ezjail now comes with image jails. HEADS UP! A lot of testing is ahead.

ezjail-admin

@@ -28,6 +28,16 @@ ezjail_fdescfs_enable=${ezjail_fdescfs_enable:-"YES"}
 # define our bail out shortcut
 exerr () { echo -e "$*"; exit 1; }
 
+# define detach strategy for image jails
+detach_images () {
+  # unmount and detach memory disc
+  if [ "${newjail_img_device}" ]; then
+    umount ${newjail_root}
+    [ "${newjail_image}" = "crypto" ] && gbde detach /dev/${newjail_img_device}
+    mdconfig -d -u ${newjail_img_device}
+  fi
+}
+
 # check for command
 [ "$1" ] || exerr "Usage: `basename -- $0` [create|delete|list|update] {params}"
 
@@ -35,11 +45,14 @@ case "$1" in
 ######################## ezjail-admin CREATE ########################
 create)
   shift
-  args=`getopt xf:r: $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip"
+  args=`getopt f:r:s:xic $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-s size] [-xic] jailname jailip"
 
   newjail_root=
   newjail_flavour=
   newjail_softlink=
+  newjail_image=
+  newjail_imagesize=
+  newjail_device=
   newjail_fill="YES"
 
   set -- ${args}
@@ -48,14 +61,20 @@ create)
       -x) newjail_fill="NO"; shift;;
       -r) newjail_root="$2"; shift 2;;
       -f) newjail_flavour="$2"; shift 2;;
+      -i) newjail_image="simple"; shift;;
+      -s) newjail_imagesize="$2"; shift 2;;
+      -c) newjail_image="crypto"; shift;;
       --) shift; break;;
     esac
   done
-  newjail_name=$1; newjail_ip=$2
+  newjail_name=$1; newjail_ip=$2   
 
   # we need at least a name and an ip for new jail
   [ "${newjail_name}" -a "${newjail_ip}" -a $# = 2 ] || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip"
 
+  # check for sanity of settings concerning the image feature
+  [ "${newjail_image}" -a "$newjail_fill" = "YES" -a ! "${newjail_imagesize}" ] && exerr "Image jails need an image size."
+
   # check, whether ezjail-update has been called. existence of
   # ezjail_jailbase is our indicator
   [ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. Please run 'ezjail-admin update' first."
@@ -103,35 +122,87 @@ create)
   # All sanity checks that may lead to errors are hopefully passed here
   #
 
+  if [ "${newjail_image}" ]; then
+    # Strip trailing slashes from jail root, those would confuse image path
+    newjail_img=${newjail_root%/}; while [ "${newjail_img}" -a -z "${newjail_img%%*/}" ]; do newjail_img=${newjail_img%/}; done
+    [ -z "${newjail_img}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${newjail_root}."
+
+    # Location of our image and crypto image lock file
+    newjail_lock=${newjail_img}.lock
+    newjail_img=${newjail_img}.img
+
+    # If NOT exist, create image
+    if [ "$newjail_fill" = "YES" ]; then
+      [ -e "${newjail_img}" ] && exerr "Error: a file exists at the location ${newjail_img}, preventing our own image file to be created."
+      [ "${newjail_image}" = "crypto" -a -e "${newjail_lock}" ] && exerr "Error: a file exists at the location ${newjail_lock}, preventing our own crypto image lock file to be created."
+
+      # Now create jail disc image
+      touch "${newjail_img}"
+      dd if=/dev/random of="${newjail_img}" bs="${newjail_imagesize}" count=1 || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${newjail_img}. The image size provided was ${newjail_imagesize}."
+
+      # And attach device
+      newjail_img_device=`mdconfig -a -t vnode -f ${newjail_img}`
+
+      if [ "${newjail_image}" = "crypto" ]; then
+        # Initialise crypto image
+        # XXX TODO: catch error and detach memory disc
+        echo "Initialising crypto device. Enter a new passphrase twice..."
+        gbde init /dev/${newjail_img_device} -L ${newjail_lock}
+
+        # XXX TODO: catch error and detach memory disc
+        echo "Attaching crypto device. Enter the passphrase..."
+        gbde attach /dev/${newjail_img_device} -l ${newjail_lock}
+        newjail_device=${newjail_img_device}.bde
+      else
+        newjail_device=${newjail_img_device}
+      fi
+
+      # Format memory image
+      newfs /dev/${newjail_device}
+      # Create mount point and mount
+      mkdir -p ${newjail_root}
+      mount /dev/${newjail_device} ${newjail_root}
+    else
+      [ -e ${newjail_root} -a ! -d ${newjail_root} ] && exerr "Error: Could not create mount point for your jail image. A file exists at its location. (For existing image jails, call this tool without the .img suffix when specifying jail root.)"
+      [ -d ${newjail_root} ] || mkdir -p ${newjail_root}
+    fi
+  fi
+
   # now take a copy of our template jail
   if [ "${newjail_fill}" = "YES" ]; then
-    mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && \
+    mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && find * | cpio -p -v ${newjail_root} > /dev/null
-    find * | cpio -p -v ${newjail_root} > /dev/null
+    [ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail."
-    [ $? = 0 ] || exerr "Error: Could not copy template jail."
   fi
 
   # if a soft link is necessary, create it now
-  [ "${newjail_softlink}" ] && ln -s ${newjail_root} ${newjail_softlink}
+  [ "${newjail_softlink}" ] && ln -s ${newjail_root} ${newjail_softlink}  
 
   # if the automount feature is not disabled, this fstab entry for new jail
   # will be obeyed
-  echo ${ezjail_jailbase} ${newjail_root}/basejail nullfs ro 0 0 > /etc/fstab.${newjail_nname}
+  echo -n > /etc/fstab.${newjail_nname}
+  [ "${newjail_image}" ] && \
+  echo ${newjail_root}.device ${newjail_root} ufs rw 0 0 >> /etc/fstab.${newjail_nname}
+  echo ${ezjail_jailbase} ${newjail_root}/basejail nullfs ro 0 0 >> /etc/fstab.${newjail_nname}
 
-  # now, where everything seems to have gone right, create control file in
+  # now, where everything seems to have gone right, create control file in  
   # ezjails config dir
   mkdir -p ${ezjail_jailcfgs}
-  echo export jail_${newjail_nname}_hostname=\"${newjail_name}\"  > ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_hostname=\"${newjail_name}\" > ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_ip=\"${newjail_ip}\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_ip=\"${newjail_ip}\" >> ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_rootdir=\"${newjail_root}\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_rootdir=\"${newjail_root}\" >> ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_exec=\"/bin/sh /etc/rc\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_exec=\"/bin/sh /etc/rc\" >> ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_mount_enable=\"${ezjail_mount_enable}\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_mount_enable=\"${ezjail_mount_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_devfs_enable=\"${ezjail_devfs_enable}\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_devfs_enable=\"${ezjail_devfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_jailcfgs}/${newjail_nname}
-  echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\"  >> ${ezjail_jailcfgs}/${newjail_nname}
+  echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname}
   echo export jail_${newjail_nname}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname}
+  [ "${newjail_image}" ] && \
+  echo export jail_${newjail_nname}_image=\"${newjail_img}\" >> ${ezjail_jailcfgs}/${newjail_nname}
+  [ "${newjail_image}" = "crypto" ] && \
+  echo export jail_${newjail_nname}_cryptimage=\"YES\" >> ${ezjail_jailcfgs}/${newjail_nname}
 
-  # Final steps for flavour installation
+  # Final steps for flavour installation   
-  if [ "${newjail_flavour}" ]; then
+  if [ "${newjail_fill}" = "YES" -a "${newjail_flavour}" ]; then
     # install files and config to new jail
     cd ${ezjail_flavours}/${newjail_flavour} && find * | cpio -p -v ${newjail_root} > /dev/null
     [ $? = 0 ] || echo "Warning: Could not fully install flavour."
@@ -144,6 +215,9 @@ create)
     fi
   fi
 
+  # Detach (crypto and) memory discs
+  detach_images
+
   #
   # For user convenience some scenarios commonly causing headaches are checked
   #
@@ -160,7 +234,7 @@ create)
   newjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]`
   [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${newjail_ip})\n  This may cause some confusion, here they are:\n${newjail_listener}"
   IFS=${TIFS}
-
+  
   ;;
 ######################## ezjail-admin DELETE ########################
 delete)
@@ -190,6 +264,7 @@ delete)
   # fetch information about the jail to be gone by parsing our records
   . ${ezjail_jailcfgs}/${oldjail_nname}
   eval oldjail_rootdir=\"\$jail_${oldjail_nname}_rootdir\"
+  eval oldjail_image=\"\$jail_${oldjail_nname}_image\"
 
   # if jail is still running, refuse to go any further
   [ -f /var/run/jail_${oldjail_nname}.id ] && exerr "Error: Jail appears to be still running, stop it first.\n(/var/run/jail_${oldjail_nname}.id exists)."
@@ -204,7 +279,10 @@ delete)
   [ -L ${oldjail_softlink} ] && rm ${oldjail_softlink}
 
   # if wiping the jail was requested, remove it
-  [ "${oldjail_wipe}" ] && rm -rf ${oldjail_rootdir}
+  if [ "${oldjail_wipe}" ]; then
+    [ "${oldjail_image}" ] && rm -f ${oldjail_image} ${oldjail_image%.img}.lock ${oldjail_image%.img}.device
+    rm -rf ${oldjail_rootdir}
+  fi
 
   ;;
 ######################## ezjail-admin LIST ########################