summaryrefslogtreecommitdiff
path: root/ezjail-img.sh
diff options
context:
space:
mode:
Diffstat (limited to 'ezjail-img.sh')
-rw-r--r--ezjail-img.sh47
1 files changed, 33 insertions, 14 deletions
diff --git a/ezjail-img.sh b/ezjail-img.sh
index b41e7ad..fc7d02f 100644
--- a/ezjail-img.sh
+++ b/ezjail-img.sh
@@ -46,8 +46,8 @@ case "$1" in
46######################## ezjail-admin CREATE ######################## 46######################## ezjail-admin CREATE ########################
47create) 47create)
48 shift 48 shift
49 args=`getopt xf:r:is:c $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-i size] [-xc] jailname jailip" 49 args=`getopt f:r:s:xic $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-s size] [-xic] jailname jailip"
50 50
51 newjail_root= 51 newjail_root=
52 newjail_flavour= 52 newjail_flavour=
53 newjail_softlink= 53 newjail_softlink=
@@ -55,7 +55,7 @@ create)
55 newjail_imagesize= 55 newjail_imagesize=
56 newjail_device= 56 newjail_device=
57 newjail_fill="YES" 57 newjail_fill="YES"
58 58
59 set -- ${args} 59 set -- ${args}
60 for arg do 60 for arg do
61 case ${arg} in 61 case ${arg} in
@@ -69,7 +69,7 @@ create)
69 esac 69 esac
70 done 70 done
71 newjail_name=$1; newjail_ip=$2 71 newjail_name=$1; newjail_ip=$2
72 72
73 # we need at least a name and an ip for new jail 73 # we need at least a name and an ip for new jail
74 [ "${newjail_name}" -a "${newjail_ip}" -a $# = 2 ] || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip" 74 [ "${newjail_name}" -a "${newjail_ip}" -a $# = 2 ] || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip"
75 75
@@ -96,11 +96,11 @@ create)
96 # "an ezjail would already exist" 96 # "an ezjail would already exist"
97 [ "${newjail_nname}" = "basejail" -o "${newjail_nname}" = "newjail" -o "${newjail_nname}" = "fulljail" -o "${newjail_nname}" = "flavours" ] && \ 97 [ "${newjail_nname}" = "basejail" -o "${newjail_nname}" = "newjail" -o "${newjail_nname}" = "fulljail" -o "${newjail_nname}" = "flavours" ] && \
98 exerr "Error: ezjail needs the ${newjail_nname} directory for its own administrative purposes. Please rename the ezjail." 98 exerr "Error: ezjail needs the ${newjail_nname} directory for its own administrative purposes. Please rename the ezjail."
99 99
100 # jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com 100 # jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com
101 # so check, whether we might be running into problems 101 # so check, whether we might be running into problems
102 [ -e ${ezjail_jailcfgs}/${newjail_nname} ] && exerr "Error: an ezjail config already exists at ${ezjail_jailcfgs}/${newjail_nname}. Please rename the ezjail." 102 [ -e ${ezjail_jailcfgs}/${newjail_nname} ] && exerr "Error: an ezjail config already exists at ${ezjail_jailcfgs}/${newjail_nname}. Please rename the ezjail."
103 103
104 # if jail root specified on command line is not absolute, make it absolute 104 # if jail root specified on command line is not absolute, make it absolute
105 # inside our jail directory 105 # inside our jail directory
106 [ "${newjail_root%%[!/]*}" ] || newjail_root=${ezjail_jaildir}/${newjail_root} 106 [ "${newjail_root%%[!/]*}" ] || newjail_root=${ezjail_jaildir}/${newjail_root}
@@ -124,23 +124,43 @@ create)
124 # 124 #
125 125
126 if [ "${newjail_image}" ]; then 126 if [ "${newjail_image}" ]; then
127 # Strip trailing slashes from jail root, those would confuse image path
127 newjail_img=${newjail_root%/}; while [ "${newjail_img}" -a -z "${newjail_img%%*/}" ]; do newjail_img=${newjail_img%/}; done 128 newjail_img=${newjail_root%/}; while [ "${newjail_img}" -a -z "${newjail_img%%*/}" ]; do newjail_img=${newjail_img%/}; done
128 [ -z "${newjail_img}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${newjail_root}." 129 [ -z "${newjail_img}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${newjail_root}."
130
131 # Location of our image and crypto image lock file
129 newjail_lock=${newjail_img}.lock 132 newjail_lock=${newjail_img}.lock
130 newjail_img=${newjail_img}.img 133 newjail_img=${newjail_img}.img
134
135 # If NOT exist, create image
131 if [ "$newjail_fill" = "YES" ]; then 136 if [ "$newjail_fill" = "YES" ]; then
132 [ -e "${newjail_img}" ] && exerr "Error: a file exists at the location ${newjail_img}, preventing our own image file to be created." 137 [ -e "${newjail_img}" ] && exerr "Error: a file exists at the location ${newjail_img}, preventing our own image file to be created."
138 [ "${newjail_image}" = "crypto" -a -e "${newjail_lock}" ] && exerr "Error: a file exists at the location ${newjail_lock}, preventing our own crypto image lock file to be created."
139
140 # Now create jail disc image
133 touch "${newjail_img}" 141 touch "${newjail_img}"
134 dd if=/dev/random of="${newjail_img}" bs="${newjail_imagesize}" count=1 || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${newjail_img}. The image size provided was ${newjail_imagesize}." 142 dd if=/dev/random of="${newjail_img}" bs="${newjail_imagesize}" count=1 || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${newjail_img}. The image size provided was ${newjail_imagesize}."
143
144 # And attach device
135 newjail_img_device=`mdconfig -a -t vnode -f ${newjail_img}` 145 newjail_img_device=`mdconfig -a -t vnode -f ${newjail_img}`
146
136 if [ "${newjail_image}" = "crypto" ]; then 147 if [ "${newjail_image}" = "crypto" ]; then
148 # Initialise crypto image
149 # XXX TODO: catch error and detach memory disc
150 echo "Initialising crypto device. Enter a new passphrase twice..."
137 gbde init /dev/${newjail_img_device} -L ${newjail_lock} 151 gbde init /dev/${newjail_img_device} -L ${newjail_lock}
152
153 # XXX TODO: catch error and detach memory disc
154 echo "Attaching crypto device. Enter the passphrase..."
138 gbde attach /dev/${newjail_img_device} -l ${newjail_lock} 155 gbde attach /dev/${newjail_img_device} -l ${newjail_lock}
139 newjail_device=${newjail_img_device}.bde 156 newjail_device=${newjail_img_device}.bde
140 else 157 else
141 newjail_device=${newjail_img_device} 158 newjail_device=${newjail_img_device}
142 fi 159 fi
160
161 # Format memory image
143 newfs /dev/${newjail_device} 162 newfs /dev/${newjail_device}
163 # Create mount point and mount
144 mkdir -p ${newjail_root} 164 mkdir -p ${newjail_root}
145 mount /dev/${newjail_device} ${newjail_root} 165 mount /dev/${newjail_device} ${newjail_root}
146 else 166 else
@@ -151,8 +171,7 @@ create)
151 171
152 # now take a copy of our template jail 172 # now take a copy of our template jail
153 if [ "${newjail_fill}" = "YES" ]; then 173 if [ "${newjail_fill}" = "YES" ]; then
154 mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && \ 174 mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && find * | cpio -p -v ${newjail_root} > /dev/null
155 find * | cpio -p -v ${newjail_root} > /dev/null
156 [ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail." 175 [ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail."
157 fi 176 fi
158 177
@@ -178,7 +197,7 @@ create)
178 echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_jailcfgs}/${newjail_nname} 197 echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_jailcfgs}/${newjail_nname}
179 echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} 198 echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname}
180 echo export jail_${newjail_nname}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} 199 echo export jail_${newjail_nname}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname}
181 [ "${newjail_imagesize}" ] && \ 200 [ "${newjail_image}" ] && \
182 echo export jail_${newjail_nname}_image=\"${newjail_img}\" >> ${ezjail_jailcfgs}/${newjail_nname} 201 echo export jail_${newjail_nname}_image=\"${newjail_img}\" >> ${ezjail_jailcfgs}/${newjail_nname}
183 [ "${newjail_image}" = "crypto" ] && \ 202 [ "${newjail_image}" = "crypto" ] && \
184 echo export jail_${newjail_nname}_cryptimage=\"YES\" >> ${ezjail_jailcfgs}/${newjail_nname} 203 echo export jail_${newjail_nname}_cryptimage=\"YES\" >> ${ezjail_jailcfgs}/${newjail_nname}
@@ -188,7 +207,7 @@ create)
188 # install files and config to new jail 207 # install files and config to new jail
189 cd ${ezjail_flavours}/${newjail_flavour} && find * | cpio -p -v ${newjail_root} > /dev/null 208 cd ${ezjail_flavours}/${newjail_flavour} && find * | cpio -p -v ${newjail_root} > /dev/null
190 [ $? = 0 ] || echo "Warning: Could not fully install flavour." 209 [ $? = 0 ] || echo "Warning: Could not fully install flavour."
191 210
192 # If a config is found, make it auto run on jails startup 211 # If a config is found, make it auto run on jails startup
193 if [ -f ${newjail_root}/ezjail.flavour ]; then 212 if [ -f ${newjail_root}/ezjail.flavour ]; then
194 ln -s /ezjail.flavour ${newjail_root}/etc/rc.d/ezjail-config.sh 213 ln -s /ezjail.flavour ${newjail_root}/etc/rc.d/ezjail-config.sh
@@ -199,20 +218,20 @@ create)
199 218
200 # Detach (crypto and) memory discs 219 # Detach (crypto and) memory discs
201 detach_images 220 detach_images
202 221
203 # 222 #
204 # For user convenience some scenarios commonly causing headaches are checked 223 # For user convenience some scenarios commonly causing headaches are checked
205 # 224 #
206 225
207 # check, whether IP is configured on a local interface, warn if it isnt 226 # check, whether IP is configured on a local interface, warn if it isnt
208 ping -c 1 -m 1 -t 1 -q ${newjail_ip} > /dev/null 227 ping -c 1 -m 1 -t 1 -q ${newjail_ip} > /dev/null
209 [ $? = 0 ] || echo "Warning: IP ${newjail_ip} not configured on a local interface." 228 [ $? = 0 ] || echo "Warning: IP ${newjail_ip} not configured on a local interface."
210 229
211 # check, whether some host system services do listen on the Jails IP 230 # check, whether some host system services do listen on the Jails IP
212 TIFS=${IFS}; IFS=_ 231 TIFS=${IFS}; IFS=_
213 newjail_listener=`sockstat -4 -l | grep ${newjail_ip}:[[:digit:]]` 232 newjail_listener=`sockstat -4 -l | grep ${newjail_ip}:[[:digit:]]`
214 [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on IP ${newjail_ip}\n This may cause some confusion, here they are:\n${newjail_listener}" 233 [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on IP ${newjail_ip}\n This may cause some confusion, here they are:\n${newjail_listener}"
215 234
216 newjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]` 235 newjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]`
217 [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${newjail_ip})\n This may cause some confusion, here they are:\n${newjail_listener}" 236 [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${newjail_ip})\n This may cause some confusion, here they are:\n${newjail_listener}"
218 IFS=${TIFS} 237 IFS=${TIFS}