Ryan Hughes
defbf90e89
* Revert "Merge pull request #11874 from acrogenesis/feature/usb-device-authorization" This reverts commit5cb31317b4, reversing changes made to9d48fc402e. * Undo USB and Thunderbolt device approval on machines that ran it * Verify boot rebuilds, recover Thunderbolt journals and prove USBGuard ownership in the removal migration * Read the boot partition from ESP_PATH and stop on failed Bolt reads in the removal migration * Recover Bolt's original mode from the setup journal in the removal migration
620 lines
25 KiB
Bash
Executable File
620 lines
25 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Factory-reset this machine back to its freshly-installed state
|
|
# omarchy:group=setup
|
|
# omarchy:requires-sudo=true
|
|
# omarchy:examples=sudo omarchy-system-factory-reset
|
|
|
|
# Returns the machine to provisioning state — fully installed, no user, first-boot
|
|
# setup pending — the state you want before selling or handing the machine on.
|
|
#
|
|
# The running root (@) is swapped for a fresh writable clone of the @factory
|
|
# snapshot, so user-installed packages and /etc drift are gone too. That
|
|
# snapshot is taken by the Omarchy Quattro installer, so only machines
|
|
# installed from that ISO can be reset; a machine upgraded to Quattro from an
|
|
# earlier version has no baseline to return to and is turned away.
|
|
#
|
|
# The heavy lifting happens on the next boot via omarchy-system-factory-reset-finish, staged
|
|
# here. On encrypted installs the LUKS volume is re-keyed to a throwaway
|
|
# passphrase with an auto-unlock keyfile for the provisioning window; first-boot setup
|
|
# re-keys it to the new owner's password and removes the keyfile. A platform
|
|
# whose boot chain the Limine UKI path can't drive rebuilds, verifies and
|
|
# unlocks it through omarchy-lifecycle-dispatch.
|
|
#
|
|
# Honest limitations:
|
|
# - On unencrypted disks this is deletion, not forensic erasure. fstrim helps
|
|
# on SSDs; use blkdiscard + a reinstall if you need certainty.
|
|
# - LUKS re-keying changes passphrases, not the volume key. Freed extents
|
|
# remain readable to someone with raw-device access and a valid passphrase.
|
|
# Use cryptsetup reencrypt or a reinstall if you need certainty.
|
|
|
|
set -euo pipefail
|
|
|
|
PROVISIONING_DIR=/var/lib/omarchy/provisioning
|
|
PACKAGED_PATH=/usr/bin/omarchy-system-factory-reset
|
|
OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
|
|
TOP_MNT=/run/omarchy-system-factory-reset/top
|
|
NEXT_NAME=@omarchy-reset-next
|
|
LOG_FILE=/var/log/omarchy-system-factory-reset.log
|
|
|
|
# Never replace a newer checkout reset with a different installed implementation.
|
|
if ! /usr/bin/cmp -s -- "${BASH_SOURCE[0]}" "$PACKAGED_PATH"; then
|
|
echo "Factory reset differs from the installed command. Install the matching Omarchy package before resetting." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Self-elevate so the menu entry (and a bare shell invocation) need no sudo
|
|
# prefix. The caller's gum theme vars are forwarded as `env` arguments rather
|
|
# than via `sudo -E`, so styling survives even under an env_reset sudoers.
|
|
# Always elevate the packaged copy, including when invoked from a dev checkout.
|
|
if (( EUID != 0 )); then
|
|
mapfile -t gum_env < <(env | grep '^GUM_' || true)
|
|
exec sudo env "${gum_env[@]}" "$PACKAGED_PATH" "$@"
|
|
fi
|
|
|
|
export PATH="$OMARCHY_PATH/bin:$PATH"
|
|
|
|
log() {
|
|
echo "$1" | tee -a "$LOG_FILE" >/dev/null
|
|
gum style --foreground 8 " $1"
|
|
}
|
|
|
|
fail() {
|
|
gum style --foreground 1 "Error: $1"
|
|
exit 1
|
|
}
|
|
|
|
root_device() {
|
|
findmnt -no SOURCE / | sed 's/\[.*\]//'
|
|
}
|
|
|
|
root_is_btrfs_at() {
|
|
[[ $(findmnt -no FSTYPE /) == btrfs ]] && findmnt -no OPTIONS / | grep -q "subvol=/@\(,\|$\)"
|
|
}
|
|
|
|
DISPATCH="$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch"
|
|
|
|
# A platform whose boot package implements the reset operations rebuilds,
|
|
# verifies and unlocks the factory root's boot chain itself; everywhere else
|
|
# the Limine UKI path below does. Deciding fails closed.
|
|
RESET_BOOT=""
|
|
|
|
reset_boot_owner() {
|
|
[[ -z $RESET_BOOT ]] || return 0
|
|
|
|
local operation path found=0 missing=0
|
|
for operation in reset-prepare reset-verify reset-commit reset-rollback; do
|
|
path=$("$DISPATCH" --resolve "$operation") || return 1
|
|
if [[ -n $path ]]; then
|
|
found=$((found + 1))
|
|
else
|
|
missing=$((missing + 1))
|
|
fi
|
|
done
|
|
if (( missing == 0 )); then
|
|
RESET_BOOT=platform
|
|
elif (( found == 0 )); then
|
|
RESET_BOOT=generic
|
|
else
|
|
echo "Error: the boot package implements only some of the factory reset operations" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# Runs a reset operation with its output in the log. A failure keeps the
|
|
# operation's last line for the error shown.
|
|
RESET_BOOT_ERROR=""
|
|
|
|
reset_boot_op() {
|
|
local output status=0
|
|
output=$("$DISPATCH" "$@" 2>&1) || status=$?
|
|
[[ -z $output ]] || printf '%s\n' "$output" >>"$LOG_FILE"
|
|
if (( status == 0 )); then
|
|
return 0
|
|
fi
|
|
RESET_BOOT_ERROR=$(tail -n 1 <<<"$output")
|
|
RESET_BOOT_ERROR=${RESET_BOOT_ERROR:-"$1 failed"}
|
|
return 1
|
|
}
|
|
|
|
# Resolve the crypto_LUKS partition backing the root, or return non-zero if
|
|
# the root is not on LUKS. Prefers the cmdline cryptdevice= spec (archinstall
|
|
# writes PARTUUID=, the pre-mounted path UUID=), and falls back to walking the
|
|
# device tree for roots reached via rd.luks/crypttab with a plain /dev/mapper
|
|
# root and no cryptdevice=.
|
|
luks_device() {
|
|
local spec
|
|
spec=$(grep -o 'cryptdevice=[^ :]*' /proc/cmdline | head -1 | cut -d= -f2-)
|
|
case $spec in
|
|
UUID=*) echo "/dev/disk/by-uuid/${spec#UUID=}"; return 0 ;;
|
|
PARTUUID=*) echo "/dev/disk/by-partuuid/${spec#PARTUUID=}"; return 0 ;;
|
|
LABEL=*) echo "/dev/disk/by-label/${spec#LABEL=}"; return 0 ;;
|
|
PARTLABEL=*) echo "/dev/disk/by-partlabel/${spec#PARTLABEL=}"; return 0 ;;
|
|
/dev/*) echo "$spec"; return 0 ;;
|
|
esac
|
|
|
|
local src part
|
|
src=$(findmnt -no SOURCE / | sed 's/\[.*//')
|
|
[[ -n $src ]] || return 1
|
|
part=$(lsblk -nsrpo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
|
|
[[ -n $part ]] && { echo "$part"; return 0; }
|
|
return 1
|
|
}
|
|
|
|
encrypted_install() {
|
|
luks_device >/dev/null 2>&1
|
|
}
|
|
|
|
# No trailing `| head` stage: under pipefail an infinite tr killed by
|
|
# SIGPIPE fails the substitution and errexit aborts the whole reset.
|
|
generate_passphrase() {
|
|
local raw
|
|
raw=$(head -c 4096 /dev/urandom | tr -dc 'a-zA-Z0-9')
|
|
printf '%s' "${raw:0:48}"
|
|
}
|
|
|
|
cleanup() {
|
|
# Before the switch the old root still boots: the boot package gives it back
|
|
# its boot state before the reset's throwaway slot is revoked.
|
|
if [[ ${reset_committed:-0} == 0 && ${RESET_BOOT_PREPARED:-0} == 1 ]]; then
|
|
reset_boot_op reset-rollback || echo "Error: $RESET_BOOT_ERROR (see $LOG_FILE)" >&2
|
|
fi
|
|
if mountpoint -q "$TOP_MNT" 2>/dev/null; then
|
|
if [[ -d $TOP_MNT/$NEXT_NAME && ${swap_done:-0} == 0 ]]; then
|
|
btrfs subvolume delete --recursive "$TOP_MNT/$NEXT_NAME" >/dev/null 2>&1 || true
|
|
fi
|
|
umount -R "$TOP_MNT" 2>/dev/null || true
|
|
fi
|
|
rmdir "$TOP_MNT" 2>/dev/null || true
|
|
if [[ ${reset_committed:-0} == 0 ]]; then
|
|
revoke_reset_luks
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
confirm_reset() {
|
|
echo
|
|
gum style --bold --foreground 1 "Reset this computer to factory state?"
|
|
echo
|
|
gum style "This will permanently erase:"
|
|
gum style " • All user accounts and everything in /home"
|
|
gum style " • All packages and system changes made since installation"
|
|
gum style " • Machine identity (network connections, host keys, machine-id)"
|
|
echo
|
|
gum style "The next boot asks for a new user, exactly like a fresh install."
|
|
gum style --foreground 8 "Note: on disks without encryption this is deletion, not secure erasure."
|
|
echo
|
|
|
|
local typed
|
|
typed=$(gum input --placeholder "Type 'reset' to continue" --prompt "> ") || exit 1
|
|
[[ $typed == "reset" ]] || fail "Reset not confirmed."
|
|
}
|
|
|
|
# The slot the reset's throwaway key opens, or nothing. Restricting cryptsetup
|
|
# to a token type no token has keeps an enrolled token from answering for it.
|
|
reset_luks_slot() {
|
|
local -
|
|
set +x
|
|
LC_ALL=C cryptsetup open --test-passphrase --verbose --token-type passphrase-only \
|
|
--key-file <(printf '%s' "$RESET_THROWAWAY") "$RESET_LUKS_DEVICE" 2>&1 |
|
|
grep -o 'Key slot [0-9]* unlocked' | grep -o '[0-9]*' | head -1 || true
|
|
}
|
|
|
|
# Add the throwaway slot where the platform's boot package owns the unlock.
|
|
# Called once reset-verify passed, so a failed rebuild adds no credential.
|
|
# reset-commit writes the boot-time key only once the factory root is active:
|
|
# a power loss before the switch leaves the old root asking for its password,
|
|
# never unlocked unattended.
|
|
add_reset_luks_slot() {
|
|
local -
|
|
set +x
|
|
[[ -n ${RESET_LUKS_DEVICE:-} && -n ${RESET_LUKS_AUTH:-} && -n ${RESET_THROWAWAY:-} ]] || fail "the reset is missing its throwaway passphrase"
|
|
RESET_LUKS_ADDED=1
|
|
{ cryptsetup luksAddKey --key-file <(printf '%s' "$RESET_LUKS_AUTH") "$RESET_LUKS_DEVICE" <(printf '%s' "$RESET_THROWAWAY") ; } 2>>"$LOG_FILE" ||
|
|
fail "could not add the throwaway LUKS keyslot"
|
|
RESET_LUKS_SLOT=$(reset_luks_slot)
|
|
[[ -n $RESET_LUKS_SLOT ]] || fail "could not identify the throwaway LUKS keyslot"
|
|
}
|
|
|
|
# Only the slot this attempt added goes, found by its key if the add was not
|
|
# confirmed. The platform's boot-time key is written only after activation, so
|
|
# a failed reset has none to revoke.
|
|
revoke_reset_luks() {
|
|
local -
|
|
set +x
|
|
[[ ${RESET_LUKS_ADDED:-0} == 1 && -n ${RESET_LUKS_AUTH:-} ]] || return 0
|
|
[[ -n ${RESET_LUKS_SLOT:-} ]] || RESET_LUKS_SLOT=$(reset_luks_slot)
|
|
if [[ -n $RESET_LUKS_SLOT ]]; then
|
|
{ cryptsetup luksKillSlot -q --key-file <(printf '%s' "$RESET_LUKS_AUTH") "$RESET_LUKS_DEVICE" "$RESET_LUKS_SLOT" ; } 2>>"$LOG_FILE" || true
|
|
else
|
|
echo "Could not find the reset's throwaway LUKS slot on $RESET_LUKS_DEVICE to revoke; check its keyslots" >>"$LOG_FILE"
|
|
fi
|
|
RESET_LUKS_ADDED=0
|
|
RESET_LUKS_SLOT=""
|
|
}
|
|
|
|
# Re-key to a throwaway passphrase whose keyfile auto-unlocks boot during the
|
|
# provisioning window. $1 is the root of the staged factory system. Where the
|
|
# platform's boot package owns the unlock, only the staged key is written here:
|
|
# reset-prepare stages the unlock with the rest of the boot files, and the
|
|
# throwaway slot follows their verification.
|
|
stage_luks_rekey() {
|
|
local next="$1" device passphrase
|
|
|
|
device=$(luks_device) || fail "encrypted install, but no usable cryptdevice= in /proc/cmdline"
|
|
[[ -e $device ]] || fail "LUKS device $device not found"
|
|
|
|
echo
|
|
gum style "Confirm your disk encryption passphrase to authorize the re-key."
|
|
local current
|
|
while true; do
|
|
current=$(gum input --password --placeholder "Current disk encryption passphrase" --prompt "Passphrase> ") || exit 1
|
|
if cryptsetup open --test-passphrase --token-type passphrase-only --key-file <(printf '%s' "$current") "$device" 2>/dev/null; then
|
|
break
|
|
fi
|
|
gum style --foreground 1 "That passphrase does not unlock $device. Try again."
|
|
done
|
|
|
|
passphrase=$(generate_passphrase)
|
|
reset_boot_owner || fail "could not tell how this machine's boot chain is reset"
|
|
RESET_LUKS_AUTH=$current
|
|
RESET_LUKS_DEVICE=$device
|
|
RESET_THROWAWAY=$passphrase
|
|
if [[ $RESET_BOOT == "generic" ]]; then
|
|
# Revoked like the platform's slot if the reset fails before activation.
|
|
RESET_LUKS_ADDED=1
|
|
cryptsetup luksAddKey --key-file <(printf '%s' "$current") "$device" <(printf '%s' "$passphrase")
|
|
fi
|
|
|
|
install -d -m 755 "$next$PROVISIONING_DIR"
|
|
printf '%s' "$passphrase" >"$next$PROVISIONING_DIR/luks-key"
|
|
chmod 600 "$next$PROVISIONING_DIR/luks-key"
|
|
|
|
[[ $RESET_BOOT == "generic" ]] || return 0
|
|
|
|
install -d -m 755 "$next/etc/omarchy"
|
|
printf '%s' "$passphrase" >"$next/etc/omarchy/provisioning.key"
|
|
chmod 600 "$next/etc/omarchy/provisioning.key"
|
|
|
|
install -d "$next/etc/limine-entry-tool.d" "$next/etc/mkinitcpio.conf.d"
|
|
echo 'KERNEL_CMDLINE[default]+=" cryptkey=rootfs:/etc/omarchy/provisioning.key"' \
|
|
>"$next/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf"
|
|
echo 'FILES+=(/etc/omarchy/provisioning.key)' \
|
|
>"$next/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf"
|
|
}
|
|
|
|
install_provisioning_units() {
|
|
local next="$1" unit_src="$2"
|
|
|
|
install -Dm644 "$unit_src/omarchy-provision-owner.service" \
|
|
"$next/etc/systemd/system/omarchy-provision-owner.service"
|
|
install -Dm644 "$unit_src/omarchy-system-factory-reset-finish.service" \
|
|
"$next/etc/systemd/system/omarchy-system-factory-reset-finish.service"
|
|
|
|
install -d "$next/etc/systemd/system/multi-user.target.wants" \
|
|
"$next/etc/systemd/system/sysinit.target.wants"
|
|
ln -sf /etc/systemd/system/omarchy-provision-owner.service \
|
|
"$next/etc/systemd/system/multi-user.target.wants/omarchy-provision-owner.service"
|
|
ln -sf /etc/systemd/system/omarchy-system-factory-reset-finish.service \
|
|
"$next/etc/systemd/system/sysinit.target.wants/omarchy-system-factory-reset-finish.service"
|
|
}
|
|
|
|
# Start the ESP's limine.conf over from the shipped template and drop the
|
|
# previous Omarchy identity's state. limine-entry-tool keys OS entries by
|
|
# machine-id, so after a reset gives the machine a fresh identity, the
|
|
# previous system's entry (with the now-stale UKI hash) would survive, sort
|
|
# first, and make Limine refuse the rebuilt UKI with a hash-mismatch warning.
|
|
# Only machine-ids the old limine.conf referenced are removed — a shared ESP
|
|
# may hold other installations' machine-id directories.
|
|
reset_limine_config() {
|
|
local root="$1" esp="$2" template found=""
|
|
|
|
local old_ids=""
|
|
if [[ -f $root$esp/limine.conf ]]; then
|
|
old_ids=$(grep -o 'machine-id=[0-9a-f]\{32\}' "$root$esp/limine.conf" | cut -d= -f2 | sort -u)
|
|
fi
|
|
|
|
for template in "$root/usr/share/omarchy/install/assets/limine/limine.conf" \
|
|
"$root/usr/share/omarchy/default/limine/limine.conf"; do
|
|
if [[ -f $template ]]; then
|
|
cp "$template" "$root$esp/limine.conf"
|
|
found=1
|
|
break
|
|
fi
|
|
done
|
|
[[ -n $found ]] || fail "no limine.conf template in $root/usr/share/omarchy"
|
|
|
|
local machine_id old_id
|
|
machine_id=$(cat "$root/etc/machine-id" 2>/dev/null || true)
|
|
for old_id in $old_ids; do
|
|
[[ $old_id == "$machine_id" ]] && continue
|
|
rm -rf "${root:?}$esp/$old_id"
|
|
done
|
|
}
|
|
|
|
# Every UKI entry in limine.conf carries a #blake2b hash of the file it
|
|
# points at; a mismatch makes Limine stop at a scary warning. Never hand over
|
|
# a staged reset in that state.
|
|
verify_limine_hashes() {
|
|
local root="$1" esp="$2" line path hash file
|
|
while IFS= read -r line; do
|
|
path=${line#*boot():}
|
|
path=${path%%#*}
|
|
hash=${line##*#}
|
|
file="$root$esp$path"
|
|
[[ -f $file ]] || fail "limine.conf points at missing $path"
|
|
[[ $(b2sum "$file" | cut -d' ' -f1) == "$hash" ]] ||
|
|
fail "limine.conf hash for $path does not match the rebuilt file"
|
|
done < <(grep -o 'boot():/EFI/Linux/[^#]*#[0-9a-f]*' "$root$esp/limine.conf")
|
|
}
|
|
|
|
# Rebuild the UKI from inside the next root so the deployed kernel/initramfs
|
|
# match the factory root's modules (the seller may have updated kernels since
|
|
# install) and embed the auto-unlock keyfile on encrypted machines.
|
|
rebuild_next_boot() {
|
|
local next="$1"
|
|
|
|
reset_boot_owner || fail "could not tell how this machine's boot chain is reset"
|
|
if [[ $RESET_BOOT == "platform" ]]; then
|
|
rebuild_next_boot_platform "$next"
|
|
return
|
|
fi
|
|
|
|
local esp_source esp_mount
|
|
esp_mount=$(awk '$3 == "vfat" && $2 ~ /^\/(boot|efi)/ { print $2; exit }' "$next/etc/fstab")
|
|
esp_source=$(awk '$3 == "vfat" && $2 ~ /^\/(boot|efi)/ { print $1; exit }' "$next/etc/fstab")
|
|
[[ -n $esp_mount && -n $esp_source ]] || fail "could not find the ESP in $next/etc/fstab"
|
|
|
|
local esp_device=$esp_source
|
|
if [[ $esp_source == UUID=* ]]; then
|
|
esp_device="/dev/disk/by-uuid/${esp_source#UUID=}"
|
|
fi
|
|
[[ -e $esp_device ]] || fail "ESP device $esp_device not found"
|
|
|
|
mount "$esp_device" "$next$esp_mount"
|
|
|
|
local dir
|
|
for dir in proc sys dev run; do
|
|
mount --rbind "/$dir" "$next/$dir"
|
|
mount --make-rslave "$next/$dir"
|
|
done
|
|
|
|
# Btrfs snapshots do not recurse into nested subvolumes, so the factory
|
|
# root carries only an empty /swap directory where the hibernation swapfile
|
|
# lived. Recreate it and refresh the resume offset before the UKI build
|
|
# bakes the cmdline; the empty placeholder directory has to go first so the
|
|
# subvolume can be recreated.
|
|
if [[ -x $next/usr/bin/omarchy-hibernation-setup ]] && grep -q "/swap/swapfile" "$next/etc/fstab"; then
|
|
log "Recreating the hibernation swapfile in the factory system"
|
|
if [[ -d $next/swap ]] && ! btrfs subvolume show "$next/swap" >/dev/null 2>&1; then
|
|
rmdir "$next/swap" 2>/dev/null || true
|
|
fi
|
|
# The factory root still carries the resume drop-ins from install, which
|
|
# make hibernation-setup conclude it has nothing to do; with the swapfile
|
|
# gone they must go so it reconfigures from scratch. The resume-offset
|
|
# drop-in especially: hibernation-setup only recomputes the physical
|
|
# offset when it is absent, so a surviving one bakes the old swapfile's
|
|
# offset into the rebuilt UKI and breaks resume.
|
|
if [[ ! -f $next/swap/swapfile ]]; then
|
|
rm -f "$next/etc/mkinitcpio.conf.d/omarchy_resume.conf" \
|
|
"$next/etc/limine-entry-tool.d/resume.conf"
|
|
fi
|
|
if ! chroot "$next" env OMARCHY_PATH=/usr/share/omarchy \
|
|
/usr/bin/omarchy-hibernation-setup --force --no-rebuild >>"$LOG_FILE" 2>&1; then
|
|
fail "hibernation setup failed in the factory root (see $LOG_FILE)"
|
|
fi
|
|
[[ -f $next/swap/swapfile ]] ||
|
|
fail "hibernation setup did not recreate $next/swap/swapfile (see $LOG_FILE)"
|
|
fi
|
|
|
|
reset_limine_config "$next" "$esp_mount"
|
|
|
|
log "Rebuilding boot files from the factory system (this can take a minute)"
|
|
if ! chroot "$next" /usr/bin/limine-update >>"$LOG_FILE" 2>&1; then
|
|
fail "limine-update failed in the factory root (see $LOG_FILE)"
|
|
fi
|
|
|
|
verify_limine_hashes "$next" "$esp_mount"
|
|
|
|
for dir in run dev sys proc; do
|
|
umount -R "$next/$dir" 2>/dev/null || true
|
|
done
|
|
umount "$next$esp_mount"
|
|
}
|
|
|
|
# The boot package stages the factory root's boot files and unlock, then proves
|
|
# they boot it; reset-rollback undoes both if the reset fails before the switch.
|
|
# The throwaway slot is added only once they are proven.
|
|
rebuild_next_boot_platform() {
|
|
local next="$1"
|
|
local -a luks=()
|
|
[[ -z ${RESET_LUKS_DEVICE:-} ]] || luks=("$RESET_LUKS_DEVICE")
|
|
|
|
RESET_BOOT_PREPARED=1
|
|
log "Rebuilding boot files from the factory system (this can take a minute)"
|
|
reset_boot_op reset-prepare "$next" "${luks[@]}" || fail "$RESET_BOOT_ERROR (see $LOG_FILE)"
|
|
log "Verifying that the factory system boots"
|
|
reset_boot_op reset-verify "$next" || fail "$RESET_BOOT_ERROR (see $LOG_FILE)"
|
|
|
|
[[ -z ${RESET_LUKS_DEVICE:-} ]] || add_reset_luks_slot
|
|
}
|
|
|
|
# Both the staged system and the retained baseline must lose the old hashes.
|
|
scrub_factory_accounts() {
|
|
local root="$1" user users
|
|
|
|
users=$(awk -F: '$3 >= 1000 && $3 < 60000 { print $1 }' "$root/etc/passwd") || return 1
|
|
for user in $users; do
|
|
userdel --root "$root" "$user" 2>>"$LOG_FILE" || return 1
|
|
rm -rf "${root:?}/home/$user" || return 1
|
|
done
|
|
|
|
# passwd --lock preserves the hash. Replace it, then remove the backups
|
|
# that userdel and usermod leave behind.
|
|
usermod --root "$root" --password '!' root >>"$LOG_FILE" 2>&1 || return 1
|
|
rm -f "$root/etc/"{shadow-,gshadow-,passwd-,group-,subuid-,subgid-}
|
|
}
|
|
|
|
# Remove the seller's account material and machine identity from the retained
|
|
# @factory baseline so it can neither be mounted for recovery nor restore the
|
|
# seller's account on a future reset. Idempotent (a scrubbed baseline has no
|
|
# uid>=1000 accounts left to remove).
|
|
sanitize_factory_baseline() {
|
|
local factory="$1"
|
|
btrfs property set -ts "$factory" ro false
|
|
|
|
if ! scrub_factory_accounts "$factory"; then
|
|
btrfs property set -ts "$factory" ro true
|
|
fail "could not remove account credentials from the factory baseline (see $LOG_FILE)"
|
|
fi
|
|
rm -f "$factory"/etc/ssh/ssh_host_*
|
|
rm -f "$factory"/etc/NetworkManager/system-connections/*
|
|
rm -rf "$factory"/var/lib/NetworkManager/* "$factory/var/lib/tailscale" "$factory/var/lib/iwd"
|
|
rm -f "$factory/var/lib/sddm/state.conf" "$factory/etc/sddm.conf.d/autologin.conf"
|
|
: >"$factory/etc/machine-id"
|
|
|
|
btrfs property set -ts "$factory" ro true
|
|
}
|
|
|
|
stage_full_reset() {
|
|
local top="$TOP_MNT" next="$TOP_MNT/$NEXT_NAME"
|
|
|
|
log "Cloning the factory snapshot"
|
|
[[ -d $next ]] && btrfs subvolume delete --recursive "$next" >/dev/null
|
|
btrfs subvolume snapshot "$top/@factory" "$next" >>"$LOG_FILE"
|
|
|
|
local unit_src="$next/usr/share/omarchy/install/provisioning"
|
|
[[ -f $unit_src/omarchy-provision-owner.service && -x $next/usr/bin/omarchy-provision-owner ]] ||
|
|
fail "the factory snapshot predates provisioning support; cannot reset from it"
|
|
|
|
log "Scrubbing machine identity from the factory system"
|
|
systemd-id128 new >"$next/etc/machine-id"
|
|
rm -f "$next"/etc/ssh/ssh_host_*
|
|
rm -f "$next"/etc/NetworkManager/system-connections/*
|
|
rm -rf "$next"/var/lib/NetworkManager/* "$next/var/lib/tailscale" "$next/var/lib/iwd"
|
|
rm -f "$next/var/lib/sddm/state.conf" "$next/etc/sddm.conf.d/autologin.conf"
|
|
|
|
# A factory snapshot from a normal install contains the original
|
|
# user account; first-boot setup must start from none. A leftover account
|
|
# would keep its password hash and group memberships (including wheel), so
|
|
# failure here has to abort the reset, not be shrugged off.
|
|
log "Removing account credentials from the factory system"
|
|
scrub_factory_accounts "$next" ||
|
|
fail "could not remove account credentials from the factory system (see $LOG_FILE)"
|
|
|
|
# @factory itself survives the wipe as the baseline for future resets. If it
|
|
# came from a normal install it still holds the seller's account and
|
|
# /etc/shadow, which the new wheel user could mount and read — and a second
|
|
# reset would restore that account. Scrub it once, in place.
|
|
sanitize_factory_baseline "$top/@factory"
|
|
|
|
# Keep the Node tarball reachable for offline first-boot finalization.
|
|
if ! compgen -G "$next$PROVISIONING_DIR/packages/node-v*.tar.gz" >/dev/null; then
|
|
if compgen -G "$PROVISIONING_DIR/packages/node-v*.tar.gz" >/dev/null; then
|
|
install -d -m 755 "$next$PROVISIONING_DIR/packages"
|
|
cp "$PROVISIONING_DIR"/packages/node-v*.tar.gz "$next$PROVISIONING_DIR/packages/"
|
|
fi
|
|
fi
|
|
|
|
install -d -m 755 "$next$PROVISIONING_DIR"
|
|
touch "$next$PROVISIONING_DIR/pending" "$next$PROVISIONING_DIR/wipe-pending"
|
|
|
|
install_provisioning_units "$next" "$unit_src"
|
|
|
|
if encrypted_install; then
|
|
stage_luks_rekey "$next"
|
|
fi
|
|
|
|
rebuild_next_boot "$next"
|
|
|
|
log "Activating the factory system"
|
|
local old="@omarchy-old-$(date +%s)"
|
|
mv "$top/@" "$top/$old"
|
|
# Until the factory root is at @ the reset is not committed: cleanup has the
|
|
# platform's boot package roll its boot state back to the old root and
|
|
# revokes the throwaway slot, so the old root goes back to @ first.
|
|
if ! mv "$next" "$top/@"; then
|
|
if mv "$top/$old" "$top/@"; then
|
|
[[ $RESET_BOOT == "platform" ]] ||
|
|
fail "could not activate the factory system; the current root is back at @, but its boot files were already rebuilt from the factory system: run 'sudo limine-update' before rebooting (see $LOG_FILE)"
|
|
fail "could not activate the factory system; the current root is back at @ (see $LOG_FILE)"
|
|
fi
|
|
# Neither root is at @. Keep the staged one as well for recovery.
|
|
swap_done=1
|
|
fail "could not activate the factory system or put the current root back; from a live USB, mount the Btrfs top level, rename $old to @, and rebuild its boot files if it does not boot"
|
|
fi
|
|
# From here the old root is gone, so the reset's unlock must survive.
|
|
reset_committed=1
|
|
swap_done=1
|
|
sync
|
|
|
|
# The boot package that prepared the reset gets the key on standard input,
|
|
# never in arguments. A failure costs the first boot one prompt for the
|
|
# current disk password.
|
|
if [[ ${RESET_BOOT_PREPARED:-0} == 1 ]] && ! reset_boot_op reset-commit < <(printf '%s' "${RESET_THROWAWAY:-}"); then
|
|
log "$RESET_BOOT_ERROR"
|
|
fi
|
|
}
|
|
|
|
# A reset is a clone of @factory, so a machine without one has nothing to
|
|
# return to. Only the Quattro installer takes that snapshot.
|
|
require_factory_snapshot() {
|
|
[[ -d $TOP_MNT/@factory ]] && return 0
|
|
|
|
echo
|
|
gum style --bold --foreground 3 "This machine has no factory snapshot to reset to."
|
|
echo
|
|
gum style "A reset restores the @factory snapshot the Omarchy Quattro installer takes"
|
|
gum style "right after installing. Machines upgraded to Quattro from an earlier version,"
|
|
gum style "or installed some other way, never got one, so there is no baseline here to"
|
|
gum style "return to."
|
|
echo
|
|
gum style --foreground 8 "Reinstall from the Omarchy ISO to make this machine resettable."
|
|
exit 1
|
|
}
|
|
|
|
main() {
|
|
omarchy-cmd-present btrfs || { echo "Error: btrfs-progs is required" >&2; exit 1; }
|
|
|
|
root_is_btrfs_at || fail "reset requires the standard Omarchy Btrfs layout (subvol=@)"
|
|
|
|
touch "$LOG_FILE"
|
|
chmod 600 "$LOG_FILE"
|
|
swap_done=0
|
|
|
|
local device
|
|
device=$(root_device)
|
|
[[ -n $device ]] || fail "could not determine the root device"
|
|
|
|
mkdir -p "$TOP_MNT"
|
|
mountpoint -q "$TOP_MNT" || mount -o subvolid=5 "$device" "$TOP_MNT"
|
|
|
|
require_factory_snapshot
|
|
|
|
# Decided before anything is asked: a platform whose boot package is missing
|
|
# stops here, with the dispatcher's error naming the package.
|
|
reset_boot_owner || fail "this machine's boot package cannot factory-reset it"
|
|
|
|
confirm_reset
|
|
|
|
# The running system's limine-snapper-sync must not rewrite the ESP's
|
|
# limine.conf behind the staged rebuild (subvolume changes below can
|
|
# trigger it). The runtime mask evaporates on the reboot that follows.
|
|
systemctl mask --runtime --now limine-snapper-sync.service >/dev/null 2>&1 || true
|
|
systemctl mask --runtime --now limine-snapper-sync.path >/dev/null 2>&1 || true
|
|
|
|
stage_full_reset
|
|
|
|
umount -R "$TOP_MNT" 2>/dev/null || true
|
|
|
|
echo
|
|
gum style --bold "Reset staged. The wipe finishes on the next boot."
|
|
if gum confirm --affirmative "Reboot now" --negative "Reboot later" "Reboot to complete the reset?"; then
|
|
systemctl reboot
|
|
else
|
|
gum style --foreground 3 "Do not keep using this machine — changes made now will be lost."
|
|
fi
|
|
}
|
|
|
|
main "$@"
|