689 lines
31 KiB
Bash
Executable File
689 lines
31 KiB
Bash
Executable File
#!/bin/sh
|
|
# $Id$
|
|
|
|
# ugly: this variable is set during port install time
|
|
ezjail_prefix=EZJAIL_PREFIX
|
|
ezjail_etc=${ezjail_prefix}/etc
|
|
ezjail_share=${ezjail_prefix}/share/ezjail
|
|
ezjail_examples=${ezjail_prefix}/share/examples/ezjail
|
|
ezjail_jailcfgs=${ezjail_etc}/ezjail
|
|
|
|
# read user config
|
|
[ -f ${ezjail_etc}/ezjail.conf ] && . ${ezjail_etc}/ezjail.conf
|
|
|
|
# set defaults
|
|
ezjail_jaildir=${ezjail_jaildir:-"/usr/jails"}
|
|
ezjail_jailtemplate=${ezjail_jailtemplate:-"${ezjail_jaildir}/newjail"}
|
|
ezjail_jailbase=${ezjail_jailbase:-"${ezjail_jaildir}/basejail"}
|
|
ezjail_jailfull=${ezjail_jailfull:-"${ezjail_jaildir}/fulljail"}
|
|
ezjail_jailtemp=${ezjail_jailtemp:-"${ezjail_jaildir}/ezjailtemp"}
|
|
ezjail_flavours=${ezjail_flavours:-"${ezjail_jaildir}/flavours"}
|
|
ezjail_portscvsroot=${ezjail_portscvsroot:-":pserver:anoncvs@anoncvs.at.FreeBSD.org:/home/ncvs"}
|
|
ezjail_sourcetree=${ezjail_sourcetree:-"/usr/src"}
|
|
ezjail_uglyperlhack=${ezjail_uglyperlhack:-"YES"}
|
|
|
|
ezjail_mount_enable=${ezjail_mount_enable:-"YES"}
|
|
ezjail_devfs_enable=${ezjail_devfs_enable:-"YES"}
|
|
ezjail_devfs_ruleset=${ezjail_devfs_ruleset:-"devfsrules_jail"}
|
|
ezjail_procfs_enable=${ezjail_procfs_enable:-"YES"}
|
|
ezjail_fdescfs_enable=${ezjail_fdescfs_enable:-"YES"}
|
|
|
|
ezjail_dirlist="bin boot lib libexec rescue sbin usr/bin usr/games usr/include usr/lib usr/libdata usr/libexec usr/sbin usr/src usr/share"
|
|
case `uname -p` in amd64) ezjail_dirlist="${ezjail_dirlist} usr/lib32";; esac
|
|
|
|
# Synopsis messages
|
|
ezjail_usage_ezjailadmin="Usage: `basename -- $0` [config|create|delete|install|list|update] {params}"
|
|
ezjail_usage_create="Usage: `basename -- $0` create [-xbi] [-f flavour] [-r jailroot] [-s size] [-c bde|eli] [-C args] jailname jailip"
|
|
ezjail_usage_delete="Usage: `basename -- $0` delete [-w] jailname"
|
|
ezjail_usage_list="Usage: `basename -- $0` list"
|
|
ezjail_usage_update="Usage: `basename -- $0` update [-s sourcetree] [-i] [-pP]"
|
|
ezjail_usage_install="Usage: `basename -- $0` install [-mps] [-h host] [-r release]"
|
|
ezjail_usage_config="Usage: `basename -- $0` config [-r run|norun] [-i attach|detach] jailname"
|
|
|
|
################################
|
|
# End of variable initialization
|
|
#
|
|
|
|
# define our bail out shortcut
|
|
exerr () { echo -e "$*" >&2 ; exit 1; }
|
|
|
|
# define detach strategy for image jails
|
|
detach_images () {
|
|
# unmount and detach memory disc
|
|
if [ -n "${ezjail_imagedevice}" ]; then
|
|
umount ${ezjail_rootdir} > /dev/null
|
|
case ${ezjail_imagetype} in
|
|
bde) gbde detach /dev/${ezjail_imagedevice} > /dev/null;;
|
|
eli) geli detach /dev/${ezjail_imagedevice} > /dev/null;;
|
|
esac
|
|
mdconfig -d -u ${ezjail_imagedevice} > /dev/null
|
|
[ "$1" = "keep" ] || rm -f ${ezjail_image}
|
|
fi
|
|
# This function is being called in case of error. Keep $? bad
|
|
return 1
|
|
}
|
|
|
|
# fetch everything we need to know about an ezjail from config
|
|
fetchjailinfo () {
|
|
ezjail_name=$1
|
|
|
|
# Clean variables, prevent polution
|
|
unset ezjail_config ezjail_running ezjail_hostname ezjail_rootdir ezjail_image ezjail_imagetype ezjail_ip ezjail_id ezjail_attached ezjail_device
|
|
|
|
ezjail_safename=`echo -n "${ezjail_name}" | tr -c [:alnum:] _`
|
|
|
|
[ -e ${ezjail_jailcfgs}/${ezjail_safename} ] && ezjail_config=${ezjail_jailcfgs}/${ezjail_safename}
|
|
[ -e ${ezjail_jailcfgs}/${ezjail_safename}.norun ] && ezjail_config=${ezjail_jailcfgs}/${ezjail_safename}.norun
|
|
[ "${ezjail_config}" ] || return 0
|
|
|
|
. ${ezjail_config}
|
|
eval ezjail_hostname=\"\$jail_${ezjail_safename}_hostname\"
|
|
eval ezjail_rootdir=\"\$jail_${ezjail_safename}_rootdir\"
|
|
eval ezjail_ip=\"\$jail_${ezjail_safename}_ip\"
|
|
eval ezjail_image=\"\$jail_${ezjail_safename}_image\"
|
|
eval ezjail_imagetype=\"\$jail_${ezjail_safename}_imagetype\"
|
|
eval ezjail_attachparams=\"\$jail_${ezjail_safename}_attachparams\"
|
|
eval ezjail_attachblocking=\"\$jail_${ezjail_safename}_attachblocking\"
|
|
eval ezjail_forceblocking=\"\$jail_${ezjail_safename}_forceblocking\"
|
|
|
|
ezjail_softlink=${ezjail_jaildir}/`basename -- ${ezjail_rootdir}`
|
|
|
|
if [ -n "${ezjail_image}" -a -L "${ezjail_rootdir}.device" ]; then
|
|
# Fetch destination of soft link
|
|
ezjail_device=`stat -f "%Y" ${ezjail_rootdir}.device`
|
|
[ -e "${ezjail_device}" ] && ezjail_attached="YES"
|
|
fi
|
|
|
|
[ -f /var/run/jail_${ezjail_safename}.id ] && ezjail_id=`cat /var/run/jail_${ezjail_safename}.id` || return
|
|
jls | grep -q -E "^ +${ezjail_id} " || unset ezjail_id
|
|
}
|
|
|
|
# fill the base jail - this function is used by install and update
|
|
ezjail_splitworld() {
|
|
# Fill basejail from installed world
|
|
cd ${ezjail_jailfull} || exerr "Cant access temporary Jail directory."
|
|
|
|
# This mkdir is important, since cpio will create intermediate
|
|
# directories with permission 0700 which is bad
|
|
mkdir -p ${ezjail_jailbase}/usr
|
|
for dir in ${ezjail_dirlist}; do
|
|
find ${dir} | cpio -d -p -v ${ezjail_jailbase} || exerr "Installation of ${dir} failed."
|
|
chflags -R noschg ${dir}; rm -r ${dir}; ln -s /basejail/${dir} ${dir}
|
|
done
|
|
mkdir basejail
|
|
|
|
# Try to remove the old template jail
|
|
[ -d ${ezjail_jailtemplate} ] && chflags -R noschg ${ezjail_jailtemplate} && rm -rf ${ezjail_jailtemplate}
|
|
mv ${ezjail_jailfull} ${ezjail_jailtemplate}
|
|
|
|
# If the default flavour example has not yet been copied, do it now
|
|
[ -d ${ezjail_flavours}/default ] || mkdir -p ${ezjail_flavours} && cp -p -R ${ezjail_examples}/default ${ezjail_flavours}
|
|
|
|
# no /usr/ports? link to /basejail/usr/ports
|
|
[ -e ${ezjail_jailtemplate}/usr/ports ] || ln -s /basejail/usr/ports ${ezjail_jailtemplate}/usr/ports
|
|
|
|
# A ports collection inside jails is hardly useful w/o an appropriate
|
|
# /etc/make.conf.
|
|
if [ -f ${ezjail_examples}/default/etc/make.conf -a ! -f ${ezjail_jailtemplate}/etc/make.conf ]; then
|
|
cp -p ${ezjail_examples}/default/etc/make.conf ${ezjail_jailtemplate}/etc/
|
|
echo "Note: a non-standard /etc/make.conf was copied to the template jail in order to get the ports collection running inside jails."
|
|
fi
|
|
|
|
# The ugly perl hack[tm]. Note: we wont do such things for any given
|
|
# port :(
|
|
[ "${ezjail_uglyperlhack}" = "YES" -a ! -L ${ezjail_jailbase}/usr/bin/perl ] && ln -s /usr/local/bin/perl ${ezjail_jailbase}/usr/bin/perl
|
|
}
|
|
|
|
# The user may want to have a ports tree in basejail
|
|
ezjail_updateports () {
|
|
# if /usr/ports/CVS exists, assume cvs up is safe
|
|
# this is legacy
|
|
if [ -f ${ezjail_jailbase}/usr/ports/CVS/Root ]; then
|
|
echo -n "Updating ports from "; cat ${ezjail_jailbase}/usr/ports/CVS/Root
|
|
echo "Warning: Upgrading legacy ports copy. Consider removing ${ezjail_jailbase}/usr/ports and use the new portsnap strategy instead."
|
|
echo "Gathering local information may take a while."
|
|
cd ${ezjail_jailbase}/usr/ports/ && cvs -d ${ezjail_portscvsroot} up -Pd
|
|
else
|
|
portsnap fetch
|
|
[ -d ${ezjail_jailbase}/usr/ports ] && ezjail_portsnapaction=update
|
|
portsnap -p ${ezjail_jailbase}/usr/ports ${ezjail_portsnapaction:-"extract"}
|
|
fi
|
|
[ $? = 0 ] || exerr "Updating ports failed."
|
|
}
|
|
|
|
#############################
|
|
# End of function definitions
|
|
#
|
|
|
|
# check for command
|
|
[ $# -gt 0 ] || exerr ${ezjail_usage_ezjailadmin}
|
|
|
|
case "$1" in
|
|
######################## ezjail-admin CREATE ########################
|
|
create)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_rootdir ezjail_flavour ezjail_softlink ezjail_image ezjail_imagetype ezjail_imageparams ezjail_imagesize ezjail_device ezjail_config ezjail_attachparams ezjail_exists ezjail_attachblocking ezjail_forceblocking ezjail_sourcedevice
|
|
shift; while getopts :f:r:s:xbic:C: arg; do case ${arg} in
|
|
x) ezjail_exists="YES";;
|
|
r) ezjail_rootdir="${OPTARG}";;
|
|
f) ezjail_flavour="${OPTARG}";;
|
|
c) ezjail_imagetype="${OPTARG}";;
|
|
C) ezjail_imageparams="${OPTARG}";;
|
|
b) ezjail_forceblocking="YES";;
|
|
i) ezjail_imagetype=${ezjail_imagetype:-"simple"};;
|
|
s) ezjail_imagesize="${OPTARG}";;
|
|
?) exerr ${ezjail_usage_create};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
ezjail_name=$1; ezjail_ip=$2
|
|
|
|
# we need at least a name and an ip for new jail
|
|
[ "${ezjail_name}" -a "${ezjail_ip}" -a $# -eq 2 ] || exerr ${ezjail_usage_create}
|
|
|
|
# check for sanity of settings concerning the image feature
|
|
[ "${ezjail_imagetype}" -a -z "${ezjail_exists}" -a -z "${ezjail_imagesize}" ] && exerr "Image jails need an image size."
|
|
|
|
# check for a sane image type
|
|
case ${ezjail_imagetype} in ""|simple|bde|eli) ;; *) exerr ${ezjail_usage_create};; esac
|
|
|
|
# check for a sane image size and split it up in blocks
|
|
if [ "${ezjail_imagesize}" ]; then
|
|
_val=`echo "${ezjail_imagesize}"|tr A-Z a-z|sed -Ees:g:km:g -es:m:kk:g -es:k:*2b:g -es:b:*128w:g -es:w:*4\ :g -e"s:(^|[^0-9])0x:\1\0X:g" -ey:x:*:`
|
|
_val=`echo ${_val} | bc`
|
|
[ $? -eq 0 -a ${_val} -gt 0 ] || exerr "Error: The image size you specified is somehow incomprehensible (you specified ${ezjail_imagesize})."
|
|
ezjail_imageblockcount=`echo ${_val} / 1048576 | bc`
|
|
ezjail_imagerestbytes=`echo ${_val} % 1048576 | bc`
|
|
fi
|
|
|
|
# check, whether ezjail-update has been called. existence of
|
|
# ezjail_jailbase is our indicator
|
|
[ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. Please run 'ezjail-admin update' first."
|
|
|
|
# relative paths don't make sense in rc.scripts
|
|
[ "${ezjail_jaildir%%[!/]*}" ] || exerr "Error: Need an absolute path in ezjail_jaildir, it currently is set to: ${ezjail_jaildir}."
|
|
|
|
# jail names must not irritate file systems, excluding dots from this list
|
|
# was done intentionally to permit foo.com style directory names, however,
|
|
# the jail name will be foo_com in most scripts
|
|
|
|
ezjail_hostname=`echo -n ${ezjail_name} | tr /~ __`
|
|
ezjail_safename=`echo -n "${ezjail_name}" | tr -c [:alnum:] _`
|
|
ezjail_rootdir=${ezjail_rootdir:-"${ezjail_jaildir}/${ezjail_hostname}"}
|
|
ezjail_config=${ezjail_jailcfgs}/${ezjail_safename}
|
|
|
|
# This scenario really will only lead to real troubles in the 'fulljail'
|
|
# case, but I should still explain this to the user and not claim that
|
|
# "an ezjail would already exist"
|
|
case ${ezjail_hostname} in basejail|newjail|fulljail|flavous|ezjailtemp) exerr "Error: ezjail needs the ${ezjail_hostname} directory for its own administrative purposes. Please rename the ezjail.";; esac
|
|
|
|
# jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com
|
|
# so check, whether we might be running into problems
|
|
[ -e ${ezjail_config} ] && exerr "Error: an ezjail config already exists at ${ezjail_config}. Please rename the ezjail."
|
|
|
|
# if jail root specified on command line is not absolute, make it absolute
|
|
# inside our jail directory
|
|
[ "${ezjail_rootdir%%[!/]*}" ] || ezjail_rootdir=${ezjail_jaildir}/${ezjail_rootdir}
|
|
|
|
# if a directory at the specified jail root already exists, refuse to
|
|
# install
|
|
[ -e ${ezjail_rootdir} -a -z "${ezjail_exists}" ] && exerr "Error: the specified jail root ${ezjail_rootdir} alread exists."
|
|
|
|
# if jail root specified on command line does not lie within our jail
|
|
# directory, we need to create a softlink
|
|
if [ "${ezjail_rootdir##${ezjail_jaildir}}" = "${ezjail_rootdir}" ]; then
|
|
ezjail_softlink=${ezjail_jaildir}/`basename -- ${ezjail_rootdir}`
|
|
[ -e ${ezjail_softlink} ] && exerr "Error: an ezjail already exists at ${ezjail_softlink}."
|
|
fi
|
|
|
|
# do some sanity checks on the selected flavour (if any)
|
|
[ "${ezjail_flavour}" -a ! -d ${ezjail_flavours}/${ezjail_flavour} ] && exerr "Error: Flavour config directory ${ezjail_flavours}/${ezjail_flavour} not found."
|
|
|
|
#
|
|
# All sanity checks that may lead to errors are hopefully passed here
|
|
#
|
|
|
|
if [ "${ezjail_imagetype}" ]; then
|
|
# Strip trailing slashes from jail root, those would confuse image path
|
|
ezjail_image=${ezjail_rootdir%/}; while [ "${ezjail_image}" -a -z "${ezjail_image%%*/}" ]; do ezjail_image=${ezjail_image%/}; done
|
|
[ -z "${ezjail_image}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${ezjail_rootdir}."
|
|
|
|
# Location of our image file
|
|
ezjail_image=${ezjail_image}.img
|
|
|
|
# Prepare crypto jail so that an attacker cannot guess which blocks
|
|
# have been written
|
|
case ${ezjail_imagetype} in crypto|bde|eli) ezjail_sourcedevice=/dev/random;; simple) ezjail_sourcedevice=/dev/zero;; esac
|
|
|
|
# If NOT exist, create image
|
|
if [ -z "${ezjail_exists}" ]; then
|
|
[ -e "${ezjail_image}" ] && exerr "Error: a file exists at the location ${ezjail_image}, preventing our own image file to be created."
|
|
|
|
# Now create jail disc image
|
|
touch "${ezjail_image}"
|
|
if [ "${ezjail_imageblockcount}" -gt 0 ]; then
|
|
dd if=${ezjail_sourcedevice} of="${ezjail_image}" bs=1m count=${ezjail_imageblockcount} || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${ezjail_image}. The image size provided was ${ezjail_imagesize}."
|
|
fi
|
|
if [ "${ezjail_imagerestbytes}" -gt 0 ]; then
|
|
( dd if=${ezjail_sourcedevice} bs=${ezjail_imagerestbytes} count=1 >> "${ezjail_image}" ) || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${ezjail_image}. The image size provided was ${ezjail_imagesize}."
|
|
fi
|
|
|
|
# And attach device
|
|
ezjail_imagedevice=`mdconfig -a -t vnode -f ${ezjail_image}`
|
|
[ $? = 0 ] || detach_images || exerr "Error: Could not attach image device. (Command failed was 'mdconfig -a -t vnode -f ${ezjail_image}')"
|
|
case "${ezjail_imagetype}" in
|
|
bde|eli)
|
|
# parse imageparams, generate attachparams
|
|
ezjail_attachblocking="YES"
|
|
if [ -n "${ezjail_imageparams}" ]; then
|
|
ezjail_attachparams=`echo $0 _parse_g${ezjail_imagetype}_attach_args_ ${ezjail_imageparams} | /bin/sh `
|
|
[ 5 -eq $? ] && exerr "processing of ezjail_imageparams failed"
|
|
[ 3 -eq $? ] && unset ezjail_attachblocking
|
|
fi
|
|
case "${ezjail_imagetype}" in
|
|
bde) init_cmd="gbde init /dev/${ezjail_imagedevice} ${ezjail_imageparams}"
|
|
attach_cmd="gbde attach /dev/${ezjail_imagedevice} ${ezjail_attachparams}";;
|
|
eli) init_cmd="geli init ${ezjail_imageparams} /dev/${ezjail_imagedevice}"
|
|
attach_cmd="geli attach ${ezjail_attachparams} /dev/${ezjail_imagedevice}";;
|
|
esac
|
|
[ -n "${ezjail_attachblocking}" ] && echo "Initialising crypto device. Enter a new passphrase twice... "
|
|
( echo ${init_cmd} | /bin/sh ) || detach_images || exerr "Error: Could not initialise crypto image."
|
|
|
|
[ -n "${ezjail_attachblocking}" ] && echo "Attaching crypto device. Enter the passphrase... "
|
|
( echo ${attach_cmd} | /bin/sh ) || detach_images || exerr "Error: Could not attach crypto image."
|
|
ezjail_device=${ezjail_imagedevice}.${ezjail_imagetype}
|
|
;;
|
|
simple)
|
|
ezjail_device=${ezjail_imagedevice}
|
|
;;
|
|
esac
|
|
|
|
# Format memory image
|
|
newfs /dev/${ezjail_device} || detach_images || exerr "Error: Could not newfs /dev/${ezjail_device}."
|
|
# Create mount point and mount
|
|
mkdir -p ${ezjail_rootdir} || detach_images || exerr "Error: Could not create jail root mount point ${ezjail_rootdir}."
|
|
mount /dev/${ezjail_device} ${ezjail_rootdir} || detach_images || exerr "Error: Could not mount /dev/${ezjail_device} to ${ezjail_root}."
|
|
else
|
|
[ -e ${ezjail_rootdir} -a ! -d ${ezjail_rootdir} ] && exerr "Error: Could not create mount point for your jail image. A file exists at its location. (For existing image jails, call this tool without the .img suffix when specifying jail root.)"
|
|
[ -d ${ezjail_rootdir} ] || mkdir -p ${ezjail_rootdir}
|
|
fi
|
|
fi
|
|
|
|
# now take a copy of our template jail
|
|
if [ -z "${ezjail_exists}" ]; then
|
|
mkdir -p ${ezjail_rootdir} && cd ${ezjail_jailtemplate} && find * | cpio -p -v ${ezjail_rootdir} > /dev/null
|
|
[ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail."
|
|
fi
|
|
|
|
# if a soft link is necessary, create it now
|
|
[ "${ezjail_softlink}" ] && ln -s ${ezjail_rootdir} ${ezjail_softlink}
|
|
|
|
# if the automount feature is not disabled, this fstab entry for new jail
|
|
# will be obeyed
|
|
echo -n > /etc/fstab.${ezjail_safename}
|
|
[ "${ezjail_imagetype}" ] && \
|
|
echo ${ezjail_rootdir}.device ${ezjail_rootdir} ufs rw 0 0 >> /etc/fstab.${ezjail_safename}
|
|
echo ${ezjail_jailbase} ${ezjail_rootdir}/basejail nullfs ro 0 0 >> /etc/fstab.${ezjail_safename}
|
|
|
|
# now, where everything seems to have gone right, create control file in
|
|
# ezjails config dir
|
|
mkdir -p ${ezjail_jailcfgs}
|
|
echo "# To specify the start up order of your ezjails, use these lines to" > ${ezjail_config}
|
|
echo "# create a Jail dependency tree. See rcorder(8) for more details." >> ${ezjail_config}
|
|
echo -e "#\n# PROVIDE: standard_ezjail\n# REQUIRE: \n# BEFORE: \n#\n" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_hostname=\"${ezjail_hostname}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_ip=\"${ezjail_ip}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_rootdir=\"${ezjail_rootdir}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_exec=\"/bin/sh /etc/rc\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_mount_enable=\"${ezjail_mount_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_devfs_enable=\"${ezjail_devfs_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_image=\"${ezjail_image}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_imagetype=\"${ezjail_imagetype}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_attachparams=\"${ezjail_attachparams}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_attachblocking=\"${ezjail_attachblocking}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_forceblocking=\"${ezjail_forceblocking}\" >> ${ezjail_config}
|
|
|
|
# Final steps for flavour installation
|
|
if [ -z "${ezjail_exists}" -a -n "${ezjail_flavour}" ]; then
|
|
# install files and config to new jail
|
|
cd ${ezjail_flavours}/${ezjail_flavour} && find * | cpio -p -u -v ${ezjail_rootdir} > /dev/null
|
|
[ $? = 0 ] || echo "Warning: Could not fully install flavour."
|
|
|
|
# If a config is found, make it auto run on jails startup
|
|
if [ -f ${ezjail_rootdir}/ezjail.flavour ]; then
|
|
ln -s /ezjail.flavour ${ezjail_rootdir}/etc/rc.d/ezjail-config.sh
|
|
chmod 0700 ${ezjail_rootdir}/ezjail.flavour
|
|
echo "Note: Shell scripts installed, flavourizing on jails first startup."
|
|
fi
|
|
fi
|
|
|
|
# Detach (crypto and) memory discs
|
|
detach_images keep
|
|
|
|
#
|
|
# For user convenience some scenarios commonly causing headaches are checked
|
|
#
|
|
|
|
# check, whether IP is configured on a local interface, warn if it isnt
|
|
ping -c 1 -m 1 -t 1 -q ${ezjail_ip} > /dev/null
|
|
[ $? = 0 ] || echo "Warning: IP ${ezjail_ip} not configured on a local interface."
|
|
|
|
# check, whether some host system services do listen on the Jails IP
|
|
TIFS=${IFS}; IFS=_
|
|
ezjail_listener=`sockstat -4 -l | grep ${ezjail_ip}:[[:digit:]]`
|
|
[ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on IP ${ezjail_ip}\n This may cause some confusion, here they are:\n${ezjail_listener}"
|
|
|
|
ezjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]`
|
|
[ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${ezjail_ip})\n This may cause some confusion, here they are:\n${ezjail_listener}"
|
|
IFS=${TIFS}
|
|
|
|
;;
|
|
######################## ezjail-admin DELETE ########################
|
|
delete)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_wipeme
|
|
|
|
shift; while getopts :w arg; do case ${arg} in
|
|
w) ezjail_wipeme="YES";;
|
|
?) exerr ${ezjail_usage_delete};;
|
|
esac; done; shift $(( $OPTIND - 1 ))
|
|
|
|
# we need name of jail to vanish
|
|
[ $# -eq 1 ] || exerr ${ezjail_usage_delete}
|
|
|
|
# Get all info we have on that jail
|
|
fetchjailinfo $1
|
|
|
|
# check for existence of jail in our records
|
|
[ -n "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."
|
|
|
|
# if jail is still running, refuse to go any further
|
|
[ -n "${ezjail_id}" ] && exerr "Error: Jail appears to be still running, stop it first."
|
|
|
|
# if jail is attached, refuse to go any further
|
|
[ -n "${ezjail_attached}" ] && exerr "Error: Jail image file ${ezjail_image} is attached as ${ezjail_device}. '`basename -- $0` config -i detach' it first."
|
|
|
|
# now we know everything we need to let the jail be gone remove entry
|
|
# from ezjail resource structure, delete fstab.JAILNAME
|
|
rm -f ${ezjail_config} /etc/fstab.${ezjail_safename}
|
|
|
|
# if there is a soft link pointing to the jail root, remove it
|
|
[ -L ${ezjail_softlink} ] && rm ${ezjail_softlink}
|
|
|
|
# if wiping the jail was requested, remove it
|
|
if [ "${ezjail_wipeme}" ]; then
|
|
[ "${ezjail_image}" ] && rm -f ${ezjail_image} ${ezjail_image%.img}.device
|
|
rm -rf ${ezjail_rootdir}
|
|
fi
|
|
|
|
;;
|
|
######################## ezjail-admin LIST ########################
|
|
list)
|
|
[ $# -eq 1 ] || exerr ${ezjail_usage_list}
|
|
|
|
ezjail_list=`find -X ${ezjail_prefix}/etc/ezjail/ 2> /dev/null | xargs rcorder | xargs basename -a`
|
|
|
|
printf "%-3s %-5s %-15s %-28s %s\\n" STA JID IP Hostname "Root Directory"
|
|
echo "--- ----- --------------- ---------------------------- -----------------------------"
|
|
for ezjail in ${ezjail_list}; do
|
|
fetchjailinfo ${ezjail%.norun}
|
|
case ${ezjail_imagetype} in simple) ezjail_state="I";; bde) ezjail_state="B";; eli) ezjail_state="E";; *) ezjail_state="D";; esac
|
|
if [ "${ezjail_id}" ]; then
|
|
ezjail_state=${ezjail_state}R
|
|
else
|
|
[ -n "${ezjail_attached}" ] && ezjail_state=${ezjail_state}A || ezjail_state=${ezjail_state}S
|
|
fi
|
|
[ "${ezjail_safename}" != "${ezjail}" ] && ezjail_state=${ezjail_state}N
|
|
|
|
printf "%-3s %-5s %-15s %-28s %s\\n" "${ezjail_state}" "${ezjail_id:-N/A}" "${ezjail_ip}" "${ezjail_hostname}" "${ezjail_rootdir}"
|
|
done
|
|
|
|
;;
|
|
######################## ezjail-admin UPDATE ########################
|
|
setup|update)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_provideports
|
|
ezjail_installaction="world"
|
|
|
|
shift; while getopts :ipPs: arg; do case ${arg} in
|
|
i) ezjail_installaction="installworld";;
|
|
s) ezjail_sourcetree="${OPTARG}";;
|
|
p) ezjail_provideports="YES";;
|
|
P) ezjail_provideports="YES"; ezjail_installaction="none";;
|
|
?) exerr ${ezjail_usage_update};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
[ $# -eq 0 ] || exerr ${ezjail_usage_update}
|
|
|
|
if [ "${ezjail_installaction}" = "none" ]; then
|
|
# check, whether ezjail-update has been called. existence of
|
|
# ezjail_jailbase is our indicator
|
|
[ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. You cannot fill base jails ports tree before creating it. Please run 'ezjail-admin update' first."
|
|
else
|
|
# Bump the user for some of the most common errors
|
|
[ -d ${ezjail_sourcetree} ] || exerr "Cannot find your copy of the FreeBSD source tree in ${ezjail_sourcetree}."
|
|
[ -e ${ezjail_sourcetree}/Makefile ] || exerr "Your source tree in ${ezjail_sourcetree} seems to be incomplete (Makefile missing)."
|
|
|
|
# Normally fulljail should be renamed by past ezjail-admin commands.
|
|
# However those may have failed
|
|
[ -d "${ezjail_jailfull}" ] && chflags -R noschg ${ezjail_jailfull} && rm -rf ${ezjail_jailfull}
|
|
mkdir -p ${ezjail_jailfull} || exerr "Cannot create temporary Jail directory."
|
|
|
|
# make and setup our world, then split basejail and newjail
|
|
cd ${ezjail_sourcetree} && make ${ezjail_installaction} DESTDIR=${ezjail_jailfull} || exerr "make ${ezjail_installaction} failed."
|
|
cd ${ezjail_sourcetree}/etc && make distribution DESTDIR=${ezjail_jailfull} || exerr "make distribution failed."
|
|
ezjail_splitworld
|
|
|
|
fi # installaction="none"
|
|
|
|
# Provide a copy of ports tree in basejail
|
|
[ "${ezjail_provideports}" = "YES" ] && ezjail_updateports
|
|
|
|
;;
|
|
######################## ezjail-admin INSTALL ########################
|
|
install)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_release ezjail_ftphost ezjail_installmanpages ezjail_installports ezjail_installsources ezjail_dir ezjail_reldir
|
|
|
|
shift; while getopts :mpsh:r: arg; do case ${arg} in
|
|
m) ezjail_installmanpages=" manpages";;
|
|
s) ezjail_installsources=" src";;
|
|
p) ezjail_installports="YES";;
|
|
h) ezjail_ftphost="${OPTARG}";;
|
|
r) ezjail_release="${OPTARG}";;
|
|
?) exerr ${ezjail_usage_install};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
[ $# -eq 0 ] || exerr ${ezjail_usage_install}
|
|
|
|
ezjail_installarch=`uname -p`
|
|
ezjail_ftphost=${ezjail_ftphost:-"ftp.freebsd.org"}
|
|
ezjail_ftphost=${ezjail_ftphost#ftp://}
|
|
ezjail_dir=${ezjail_ftphost#file://}
|
|
[ "${ezjail_dir%%[!/]*}" ] || ezjail_reldir=${PWD}
|
|
|
|
# ftp servers normally wont provide non-RELEASE-builds
|
|
if [ -z "${ezjail_release}" ]; then
|
|
ezjail_release=`uname -r`
|
|
if [ "${ezjail_release%-RELEASE}" != "${ezjail_release}" -a "${ezjail_dir}" = "${ezjail_ftphost}" ]; then
|
|
echo "Your system is ${ezjail_release}. Normally FTP-servers don't provide non-RELEASE-builds."
|
|
echo -n "Release [ ${ezjail_release} ]: "
|
|
read ezjail_releasetmp
|
|
[ "${ezjail_releasetmp}" ] && ezjail_release=${ezjail_releasetmp}
|
|
fi
|
|
fi
|
|
|
|
# Normally fulljail should be renamed by past ezjail-admin commands.
|
|
# However those may have failed
|
|
[ -d "${ezjail_jailfull}" ] && chflags -R noschg ${ezjail_jailfull} && rm -rf ${ezjail_jailfull}
|
|
mkdir -p ${ezjail_jailfull} || exerr "Cannot create temporary Jail directory."
|
|
DESTDIR=${ezjail_jailfull}
|
|
|
|
rm -rf ${ezjail_jailtemp}
|
|
for pkg in base ${ezjail_installmanpages} ${ezjail_installsources}; do
|
|
|
|
# The first case means, that a remote host has been specified.
|
|
if [ "${ezjail_dir}" = "${ezjail_ftphost}" ]; then
|
|
# Create and try to access temp dir
|
|
mkdir -p ${ezjail_jailtemp} || exerr "Could not create temporary base jail directory ${ezjail_jailtemp}."
|
|
cd ${ezjail_jailtemp} || exerr "Could not cd to ${ezjail_jailtemp}."
|
|
|
|
# Try all paths as stolen from sysinstall, break on success.
|
|
for ezjail_path in pub/FreeBSD/releases pub/FreeBSD/snapshot pub/FreeBSD releases snapshots NO; do
|
|
[ "${ezjail_path}" = "NO" ] && exerr "Could not fetch ${pkg} from ${ezjail_ftphost}."
|
|
ftp "${ezjail_ftphost}:${ezjail_path}/${ezjail_installarch}/${ezjail_release}/${pkg}/*" && break
|
|
done
|
|
|
|
# These actions are really ugly: sources want $1 to contain the set
|
|
# of sources to install, base asks the user if he is sure, hence the
|
|
# yes and the set -- all
|
|
set -- all
|
|
[ -f install.sh ] && yes | . install.sh
|
|
[ $? = 0 ] || exerr "Package install script for ${pkg} failed."
|
|
|
|
rm -rf ${ezjail_jailtemp}
|
|
else
|
|
cd ${ezjail_reldir}/${ezjail_dir}/${pkg} || exerr "Could not cd to ${ezjail_dir}."
|
|
set -- all
|
|
[ -f install.sh ] && yes | . install.sh
|
|
[ $? = 0 ] || exerr "Package install script for ${pkg} failed."
|
|
fi
|
|
done
|
|
|
|
# Split basejail and newjail
|
|
ezjail_splitworld
|
|
|
|
# Fill ports, if requested
|
|
[ "${ezjail_installports}" = "YES" ] && ezjail_updateports
|
|
|
|
;;
|
|
######################## ezjail-admin CONFIG ########################
|
|
config)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_setrunnable ezjail_imageaction
|
|
|
|
shift; while getopts :r:i: arg; do case ${arg} in
|
|
i) ezjail_imageaction=${OPTARG};;
|
|
r) ezjail_setrunnable=${OPTARG};;
|
|
?) exerr ${ezjail_usage_config};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
[ $# -eq 1 ] || exerr ${ezjail_usage_config}
|
|
|
|
# Jail name mandatory
|
|
fetchjailinfo $1
|
|
|
|
# check for existence of jail in our records
|
|
[ -n "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."
|
|
|
|
# Nothing to be configured?
|
|
[ -z "${ezjail_setrunnable}" -a -z "${ezjail_imageaction}" ] && echo "Warning: No config option specified."
|
|
|
|
case ${ezjail_setrunnable} in
|
|
run) [ "${ezjail_config}" = "${ezjail_config%.norun}" ] || mv ${ezjail_config} ${ezjail_config%.norun};;
|
|
norun) [ "${ezjail_config}" = "${ezjail_config%.norun}" ] && mv ${ezjail_config} ${ezjail_config}.norun ;;
|
|
esac
|
|
|
|
[ -n "${ezjail_imageaction}" -a -z "${ezjail_image}" ] && exerr "Error: Jail ${ezjail_name} not an image jail."
|
|
|
|
case "${ezjail_imageaction}" in
|
|
attach)
|
|
# Check, if image already attached
|
|
[ -n "${ezjail_attached}" ] && exerr "Error: Jail image file ${ezjail_image} already attached as ${ezjail_device}."
|
|
rm -f ${ezjail_rootdir}.device
|
|
|
|
# Create a memory disc from jail image
|
|
ezjail_imagedevice=`mdconfig -a -t vnode -f ${ezjail_image}` || exerr "Error: Could not attach memory disc."
|
|
|
|
# If this is a crypto jail, try to mount it, remind user, which jail
|
|
# this is. In this case, the device to mount is
|
|
case ${ezjail_imagetype} in
|
|
crypto|bde)
|
|
echo "Attaching bde device for image jail ${ezjail}..."
|
|
echo gbde attach /dev/${ezjail_imagedevice} ${ezjail_attachparams} | /bin/sh
|
|
[ $? -eq 0 ] || detach_images keep || exerr "Error: Attaching bde device failed."
|
|
# Device to mount is not md anymore
|
|
ezjail_device=${ezjail_imagedevice}.bde
|
|
;;
|
|
eli)
|
|
echo "Attaching eli device for image jail ${ezjail}..."
|
|
echo geli attach ${ezjail_attachparams} /dev/${ezjail_imagedevice} | /bin/sh
|
|
[ $? -eq 0 ] || detach_images keep || exerr "Error: Attaching eli device failed."
|
|
# Device to mount is not md anymore
|
|
ezjail_device=${ezjail_imagedevice}.eli
|
|
;;
|
|
esac
|
|
|
|
mount /dev/${ezjail_device} ${ezjail_rootdir} || detach_images keep || exerr "Error: Could not mount /dev/${ezjail_device} to ${ezjail_root}."
|
|
# relink image device
|
|
ln -s /dev/${ezjail_device} ${ezjail_rootdir}.device
|
|
|
|
;;
|
|
detach)
|
|
# Check, if image really attached or running
|
|
[ -n "${ezjail_id}" ] && exerr "Error: Jail ${ezjail_name} still running. Can not detach."
|
|
[ -n "${ezjail_attached}" ] || exerr "Error: Jail image file ${ezjail_name} is not attached."
|
|
ezjail_device=${ezjail_device#/dev/}
|
|
|
|
# Add this device to the list of devices to be unmounted
|
|
case ${ezjail_imagetype} in
|
|
crypto|bde) ezjail_imagedevice="${ezjail_device%.bde}" ;;
|
|
eli) ezjail_imagedevice="${ezjail_device%.eli}" ;;
|
|
*) ezjail_imagedevice="${ezjail_device}" ;;
|
|
esac
|
|
|
|
# Unmount/detach everything
|
|
detach_images keep
|
|
|
|
# Remove soft link (which acts as a lock)
|
|
rm -f ${ezjail_rootdir}.device
|
|
;;
|
|
esac
|
|
;;
|
|
|
|
##############################################################################
|
|
# ezjail_imageparams HACK starts here
|
|
#
|
|
#
|
|
_parse_geli_attach_args_)
|
|
# create geli(8) attach arguments from geli(8) init arguments:
|
|
# -P becomes -p if present, -K newkeyfile becomes -k newkeyfile if present,
|
|
# everything else is dicarded
|
|
# exit values: 2->NO_ERROR, 3->NO_ERROR,PASSWORD_SET, 5->PARSER_ERROR
|
|
_exit=2
|
|
shift; while getopts :bPva:i:K:l:s: arg; do case ${arg} in
|
|
b|v|a|i|l|s);; # ignore these
|
|
P) echo -n "-p "; _exit=3 ;;
|
|
K) echo -n "-k '$OPTARG' ";;
|
|
?) exit 5;;
|
|
esac; done
|
|
exit ${_exit}
|
|
;;
|
|
_parse_gbde_attach_args_)
|
|
# create gbde(8) attach arguments from gbde(8) init arguments:
|
|
# -L lockfile becomes -l lockfile if present
|
|
# -K keyfile becomes -k keyfile if present
|
|
# -P passphrase becomes -p passphrase if present
|
|
# everything else is discarded
|
|
# exit values: 2->NO_ERROR, 3->NO_ERROR+PASSWORD_SET, 5->PARSER_ERROR
|
|
_exit=2
|
|
shift; while getopts :iK:f:L:P: arg; do case ${arg} in
|
|
i|f);; # ignore these
|
|
P) echo -n "-p '$OPTARG' "; _exit=3;;
|
|
K) echo -n "-k '$OPTARG' ";;
|
|
L) echo -n "-l '$OPTARG' ";;
|
|
?) exit 5;;
|
|
esac; done
|
|
exit ${_exit}
|
|
;;
|
|
#
|
|
# ezjail_imageparams HACK ends here (thank god)
|
|
##############################################################################
|
|
|
|
*)
|
|
exerr ${ezjail_usage_ezjailadmin}
|
|
;;
|
|
esac
|