diff options
-rw-r--r-- | ezjail-img.sh | 244 |
1 files changed, 0 insertions, 244 deletions
diff --git a/ezjail-img.sh b/ezjail-img.sh deleted file mode 100644 index fc7d02f..0000000 --- a/ezjail-img.sh +++ /dev/null | |||
@@ -1,244 +0,0 @@ | |||
1 | #!/bin/sh | ||
2 | |||
3 | # ugly: this variable is set during port install time | ||
4 | #ezjail_prefix=EZJAIL_PREFIX | ||
5 | ezjail_prefix=/usr/local/ | ||
6 | ezjail_etc=${ezjail_prefix}/etc | ||
7 | ezjail_share=${ezjail_prefix}/share/ezjail | ||
8 | ezjail_examples=${ezjail_prefix}/share/examples/ezjail | ||
9 | ezjail_jailcfgs=${ezjail_etc}/ezjail | ||
10 | |||
11 | # read user config | ||
12 | [ -f ${ezjail_etc}/ezjail.conf ] && . ${ezjail_etc}/ezjail.conf | ||
13 | |||
14 | # set defaults | ||
15 | ezjail_jaildir=${ezjail_jaildir:-"/usr/jails"} | ||
16 | ezjail_jailtemplate=${ezjail_jailtemplate:-"${ezjail_jaildir}/newjail"} | ||
17 | ezjail_jailbase=${ezjail_jailbase:-"${ezjail_jaildir}/basejail"} | ||
18 | ezjail_jailfull=${ezjail_jailfull:-"${ezjail_jaildir}/fulljail"} | ||
19 | ezjail_flavours=${ezjail_flavours:-"${ezjail_jaildir}/flavours"} | ||
20 | ezjail_sourcetree=${ezjail_sourcetree:-"/usr/src"} | ||
21 | ezjail_portscvsroot=${ezjail_portscvsroot:-":pserver:anoncvs@anoncvs.at.FreeBSD.org:/home/ncvs"} | ||
22 | |||
23 | ezjail_mount_enable=${ezjail_mount_enable:-"YES"} | ||
24 | ezjail_devfs_enable=${ezjail_devfs_enable:-"YES"} | ||
25 | ezjail_devfs_ruleset=${ezjail_devfs_ruleset:-"devfsrules_jail"} | ||
26 | ezjail_procfs_enable=${ezjail_procfs_enable:-"YES"} | ||
27 | ezjail_fdescfs_enable=${ezjail_fdescfs_enable:-"YES"} | ||
28 | |||
29 | # define our bail out shortcut | ||
30 | exerr () { echo -e "$*"; exit 1; } | ||
31 | |||
32 | # define detach strategy for image jails | ||
33 | detach_images () { | ||
34 | # unmount and detach memory disc | ||
35 | if [ "${newjail_img_device}" ]; then | ||
36 | umount ${newjail_root} | ||
37 | [ "${newjail_image}" = "crypto" ] && gbde detach /dev/${newjail_img_device} | ||
38 | mdconfig -d -u ${newjail_img_device} | ||
39 | fi | ||
40 | } | ||
41 | |||
42 | # check for command | ||
43 | [ "$1" ] || exerr "Usage: `basename -- $0` [create] {params}" | ||
44 | |||
45 | case "$1" in | ||
46 | ######################## ezjail-admin CREATE ######################## | ||
47 | create) | ||
48 | shift | ||
49 | args=`getopt f:r:s:xic $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-s size] [-xic] jailname jailip" | ||
50 | |||
51 | newjail_root= | ||
52 | newjail_flavour= | ||
53 | newjail_softlink= | ||
54 | newjail_image= | ||
55 | newjail_imagesize= | ||
56 | newjail_device= | ||
57 | newjail_fill="YES" | ||
58 | |||
59 | set -- ${args} | ||
60 | for arg do | ||
61 | case ${arg} in | ||
62 | -x) newjail_fill="NO"; shift;; | ||
63 | -r) newjail_root="$2"; shift 2;; | ||
64 | -f) newjail_flavour="$2"; shift 2;; | ||
65 | -i) newjail_image="simple"; shift;; | ||
66 | -s) newjail_imagesize="$2"; shift 2;; | ||
67 | -c) newjail_image="crypto"; shift;; | ||
68 | --) shift; break;; | ||
69 | esac | ||
70 | done | ||
71 | newjail_name=$1; newjail_ip=$2 | ||
72 | |||
73 | # we need at least a name and an ip for new jail | ||
74 | [ "${newjail_name}" -a "${newjail_ip}" -a $# = 2 ] || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip" | ||
75 | |||
76 | # check for sanity of settings concerning the image feature | ||
77 | [ "${newjail_image}" -a "$newjail_fill" = "YES" -a ! "${newjail_imagesize}" ] && exerr "Image jails need an image size." | ||
78 | |||
79 | # check, whether ezjail-update has been called. existence of | ||
80 | # ezjail_jailbase is our indicator | ||
81 | [ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. Please run 'ezjail-admin update' first." | ||
82 | |||
83 | # relative paths don't make sense in rc.scripts | ||
84 | [ "${ezjail_jaildir%%[!/]*}" ] || exerr "Error: Need an absolute path in ezjail_jaildir, it currently is set to: ${ezjail_jaildir}." | ||
85 | |||
86 | # jail names must not irritate file systems, excluding dots from this list | ||
87 | # was done intentionally to permit foo.com style directory names, however, | ||
88 | # the jail name will be foo_com in most scripts | ||
89 | |||
90 | newjail_name=`echo -n ${newjail_name} | tr /~ __` | ||
91 | newjail_nname=`echo -n "${newjail_name}" | tr -c [:alnum:] _` | ||
92 | newjail_root=${newjail_root:-"${ezjail_jaildir}/${newjail_name}"} | ||
93 | |||
94 | # This scenario really will only lead to real troubles in the 'fulljail' | ||
95 | # case, but I should still explain this to the user and not claim that | ||
96 | # "an ezjail would already exist" | ||
97 | [ "${newjail_nname}" = "basejail" -o "${newjail_nname}" = "newjail" -o "${newjail_nname}" = "fulljail" -o "${newjail_nname}" = "flavours" ] && \ | ||
98 | exerr "Error: ezjail needs the ${newjail_nname} directory for its own administrative purposes. Please rename the ezjail." | ||
99 | |||
100 | # jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com | ||
101 | # so check, whether we might be running into problems | ||
102 | [ -e ${ezjail_jailcfgs}/${newjail_nname} ] && exerr "Error: an ezjail config already exists at ${ezjail_jailcfgs}/${newjail_nname}. Please rename the ezjail." | ||
103 | |||
104 | # if jail root specified on command line is not absolute, make it absolute | ||
105 | # inside our jail directory | ||
106 | [ "${newjail_root%%[!/]*}" ] || newjail_root=${ezjail_jaildir}/${newjail_root} | ||
107 | |||
108 | # if a directory at the specified jail root already exists, refuse to | ||
109 | # install | ||
110 | [ -e ${newjail_root} -a "${newjail_fill}" = "YES" ] && exerr "Error: the specified jail root ${newjail_root} alread exists." | ||
111 | |||
112 | # if jail root specified on command line does not lie within our jail | ||
113 | # directory, we need to create a softlink | ||
114 | if [ "${newjail_root##${ezjail_jaildir}}" = "${newjail_root}" ]; then | ||
115 | newjail_softlink=${ezjail_jaildir}/`basename -- ${newjail_root}` | ||
116 | [ -e ${newjail_softlink} -a "${newjail_fill}" = "YES" ] && exerr "Error: an ezjail already exists at ${newjail_softlink}." | ||
117 | fi | ||
118 | |||
119 | # do some sanity checks on the selected flavour (if any) | ||
120 | [ "${newjail_flavour}" -a ! -d ${ezjail_flavours}/${newjail_flavour} ] && exerr "Error: Flavour config directory ${ezjail_flavours}/${newjail_flavour} not found." | ||
121 | |||
122 | # | ||
123 | # All sanity checks that may lead to errors are hopefully passed here | ||
124 | # | ||
125 | |||
126 | if [ "${newjail_image}" ]; then | ||
127 | # Strip trailing slashes from jail root, those would confuse image path | ||
128 | newjail_img=${newjail_root%/}; while [ "${newjail_img}" -a -z "${newjail_img%%*/}" ]; do newjail_img=${newjail_img%/}; done | ||
129 | [ -z "${newjail_img}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${newjail_root}." | ||
130 | |||
131 | # Location of our image and crypto image lock file | ||
132 | newjail_lock=${newjail_img}.lock | ||
133 | newjail_img=${newjail_img}.img | ||
134 | |||
135 | # If NOT exist, create image | ||
136 | if [ "$newjail_fill" = "YES" ]; then | ||
137 | [ -e "${newjail_img}" ] && exerr "Error: a file exists at the location ${newjail_img}, preventing our own image file to be created." | ||
138 | [ "${newjail_image}" = "crypto" -a -e "${newjail_lock}" ] && exerr "Error: a file exists at the location ${newjail_lock}, preventing our own crypto image lock file to be created." | ||
139 | |||
140 | # Now create jail disc image | ||
141 | touch "${newjail_img}" | ||
142 | dd if=/dev/random of="${newjail_img}" bs="${newjail_imagesize}" count=1 || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${newjail_img}. The image size provided was ${newjail_imagesize}." | ||
143 | |||
144 | # And attach device | ||
145 | newjail_img_device=`mdconfig -a -t vnode -f ${newjail_img}` | ||
146 | |||
147 | if [ "${newjail_image}" = "crypto" ]; then | ||
148 | # Initialise crypto image | ||
149 | # XXX TODO: catch error and detach memory disc | ||
150 | echo "Initialising crypto device. Enter a new passphrase twice..." | ||
151 | gbde init /dev/${newjail_img_device} -L ${newjail_lock} | ||
152 | |||
153 | # XXX TODO: catch error and detach memory disc | ||
154 | echo "Attaching crypto device. Enter the passphrase..." | ||
155 | gbde attach /dev/${newjail_img_device} -l ${newjail_lock} | ||
156 | newjail_device=${newjail_img_device}.bde | ||
157 | else | ||
158 | newjail_device=${newjail_img_device} | ||
159 | fi | ||
160 | |||
161 | # Format memory image | ||
162 | newfs /dev/${newjail_device} | ||
163 | # Create mount point and mount | ||
164 | mkdir -p ${newjail_root} | ||
165 | mount /dev/${newjail_device} ${newjail_root} | ||
166 | else | ||
167 | [ -e ${newjail_root} -a ! -d ${newjail_root} ] && exerr "Error: Could not create mount point for your jail image. A file exists at its location. (For existing image jails, call this tool without the .img suffix when specifying jail root.)" | ||
168 | [ -d ${newjail_root} ] || mkdir -p ${newjail_root} | ||
169 | fi | ||
170 | fi | ||
171 | |||
172 | # now take a copy of our template jail | ||
173 | if [ "${newjail_fill}" = "YES" ]; then | ||
174 | mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && find * | cpio -p -v ${newjail_root} > /dev/null | ||
175 | [ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail." | ||
176 | fi | ||
177 | |||
178 | # if a soft link is necessary, create it now | ||
179 | [ "${newjail_softlink}" ] && ln -s ${newjail_root} ${newjail_softlink} | ||
180 | |||
181 | # if the automount feature is not disabled, this fstab entry for new jail | ||
182 | # will be obeyed | ||
183 | echo -n > /etc/fstab.${newjail_nname} | ||
184 | [ "${newjail_image}" ] && \ | ||
185 | echo ${newjail_root}.device ${newjail_root} ufs rw 0 0 >> /etc/fstab.${newjail_nname} | ||
186 | echo ${ezjail_jailbase} ${newjail_root}/basejail nullfs ro 0 0 >> /etc/fstab.${newjail_nname} | ||
187 | |||
188 | # now, where everything seems to have gone right, create control file in | ||
189 | # ezjails config dir | ||
190 | mkdir -p ${ezjail_jailcfgs} | ||
191 | echo export jail_${newjail_nname}_hostname=\"${newjail_name}\" > ${ezjail_jailcfgs}/${newjail_nname} | ||
192 | echo export jail_${newjail_nname}_ip=\"${newjail_ip}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
193 | echo export jail_${newjail_nname}_rootdir=\"${newjail_root}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
194 | echo export jail_${newjail_nname}_exec=\"/bin/sh /etc/rc\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
195 | echo export jail_${newjail_nname}_mount_enable=\"${ezjail_mount_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
196 | echo export jail_${newjail_nname}_devfs_enable=\"${ezjail_devfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
197 | echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
198 | echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
199 | echo export jail_${newjail_nname}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
200 | [ "${newjail_image}" ] && \ | ||
201 | echo export jail_${newjail_nname}_image=\"${newjail_img}\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
202 | [ "${newjail_image}" = "crypto" ] && \ | ||
203 | echo export jail_${newjail_nname}_cryptimage=\"YES\" >> ${ezjail_jailcfgs}/${newjail_nname} | ||
204 | |||
205 | # Final steps for flavour installation | ||
206 | if [ "${newjail_fill}" = "YES" -a "${newjail_flavour}" ]; then | ||
207 | # install files and config to new jail | ||
208 | cd ${ezjail_flavours}/${newjail_flavour} && find * | cpio -p -v ${newjail_root} > /dev/null | ||
209 | [ $? = 0 ] || echo "Warning: Could not fully install flavour." | ||
210 | |||
211 | # If a config is found, make it auto run on jails startup | ||
212 | if [ -f ${newjail_root}/ezjail.flavour ]; then | ||
213 | ln -s /ezjail.flavour ${newjail_root}/etc/rc.d/ezjail-config.sh | ||
214 | chmod 0700 ${newjail_root}/ezjail.flavour | ||
215 | echo "Note: Shell scripts installed, flavourizing on jails first startup." | ||
216 | fi | ||
217 | fi | ||
218 | |||
219 | # Detach (crypto and) memory discs | ||
220 | detach_images | ||
221 | |||
222 | # | ||
223 | # For user convenience some scenarios commonly causing headaches are checked | ||
224 | # | ||
225 | |||
226 | # check, whether IP is configured on a local interface, warn if it isnt | ||
227 | ping -c 1 -m 1 -t 1 -q ${newjail_ip} > /dev/null | ||
228 | [ $? = 0 ] || echo "Warning: IP ${newjail_ip} not configured on a local interface." | ||
229 | |||
230 | # check, whether some host system services do listen on the Jails IP | ||
231 | TIFS=${IFS}; IFS=_ | ||
232 | newjail_listener=`sockstat -4 -l | grep ${newjail_ip}:[[:digit:]]` | ||
233 | [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on IP ${newjail_ip}\n This may cause some confusion, here they are:\n${newjail_listener}" | ||
234 | |||
235 | newjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]` | ||
236 | [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${newjail_ip})\n This may cause some confusion, here they are:\n${newjail_listener}" | ||
237 | IFS=${TIFS} | ||
238 | |||
239 | ;; | ||
240 | *) | ||
241 | exerr "Usage: `basename -- $0` [create|delete|list|update] {params}" | ||
242 | ;; | ||
243 | esac | ||
244 | |||