Skip to content

Commit 6c7a40e

Browse files
aghiles-aitaghiles-ait
authored
refactor(encryptedDisk): translate to bash and improve encrypted disk (#33)
* refactor: direct translation from python to bash * refactor: replace informative or fatal messages generated by echo cmd with corresponding log funtions * chore: add starting and ending logs * refactor: add more context to existing log messages * refactor: factorize repeated partitioning, formatting, encryption of disk into functions * refactor: add additional logs for context * chore: delete unused init.py file * refactor: enrich code with logs * refactor: factorize displaying of mount directory * refactor replace luksOpen with the more modern open cryptsetup command * refactor: factorize mount device operation in a single function * refactot: factorize mount_device in a single place * refactor: add logs and comment * docs: add beginning commentary section * chore: add additional context to comment * refactor: delete encryptedDisk.py * refactor: change create_partition function to detect_or_create_partition to create or directly assign an existing partition * chore: make grep case insensitive * refactor: use one line idiomatic logging when possible * chore: rename "path" env variable to "mount_path" for more context * refactor: factorize detect_or_create_partition() code * refactor: delete unsupported keyType case * refactor: reorder the code * chore: add control about the pre-existence of mapper * refactor: remove irrelevant condition tests * chore: umount mount_path prior to execution * refactor: reorder the code * fix: correct mistake in the header comment * docs: add a warning readme.md * refactor: make mappername value controlled by create_or_detect_partition() * Revert "refactor: make mappername value controlled by create_or_detect_partition()" This reverts commit 24c28ed. * refactor: make mappername value controlled by create_or_detect_partition() * refactor: merge code * fix: add missing mappername modification * fix: test existence of device_to_mount file after its assignment * chore: uniformize syntax between two for loops * fix: add --key_file=- to cryptsetup * chore: delete unnecessary ls command
1 parent 6300eaf commit 6c7a40e

File tree

4 files changed

+158
-89
lines changed

4 files changed

+158
-89
lines changed

‎cvmassistants/disktool/__init__.py‎

Whitespace-only changes.

‎cvmassistants/disktool/encryptedDisk.py‎

Lines changed: 0 additions & 89 deletions
This file was deleted.

‎cvmassistants/disktool/encryptedDisk.sh‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
#!/usr/bin/env bash
2+
###############################################################################
3+
# Script: encryptedDisk.sh
4+
# Description: Configure encrypted or unencrypted disk partitions on Ubuntu systems (e.g., TDX environment)
5+
#
6+
# This script partitions, formats, and mounts disk devices. Supports both
7+
# encrypted (LUKS) and unencrypted disks. Environment variables control behavior:
8+
# `mount_path` (mount point), `disk` (device name), `keyType` (only wrapkey supported),
9+
# and `wrapkey` (encryption key).
10+
#
11+
# Requirements:
12+
# - Must be run as root
13+
# - cryptsetup must be installed (for encrypted disks)
14+
# - fdisk must be installed
15+
# - mkfs.ext4 must be available
16+
#
17+
###############################################################################
18+
19+
log_info() {
20+
echo -e "[INFO] $*"
21+
}
22+
23+
log_fatal() {
24+
echo -e "[ERROR] $*" >&2
25+
exit 1
26+
}
27+
28+
# Create a new partition on a disk
29+
# Arguments: disk_device
30+
detect_or_create_partition() {
31+
local disk_dev="$1"
32+
local suffix
33+
34+
# Try both possible partition naming schemes (e.g., /dev/sda1 or /dev/nvme0n1p1)
35+
part_disk=""
36+
for suffix in "1" "p1"; do
37+
if [[ -e "${disk_dev}${suffix}" ]]; then
38+
part_disk="${disk_dev}${suffix}"
39+
mappername="${mappername}${suffix}"
40+
log_info "Partition $part_disk already exists for device $disk_dev"
41+
return 0
42+
fi
43+
done
44+
45+
log_info "Creating partition on $disk_dev with the following passed fdisk parameters:
46+
n = new partition
47+
p = primary partition
48+
1 = partition number 1
49+
<Enter><Enter> = default start and end sectors
50+
w = write changes"
51+
# Create the partition using fdisk
52+
# fdisk may return non-zero due to partition table re-read warning, but partition is created
53+
echo -e "n\np\n1\n\n\nw\n" | fdisk "$disk_dev" >/dev/null 2>&1 || true
54+
55+
# Force kernel to re-read the partition table
56+
if command -v partprobe >/dev/null 2>&1; then
57+
partprobe "$disk_dev" >/dev/null 2>&1 || log_fatal "partprobe failed on $disk_dev"
58+
elif command -v partx >/dev/null 2>&1; then
59+
partx -u "$disk_dev" >/dev/null 2>&1 || log_fatal "partx failed on $disk_dev"
60+
fi
61+
62+
# Wait a moment for partition to appear
63+
sleep 1
64+
65+
# Try both possible partition naming schemes
66+
for suffix in "1" "p1"; do
67+
part_disk="${disk_dev}${suffix}"
68+
if [[ -e "$part_disk" ]]; then
69+
mappername="${mappername}${suffix}"
70+
log_info "Partition $part_disk successfully created on $disk_dev"
71+
return 0
72+
fi
73+
done
74+
75+
log_fatal "Failed to create partition on $disk_dev — no partition device detected after fdisk"
76+
}
77+
78+
# Format and encrypt a partition
79+
# Arguments: key partition_device mapper_name
80+
format_and_encrypt_partition() {
81+
local key="$1"
82+
local part_dev="$2"
83+
local mapper="$3"
84+
85+
echo "$key" | cryptsetup luksFormat --key-file=- "$part_dev"
86+
[[ $? -ne 0 ]] && log_fatal "Failed to format partition $part_dev in luks format"
87+
log_info "Partition $part_dev formatted successfully in luks format"
88+
89+
echo "$key" | cryptsetup open --key-file=- "$part_dev" "$mapper"
90+
[[ $? -ne 0 ]] && log_fatal "Failed to open partition $part_dev in luks format"
91+
log_info "Partition $part_dev opened successfully in luks format"
92+
93+
mkfs.ext4 "/dev/mapper/$mapper"
94+
[[ $? -ne 0 ]] && log_fatal "Failed to format partition /dev/mapper/$mapper in ext4 format"
95+
log_info "Partition /dev/mapper/$mapper successfully formatted in ext4 format"
96+
97+
cryptsetup close "$mapper"
98+
[[ $? -ne 0 ]] && log_fatal "Failed to close partition /dev/mapper/$mapper"
99+
log_info "Partition /dev/mapper/$mapper closed successfully"
100+
}
101+
102+
# Mount a device to a mount point
103+
# Arguments: device_path mount_point
104+
mount_device() {
105+
local device="$1"
106+
local mount_point="$2"
107+
108+
mount "$device" "$mount_point"
109+
[[ $? -ne 0 ]] && log_fatal "Failed to mount $device to $mount_point"
110+
log_info "Mounted $device to $mount_point"
111+
}
112+
113+
log_info "Starting encrypted disk configuration..."
114+
115+
# Check required environment variables
116+
[[ -z "$mount_path" ]] && log_fatal "Mount directory is null"
117+
[[ -z "$disk" ]] && log_fatal "Disk dev name is null"
118+
# Handle only encrypted disk case
119+
[ "$keyType" != "wrapkey" ] && log_fatal "keyType $keyType is not supported"
120+
121+
log_info "Handling encrypted disk case"
122+
[[ -z "$wrapkey" ]] && log_fatal "wrapkey is null"
123+
124+
if [ ! -d "$mount_path" ]; then
125+
log_info "Mount directory $mount_path does not exist"
126+
mkdir -p "$mount_path" && log_info "Created mount directory $mount_path"
127+
else
128+
umount "$mount_path" 2>/dev/null && log_info "Unmounted $mount_path"
129+
fi
130+
131+
diskpath="/dev/$disk" # /dev/vda
132+
part_disk=""
133+
134+
mappername="${disk}"
135+
detect_or_create_partition "$diskpath" # assign part_disk and mappername
136+
device_to_mount="/dev/mapper/$mappername"
137+
[ -e "$device_to_mount" ] && log_fatal "Mapper $device_to_mount already exists"
138+
139+
# Format and encrypt the partition (and check if it opens correctly)
140+
format_and_encrypt_partition "$wrapkey" "$part_disk" "$mappername"
141+
142+
# Open the encrypted device in its mapper
143+
echo "$wrapkey" | cryptsetup open --key-file=- "$part_disk" "$mappername"
144+
[[ $? -ne 0 ]] && log_fatal "cryptsetup open --key-file=- "$part_disk" "$mappername": failed"
145+
log_info "cryptsetup open --key-file=- "$part_disk" "$mappername": success"
146+
147+
# Mount the device
148+
mount_device "$device_to_mount" "$mount_path" && log_info "Mounted $device_to_mount to $mount_path"
149+
150+
log_info "Encrypted disk configuration completed."

‎cvmassistants/disktool/readme.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
**Warning:** ⚠️
2+
This script will **forcefully format the specified partition**.
3+
All existing data on the partition will be **permanently lost**.
4+
5+
Specifically:
6+
7+
- The disk is defined via the `disk` environment variable (e.g., `vda`).
8+
- The partition affected is the **first partition** of that disk

0 commit comments

Comments
 (0)