From 6c388abea89dddcf8c1c8b56b7d8a7f5edcfb2d5 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Tue, 21 Mar 2006 16:33:05 +0000 Subject: ezjail now comes with image jails. HEADS UP! A lot of testing is ahead. --- ezjail-admin | 118 +++++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 98 insertions(+), 20 deletions(-) (limited to 'ezjail-admin') diff --git a/ezjail-admin b/ezjail-admin index f968e5e..d905279 100755 --- a/ezjail-admin +++ b/ezjail-admin @@ -28,6 +28,16 @@ ezjail_fdescfs_enable=${ezjail_fdescfs_enable:-"YES"} # define our bail out shortcut exerr () { echo -e "$*"; exit 1; } +# define detach strategy for image jails +detach_images () { + # unmount and detach memory disc + if [ "${newjail_img_device}" ]; then + umount ${newjail_root} + [ "${newjail_image}" = "crypto" ] && gbde detach /dev/${newjail_img_device} + mdconfig -d -u ${newjail_img_device} + fi +} + # check for command [ "$1" ] || exerr "Usage: `basename -- $0` [create|delete|list|update] {params}" @@ -35,11 +45,14 @@ case "$1" in ######################## ezjail-admin CREATE ######################## create) shift - args=`getopt xf:r: $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip" + args=`getopt f:r:s:xic $*` || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-s size] [-xic] jailname jailip" newjail_root= newjail_flavour= newjail_softlink= + newjail_image= + newjail_imagesize= + newjail_device= newjail_fill="YES" set -- ${args} @@ -48,14 +61,20 @@ create) -x) newjail_fill="NO"; shift;; -r) newjail_root="$2"; shift 2;; -f) newjail_flavour="$2"; shift 2;; + -i) newjail_image="simple"; shift;; + -s) newjail_imagesize="$2"; shift 2;; + -c) newjail_image="crypto"; shift;; --) shift; break;; esac done - newjail_name=$1; newjail_ip=$2 + newjail_name=$1; newjail_ip=$2 # we need at least a name and an ip for new jail [ "${newjail_name}" -a "${newjail_ip}" -a $# = 2 ] || exerr "Usage: `basename -- $0` create [-f flavour] [-r jailroot] [-x] jailname jailip" + # check for sanity of settings concerning the image feature + [ "${newjail_image}" -a "$newjail_fill" = "YES" -a ! "${newjail_imagesize}" ] && exerr "Image jails need an image size." + # check, whether ezjail-update has been called. existence of # ezjail_jailbase is our indicator [ -d ${ezjail_jailbase} ] || exerr "Error: base jail does not exist. Please run 'ezjail-admin update' first." @@ -103,35 +122,87 @@ create) # All sanity checks that may lead to errors are hopefully passed here # + if [ "${newjail_image}" ]; then + # Strip trailing slashes from jail root, those would confuse image path + newjail_img=${newjail_root%/}; while [ "${newjail_img}" -a -z "${newjail_img%%*/}" ]; do newjail_img=${newjail_img%/}; done + [ -z "${newjail_img}" ] && exerr "Error: Could not determine image file name, something is wrong with the jail root: ${newjail_root}." + + # Location of our image and crypto image lock file + newjail_lock=${newjail_img}.lock + newjail_img=${newjail_img}.img + + # If NOT exist, create image + if [ "$newjail_fill" = "YES" ]; then + [ -e "${newjail_img}" ] && exerr "Error: a file exists at the location ${newjail_img}, preventing our own image file to be created." + [ "${newjail_image}" = "crypto" -a -e "${newjail_lock}" ] && exerr "Error: a file exists at the location ${newjail_lock}, preventing our own crypto image lock file to be created." + + # Now create jail disc image + touch "${newjail_img}" + dd if=/dev/random of="${newjail_img}" bs="${newjail_imagesize}" count=1 || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${newjail_img}. The image size provided was ${newjail_imagesize}." + + # And attach device + newjail_img_device=`mdconfig -a -t vnode -f ${newjail_img}` + + if [ "${newjail_image}" = "crypto" ]; then + # Initialise crypto image + # XXX TODO: catch error and detach memory disc + echo "Initialising crypto device. Enter a new passphrase twice..." + gbde init /dev/${newjail_img_device} -L ${newjail_lock} + + # XXX TODO: catch error and detach memory disc + echo "Attaching crypto device. Enter the passphrase..." + gbde attach /dev/${newjail_img_device} -l ${newjail_lock} + newjail_device=${newjail_img_device}.bde + else + newjail_device=${newjail_img_device} + fi + + # Format memory image + newfs /dev/${newjail_device} + # Create mount point and mount + mkdir -p ${newjail_root} + mount /dev/${newjail_device} ${newjail_root} + else + [ -e ${newjail_root} -a ! -d ${newjail_root} ] && exerr "Error: Could not create mount point for your jail image. A file exists at its location. (For existing image jails, call this tool without the .img suffix when specifying jail root.)" + [ -d ${newjail_root} ] || mkdir -p ${newjail_root} + fi + fi + # now take a copy of our template jail if [ "${newjail_fill}" = "YES" ]; then - mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && \ - find * | cpio -p -v ${newjail_root} > /dev/null - [ $? = 0 ] || exerr "Error: Could not copy template jail." + mkdir -p ${newjail_root} && cd ${ezjail_jailtemplate} && find * | cpio -p -v ${newjail_root} > /dev/null + [ $? = 0 ] || detach_images || exerr "Error: Could not copy template jail." fi # if a soft link is necessary, create it now - [ "${newjail_softlink}" ] && ln -s ${newjail_root} ${newjail_softlink} + [ "${newjail_softlink}" ] && ln -s ${newjail_root} ${newjail_softlink} # if the automount feature is not disabled, this fstab entry for new jail # will be obeyed - echo ${ezjail_jailbase} ${newjail_root}/basejail nullfs ro 0 0 > /etc/fstab.${newjail_nname} + echo -n > /etc/fstab.${newjail_nname} + [ "${newjail_image}" ] && \ + echo ${newjail_root}.device ${newjail_root} ufs rw 0 0 >> /etc/fstab.${newjail_nname} + echo ${ezjail_jailbase} ${newjail_root}/basejail nullfs ro 0 0 >> /etc/fstab.${newjail_nname} - # now, where everything seems to have gone right, create control file in + # now, where everything seems to have gone right, create control file in # ezjails config dir mkdir -p ${ezjail_jailcfgs} - echo export jail_${newjail_nname}_hostname=\"${newjail_name}\" > ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_ip=\"${newjail_ip}\" >> ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_rootdir=\"${newjail_root}\" >> ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_exec=\"/bin/sh /etc/rc\" >> ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_mount_enable=\"${ezjail_mount_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_devfs_enable=\"${ezjail_devfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_jailcfgs}/${newjail_nname} - echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_hostname=\"${newjail_name}\" > ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_ip=\"${newjail_ip}\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_rootdir=\"${newjail_root}\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_exec=\"/bin/sh /etc/rc\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_mount_enable=\"${ezjail_mount_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_devfs_enable=\"${ezjail_devfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_devfs_ruleset=\"devfsrules_jail\" >> ${ezjail_jailcfgs}/${newjail_nname} + echo export jail_${newjail_nname}_procfs_enable=\"${ezjail_procfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} echo export jail_${newjail_nname}_fdescfs_enable=\"${ezjail_fdescfs_enable}\" >> ${ezjail_jailcfgs}/${newjail_nname} + [ "${newjail_image}" ] && \ + echo export jail_${newjail_nname}_image=\"${newjail_img}\" >> ${ezjail_jailcfgs}/${newjail_nname} + [ "${newjail_image}" = "crypto" ] && \ + echo export jail_${newjail_nname}_cryptimage=\"YES\" >> ${ezjail_jailcfgs}/${newjail_nname} - # Final steps for flavour installation - if [ "${newjail_flavour}" ]; then + # Final steps for flavour installation + if [ "${newjail_fill}" = "YES" -a "${newjail_flavour}" ]; then # install files and config to new jail cd ${ezjail_flavours}/${newjail_flavour} && find * | cpio -p -v ${newjail_root} > /dev/null [ $? = 0 ] || echo "Warning: Could not fully install flavour." @@ -144,6 +215,9 @@ create) fi fi + # Detach (crypto and) memory discs + detach_images + # # For user convenience some scenarios commonly causing headaches are checked # @@ -160,7 +234,7 @@ create) newjail_listener=`sockstat -4 -l | grep \*:[[:digit:]]` [ $? = 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${newjail_ip})\n This may cause some confusion, here they are:\n${newjail_listener}" IFS=${TIFS} - + ;; ######################## ezjail-admin DELETE ######################## delete) @@ -190,6 +264,7 @@ delete) # fetch information about the jail to be gone by parsing our records . ${ezjail_jailcfgs}/${oldjail_nname} eval oldjail_rootdir=\"\$jail_${oldjail_nname}_rootdir\" + eval oldjail_image=\"\$jail_${oldjail_nname}_image\" # if jail is still running, refuse to go any further [ -f /var/run/jail_${oldjail_nname}.id ] && exerr "Error: Jail appears to be still running, stop it first.\n(/var/run/jail_${oldjail_nname}.id exists)." @@ -204,7 +279,10 @@ delete) [ -L ${oldjail_softlink} ] && rm ${oldjail_softlink} # if wiping the jail was requested, remove it - [ "${oldjail_wipe}" ] && rm -rf ${oldjail_rootdir} + if [ "${oldjail_wipe}" ]; then + [ "${oldjail_image}" ] && rm -f ${oldjail_image} ${oldjail_image%.img}.lock ${oldjail_image%.img}.device + rm -rf ${oldjail_rootdir} + fi ;; ######################## ezjail-admin LIST ######################## -- cgit v1.2.3