Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ device: linux lvm support #4971

Merged
merged 41 commits into from
Dec 20, 2024
Merged

✨ device: linux lvm support #4971

merged 41 commits into from
Dec 20, 2024

Conversation

slntopp
Copy link
Member

@slntopp slntopp commented Dec 11, 2024

What has changed

After mount targets (partitions) are discovered, we'd attempt to either find fstab file or detect ostree partition.

fstab

If fstab configuration is discovered, provider will parse it and mount all discovered partitions using "opts" configured in the file. This ensures all required features and flags are used, for instance if partition has btrfs or xfs sub-volumes.
Additionally, device manager would add same partition twice or more if it's mounted multiple times with different opts.

Additionally, device manager will attempt to mount these partitions as /tmp/cnspec-scanxxxx + <fstab mountpoint>

By the time we get to attempt detect asset, partitions are already mounted and the scan dir has the structure closest to that in the original VM.

ostree

ostree filesystem together with edge case distros like Fedora CoreOS have a very different file structure as well as missing lot of usual service files (like hostname, machine-id, etc)
First of all, device manager attempts to untangle the pointers and locate the actual and latest root filesystem.
Additionally this PR introduces bind option to the volume mounter, which doesn't mount partition again with --bind as one may think, though but adjusts the fs-connection used for asset detection and can be used anywhere else, where the files search relies on standard linux tree structure. For malware detection and similar operations Bind can be ignored to get the full overview of the system.

moby/mount instead of sys/unix

Since fstab options include both flags and "data" we need a reliable way to split those, so mount doesn't crash out with invalid argument error. moby mount provides that, so we simply don't have to reinvent a bicycle here.

inject platform ids fallback

As mentioned, some distros don't have usual means of ID-ing the OS like hostname, machine-id or ssh-host-keys. We can however inject custom platform-ids in this cases. With this PR we don't error out from asset detection if no platform ids were found and there are injected ones.

Copy link
Contributor

github-actions bot commented Dec 11, 2024

Test Results

3 163 tests   3 162 ✅  1m 26s ⏱️
  372 suites      1 💤
   28 files        0 ❌

Results for commit cc236c0.

♻️ This comment has been updated with latest results.

@slntopp slntopp force-pushed the mik/linux-mount-lvm branch from effab67 to 78ab83c Compare December 11, 2024 18:41
@slntopp slntopp marked this pull request as ready for review December 11, 2024 19:16
@vjeffrey
Copy link
Contributor

@slntopp can you add some words about how to best test this new functionality?

@slntopp
Copy link
Member Author

slntopp commented Dec 13, 2024

  1. Attach volume(s) with Linux on it
  2. Run cnspec scan device --device-name /dev/<your-device>
  3. Enjoy successful scan

Difference is that before if root partition was btrfs, xfs with ostree, has other complex mounting configuration - scanner wouldn't be able to detect asset by failing to find related files (os-release and analogues)

go.mod Show resolved Hide resolved
providers/os/config/config.go Show resolved Hide resolved
providers/os/connection/device/linux/device_manager.go Outdated Show resolved Hide resolved
providers/os/connection/device/linux/device_manager.go Outdated Show resolved Hide resolved
providers/os/connection/snapshot/blockdevices.go Outdated Show resolved Hide resolved
providers/os/connection/snapshot/partition.go Outdated Show resolved Hide resolved
providers/os/connection/snapshot/volumemounter.go Outdated Show resolved Hide resolved
providers/os/connection/snapshot/partition.go Outdated Show resolved Hide resolved
providers/os/connection/snapshot/partition.go Show resolved Hide resolved
providers/os/connection/snapshot/partition.go Show resolved Hide resolved
providers/os/connection/snapshot/volumemounter.go Outdated Show resolved Hide resolved
func mapLVM2Partitions(part BlockDevice) (partitions []*PartitionInfo) {
for _, p := range part.Children {
devFsName := "/dev/mapper/" + p.Name
partitions = append(partitions, &PartitionInfo{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: can we make a blockdevice -> partitioninfo func? i think we use this in more places than here

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added a method to BlockDevice

@slntopp slntopp merged commit 916c468 into main Dec 20, 2024
16 checks passed
@slntopp slntopp deleted the mik/linux-mount-lvm branch December 20, 2024 16:17
@github-actions github-actions bot locked and limited conversation to collaborators Dec 20, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants