist > lala/etc/rc.shutdown
    chmod -x lala/etc/rc.shutdown.dist
    chmod +x lala/etc/rc.shutdown

    cp -pi lala/etc/profile lala/etc/profile.dist
    vi lala/etc/profile

TZ="Europe/Moscow"
#TZ="Europe/Paris"

default password is sabotage but that’s already too complicated to remember – anyhow it might even be safer not to have a password at all as long as you do not allow empty passwords

    ls -lF lala/etc/shadow
    cp -pi lala/etc/shadow lala/etc/shadow.dist
    chroot lala/ passwd -d root
    diff -bu lala/etc/shadow.dist lala/etc/shadow

assuming some XEN DomU-capable kernel in da place. otherwise grab our kernel builds.

mkdir lala/lib/modules/
tar xzf /data/kernels/5.2.21.domureiser4.modules.tar.gz -C lala/lib/modules/

ls -lF lala/etc/rc.modules # no exist
echo modprobe tmem > lala/etc/rc.modules
chmod +x lala/etc/rc.modules

cp -pi lala/etc/rc.local lala/etc/rc.local.dist
chmod -x lala/etc/rc.local.dist
vi lala/etc/rc.local

    do_static_ip=true

    if=eth0
    ip=10.1.x.x
    nm=255.255.0.0
    gw=10.1.255.254

mv -i lala/etc/resolv.conf lala/etc/resolv.conf.dist
vi lala/etc/resolv.conf

# opendns
nameserver 208.67.222.220
nameserver 208.67.222.222

du -sh lala/

and you’re done – we will enable Dropbear later on

umount lala/
rmdir lala/

Guest skeleton

assuming a domU kernel, as stated above

ls -lhF /data/kernels/5.2.21.domureiser4.vmlinuz
cat > $guest <<EOF

kernel = "/data/kernels/5.2.21.domureiser4.vmlinuz"
root = "/dev/xvda1 ro console=hvc0 mitigations=off"
#extra = "init=/bin/ash"
name = "$guest"
vcpus = 2
memory = 1024
#disk = ['tap:tapdisk:aio:/data/guests/$guest/sabotage.reiser4,xvda1,w']
#disk = ['tap:tapdisk:aio:/data/guests/$guest/sabotage.btrfs,xvda1,w']
disk = ['phy:/dev/drbd/by-res/$guest/0,xvda1,w']
vif = [ 'bridge=guestbr0, vifname=sabotage0',
    'bridge=guestbr0, vifname=sabotage1' ]
type = "pvh"
EOF

xl create $guest -c

lsmod | grep tmem
free -m

enable that alternative SSH daemon at boot-time

ping -c1 opendns.com
butch install dropbear

echo /bin/ash >> /etc/shells
echo /bin/bash >> /etc/shells

vi /var/service/dropbear/run

exec /bin/dropbear -F -G wheel -sjk 2>&1

ls -lF /var/service/dropbear/down
rm -f /var/service/dropbear/down

sv up dropbear
sv status dropbear

Further system preparation

see sabotage

Template-ready

eventually make a template out of it

sync
rm -f .ash_history
^]

xl shu sabotage
cd ../
newtemplate.bash sabotage

Additional notes

just a chroot

in case you just want a chroot instead of a XEN guest

mkdir lala/
mount saboage.ext4 lala/
    mount -o bind /dev/ lala/dev/
    mount -o bind /dev/pts/ lala/dev/pts/
    mount -o bind /proc/ lala/proc/
    mount -o bind /sys/ lala/sys/
chroot lala/ /bin/mksh

and once you’re done

umount -R lala/

Resources

download

http://mirrors.2f30.org/sabotage/

http://ftp.barfooze.de/pub/sabotage/

misc

Runit tools in busybox - up to the task? https://busybox.net/kill_it_with_fire.txt