653bd9e938
Added more error checking when attaching image jails Woke up this morning when the streets where full of cars
684 lines
32 KiB
Bash
Executable File
684 lines
32 KiB
Bash
Executable File
#!/bin/sh
|
|
# $Id$
|
|
|
|
# ugly: this variable is set during port install time
|
|
ezjail_prefix=EZJAIL_PREFIX
|
|
ezjail_etc=${ezjail_prefix}/etc
|
|
ezjail_share=${ezjail_prefix}/share/ezjail
|
|
ezjail_examples=${ezjail_prefix}/share/examples/ezjail
|
|
ezjail_jailcfgs=${ezjail_etc}/ezjail
|
|
|
|
# read user config
|
|
[ -f ${ezjail_etc}/ezjail.conf ] && . ${ezjail_etc}/ezjail.conf
|
|
|
|
# set defaults
|
|
ezjail_jaildir=${ezjail_jaildir:-"/usr/jails"}
|
|
ezjail_jailtemplate=${ezjail_jailtemplate:-"${ezjail_jaildir}/newjail"}
|
|
ezjail_jailbase=${ezjail_jailbase:-"${ezjail_jaildir}/basejail"}
|
|
ezjail_jailfull=${ezjail_jailfull:-"${ezjail_jaildir}/fulljail"}
|
|
ezjail_jailtemp=${ezjail_jailtemp:-"${ezjail_jaildir}/ezjailtemp"}
|
|
ezjail_flavours=${ezjail_flavours:-"${ezjail_jaildir}/flavours"}
|
|
ezjail_portscvsroot=${ezjail_portscvsroot:-":pserver:anoncvs@anoncvs.at.FreeBSD.org:/home/ncvs"}
|
|
ezjail_sourcetree=${ezjail_sourcetree:-"/usr/src"}
|
|
ezjail_uglyperlhack=${ezjail_uglyperlhack:-"YES"}
|
|
|
|
ezjail_mount_enable=${ezjail_mount_enable:-"YES"}
|
|
ezjail_devfs_enable=${ezjail_devfs_enable:-"YES"}
|
|
ezjail_devfs_ruleset=${ezjail_devfs_ruleset:-"devfsrules_jail"}
|
|
ezjail_procfs_enable=${ezjail_procfs_enable:-"YES"}
|
|
ezjail_fdescfs_enable=${ezjail_fdescfs_enable:-"YES"}
|
|
|
|
ezjail_dirlist="bin boot lib libexec rescue sbin usr/bin usr/games usr/include usr/lib usr/libdata usr/libexec usr/sbin usr/src usr/share"
|
|
|
|
# Synopsis messages
|
|
ezjail_usage_ezjailadmin="Usage: `basename -- $0` [config|create|delete|install|list|update] {params}"
|
|
ezjail_usage_create="Usage: `basename -- $0` create [-xbi] [-f flavour] [-r jailroot] [-s size] [-c bde|eli] [-u passurl] [-C args] jailname jailip"
|
|
ezjail_usage_delete="Usage: `basename -- $0` delete [-w] jailname"
|
|
ezjail_usage_list="Usage: `basename -- $0` list"
|
|
ezjail_usage_update="Usage: `basename -- $0` update [-s sourcetree] [-i] [-pP]"
|
|
ezjail_usage_install="Usage: `basename -- $0` install [-mps] [-h host] [-r release]"
|
|
ezjail_usage_config="Usage: `basename -- $0` config [-r run|norun] [-i attach|detach] jailname"
|
|
|
|
################################
|
|
# End of variable initialization
|
|
#
|
|
|
|
# define our bail out shortcut
|
|
exerr () { echo -e "$*" >&2 ; exit 1; }
|
|
|
|
# define detach strategy for image jails
|
|
detach_images () {
|
|
# unmount and detach memory disc
|
|
if [ "${ezjail_imagedevice}" ]; then
|
|
umount ${ezjail_rootdir} > /dev/null
|
|
case ${ezjail_imagetype} in
|
|
bde) gbde detach /dev/${ezjail_imagedevice} > /dev/null;;
|
|
eli) geli detach /dev/${ezjail_imagedevice} > /dev/null;;
|
|
esac
|
|
mdconfig -d -u ${ezjail_imagedevice} > /dev/null
|
|
[ "$1" = "keep" ] || rm -f ${ezjail_image}
|
|
fi
|
|
# This function is being called in case of error. Keep $? bad
|
|
return 1
|
|
}
|
|
|
|
# fetch everything we need to know about an ezjail from config
|
|
fetchjailinfo () {
|
|
ezjail_name=$1
|
|
|
|
# Clean variables, prevent polution
|
|
unset ezjail_config ezjail_running ezjail_hostname ezjail_rootdir ezjail_image ezjail_imagetype ezjail_ip ezjail_id
|
|
|
|
ezjail_safename=`echo -n "${ezjail_name}" | tr -c [:alnum:] _`
|
|
|
|
[ -e ${ezjail_jailcfgs}/${ezjail_safename} ] && ezjail_config=${ezjail_jailcfgs}/${ezjail_safename}
|
|
[ -e ${ezjail_jailcfgs}/${ezjail_safename}.norun ] && ezjail_config=${ezjail_jailcfgs}/${ezjail_safename}.norun
|
|
[ "${ezjail_config}" ] || return 0
|
|
|
|
. ${ezjail_config}
|
|
eval ezjail_hostname=\"\$jail_${ezjail_safename}_hostname\"
|
|
eval ezjail_rootdir=\"\$jail_${ezjail_safename}_rootdir\"
|
|
eval ezjail_ip=\"\$jail_${ezjail_safename}_ip\"
|
|
eval ezjail_image=\"\$jail_${ezjail_safename}_image\"
|
|
eval ezjail_imagetype=\"\$jail_${ezjail_safename}_imagetype\"
|
|
eval ezjail_attachparams=\"\$jail_${ezjail_safename}_attachparams\"
|
|
eval ezjail_attachblocking=\"\$jail_${ezjail_safename}_attachblocking\"
|
|
eval ezjail_forceblocking=\"\$jail_${ezjail_safename}_forceblocking\"
|
|
eval ezjail_passphraseurl=\"\$jail_${ezjail_safename}_passphraseurl\"
|
|
|
|
ezjail_softlink=${ezjail_jaildir}/`basename -- ${ezjail_rootdir}`
|
|
[ -f /var/run/jail_${ezjail_safename}.id ] && ezjail_id=`cat /var/run/jail_${ezjail_safename}.id` || return
|
|
jls | grep -q -E "^ +${ezjail_id} " || unset ezjail_id
|
|
}
|
|
|
|
# fill the base jail - this function is used by install and update
|
|
ezjail_splitworld() {
|
|
# Fill basejail from installed world
|
|
cd ${ezjail_jailfull} || exerr "Cant access temporary Jail directory."
|
|
|
|
# This mkdir is important, since cpio will create intermediate
|
|
# directories with permission 0700 which is bad
|
|
mkdir -p ${ezjail_jailbase}/usr
|
|
for dir in ${ezjail_dirlist}; do
|
|
find ${dir} | cpio -d -p -v ${ezjail_jailbase} || exerr "Installation of ${dir} failed."
|
|
chflags -R noschg ${dir}; rm -r ${dir}; ln -s /basejail/${dir} ${dir}
|
|
done
|
|
mkdir basejail
|
|
|
|
# Try to remove the old template jail
|
|
[ -d ${ezjail_jailtemplate} ] && chflags -R noschg ${ezjail_jailtemplate} && rm -rf ${ezjail_jailtemplate}
|
|
mv ${ezjail_jailfull} ${ezjail_jailtemplate}
|
|
|
|
# If the default flavour example has not yet been copied, do it now
|
|
[ -d ${ezjail_flavours}/default ] || mkdir -p ${ezjail_flavours} && cp -p -R ${ezjail_examples}/default ${ezjail_flavours}
|
|
|
|
# no /usr/ports? link to /basejail/usr/ports
|
|
[ -e ${ezjail_jailtemplate}/usr/ports ] || ln -s /basejail/usr/ports ${ezjail_jailtemplate}/usr/ports
|
|
|
|
# A ports collection inside jails is hardly useful w/o an appropriate
|
|
# /etc/make.conf.
|
|
if [ -f ${ezjail_examples}/default/etc/make.conf -a ! -f ${ezjail_jailtemplate}/etc/make.conf ]; then
|
|
cp -p ${ezjail_examples}/default/etc/make.conf ${ezjail_jailtemplate}/etc/
|
|
echo "Note: a non-standard /etc/make.conf was copied to the template jail in order to get the ports collection running inside jails."
|
|
fi
|
|
|
|
# The ugly perl hack[tm]. Note: we wont do such things for any given
|
|
# port :(
|
|
[ "${ezjail_uglyperlhack}" = "YES" -a ! -L ${ezjail_jailbase}/usr/bin/perl ] && ln -s /usr/local/bin/perl ${ezjail_jailbase}/usr/bin/perl
|
|
}
|
|
|
|
# The user may want to have a ports tree in basejail
|
|
ezjail_updateports () {
|
|
# if /usr/ports/CVS exists, assume cvs up is safe
|
|
# this is legacy
|
|
if [ -f ${ezjail_jailbase}/usr/ports/CVS/Root ]; then
|
|
echo -n "Updating ports from "; cat ${ezjail_jailbase}/usr/ports/CVS/Root
|
|
echo "Warning: Upgrading legacy ports copy. Consider removing ${ezjail_jailbase}/usr/ports and use the new portsnap strategy instead."
|
|
echo "Gathering local information may take a while."
|
|
cd ${ezjail_jailbase}/usr/ports/ && cvs -d ${ezjail_portscvsroot} up -Pd
|
|
else
|
|
portsnap fetch
|
|
[ -d ${ezjail_jailbase}/usr/ports ] && ezjail_portsnapaction=update
|
|
portsnap -p ${ezjail_jailbase}/usr/ports ${ezjail_portsnapaction:-"extract"}
|
|
fi
|
|
[ $? = 0 ] || exerr "Updating ports failed."
|
|
}
|
|
|
|
#############################
|
|
# End of function definitions
|
|
#
|
|
|
|
# check for command
|
|
[ $# -gt 0 ] || exerr ${ezjail_usage_ezjail}
|
|
|
|
case "$1" in
|
|
######################## ezjail-admin CREATE ########################
|
|
create)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_rootdir ezjail_flavour ezjail_softlink ezjail_image ezjail_imagetype ezjail_imageparams ezjail_imagesize ezjail_device ezjail_config ezjail_attachparams ezjail_passphraseurl ezjail_exists ezjail_attachblocking ezjail_forceblocking
|
|
shift; while getopts :f:r:s:xbic:u:C: arg; do case ${arg} in
|
|
x) ezjail_exists="YES";;
|
|
r) ezjail_rootdir="${OPTARG}";;
|
|
f) ezjail_flavour="${OPTARG}";;
|
|
c) ezjail_imagetype="${OPTARG}";;
|
|
C) ezjail_imageparams="${OPTARG}";;
|
|
b) ezjail_forceblocking="YES";;
|
|
i) ezjail_imagetype=${ezjail_imagetype:-"simple"};;
|
|
s) ezjail_imagesize="${OPTARG}";;
|
|
u) ezjail_urlpass="${OPTARG}";;
|
|
?) exerr ${ezjail_usage_create};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
ezjail_name=$1; ezjail_ip=$2
|
|
|
|
# we need at least a name and an ip for new jail
|
|
[ "${ezjail_name}" -a "${ezjail_ip}" -a $# -eq 2 ] || exerr ${ezjail_usage_create}
|
|
|
|
# check for sanity of settings concerning the image feature
|
|
[ "${ezjail_imagetype}" -a -z "${ezjail_exists}" -a -z "${ezjail_imagesize}" ] && exerr "Image jails need an image size."
|
|
|
|
# check for a sane image type
|
|
case ${ezjail_imagetype} in ""|simple|bde|eli) ;; *) exerr ${ezjail_usage_create};; esac
|
|
|
|
# check for a sane image size and split it up in blocks
|
|
if [ "${ezjail_imagesize}" ]; then
|
|
_val=`echo "${ezjail_imagesize}"|tr A-Z a-z|sed -Ees:g:km:g -es:m:kk:g -es:k:*2b:g -es:b:*128w:g -es:w:*4\ :g -e"s:(^|[^0-9])0x:\1\0X:g" -ey:x:*:`
|
|
_val=`echo $(( ${_val} ))`
|
|
[ $? -eq 0 -a ${_val} -gt 0 ] || exerr "Error: The image size you specified is somehow incomprehensible (you specified ${ezjail_imagesize})."
|
|
ezjail_imageblockcount=$(( ${_val} / 1048576 ))
|
|
ezjail_imagerestbytes=$(( ${_val} % 1048576 ))
|
|
fi
|
|
|
|
# check, whether ezjail-update has been called. existence of
|
|
# ezjail_jailbase is our indicator
|
|
[ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. Please run 'ezjail-admin update' first."
|
|
|
|
# relative paths don't make sense in rc.scripts
|
|
[ "${ezjail_jaildir%%[!/]*}" ] || exerr "Error: Need an absolute path in ezjail_jaildir, it currently is set to: ${ezjail_jaildir}."
|
|
|
|
# jail names must not irritate file systems, excluding dots from this list
|
|
# was done intentionally to permit foo.com style directory names, however,
|
|
# the jail name will be foo_com in most scripts
|
|
|
|
ezjail_hostname=`echo -n ${ezjail_name} | tr /~ __`
|
|
ezjail_safename=`echo -n "${ezjail_name}" | tr -c [:alnum:] _`
|
|
ezjail_rootdir=${ezjail_rootdir:-"${ezjail_jaildir}/${ezjail_hostname}"}
|
|
ezjail_config=${ezjail_jailcfgs}/${ezjail_safename}
|
|
|
|
# This scenario really will only lead to real troubles in the 'fulljail'
|
|
# case, but I should still explain this to the user and not claim that
|
|
# "an ezjail would already exist"
|
|
case ${ezjail_hostname} in basejail|newjail|fulljail|flavous|ezjailtemp) exerr "Error: ezjail needs the ${ezjail_hostname} directory for its own administrative purposes. Please rename the ezjail.";; esac
|
|
|
|
# jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com
|
|
# so check, whether we might be running into problems
|
|
[ -e ${ezjail_config} ] && exerr "Error: an ezjail config already exists at ${ezjail_config}. Please rename the ezjail."
|
|
|
|
# if jail root specified on command line is not absolute, make it absolute
|
|
# inside our jail directory
|
|
[ "${ezjail_rootdir%%[!/]*}" ] || ezjail_rootdir=${ezjail_jaildir}/${ezjail_rootdir}
|
|
|
|
# if a directory at the specified jail root already exists, refuse to
|
|
# install
|
|
[ -e ${ezjail_rootdir} -a -z "${ezjail_exists}" ] && exerr "Error: the specified jail root ${ezjail_rootdir} alread exists."
|
|
|
|
# if jail root specified on command line does not lie within our jail
|
|
# directory, we need to create a softlink
|
|
if [ "${ezjail_rootdir##${ezjail_jaildir}}" = "${ezjail_rootdir}" ]; then
|
|
ezjail_softlink=${ezjail_jaildir}/`basename -- ${ezjail_rootdir}`
|
|
[ -e ${ezjail_softlink} ] && exerr "Error: an ezjail already exists at ${ezjail_softlink}."
|
|
fi
|
|
|
|
# do some sanity checks on the selected flavour (if any)
|
|
[ "${ezjail_flavour}" -a ! -d ${ezjail_flavours}/${ezjail_flavour} ] && exerr "Error: Flavour config directory ${ezjail_flavours}/${ezjail_flavour} not found."
|
|
|
|
#
|
|
# All sanity checks that may lead to errors are hopefully passed here
|
|
#
|
|
|
|
if [ "${ezjail_imagetype}" ]; then
|
|
# Strip trailing slashes from jail root, those would confuse image path
|
|
ezjail_image=${ezjail_rootdir%/}; while [ "${ezjail_image}" -a -z "${ezjail_image%%*/}" ]; do ezjail_image=${ezjail_image%/}; done
|
|
[ -z "${ezjail_image}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${ezjail_rootdir}."
|
|
|
|
# Location of our image file
|
|
ezjail_image=${ezjail_image}.img
|
|
|
|
# If NOT exist, create image
|
|
if [ -z "${ezjail_exists}" ]; then
|
|
[ -e "${ezjail_image}" ] && exerr "Error: a file exists at the location ${ezjail_image}, preventing our own image file to be created."
|
|
|
|
# Now create jail disc image
|
|
touch "${ezjail_image}"
|
|
if [ "${ezjail_imageblockcount}" -gt 0 ]; then
|
|
dd if=/dev/random of="${ezjail_image}" bs=1m count=${ezjail_imageblockcount} || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${ezjail_image}. The image size provided was ${ezjail_imagesize}."
|
|
fi
|
|
if [ "${ezjail_imagerestbytes}" -gt 0 ]; then
|
|
( dd if=/dev/random bs=${ezjail_imagerestbytes} count=1 >> "${ezjail_image}" ) || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${ezjail_image}. The image size provided was ${ezjail_imagesize}."
|
|
fi
|
|
|
|
# And attach device
|
|
ezjail_imagedevice=`mdconfig -a -t vnode -f ${ezjail_image}`
|
|
[ $? = 0 ] || detach_images || exerr "Error: Could not attach image device. (Command failed was 'mdconfig -a -t vnode -f ${ezjail_image}')"
|
|
case "${ezjail_imagetype}" in
|
|
bde|eli)
|
|
# parse imageparams, generate attachparams
|
|
[ -n "${ezjail_passphraseurl}" ] || ezjail_attachblocking="YES"
|
|
if [ -n "${ezjail_imageparams}" ]; then
|
|
ezjail_attachparams=`echo $0 _parse_g${ezjail_imagetype}_attach_args_ ${ezjail_imageparams} | /bin/sh `
|
|
[ 5 -eq $? ] && exerr "processing of ezjail_imageparams failed"
|
|
[ 3 -eq $? ] && unset ezjail_attachblocking
|
|
fi
|
|
case "${ezjail_imagetype}" in
|
|
bde) init_cmd="gbde init /dev/${ezjail_imagedevice} ${ezjail_imageparams}"
|
|
attach_cmd="gbde attach /dev/${ezjail_imagedevice} ${ezjail_attachparams}";;
|
|
eli) init_cmd="geli init ${ezjail_imageparams} /dev/${ezjail_imagedevice}"
|
|
attach_cmd="geli attach ${ezjail_attachparams} /dev/${ezjail_imagedevice}";;
|
|
esac
|
|
[ -n "${ezjail_attachblocking}" ] && echo "Initialising crypto device. Enter a new passphrase twice... "
|
|
( echo ${init_cmd} | /bin/sh ) || detach_images || exerr "Error: Could not initialise crypto image."
|
|
|
|
[ -n "${ezjail_attachblocking}" ] && echo "Attaching crypto device. Enter the passphrase... "
|
|
( echo ${attach_cmd} | /bin/sh ) || detach_images || exerr "Error: Could not attach crypto image."
|
|
ezjail_device=${ezjail_imagedevice}.${ezjail_imagetype}
|
|
;;
|
|
simple)
|
|
ezjail_device=${ezjail_imagedevice}
|
|
;;
|
|
esac
|
|
|
|
# Format memory image
|
|
newfs /dev/${ezjail_device} || detach_images || exerr "Error: Could not newfs /dev/${ezjail_device}."
|
|
# Create mount point and mount
|
|
mkdir -p ${ezjail_rootdir} || detach_images || exerr "Error: Could not create jail root mount point ${ezjail_rootdir}."
|
|
mount /dev/${ezjail_device} ${ezjail_rootdir} || detach_images || exerr "Error: Could not mount /dev/${ezjail_device} to ${ezjail_root}."
|
|
else
|
|
[ -e ${ezjail_rootdir} -a ! -d ${ezjail_rootdir} ] && exerr "Error: Could not create mount point for your jail image. A file exists at its location. (For existing image jails, call this tool without the .img suffix when specifying jail root.)"
|
|
[ -d ${ezjail_rootdir} ] || mkdir -p ${ezjail_rootdir}
|
|
fi
|
|
fi
|
|
|
|
# now take a copy of our template jail
|
|
if [ -z "${ezjail_exists}" ]; then
|
|
mkdir -p ${ezjail_rootdir} && cd ${ezjail_jailtemplate} && find * | cpio -p -v ${ezjail_rootdir} > /dev/null
|
|
[ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail."
|
|
fi
|
|
|
|
# if a soft link is necessary, create it now
|
|
[ "${ezjail_softlink}" ] && ln -s ${ezjail_rootdir} ${ezjail_softlink}
|
|
|
|
# if the automount feature is not disabled, this fstab entry for new jail
|
|
# will be obeyed
|
|
echo -n > /etc/fstab.${ezjail_safename}
|
|
[ "${ezjail_imagetype}" ] && \
|
|
echo ${ezjail_rootdir}.device ${ezjail_rootdir} ufs rw 0 0 >> /etc/fstab.${ezjail_safename}
|
|
echo ${ezjail_jailbase} ${ezjail_rootdir}/basejail nullfs ro 0 0 >> /etc/fstab.${ezjail_safename}
|
|
|
|
# now, where everything seems to have gone right, create control file in
|
|
# ezjails config dir
|
|
mkdir -p ${ezjail_jailcfgs}
|
|
echo "# To specify the start up order of your ezjails, use these lines to" > ${ezjail_config}
|
|
echo "# create a Jail dependency tree. See rcorder(8) for more details." >> ${ezjail_config}
|
|
echo -e "#\n# PROVIDE: \n# REQUIRE: \n# BEFORE: \n#\n" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_hostname=\"${ezjail_hostname}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_ip=\"${ezjail_ip}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_rootdir=\"${ezjail_rootdir}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_exec=\"/bin/sh /etc/rc\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_mount_enable=\"${ezjail_mount_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_devfs_enable=\"${ezjail_devfs_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_image=\"${ezjail_image}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_imagetype=\"${ezjail_imagetype}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_attachparams=\"${ezjail_attachparams}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_attachblocking=\"${ezjail_attachblocking}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_forceblocking=\"${ezjail_forceblocking}\" >> ${ezjail_config}
|
|
echo export jail_${ezjail_safename}_passphraseurl=\"${ezjail_passphraseurl}\" >> ${ezjail_config}
|
|
|
|
# Final steps for flavour installation
|
|
if [ -z "${ezjail_exists}" -a -n "${ezjail_flavour}" ]; then
|
|
# install files and config to new jail
|
|
cd ${ezjail_flavours}/${ezjail_flavour} && find * | cpio -p -u -v ${ezjail_rootdir} > /dev/null
|
|
[ $? = 0 ] || echo "Warning: Could not fully install flavour."
|
|
|
|
# If a config is found, make it auto run on jails startup
|
|
if [ -f ${ezjail_rootdir}/ezjail.flavour ]; then
|
|
ln -s /ezjail.flavour ${ezjail_rootdir}/etc/rc.d/ezjail-config.sh
|
|
chmod 0700 ${ezjail_rootdir}/ezjail.flavour
|
|
echo "Note: Shell scripts installed, flavourizing on jails first startup."
|
|
fi
|
|
fi
|
|
|
|
# Detach (crypto and) memory discs
|
|
detach_images keep
|
|
|
|
#
|
|
# For user convenience some scenarios commonly causing headaches are checked
|
|
#
|
|
|
|
# check, whether IP is configured on a local interface, warn if it isnt
|
|
ping -c 1 -m 1 -t 1 -q ${ezjail_ip} > /dev/null
|
|
[ $? = 0 ] || echo "Warning: IP ${ezjail_ip} not configured on a local interface."
|
|
|
|
# check, whether some host system services do listen on the Jails IP
|
|
TIFS=${IFS}; IFS=_
|
|
ezjail_listener=`sockstat -4 -l | grep ${ezjail_ip}:[[:digit:]]`
|
|
[ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on IP ${ezjail_ip}\n This may cause some confusion, here they are:\n${ezjail_listener}"
|
|
|
|
ezjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]`
|
|
[ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${ezjail_ip})\n This may cause some confusion, here they are:\n${ezjail_listener}"
|
|
IFS=${TIFS}
|
|
|
|
[ -n "${ezjail_passphraseurl}" ] && echo -e "You specified a passphrase file location ${ezjail_passphraseurl}\nThis will be fetched by ezjail.sh when auto-running this jail. The file should contain a line in the form\njail_${ezjail_safename}_passphrase=YOURPASSPHRASE\n. If fetching fails or the file does not contain that line, the jail ${ezjail_name} will not be started, even if no passphrase was necessary."
|
|
|
|
;;
|
|
######################## ezjail-admin DELETE ########################
|
|
delete)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_wipeme
|
|
|
|
shift; while getopts :w arg; do case ${arg} in
|
|
w) ezjail_wipeme="YES";;
|
|
?) exerr ${ezjail_usage_delete};;
|
|
esac; done; shift $(( $OPTIND - 1 ))
|
|
|
|
# we need name of jail to vanish
|
|
[ $# -eq 1 ] || exerr ${ezjail_usage_delete}
|
|
|
|
# Get all info we have on that jail
|
|
fetchjailinfo $1
|
|
|
|
# check for existence of jail in our records
|
|
[ "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."
|
|
|
|
# if jail is still running, refuse to go any further
|
|
[ "${ezjail_id}" ] && exerr "Error: Jail appears to be still running, stop it first."
|
|
|
|
# now we know everything we need to let the jail be gone remove entry
|
|
# from ezjail resource structure, delete fstab.JAILNAME
|
|
rm -f ${ezjail_config} /etc/fstab.${ezjail_safename}
|
|
|
|
# if there is a soft link pointing to the jail root, remove it
|
|
[ -L ${ezjail_softlink} ] && rm ${ezjail_softlink}
|
|
|
|
# if wiping the jail was requested, remove it
|
|
if [ "${ezjail_wipeme}" ]; then
|
|
[ "${ezjail_image}" ] && rm -f ${ezjail_image} ${ezjail_image%.img}.device
|
|
rm -rf ${ezjail_rootdir}
|
|
fi
|
|
|
|
;;
|
|
######################## ezjail-admin LIST ########################
|
|
list)
|
|
[ $# -eq 1 ] || exerr ${ezjail_usage_list}
|
|
|
|
ezjail_list=`find -X ${ezjail_prefix}/etc/ezjail/ 2> /dev/null | xargs rcorder | xargs basename -a`
|
|
|
|
printf "%-3s %-5s %-15s %-28s %s\\n" STA JID IP Hostname "Root Directory"
|
|
echo "--- ----- --------------- ---------------------------- -----------------------------"
|
|
for ezjail in ${ezjail_list}; do
|
|
fetchjailinfo ${ezjail%.norun}
|
|
case ${ezjail_imagetype} in simple) ezjail_state="I";; bde) ezjail_state="B";; eli) ezjail_state="E";; *) ezjail_state="D";; esac
|
|
[ "${ezjail_id}" ] && ezjail_state=${ezjail_state}R || ezjail_state=${ezjail_state}S
|
|
[ "${ezjail_safename}" != "${ezjail}" ] && ezjail_state=${ezjail_state}N
|
|
|
|
printf "%-3s %-5s %-15s %-28s %s\\n" "${ezjail_state}" "${ezjail_id:-N/A}" "${ezjail_ip}" "${ezjail_hostname}" "${ezjail_rootdir}"
|
|
done
|
|
|
|
;;
|
|
######################## ezjail-admin UPDATE ########################
|
|
setup|update)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_provideports
|
|
ezjail_installaction="world"
|
|
|
|
shift; while getopts :ipPs: arg; do case ${arg} in
|
|
i) ezjail_installaction="installworld";;
|
|
s) ezjail_sourcetree="${OPTARG}";;
|
|
p) ezjail_provideports="YES";;
|
|
P) ezjail_provideports="YES"; ezjail_installaction="none";;
|
|
?) exerr ${ezjail_usage_update};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
[ $# -eq 0 ] || exerr ${ezjail_usage_update}
|
|
|
|
if [ "${ezjail_installaction}" = "none" ]; then
|
|
# check, whether ezjail-update has been called. existence of
|
|
# ezjail_jailbase is our indicator
|
|
[ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. You cannot fill base jails ports tree before creating it. Please run 'ezjail-admin update' first."
|
|
else
|
|
# Bump the user for some of the most common errors
|
|
[ -d ${ezjail_sourcetree} ] || exerr "Cannot find your copy of the FreeBSD source tree in ${ezjail_sourcetree}."
|
|
[ -e ${ezjail_sourcetree}/Makefile ] || exerr "Your source tree in ${ezjail_sourcetree} seems to be incomplete (Makefile missing)."
|
|
|
|
# Normally fulljail should be renamed by past ezjail-admin commands.
|
|
# However those may have failed
|
|
[ -d "${ezjail_jailfull}" ] && chflags -R noschg ${ezjail_jailfull} && rm -rf ${ezjail_jailfull}
|
|
mkdir -p ${ezjail_jailfull} || exerr "Cannot create temporary Jail directory."
|
|
|
|
# make and setup our world, then split basejail and newjail
|
|
cd ${ezjail_sourcetree} && make ${ezjail_installaction} DESTDIR=${ezjail_jailfull} || exerr "make ${ezjail_installaction} failed."
|
|
cd ${ezjail_sourcetree}/etc && make distribution DESTDIR=${ezjail_jailfull} || exerr "make distribution failed."
|
|
ezjail_splitworld
|
|
|
|
fi # installaction="none"
|
|
|
|
# Provide a copy of ports tree in basejail
|
|
[ "${ezjail_provideports}" = "YES" ] && ezjail_updateports
|
|
|
|
;;
|
|
######################## ezjail-admin INSTALL ########################
|
|
install)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_release ezjail_ftphost ezjail_installmanpages ezjail_installports ezjail_installsources ezjail_dir ezjail_reldir
|
|
|
|
shift; while getopts :mpsh:r: arg; do case ${arg} in
|
|
m) ezjail_installmanpages=" manpages";;
|
|
s) ezjail_installsources=" src";;
|
|
p) ezjail_installports="YES";;
|
|
h) ezjail_ftphost="${OPTARG}";;
|
|
r) ezjail_release="${OPTARG}";;
|
|
?) exerr ${ezjail_usage_install};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
[ $# -eq 0 ] || exerr ${ezjail_usage_install}
|
|
|
|
ezjail_installarch=`uname -p`
|
|
ezjail_ftphost=${ezjail_ftphost:-"ftp.freebsd.org"}
|
|
ezjail_ftphost=${ezjail_ftphost#ftp://}
|
|
ezjail_dir=${ezjail_ftphost#file://}
|
|
[ "${ezjail_dir%%[!/]*}" ] || ezjail_reldir=${PWD}
|
|
|
|
# ftp servers normally wont provide non-RELEASE-builds
|
|
if [ -z "${ezjail_release}" ]; then
|
|
ezjail_release=`uname -r`
|
|
if [ "${ezjail_release%-RELEASE}" != "${ezjail_release}" -a "${ezjail_dir}" = "${ezjail_ftphost}" ]; then
|
|
echo "Your system is ${ezjail_release}. Normally FTP-servers don't provide non-RELEASE-builds."
|
|
echo -n "Release [ ${ezjail_release} ]: "
|
|
read ezjail_releasetmp
|
|
[ "${ezjail_releasetmp}" ] && ezjail_release=${ezjail_releasetmp}
|
|
fi
|
|
fi
|
|
|
|
# Normally fulljail should be renamed by past ezjail-admin commands.
|
|
# However those may have failed
|
|
[ -d "${ezjail_jailfull}" ] && chflags -R noschg ${ezjail_jailfull} && rm -rf ${ezjail_jailfull}
|
|
mkdir -p ${ezjail_jailfull} || exerr "Cannot create temporary Jail directory."
|
|
DESTDIR=${ezjail_jailfull}
|
|
|
|
rm -rf ${ezjail_jailtemp}
|
|
for pkg in base ${ezjail_installmanpages} ${ezjail_installsources}; do
|
|
|
|
# The first case means, that a remote host has been specified.
|
|
if [ "${ezjail_dir}" = "${ezjail_ftphost}" ]; then
|
|
# Create and try to access temp dir
|
|
mkdir -p ${ezjail_jailtemp} || exerr "Could not create temporary base jail directory ${ezjail_jailtemp}."
|
|
cd ${ezjail_jailtemp} || exerr "Could not cd to ${ezjail_jailtemp}."
|
|
|
|
# Try all paths as stolen from sysinstall, break on success.
|
|
for ezjail_path in pub/FreeBSD/releases pub/FreeBSD/snapshot pub/FreeBSD releases snapshots NO; do
|
|
[ "${ezjail_path}" = "NO" ] && exerr "Could not fetch ${pkg} from ${ezjail_ftphost}."
|
|
ftp "${ezjail_ftphost}:${ezjail_path}/${ezjail_installarch}/${ezjail_release}/${pkg}/*" && break
|
|
done
|
|
|
|
# These actions are really ugly: sources want $1 to contain the set
|
|
# of sources to install, base asks the user if he is sure, hence the
|
|
# yes and the set -- all
|
|
set -- all
|
|
[ -f install.sh ] && yes | . install.sh
|
|
[ $? = 0 ] || exerr "Package install script for ${pkg} failed."
|
|
|
|
rm -rf ${ezjail_jailtemp}
|
|
else
|
|
cd ${basejail_reldir}/${basejail_dir}/${pkg} || exerr "Could not cd to ${basejail_dir}."
|
|
set -- all
|
|
[ -f install.sh ] && yes | . install.sh
|
|
[ $? = 0 ] || exerr "Package install script for ${pkg} failed."
|
|
fi
|
|
done
|
|
|
|
# Split basejail and newjail
|
|
ezjail_splitworld
|
|
|
|
# Fill ports, if requested
|
|
[ "${ezjail_installports}" = "YES" ] && ezjail_updateports
|
|
|
|
;;
|
|
######################## ezjail-admin CONFIG ########################
|
|
config)
|
|
# Clean variables, prevent polution
|
|
unset ezjail_setrunnable ezjail_imageaction
|
|
|
|
shift; while getopts :r: arg; do case ${arg} in
|
|
i) ezjail_imageaction=${OPTARG};;
|
|
r) ezjail_setrunnable=${OPTARG};;
|
|
?) exerr ${ezjail_usage_config};;
|
|
esac; done; shift $(( ${OPTIND} - 1 ))
|
|
|
|
[ $# -eq 1 ] || exerr ${ezjail_usage_config}
|
|
|
|
# Jail name mandatory
|
|
fetchjailinfo $1
|
|
|
|
# check for existence of jail in our records
|
|
[ -n "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."
|
|
|
|
# Nothing to be configured?
|
|
[ -z "${ezjail_setrunnable}" -a -z "${ezjail_imageaction}" ] && echo "Warning: No config option specified."
|
|
|
|
case ${ezjail_setrunnable} in
|
|
run) [ "${ezjail_config}" = "${ezjail_config%.norun}" ] || mv ${ezjail_config} ${ezjail_config%.norun};;
|
|
norun) [ "${ezjail_config}" = "${ezjail_config%.norun}" ] && mv ${ezjail_config} ${ezjail_config}.norun ;;
|
|
*) echo "Warning: Unknow runnable option specified.";;
|
|
esac
|
|
|
|
[ -n "${ezjail_imageaction} -a -z "${ezjail_image}" ] && exerr "Error: Jail ${ezjail_name} not an image jail."
|
|
|
|
case ${ezjail_imageaction} in
|
|
attach)
|
|
# Check, if image already attached
|
|
if [ -L "${ezjail_root}.device" ]; then
|
|
# Fetch destination of soft link
|
|
ezjail_device=`stat -f "%Y" ${ezjail_root}.device`
|
|
[ -b "${ezjail_device}" ] && exerr "Error: Jail image file ${ezjail_name} already attached as ${ezjail_device}."
|
|
rm -f ${ezjail_root}.device
|
|
fi
|
|
|
|
# Create a memory disc from jail image
|
|
ezjail_imagedevice=`mdconfig -a -t vnode -f ${ezjail_image}` || exerr "Error: Could not attach memory disc."
|
|
|
|
# If this is a crypto jail, try to mount it, remind user, which jail
|
|
# this is. In this case, the device to mount is
|
|
case ${ezjail_imagetype} in
|
|
crypto|bde)
|
|
echo "Attaching bde device for image jail ${ezjail}..."
|
|
echo gbde attach /dev/${ezjail_imagedevice} ${ezjail_attachparams} | /bin/sh
|
|
[ $? -eq 0 ] || detach_images keep || exerr "Error: Attaching bde device failed."
|
|
# Device to mount is not md anymore
|
|
ezjail_device=${ezjail_imagedevice}.bde
|
|
;;
|
|
eli)
|
|
echo "Attaching eli device for image jail ${ezjail}..."
|
|
echo geli attach ${ezjail_attachparams} /dev/${ezjail_device} | /bin/sh
|
|
[ $? -eq 0 ] || detach_images keep || exerr "Error: Attaching eli device failed."
|
|
# Device to mount is not md anymore
|
|
ezjail_device=${ezjail_imagedevice}.eli
|
|
;;
|
|
esac
|
|
|
|
mount /dev/${ezjail_device} ${ezjail_rootdir} || detach_images keep || exerr "Error: Could not mount /dev/${ezjail_device} to ${ezjail_root}."
|
|
# relink image device
|
|
ln -s /dev/${ezjail_device} ${ezjail_root}.device
|
|
|
|
;;
|
|
detach)
|
|
[ -n "${ezjail_id}" ] && exerr "Error: Jail ${ezjail_name} still running. Can't detach."
|
|
|
|
# Check, if image really attached
|
|
if [ -L "${ezjail_root}.device" ]; then
|
|
# Fetch destination of soft link
|
|
ezjail_device=`stat -f "%Y" ${ezjail_root}.device`
|
|
[ -b "${ezjail_device}" ] || exerr "Error: Jail image file ${ezjail_name} is not attached."
|
|
fi
|
|
|
|
# Add this device to the list of devices to be unmounted
|
|
case ${ezjail_imagetype} in
|
|
crypto|bde) ezjail_imagedevice="${ezjail_device%.bde}" ;;
|
|
eli) ezjail_imagedevice="${ezjail_device%.eli}" ;;
|
|
*) ezjail_imagedevice="${ezjail_device} ;;
|
|
esac
|
|
|
|
# Unmount/detach everything
|
|
detach_images keep
|
|
|
|
# Remove soft link (which acts as a lock)
|
|
rm -f ${ezjail_root}.device
|
|
;;
|
|
*) echo "Warning: Unknow image action specified.";;
|
|
;;
|
|
|
|
##############################################################################
|
|
# ezjail_imageparams HACK starts here
|
|
#
|
|
#
|
|
_parse_geli_attach_args_)
|
|
# create geli(8) attach arguments from geli(8) init arguments:
|
|
# -P becomes -p if present, -K newkeyfile becomes -k newkeyfile if present,
|
|
# everything else is dicarded
|
|
# exit values: 2->NO_ERROR, 3->NO_ERROR,PASSWORD_SET, 5->PARSER_ERROR
|
|
_exit=2
|
|
shift; while getopts :bPva:i:K:l:s: arg; do case ${arg} in
|
|
b|v|a|i|l|s);; # ignore these
|
|
P) echo -n "-p "; _exit=3 ;;
|
|
K) echo -n "-k '$OPTARG' ";;
|
|
?) exit 5;;
|
|
esac; done
|
|
exit ${_exit}
|
|
;;
|
|
_parse_gbde_attach_args_)
|
|
# create gbde(8) attach arguments from gbde(8) init arguments:
|
|
# -L lockfile becomes -l lockfile if present
|
|
# -K keyfile becomes -k keyfile if present
|
|
# -P passphrase becomes -p passphrase if present
|
|
# everything else is discarded
|
|
# exit values: 2->NO_ERROR, 3->NO_ERROR+PASSWORD_SET, 5->PARSER_ERROR
|
|
_exit=2
|
|
shift; while getopts :iK:f:L:P: arg; do case ${arg} in
|
|
i|f);; # ignore these
|
|
P) echo -n "-p '$OPTARG' "; _exit=3;;
|
|
K) echo -n "-k '$OPTARG' ";;
|
|
L) echo -n "-l '$OPTARG' ";;
|
|
?) exit 5;;
|
|
esac; done
|
|
exit ${_exit}
|
|
;;
|
|
#
|
|
# ezjail_imageparams HACK ends here (thank god)
|
|
##############################################################################
|
|
|
|
*)
|
|
exerr ${ezjail_usage_ezjailadmin}
|
|
;;
|
|
esac
|