aboutsummaryrefslogtreecommitdiff
path: root/lib/libbe
Commit message (Collapse)AuthorAgeFilesLines
* libbe(3): add needed bits for be_destroy to auto-destroy some originsKyle Evans2019-10-163-2/+53
| | | | | | | | | | | | | | | | | | | New BEs can be created from either an existing snapshot or an existing BE. If an existing BE is chosen (either implicitly via 'bectl create' or explicitly via 'bectl create -e foo bar', for instance), then bectl will create a snapshot of the current BE or "foo" with be_snapshot, with a name formatted like: strftime("%F-%T") and a serial added to it. This commit adds the needed bits for libbe or consumers to determine if a snapshot names matches one of these auto-created snapshots (with some light validation of the date/time/serial), and also a be_destroy flag to specify that the origin should be automatically destroyed if possible. A future commit to bectl will specify BE_DESTROY_AUTOORIGIN by default so we clean up the origin in the most common case, non-user-managed snapshots. Notes: svn path=/head/; revision=353644
* fixup up fallout from r352447 in libbeAndriy Gapon2019-09-171-1/+2
| | | | | | | | | | I totally forgot that we now have another in-tree consumer of libzfs. MFC after: 3 days X-MFC with: r352447 Notes: svn path=/head/; revision=352449
* pkgbase: Create a FreeBSD-utilities package and make it the default oneEmmanuel Vadot2019-09-051-1/+0
| | | | | | | | | | | | | The default package use to be FreeBSD-runtime but it should only contain binaries and libs enough to boot to single user and repair the system, it is also very handy to have a package that can be tranform to a small mfsroot. So create a new package named FreeBSD-utilities and make it the default one. Also move a few binaries and lib into this package when it make sense. Reviewed by: bapt, gjb Differential Revision: https://reviews.freebsd.org/D21506 Notes: svn path=/head/; revision=351858
* libbe(3): restructure be_mount, skip canmount check for BE datasetKyle Evans2019-06-251-13/+19
| | | | | | | | | | | | Further cleanup after r349380; loader and kernel will both ignore canmount on the root dataset as well, so we should not be so strict about it when mounting it. be_mount is restructured to make it more clear that depth==0 is special, and to not try fetching these properties that we won't care about. MFC after: 3 days Notes: svn path=/head/; revision=349383
* libbe(3): mount: the BE dataset is mounted at /Kyle Evans2019-06-251-1/+1
| | | | | | | | | | | | | | | | Other parts of libbe(3) were fairly strict on the mountpoint property of the BE dataset, and be_mount was not much better. It was improved in r347027 to allow mountpoint=none for depth==0, but this bit was still sensitive to mountpoint != / and mountpoint != none. Given that other parts of libbe(3) no longer restrict the mountpoint property here, and the rest of the base system is generally OK and will assume that a BE is mounted at /, let's do the same. Reported by: ler MFC after: 3 days Notes: svn path=/head/; revision=349380
* libbe(3): Descend into children of datasets w/ mountpoint=noneKyle Evans2019-05-161-5/+5
| | | | | | | | | | | | | These datasets will generally be canmount=noauto,mountpoint=none (e.g. zroot/var) but have children that may need to be mounted. Instead of skipping that segment for no good reason, descend. Submitted by: Wes Maag Reported by: Wes Maag MFC after: 3 days Notes: svn path=/head/; revision=347640
* libbe: set mountpoint=none in be_importKyle Evans2019-05-021-1/+1
| | | | | | | | | | If we're going to set a mountpoint at all, mountpoint=none makes more sense than mountpoint=/. MFC after: 3 days Notes: svn path=/head/; revision=347028
* libbe(3): Properly mount BEs with mountpoint=noneKyle Evans2019-05-021-21/+40
| | | | | | | | | | | | Instead of pretending to successfully mount them while not actually mounting anything, we'll now actually mount them *and* claim we mounted them successfully. Reported by: ler MFC after: 3 days Notes: svn path=/head/; revision=347027
* libbe(3): Fix libcompat buildKyle Evans2019-04-251-1/+2
| | | | | | | | | | | | | SHLIBDIR should still be optionally set, just before src.opts.mk is included so that libcompat can properly override it. This fixes lib32 failures reported by both Jenkins and Michael Butler. Reported by: Michael Butler <imb@protected-networks.net> MFC after: 3 days X-MFC-With: r346546 Notes: svn path=/head/; revision=346705
* libbe(3): Fix mis-application of patch (SHLIBDIR)Kyle Evans2019-04-251-1/+1
| | | | | | | | | | | | | | Rob's patch in D18564 cemented the SHLIBDIR because bsd.own.mk (included by src.opts.mk) sets it to /usr/lib. r346546 did somehow not apply this part of the patch, leaving it to get installed to the wrong place and subsequently removed via ObsoleteFiles. Reported by: jkim MFC after: 3 days X-MFC-With: r346546 Notes: svn path=/head/; revision=346700
* libbe(3): Copy received properties as wellKyle Evans2019-04-251-2/+6
| | | | | | | | | | This was inherently broken on send|recv datasets. Reported and tested by: Wes Maag <jwmaag gmail com> MFC after: 3 days Notes: svn path=/head/; revision=346680
* libbe(3): Add a test for be creationKyle Evans2019-04-224-0/+257
| | | | | | | | | Submitted by: Rob Fairbanks <rob.fx907 gmail com> MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D18564 Notes: svn path=/head/; revision=346546
* libbe(3): allow creation of arbitrary depth boot environmentsKyle Evans2019-04-224-64/+134
| | | | | | | | | | | | | | libbe currently only provides an API to create a recursive boot environment, without any formal support for intentionally limiting the depth. This changeset adds an API, be_create_depth, that may be used to arbitrarily restrict the depth of the new BE. Submitted by: Rob Fairbanks <rob.fx907 gmail com> MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D18564 Notes: svn path=/head/; revision=346545
* libbe(3): use libzfs name validation for datasets/snapshot namesKyle Evans2019-04-101-6/+7
| | | | | | | | | | | Our home-rolled solution didn't quite capture all of the details, and we didn't actually validate snapshot names at all. zfs_name_valid captures the important details, but it doesn't necessarily expose the errors that we're wanting to see in the be_validate_* functions. Validating lengths independently, then the names, should make this a non-issue. Notes: svn path=/head/; revision=346082
* libbe(3): Add a serial to the generated snapshot namesKyle Evans2019-04-031-6/+26
| | | | | | | | | | | | | | | | | | | To use bectl in an example, when one creates a new boot environment with either `bectl create <be>` or `bectl create -e <otherbe> <be>`, libbe will take a snapshot of the original boot environment to clone. Previously, this used %F-%T date format as the snapshot name, but this has some limitations- attempting to create multiple boot environments in quick succession may collide if done within the same second. Tack a serial onto it to reduce the chances of a collision... we could still collide if multiple processes/threads are creating boot environments at the same time, but this is likely not a big concern as this has only been reported as occurring in freebsd-ci setup. MFC after: 3 days Notes: svn path=/head/; revision=345848
* libbe: Fix zfs_is_mounted check w/ snapshotsKyle Evans2019-04-011-10/+10
| | | | | | | | | | | | | | 'be_destroy' can destroy a boot environment (by name) or a given snapshot. If the target to be destroyed is a dataset, check if it's mounted. We don't want to check if the origin dataset is mounted when destroying a snapshot. PR: 236043 Submitted by: Rob Fairbanks <rob.fx907 gmail com> MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D19650 Notes: svn path=/head/; revision=345769
* libbe(3): Fix be_destroy behavior w.r.t. deep BE snapshots and -oKyle Evans2019-02-134-25/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | be_destroy is documented to recursively destroy a boot environment. In the case of snapshots, one would take this to mean that these are also recursively destroyed. However, this was previously not the case. be_destroy would descend into the be_destroy callback and attempt to zfs_iter_children on the top-level snapshot, which is bogus. Our alternative approach is to take note of the snapshot name and iterate through all of fs children of the BE to try destruction in the children. The -o option is also fixed to work properly with deep BEs. If the BE was created with `bectl create -e otherDeepBE newDeepBE`, for instance, then a recursive snapshot of otherDeepBE would have been taken for construction of newDeepBE but a subsequent destroy with BE_DESTROY_ORIGIN set would only clean up the snapshot at the root of otherDeepBE: ${BEROOT}/otherDeepBE@... The most recent iteration instead pretends not to know how these things work, verifies that the origin is another BE and then passes that back through be_destroy to DTRT when snapshots and deep BEs may be in play. MFC after: 1 week Notes: svn path=/head/; revision=344084
* libbe(3): Belatedly note the BE_DESTROY_ORIGIN option added in r343977Kyle Evans2019-02-121-1/+8
| | | | | | | X-MFC-With: r343977 Notes: svn path=/head/; revision=344034
* libbe(3): Add a destroy option for removing the originKyle Evans2019-02-102-7/+24
| | | | | | | | | | | | | | | | | | Currently origin snapshots are left behind when a BE is destroyed, whether it was an auto-created snapshot or explicitly specified via, for example, `bectl create -e be@mysnap ...`. Removing it automatically could be argued as a POLA violation in some circumstances, so provide a flag to be_destroy for it. An accompanying option will be added to bectl(8) to utilize this. Some minor style/consistency nits in the affected areas also addressed. Reported by: Shawn Webb MFC after: 1 week Notes: svn path=/head/; revision=343977
* libbe(3): simplify import, allow replication streamsKyle Evans2019-01-231-42/+7
| | | | | | | | | | | | | | | | | Previously, we directly used libzfs_core's lzc_receive to import to a temporary snapshot, then cloned the snapshot and setup the properties. This failed when attempting to import replication streams with questionable error. libzfs's zfs_receive is a much better fit here, so we now use it instead with the destination dataset and let libzfs take care of the dirty details. be_import is greatly simplified as a result. Reported by: Marie Helene Kvello-Aune <freebsd@mhka.no> MFC after: 1 week Notes: svn path=/head/; revision=343335
* libbe(3): Change be_mount to mount/unmount child datasetsKyle Evans2019-01-101-37/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | This set of changes is geared towards making bectl respect deep boot environments when they exist and are mounted. The deep BE composition functionality (`bectl add`) remains disabled for the time being. This set of changes has no effect for the average user. but allows deep BE users to upgrade properly with their current setup. libbe(3): Open the target boot environment and get a zfs handle, then pass that with the target mountpoint to be_mount_iter; If the BE_MNT_DEEP flag is set call zfs_iter_filesystems and mount the child datasets. Similar logic is employed when unmounting the datasets, save for children are unmounted first. bectl(8): Change bectl_cmd_jail to pass the BE_MNT_DEEP flag when calling be_mount as well as call be_unmount when cleaning up after the jail has exited instead of umount(2) directly. PR: 234795 Submitted by: Wes Maag <jwmaag_gmail.com> (test additions by kevans) MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D18796 Notes: svn path=/head/; revision=342911
* libbe(3): move altroot augmentation bits around a little bitKyle Evans2019-01-093-14/+38
| | | | | | | | | | | | | | | | | We could perhaps have a method that does this given a dataset, but it's yet clear that we'll always want to bypass the altroot when we grab the mountpoint. For now, we'll refactor things a bit so we grab the altroot length when libbe is initialized and have a common method that does the necessary augmentation (replace with / if it's the root, return a pointer to later in the string if not). This will be used in some upcoming work to make be_mount work properly for deep BEs. MFC after: 1 week Notes: svn path=/head/; revision=342903
* libbe(3): Don't allow bootfs to be destroyedKyle Evans2019-01-071-1/+2
| | | | | | | | | | | | | | | | | | | | | Previously, the following sequence of events was feasible under some circumstance: bectl create test bectl activate test # the test BE dataset gets promoted and set as bootfs bectl destroy test I was unable to reproduce the destroy succeeding, but we should be rejecting this before it even gets to libzfs because it would leave the system in an inconsistent state. Forcing the user to be explicit as to which environment should be activated instead is much better. Reported by: Graham Perrin <grahamperrin@gmail.com> MFC after: 3 days Notes: svn path=/head/; revision=342849
* Cross-reference libbe(3) and bectl(8).Mateusz Piotrowski2018-11-211-1/+1
| | | | | | | | | | | | | Those two manual pages are already referencing each other in the HISTORY sections, which people might skip. Mention those manual pages explicitly in the SEE ALSO sections. Also, remove a reference to be(1) from libbe(3). Reviewed by: bcr Approved by: krion (mentor, implicit), mat (mentor, implicit) Differential Revision: https://reviews.freebsd.org/D18136 Notes: svn path=/head/; revision=340723
* libbe(3): Put each error value in separate line.Mateusz Piotrowski2018-11-211-24/+43
| | | | | | | | | | | As requested by a TODO in the source code. Reviewed by: bcr Approved by: krion (mentor, implicit), mat (mentor, implicit) Differential Revision: https://reviews.freebsd.org/D18063 Notes: svn path=/head/; revision=340722
* libbe(3): Handle non-ZFS rootfs betterKyle Evans2018-11-191-2/+19
| | | | | | | | | | | | | | | | | | | | | | | If rootfs isn't ZFS, current version will emit an error claiming so and fail to initialize libbe. As a consumer, bectl -r (undocumented) can be specified to operate on a BE independently of whether on a UFS or ZFS root. Unbreak this for the UFS case by only erroring out the init if we can't determine a ZFS dataset for rootfs and no BE root was specified. Consumers of libbe should take care to ensure that rootfs is non-empty if they're trying to use it, because this could certainly be the case. Some check is needed before zfs_path_to_zhandle because it will unconditionally emit to stderr if the path isn't a ZFS filesystem, which is unhelpful for our purposes. This should also unbreak the bectl(8) tests on a UFS root, as is the case in Jenkins' -test runs. MFC after: 3 days Notes: svn path=/head/; revision=340635
* libbe(3): Properly account for altroot when creating new BEsKyle Evans2018-11-192-1/+15
| | | | | | | | | | | | Previously we would blindly copy the 'mountpoint' property, which includes the altroot. The altroot needs to be snipped off prior to setting it on the new BE, though, or you'll end up with a new BE and a mountpoint of /mnt with altroot=/mnt MFC after: 3 days Notes: svn path=/head/; revision=340593
* bectl(3)/libbe(3): Allow BE root to be specifiedKyle Evans2018-11-194-16/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add an undocumented -r option preceding the bectl subcommand to specify a BE root to operate out of. This will remain undocumented for now, as some caveats apply: - BEs cannot be activated in the pool that doesn't contain the rootfs - bectl create cannot work out of the box without the -e option right now, since it defaults to the rootfs and cross-pool cloning doesn't work like that (IIRC) Plumb the BE root through to libbe(3) so that some things -can- be done to it, e.g. bectl -r tank/ROOT create -e default upgrade bectl -r tank/ROOT mount upgrade /mnt this aides in some upgrade setups where rootfs is not necessarily ZFS, and also makes it easier/possible to regression-test bectl when combined with a file-backed zpool. MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D18029 Notes: svn path=/head/; revision=340592
* libbe(3): Rewrite be_unmount to stop mucking with getmntinfo(2)Kyle Evans2018-11-171-26/+8
| | | | | | | | | | | Go through the ZFS layer instead; given a BE, we can derive the dataset, zfs_open it, then zfs_unmount. ZFS takes care of the dirty details and likely gets it more correct than we did for more interesting setups. MFC after: 3 days Notes: svn path=/head/; revision=340508
* libbe(3): rewrite init to support chroot usageKyle Evans2018-11-172-99/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libbe(3) currently uses zfs_be_root and locates which of its children is currently mounted at "/". This is reasonable, but not correct in the case of a chroot, for two reasons: - chroot root may be of a different zpool than zfs_be_root - chroot root will not show up as mounted at "/" Fix both of these by rewriting libbe_init to work from the rootfs down. zfs_path_to_zhandle on / will resolve to the dataset mounted at the new root, rather than the real root. From there, we can derive the BE root/pool and grab the bootfs off of the new pool. This does no harm in the average case, and opens up bectl to operating on different pools for scenarios where one may be, for instance, updating a pool that generally gets re-rooted into from a separate UFS root or zfs bootpool. While here, I've also: - Eliminated the check for /boot and / to be on the same partition. This leaves one open to a setup where /boot (and consequently, kernel/modules) are not included in the boot environment. This may very well be an intentional setup done by someone that knows what they're doing, we should not kill BE usage because of it. - Eliminated the validation bits of BEs and snapshots that enforced 'mountpoint' to be "/" -- this broke when trying to operate on an imported pool with an altroot, but we need not be this picky. Reported by: philip Reviewed by: philip, allanjude (previous version) Tested by: philip MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D18012 Notes: svn path=/head/; revision=340507
* libbe(3): Set canmount properly when activating a new BEKyle Evans2018-11-101-0/+18
| | | | | | | | | | | | The previously activated BE should have canmount=noauto set on it upon activation of the new BE, but we previously did not touch canmount on either old or new BE. PR: 233113 MFC after: 3 days Notes: svn path=/head/; revision=340334
* libbe(3): Don't promote non-cloned BEsKyle Evans2018-11-011-2/+14
| | | | | | | | | | | | Most easily reproducible by attempting to activate the currently activated BE, one would get a "not a cloned filesystem" error instead of success or a sane message. PR: 232488 MFC after: 3 days Notes: svn path=/head/; revision=339994
* libbe(3): Fix BE activation promoting activated BEKyle Evans2018-10-011-7/+13
| | | | | | | | | | | | | | | | This allows older BEs to be destroyed as they become replaced by a BE created from them: e.g. bectl create -e brokenworld fixedworld bectl activate fixedworld bectl destroy brokenworld Submitted by: Shawn Webb Approved by: re (gjb) Obtained from: HardenedBSD (5948c0581e) Notes: svn path=/head/; revision=339047
* libbe(3): Fix error handling with respect to be_existsKyle Evans2018-09-016-24/+24
| | | | | | | | | | | | | | | | | | Some paths through be_exists will set the error state, others will not There are multiple reasons that a call can fail, so clean it up a bit: all paths now return an appropriate error code so the caller can attempt to distinguish between a BE legitimately not existing and just having the wrong mountpoint. The caller is expected to bubble the error through to the internal error handler as needed. This fixes some unfriendliness with bectl(8)'s activate subcommand, where it might fail due to a bad mountpoint but the only message output is a generic "failed to activate" message. Approved by: re (gjb) Notes: svn path=/head/; revision=338417
* libbe(3)/bectl(8): Make consistent with beadmKyle Evans2018-08-243-13/+11
| | | | | | | | | | | | | | | | | | | | vermaden (maintainer of beadm) points out the following inconsistencies: - "missing command" is not printed prior to usage if the error is simply a missing command; this should be obvious from the context - "bectl rename" isn't using the "don't unmount" flag (zfs rename -u), so the active BE can't be renamed. It doesn't make sense in our context to *not* use -u, so use it. Documentation updates reflect the above and note an inconsistency with the 'destroy' command that is consistent with other parts of the base system. A fix for libbe(3) not properly being installed to /lib is included. SHLIBDIR should have been added when it was moved in r337995. Approved by: re (kib) Notes: svn path=/head/; revision=338303
* libbe(3): Move build goop back out of cddl/Kyle Evans2018-08-181-0/+30
| | | | | | | | | | | | | | | | | | | | | | | Some background: in the GSoC project, libbe/Makefile lived in lib/libbe. I created projects/bectl branch, maintained the above for all of five minutes before I misread Makefile.inc1 and decided that it couldn't possibly build outside of cddl/, so I kicked the Makefile out into the cddl/ build and all was good. The misreading was of the bit where .WAIT is added to SUBDIR after lib, libexec but prior to building bin and cddl *only during the install targets*, which is the critical part. Fast forward- buildworld was still broken in my branch unbeknownst to me because I didn't nuke my OBJDIR. Combing through Makefile.inc1 eventually revealed the necessary magic to make sure that libbe's dependencies are specified well enough, and it becomes clear what needs done to make a non-cddl/ build work. This is an interesting prospect, because the build split is kind of annoying to work with. IGNORE_PRAGMA is added to avoid dropping WARNS by one more. This was previously pulled in via cddl/Makefile.inc. Notes: svn path=/head/; revision=337995
* libbe(3): Impose dataset length restrictions on boot env name validationKyle Evans2018-08-162-9/+22
| | | | | | | | | | | | | | | Previously, we only validated names for character restrictions. This is helpful, but we should've also checked length restrictions- dataset names must be restricted to MAXNAMELEN. While here, move validation before doing a bunch of concatenations and fix error handling in be_rename. It was previously setting the error state based on return value from a libzfs function, which is wrong: libzfs errors don't necessarily match cleanly to libbe errors. This would cause the assertion in be_error to hit when the error was printed. Notes: svn path=/head/; revision=337924
* libbe(3): Prefer safer versions of strcat/strcpyKyle Evans2018-08-163-12/+19
| | | | | | | | Or, in the activate case, just use snprintf since that's effectively what we're doing anyways. Notes: svn path=/head/; revision=337921
* libbe(3)/bectl(8): Hit rewind on a bunch of off-by-onesKyle Evans2018-08-163-20/+19
| | | | | | | | While here, use sizeof() in some places that it makes sense to reduce room for error and prefer strlcpy to strncpy Notes: svn path=/head/; revision=337915
* libbe(3): Fix leaky faucetsKyle Evans2018-08-143-29/+27
| | | | | | | | | | | | | | | Amongst them: - Resource leaks - Logically dead code - Unused values - Null termination issues Reported by: asomers (pointer to Coverity), Coverity CID: 1394777, 1394791, 1394830, 1394844, 1394872, 1394894, CID: 1394900, 1394907, 1394950, 1394965 Notes: svn path=/head/; revision=337800
* libbe(3): Light typo fix/word additionKyle Evans2018-08-131-2/+3
| | | | Notes: svn path=/head/; revision=337698
* libbe(3): Fix be_import to delete temp snapshotKyle Evans2018-08-132-10/+20
| | | | | | | | | | | | Deleting the temp snapshot isn't immediately possible because it's the origin of the newly imported boot environment. However, this is trivially solved by opening the new boot environment and promoting it. The roles are now reversed and the temp snapshot/dataset may be completely destroyed. Remove the BUGS from libbe(3) and bectl(8). Notes: svn path=/head/; revision=337697
* libbe(3): Document the import bug...Kyle Evans2018-08-112-9/+10
| | | | Notes: svn path=/projects/bectl/; revision=337605
* libbe(3): Brain dump...Kyle Evans2018-08-111-55/+326
| | | | Notes: svn path=/projects/bectl/; revision=337601
* libbe(3)/bectl(8): Make igor and mandoc -Tlint a little happierKyle Evans2018-08-111-38/+43
| | | | Notes: svn path=/projects/bectl/; revision=337598
* libbe(3): Bring man page back into realityKyle Evans2018-08-111-39/+8
| | | | Notes: svn path=/projects/bectl/; revision=337597
* libbe(3)/bectl(8): Kill off the 'add' functionality for nowKyle Evans2018-08-112-3/+11
| | | | | | | | | | | | The mostly-undocumented 'add' functionality, from initial read-through, is intended for construction of deep ("bdrewery style") boot environments. However, it's mostly broken at this point. `#if SOON` it out on both sides so that we're not exposing a broken API/feature. Work will resume on it in due time. Notes: svn path=/projects/bectl/; revision=337596
* libbe(3): More error handling bitsKyle Evans2018-08-103-63/+119
| | | | | | | | | | | | be_add_child functionality gets split out into separate places as a bonus. A lot of places here we'll gloss over libzfs errors, because they shouldn't be happening given the conditions that we're operating under. "Unknown error" is what I'm intending to use for the moment to indicate an exceptional circumstance- exceptional enough that we can't tell the consumer did because we're not so certain that they did anything. Notes: svn path=/projects/bectl/; revision=337592
* libbe(3): Plug some holes, do some more proper error returnsKyle Evans2018-08-101-34/+29
| | | | | | | For those returning just -1 before, have them set ERR_UNKNOWN for now. Notes: svn path=/projects/bectl/; revision=337564
* libbe(3): more small cleanup, const'ify and light style(9)Kyle Evans2018-08-102-25/+23
| | | | Notes: svn path=/projects/bectl/; revision=337563