path: root/ezjail-admin

#!/bin/sh
# $Id$

# ugly: this variable is set during port install time
ezjail_prefix=EZJAIL_PREFIX
ezjail_admin=`basename -- $0`
ezjail_etc="${ezjail_prefix}/etc"
ezjail_share="${ezjail_prefix}/share/ezjail"
ezjail_examples="${ezjail_prefix}/share/examples/ezjail"
ezjail_jailcfgs="${ezjail_etc}/ezjail"

# read user config
[ -f "${ezjail_etc}/ezjail.conf" ] && . "${ezjail_etc}/ezjail.conf"

# set defaults
ezjail_jaildir=${ezjail_jaildir:-"/usr/jails"}
ezjail_jailtemplate=${ezjail_jailtemplate:-"${ezjail_jaildir}/newjail"}
ezjail_jailbase=${ezjail_jailbase:-"${ezjail_jaildir}/basejail"}
ezjail_jailfull=${ezjail_jailfull:-"${ezjail_jaildir}/fulljail"}
ezjail_jailtemp=${ezjail_jailtemp:-"${ezjail_jaildir}/ezjailtemp"}
ezjail_flavours=${ezjail_flavours:-"${ezjail_jaildir}/flavours"}
ezjail_portscvsroot=${ezjail_portscvsroot:-":pserver:anoncvs@anoncvs.at.FreeBSD.org:/home/ncvs"}
ezjail_sourcetree=${ezjail_sourcetree:-"/usr/src"}
ezjail_uglyperlhack=${ezjail_uglyperlhack:-"YES"}
ezjail_default_execute=${ezjail_default_execute:-"/usr/bin/login -f root"}

ezjail_mount_enable=${ezjail_mount_enable:-"YES"}
ezjail_devfs_enable=${ezjail_devfs_enable:-"YES"}
ezjail_devfs_ruleset=${ezjail_devfs_ruleset:-"devfsrules_jail"}
ezjail_procfs_enable=${ezjail_procfs_enable:-"YES"}
ezjail_fdescfs_enable=${ezjail_fdescfs_enable:-"YES"}

ezjail_dirlist="bin boot lib libexec rescue sbin usr/bin usr/games usr/include usr/lib usr/libdata usr/libexec usr/sbin usr/src usr/share"
ezjail_basesystem="base"

# amd64 is a really strange platform
case `uname -p` in amd64) ezjail_dirlist="${ezjail_dirlist} usr/lib32"; ezjail_basesystem="${ezjail_basesystem} lib32";; esac

# Synopsis messages
ezjail_usage_ezjailadmin="ezjail-admin v3.0b\nUsage: ${ezjail_admin} [archive|config|console|create|delete|install|list|restore|update] {params}"
ezjail_usage_install="Usage: ${ezjail_admin} install [-mps] [-h host] [-r release]"
ezjail_usage_create="Usage: ${ezjail_admin} create [-xbi] [-f flavour] [-r jailroot] [-s size] [-c bde|eli] [-C args] [-a archive] jailname jailip"
ezjail_usage_delete="Usage: ${ezjail_admin} delete [-w] jailname"
ezjail_usage_update="Usage: ${ezjail_admin} update [-s sourcetree] [-i] [-pP]"
ezjail_usage_config="Usage: ${ezjail_admin} config [-r run|norun] [-n newname] [-i attach|detach|fsck] jailname"
ezjail_usage_console="Usage: ${ezjail_admin} console [-f] [-e command] jailname"
ezjail_usage_archive="Usage: ${ezjail_admin} archive [-Af] [-a archive] [-d archivedir] jailname [jailname...]"
ezjail_usage_restore="Usage: ${ezjail_admin} restore [-d archivedir] (archive|jailname)..."
ezjail_usage_list="Usage: ${ezjail_admin} list"

################################
# End of variable initialization
#

# define our bail out shortcut
exerr () { echo -e "$*" >&2 ; exit 1; }

# generic attach routine for image jails
attach_images () {
  # Create a memory disc from jail image
  ezjail_imagedevice=`mdconfig -a -t vnode -f ${ezjail_image}` || exerr "Error: Could not attach memory disc."

  # If this is a crypto jail, try to mount it, remind user, which jail
  # this is. In this case, the device to mount is 
  case ${ezjail_imagetype} in
  crypto|bde)
    echo Attaching bde device for image jail ${ezjail}...
    echo gbde attach "/dev/${ezjail_imagedevice}" ${ezjail_attachparams} | /bin/sh
    [ $? -eq 0 ] || detach_images keep || exerr "Error: Attaching bde device failed."
    # Device to mount is not md anymore
    ezjail_device="${ezjail_imagedevice}.bde"
    ;;
  eli)
    echo "Attaching eli device for image jail ${ezjail}..."
    echo geli attach ${ezjail_attachparams} "/dev/${ezjail_imagedevice}" | /bin/sh 
    [ $? -eq 0 ] || detach_images keep || exerr "Error: Attaching eli device failed."
    # Device to mount is not md anymore
    ezjail_device="${ezjail_imagedevice}.eli"
    ;;
  simple)
    ezjail_device=${ezjail_imagedevice}
    ;;
  esac
}

# define detach strategy for image jails
detach_images () {
  # Avoid ending up inside mount point
  cd /

  # unmount and detach memory disc
  if [ "${ezjail_imagedevice}" ]; then
    umount "${ezjail_rootdir}" > /dev/null 2> /dev/null
    case ${ezjail_imagetype} in
      bde) gbde detach "/dev/${ezjail_imagedevice}" > /dev/null;;
      eli) geli detach "/dev/${ezjail_imagedevice}" > /dev/null;;
    esac
    mdconfig -d -u "${ezjail_imagedevice}" > /dev/null
    [ "$1" = "keep" ] || rm -f "${ezjail_image}"
  fi

  # Remove soft link (which acts as a lock)
  [ -e "/dev/${ezjail_imagedevice}" ] || rm -f "${ezjail_devicelink}"

  # This function is being called in case of error. Keep $? bad
  return 1
}

# Find and execute our rc script
start_stop_jail_by_script () {
  ezjail_action=$1
  [ "${ezjail_action}" = "start" ] && ezjail_success_check="-n" || ezjail_success_check="-z"

  # Try to locate and run ezjails rc.d script
  if [ -x "${ezjail_prefix}/etc/rc.d/ezjail" ]; then
    (exec "${ezjail_prefix}/etc/rc.d/ezjail" ${ezjail_action} ${ezjail_name});
  elif [ -x "${ezjail_prefix}/etc/rc.d/ezjail.sh" ]; then
    (exec "${ezjail_prefix}/etc/rc.d/ezjail.sh" ${ezjail_action} ${ezjail_name});
  else
    exerr "Could not find ezjail's rc.d script in ${ezjail_prefix}/etc/rc.d/. You need to ${ezjail_action} ${ezjail_name} by hand."
  fi

  # Check for success of our operation
  fetchjailinfo ${ezjail_name}
  [ ${ezjail_success_check} "${ezjail_id}" ] || exerr "Error: Could not ${ezjail_action} ${ezjail_name}. You need to ${ezjail_action} it by hand."
}

# fetch everything we need to know about an ezjail from config
fetchjailinfo () {
  ezjail_name=$1

  # Clean variables, prevent polution
  unset ezjail_config ezjail_running ezjail_hostname ezjail_rootdir ezjail_image ezjail_imagetype ezjail_imagedevice ezjail_devicelink ezjail_ip ezjail_id ezjail_attached ezjail_device ezjail_device_geom

  ezjail_safename=`echo -n "${ezjail_name}" | tr -c '[:alnum:]' _`

  if [ -z "$2" ]; then
    [ -e "${ezjail_jailcfgs}/${ezjail_safename}"       ] && ezjail_config="${ezjail_jailcfgs}/${ezjail_safename}"
    [ -e "${ezjail_jailcfgs}/${ezjail_safename}.norun" ] && ezjail_config="${ezjail_jailcfgs}/${ezjail_safename}.norun"
  else
    ezjail_config=$2
  fi
  [ "${ezjail_config}" ] || return 0

  . "${ezjail_config}"
  eval ezjail_hostname=\"\$jail_${ezjail_safename}_hostname\"
  eval ezjail_rootdir=\"\$jail_${ezjail_safename}_rootdir\"
  eval ezjail_ip=\"\$jail_${ezjail_safename}_ip\"
  eval ezjail_image=\"\$jail_${ezjail_safename}_image\"
  eval ezjail_imagetype=\"\$jail_${ezjail_safename}_imagetype\"
  eval ezjail_attachparams=\"\$jail_${ezjail_safename}_attachparams\"
  eval ezjail_attachblocking=\"\$jail_${ezjail_safename}_attachblocking\"
  eval ezjail_forceblocking=\"\$jail_${ezjail_safename}_forceblocking\"

  ezjail_softlink=${ezjail_jaildir}/`basename -- "${ezjail_rootdir}"`
  ezjail_devicelink="${ezjail_rootdir}.device"

  if [ "${ezjail_image}" -a -L "${ezjail_devicelink}" ]; then
    # Fetch destination of soft link
    ezjail_device=`stat -f "%Y" ${ezjail_devicelink}`
    ezjail_device_geom=${ezjail_device#/dev/}

    # Add this device to the list of devices to be unmounted
    case ${ezjail_imagetype} in
      crypto|bde) ezjail_imagedevice=${ezjail_device_geom%.bde} ;;
      eli)        ezjail_imagedevice=${ezjail_device_geom%.eli} ;;
      *)          ezjail_imagedevice=${ezjail_device_geom} ;;
    esac

    mount -p -v | grep -q -E "^${ezjail_devicelink}[[:space:]]+${ezjail_rootdir}" && ezjail_attached="YES"
    mount -p -v | grep -q -E "^${ezjail_device}[[:space:]]+${ezjail_rootdir}" && ezjail_attached="YES"

    # Stale device link detected. Remove and clean.
    [ -z "${ezjail_attached}" ] && unset ezjail_device && rm -f "${ezjail_devicelink}"
  fi

  [ -f "/var/run/jail_${ezjail_safename}.id" ] && ezjail_id=`cat /var/run/jail_${ezjail_safename}.id` || return
  jls | grep -q -E "^ +${ezjail_id} " || unset ezjail_id
}

# fill the base jail - this function is used by install and update
ezjail_splitworld() {
  # Fill basejail from installed world
  cd "${ezjail_jailfull}" || exerr "Cant access temporary Jail directory."

  # This mkdir is important, since cpio will create intermediate
  # directories with permission 0700 which is bad
  mkdir -p "${ezjail_jailbase}/usr"
  for dir in ${ezjail_dirlist}; do
    find ${dir} | cpio -d -p -v "${ezjail_jailbase}" || exerr "Installation of ${dir} failed."
    chflags -R noschg ${dir}; rm -r ${dir}; ln -s /basejail/${dir} ${dir}
  done
  mkdir basejail

  # Try to remove the old template jail
  [ -d "${ezjail_jailtemplate}" ] && chflags -R noschg "${ezjail_jailtemplate}" && rm -rf "${ezjail_jailtemplate}"
  mv "${ezjail_jailfull}" "${ezjail_jailtemplate}"

  # If the default flavour example has not yet been copied, do it now
  [ -d "${ezjail_flavours}/default" ] || mkdir -p "${ezjail_flavours}" && cp -p -R "${ezjail_examples}/default" "${ezjail_flavours}"

  # no /usr/ports? link to /basejail/usr/ports
  [ -e "${ezjail_jailtemplate}/usr/ports" ] || ln -s /basejail/usr/ports "${ezjail_jailtemplate}/usr/ports"

  # A ports collection inside jails is hardly useful w/o an appropriate
  # /etc/make.conf.
  if [ -f "${ezjail_examples}/default/etc/make.conf" -a ! -f "${ezjail_jailtemplate}/etc/make.conf" ]; then
    cp -p "${ezjail_examples}/default/etc/make.conf" "${ezjail_jailtemplate}/etc/"
    echo "Note: a non-standard /etc/make.conf was copied to the template jail in order to get the ports collection running inside jails."
  fi

  # The ugly perl hack[tm]. Note: we wont do such things for any given
  # port :(
  [ "${ezjail_uglyperlhack}" = "YES" -a ! -L "${ezjail_jailbase}/usr/bin/perl" ] && ln -s /usr/local/bin/perl "${ezjail_jailbase}/usr/bin/perl"
}

# The user may want to have a ports tree in basejail
ezjail_updateports () {
  local _portsnap_fetch="fetch"
  # if /usr/ports/CVS exists, assume cvs up is safe
  # this is legacy
  if [ -f "${ezjail_jailbase}/usr/ports/CVS/Root" ]; then
    echo -n "Updating ports from "; cat "${ezjail_jailbase}/usr/ports/CVS/Root"
    echo "Warning: Upgrading legacy ports copy. Consider removing ${ezjail_jailbase}/usr/ports and use the new portsnap strategy instead."
    echo "Gathering local information may take a while."
    cd "${ezjail_jailbase}/usr/ports/" && cvs -d "${ezjail_portscvsroot}" up -Pd
  else
    [ -z "$TERM" -o "$TERM" = "dumb" ] && _portsnap_fetch="cron"
    portsnap ${_portsnap_fetch}
    [ -d "${ezjail_jailbase}/usr/ports" ] && ezjail_portsnapaction="update"
    portsnap -p "${ezjail_jailbase}/usr/ports" ${ezjail_portsnapaction:-"extract"}
  fi
  [ $? -eq 0 ] || exerr "Updating ports failed."
}

# Try to fetch the list of releases the server provides
ezjail_queryftpserver () {
  unset _ret
  echo -n "Querying your ftp-server... "
  TIFS=${IFS}; IFS=
  for ezjail_path in pub/FreeBSD/releases pub/FreeBSD/snapshot pub/FreeBSD releases snapshots NO; do
    if [ ${ezjail_path} = "NO" ]; then
      echo "Warning: I am having problems querying the ftp server you specified (${ezjail_ftphost})."
      _ret=1; break
    fi
    ezjail_ftpresponse=`echo ls | ftp "${ezjail_ftphost}:${ezjail_path}/${ezjail_installarch}/" 2> /dev/null` 2> /dev/null
    if [ $? -eq 0 ]; then
      echo -e "The ftp server you specified (${ezjail_ftphost}) seems to provide the following builds:\n${ezjail_ftpresponse}"
      _ret=0; break 2
    fi
  done
  IFS=${TIFS}
  ezjail_ftpserverqueried="YES"
  return ${_ret}
}

# Make a path absolute, if it isn't already
ezjail_makeabsolute ( ) {
  eval [ \"\${$1%%[!/]*}\" -o "\${$1}" = "-" ] && return
  [ "${2%%[!/]*}" ] && path=${2} || path=`pwd -P`/${2}
  eval export ${1}="${path}/\${$1}"
}

parse_geli_attach_args () {
  # create geli(8) attach arguments from geli(8) init arguments:
  #    -P becomes -p if present, -K newkeyfile becomes -k newkeyfile if present, 
  #    everything else is dicarded
  #  exit values: 0->NO PASSWORD SET, 1->PASSWORD SET
  _exit=0
  while getopts :bPva:i:K:l:s: arg; do
    case ${arg} in
      b|v|a|i|l|s);; # ignore these
      P) echo -n "-p "; _exit=1 ;;
      K) echo -n "-k '$OPTARG' ";;
      ?) exerr "Error: Processing of attach params failed.";;
    esac
  done
  return ${_exit}
}

parse_gbde_attach_args () {
  # create gbde(8) attach arguments from gbde(8) init arguments:
  #   -L lockfile becomes -l lockfile if present
  #   -K keyfile becomes -k keyfile if present
  #   -P passphrase becomes -p passphrase if present
  #   everything else is discarded
  #  exit values: 0->NO PASSWORD SET, 1->PASSWORD SET
  _exit=0
  while getopts :iK:f:L:P: arg; do
    case ${arg} in
      i|f);; # ignore these
      P) echo -n "-p '$OPTARG' "; _exit=1;;
      K) echo -n "-k '$OPTARG' ";;
      L) echo -n "-l '$OPTARG' ";;
      ?) exerr "Error: Processing of attach params failed.";;
    esac
  done
  return ${_exit}
}

#############################
# End of function definitions
#

# check for command
[ $# -gt 0 ] || exerr ${ezjail_usage_ezjailadmin}

case "$1" in
######################## ezjail-admin CREATE ########################
create)
  # Clean variables, prevent polution
  unset ezjail_rootdir ezjail_flavour ezjail_softlink ezjail_image ezjail_imagetype ezjail_imageparams ezjail_imagesize ezjail_device ezjail_devicelink ezjail_config ezjail_attachparams ezjail_exists ezjail_attachblocking ezjail_forceblocking ezjail_sourcedevice ezjail_rootdirempty ezjail_fromarchive ezjail_fromarchive_config
  shift; while getopts :f:r:s:xbic:C:a:A: arg; do case ${arg} in
    x) ezjail_exists="YES";;
    r) ezjail_rootdir=${OPTARG};;
    f) ezjail_flavour=${OPTARG};;
    a) ezjail_fromarchive=${OPTARG};;
    A) ezjail_fromarchive_config=${OPTARG};;
    c) ezjail_imagetype=${OPTARG};;
    C) ezjail_imageparams=${OPTARG};;
    b) ezjail_forceblocking="YES";;
    i) ezjail_imagetype=${ezjail_imagetype:-"simple"};;
    s) ezjail_imagesize=${OPTARG};;
    ?) exerr ${ezjail_usage_create};;
  esac; done; shift $(( ${OPTIND} - 1 ))

  ezjail_name=$1; ezjail_ip=$2

  # we need at least a name and an ip for new jail
  [ "${ezjail_name}" -a "${ezjail_ip}" -a $# -eq 2 ] || exerr ${ezjail_usage_create}

  # check for sanity of settings concerning the image feature
  [ -z "${ezjail_imagetype}" -o "${ezjail_exists}" -o "${ezjail_imagesize}" ] || exerr "Image jails need an image size."

  # check for a sane image type
  case ${ezjail_imagetype} in ""|simple|bde|eli) ;; *) exerr ${ezjail_usage_create};; esac

  # check for a sane image size and split it up in blocks
  if [ "${ezjail_imagesize}" ]; then
    _val=`echo "${ezjail_imagesize}"|tr GMKBWX gmkbwx|sed -Ees:g:km:g -es:m:kk:g -es:k:"*2b":g -es:b:"*128w":g -es:w:"*4 ":g -e"s:(^|[^0-9])0x:\1\0X:g" -ey:x:"*":|bc`
    [ $? -eq 0 -a ${_val} -gt 0 ] || exerr "Error: The image size you specified is somehow incomprehensible (you specified ${ezjail_imagesize})."
    ezjail_imageblockcount=`echo ${_val} / 1048576 | bc`
    ezjail_imagerestbytes=`echo ${_val} % 1048576 | bc`
  fi

  # check, whether ezjail has been set up correctly. existence of
  # ezjail_jailbase is our indicator
  [ -d "${ezjail_jailbase}" ] || exerr "Error: base jail does not exist. Please run '${ezjail_admin} install' or '${ezjail_admin} update' first."

  # relative paths don't make sense in rc.scripts
  [ "${ezjail_jaildir%%[!/]*}" ] || exerr "Error: Need an absolute path in ezjail_jaildir, it currently is set to: ${ezjail_jaildir}."

  # jail names must not irritate file systems, excluding dots from this list
  # was done intentionally to permit foo.com style directory names, however,
  # the jail name will be foo_com in most scripts

  ezjail_hostname=`echo -n "${ezjail_name}" | tr '/~' '__'`
  ezjail_safename=`echo -n "${ezjail_name}" | tr -c '[:alnum:]' _`
  ezjail_rootdir=${ezjail_rootdir:-"${ezjail_jaildir}/${ezjail_hostname}"}
  ezjail_config="${ezjail_jailcfgs}/${ezjail_safename}"

  # This scenario really will only lead to real troubles in the 'fulljail'
  # case, but I should still explain this to the user and not claim that
  # "an ezjail would already exist"
  case ${ezjail_hostname} in basejail|newjail|fulljail|flavours|ezjailtemp) exerr "Error: ezjail needs the ${ezjail_hostname} directory for its own administrative purposes. Please rename the ezjail.";; esac

  # jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com
  # so check, whether we might be running into problems
  [ -e "${ezjail_config}" -o -e "${ezjail_config}.norun" ] && exerr "Error: an ezjail config already exists at ${ezjail_config}. Please rename the ezjail."

  # if jail root specified on command line is not absolute, make it absolute
  # inside our jail directory
  ezjail_makeabsolute ezjail_rootdir ${ezjail_jaildir}

  # if a directory at the specified jail root already exists, refuse to
  # install. Empty root dirs are considered okay, sometimes they are
  # mount points to be filled by ezjail.
  [ -d "${ezjail_rootdir}" ] && [ -z "`ls -I ${ezjail_rootdir}`" ] && ezjail_rootdirempty="YES"
  [ -e "${ezjail_rootdir}" -a -z "${ezjail_rootdirempty}" -a -z "${ezjail_exists}" ] && exerr "Error: the specified jail root ${ezjail_rootdir} already exists."

  # if jail root specified on command line does not lie within our jail
  # directory, we need to create a softlink
  if [ "${ezjail_rootdir##${ezjail_jaildir}}" = "${ezjail_rootdir}" ]; then
    ezjail_softlink=${ezjail_jaildir}/`basename -- "${ezjail_rootdir}"`
    [ -e "${ezjail_softlink}" ] && exerr "Error: an ezjail already exists at ${ezjail_softlink}."
  fi

  # do some sanity checks on the selected flavour (if any)
  [ "${ezjail_flavour}" -a ! -d "${ezjail_flavours}/${ezjail_flavour}" ] && exerr "Error: Flavour config directory ${ezjail_flavours}/${ezjail_flavour} not found."

  # check for restore circumstances, normally this is invoked by the restore command
  [ "${ezjail_fromarchive}" -a "${ezjail_exists}" ] && exerr "Error: Cannot restore a jail that exists."
  [ "${ezjail_fromarchive}" -a "${ezjail_flavour}" ] && exerr "Error: Cannot apply flavours to a restored jail."
  [ "${ezjail_fromarchive}" -a "${ezjail_fromarchive}" != "-" -a ! -r "${ezjail_fromarchive}" ] && exerr "Error: Cannot restore from non existing archive: ${ezjail_fromarchive}."

  #
  # All sanity checks that may lead to errors are hopefully passed here
  #

  if [ "${ezjail_imagetype}" ]; then
    # Strip trailing slashes from jail root, those would confuse image path
    ezjail_image=${ezjail_rootdir%/}; while [ "${ezjail_image}" -a -z "${ezjail_image%%*/}" ]; do ezjail_image=${ezjail_image%/}; done
    [ "${ezjail_image}" ] || exerr "Error: Could not determine image file name, something is wrong with the jail root: ${ezjail_rootdir}."

    # Location of our image file
    ezjail_image="${ezjail_image}.img"

    # Prepare crypto jail so that an attacker cannot guess which blocks
    # have been written
    case ${ezjail_imagetype} in bde|eli) ezjail_sourcedevice="/dev/random";; simple) ezjail_sourcedevice="/dev/zero";; esac

    # If NOT exist, create image
    if [ -z "${ezjail_exists}" ]; then
      [ -e "${ezjail_image}" ] && exerr "Error: a file exists at the location ${ezjail_image}, preventing our own image file to be created."

      # Now create jail disc image
      touch "${ezjail_image}"
      echo "Creating jail image ${ezjail_image}. This may take a while."
      if [ "${ezjail_imageblockcount}" -gt 0 ]; then
        dd if="${ezjail_sourcedevice}" of="${ezjail_image}" bs=1m count=${ezjail_imageblockcount} || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${ezjail_image}. The image size provided was ${ezjail_imagesize}."
      fi
      if [ "${ezjail_imagerestbytes}" -gt 0  ]; then
        ( dd if="${ezjail_sourcedevice}" bs=${ezjail_imagerestbytes} count=1 >> "${ezjail_image}" ) || exerr "Error: Could not (or not fully) create the image file. You might want to check (and possibly remove) the file ${ezjail_image}. The image size provided was ${ezjail_imagesize}."
      fi

      # Attach device
      ezjail_imagedevice=`mdconfig -a -t vnode -f "${ezjail_image}"`
      ezjail_devicelink="${ezjail_rootdir}.device"

      [ $? -eq 0 ] || detach_images || exerr "Error: Could not attach image device. (Command failed was 'mdconfig -a -t vnode -f ${ezjail_image}')"
    fi

    case ${ezjail_imagetype} in
    bde|eli)
      # parse imageparams, generate attachparams
      ezjail_attachblocking="YES"
      if [ "${ezjail_imageparams}" ]; then
        ezjail_attachparams=`eval parse_g${ezjail_imagetype}_attach_args ${ezjail_imageparams}` || unset ezjail_attachblocking
      fi
      case ${ezjail_imagetype} in
      bde) init_cmd="gbde init /dev/${ezjail_imagedevice} ${ezjail_imageparams}"
           attach_cmd="gbde attach /dev/${ezjail_imagedevice} ${ezjail_attachparams}";;
      eli) init_cmd="geli init ${ezjail_imageparams} /dev/${ezjail_imagedevice}"
           attach_cmd="geli attach ${ezjail_attachparams} /dev/${ezjail_imagedevice}";;
      esac

      if [ -z "${ezjail_exists}" ]; then
        [ "${ezjail_attachblocking}" ] && echo "Initialising crypto device. You will be asked to enter a new passphrase twice... "
        ( echo ${init_cmd} | /bin/sh ) || detach_images || exerr "Error: Could not initialise crypto image."

        [ "${ezjail_attachblocking}" ] && echo "Attaching crypto device. You will be asked to enter the new passphrase... "
        ( echo ${attach_cmd} | /bin/sh ) || detach_images || exerr "Error: Could not attach crypto image."
      fi

      ezjail_device="${ezjail_imagedevice}.${ezjail_imagetype}"
      ;;
    simple)
      ezjail_device=${ezjail_imagedevice}
      ;;
    esac

    if [ -z "${ezjail_exists}" ]; then
      # Format memory image
      newfs -U "/dev/${ezjail_device}" || detach_images || exerr "Error: Could not newfs /dev/${ezjail_device}."
      # Create mount point and mount
      mkdir -p "${ezjail_rootdir}" || detach_images || exerr "Error: Could not create jail root mount point ${ezjail_rootdir}."
      mount "/dev/${ezjail_device}" "${ezjail_rootdir}" || detach_images || exerr "Error: Could not mount /dev/${ezjail_device} to ${ezjail_root}."
    else
      [ -e "${ezjail_rootdir}" -a ! -d "${ezjail_rootdir}" ] && exerr "Error: Could not create mount point for your jail image. A file exists at its location. (For existing image jails, call this tool without the .img suffix when specifying jail root.)"
      [ -d "${ezjail_rootdir}" ] || mkdir -p "${ezjail_rootdir}"
    fi
  fi

  if [ "${ezjail_fromarchive}" ]; then
    unset ezjail_archive_opt
    ezjail_makeabsolute ezjail_fromarchive
    [ "${ezjail_fromarchive}" = "-" ] && unset ezjail_archive_opt || ezjail_archive_opt="-f ${ezjail_fromarchive}"
    mkdir -p "${ezjail_rootdir}" && cd "${ezjail_rootdir}" && pax -rz -pe ${ezjail_archive_opt} -s:^ezjail:.: ezjail/*
    [ $? -eq 0 ] || detach_images || exerr "Error: Could not extract archive from ${ezjail_fromarchive}."
  elif [ -z "${ezjail_exists}" ]; then
    # now take a copy of our template jail
    mkdir -p "${ezjail_rootdir}" && cd "${ezjail_jailtemplate}" && find * | cpio -p -v "${ezjail_rootdir}" > /dev/null
    [ $? -eq 0 ] || detach_images || exerr "Error: Could not copy template jail."
  fi

  # if a soft link is necessary, create it now
  [ "${ezjail_softlink}" ] && ln -s "${ezjail_rootdir}" "${ezjail_softlink}"

  # if the automount feature is not disabled, this fstab entry for new jail
  # will be obeyed
  echo -n > /etc/fstab.${ezjail_safename}
  [ "${ezjail_imagetype}" ] && \
  echo ${ezjail_devicelink} ${ezjail_rootdir} ufs rw 0 0 >> "/etc/fstab.${ezjail_safename}"
  echo ${ezjail_jailbase} ${ezjail_rootdir}/basejail nullfs ro 0 0 >> "/etc/fstab.${ezjail_safename}"

  # now, where everything seems to have gone right, create control file in
  # ezjails config dir
  mkdir -p "${ezjail_jailcfgs}" || exerr "Error: can't create ezjails control directory (${ezjail_jailcfgs})."
  (
  if [ "${ezjail_fromarchive_config}" ]; then
    grep -E ^\# ${ezjail_fromarchive_config}; echo
  else
    echo -e "# To specify the start up order of your ezjails, use these lines to\n# create a Jail dependency tree. See rcorder(8) for more details."
    echo -e "#\n# PROVIDE: standard_ezjail\n# REQUIRE: \n# BEFORE: \n#\n"
  fi
  echo export jail_${ezjail_safename}_hostname=\"${ezjail_hostname}\"
  echo export jail_${ezjail_safename}_ip=\"${ezjail_ip}\"
  echo export jail_${ezjail_safename}_rootdir=\"${ezjail_rootdir}\"
  echo export jail_${ezjail_safename}_exec=\"/bin/sh /etc/rc\"
  echo export jail_${ezjail_safename}_mount_enable=\"${ezjail_mount_enable}\"
  echo export jail_${ezjail_safename}_devfs_enable=\"${ezjail_devfs_enable}\"
  echo export jail_${ezjail_safename}_devfs_ruleset=\"devfsrules_jail\"
  echo export jail_${ezjail_safename}_procfs_enable=\"${ezjail_procfs_enable}\"
  echo export jail_${ezjail_safename}_fdescfs_enable=\"${ezjail_fdescfs_enable}\"
  echo export jail_${ezjail_safename}_image=\"${ezjail_image}\"
  echo export jail_${ezjail_safename}_imagetype=\"${ezjail_imagetype}\"
  echo export jail_${ezjail_safename}_attachparams=\"${ezjail_attachparams}\"
  echo export jail_${ezjail_safename}_attachblocking=\"${ezjail_attachblocking}\"
  echo export jail_${ezjail_safename}_forceblocking=\"${ezjail_forceblocking}\"
  ) > "${ezjail_config}"

  # Final steps for flavour installation
  if [ -z "${ezjail_exists}" -a "${ezjail_flavour}" ]; then
    # install files and config to new jail
    cd "${ezjail_flavours}/${ezjail_flavour}" && find * | cpio -p -u -v "${ezjail_rootdir}" > /dev/null
    [ $? -eq 0 ] || echo "Warning: Could not fully install flavour."

    # if the packages are links and not files we have to copy them now
    find "${ezjail_rootdir}/pkg/" -type l -exec cp -r -f {} {}.ezjail \; -exec mv {}.ezjail {} \;

    # If a config is found, make it auto run on jails startup
    if [ -f "${ezjail_rootdir}/ezjail.flavour" ]; then
      ln -s /ezjail.flavour "${ezjail_rootdir}/etc/rc.d/ezjail-config.sh"
      chmod 0700 "${ezjail_rootdir}/ezjail.flavour"
      echo "Note: Shell scripts installed, flavourizing on jails first startup."
    fi
  fi

  # Detach (crypto and) memory discs
  detach_images keep

  #
  # For user convenience some scenarios commonly causing headaches are checked
  #

  # check, whether IP is configured on a local interface, warn if it isnt
  ping -c 1 -m 1 -t 1 -q ${ezjail_ip} > /dev/null
  [ $? -eq 0 ] || echo "Warning: IP ${ezjail_ip} not configured on a local interface."

  # check, whether some host system services do listen on the Jails IP
  TIFS=${IFS}; IFS=_
  ezjail_listener=`sockstat -4 -l | grep "${ezjail_ip}:[[:digit:]]"`
  [ $? -eq 0 ] && echo -e "Warning: Some services already seem to be listening on IP ${ezjail_ip}\n  This may cause some confusion, here they are:\n${ezjail_listener}"

  ezjail_listener=`sockstat -4 -l | grep "*:[[:digit:]]"`
  [ $? -eq 0 ] && echo -e "Warning: Some services already seem to be listening on all IP, (including ${ezjail_ip})\n  This may cause some confusion, here they are:\n${ezjail_listener}"
  IFS=${TIFS}

  [ "${ezjail_imagetype}" ] && echo "Note: To administrate your image jail, attach it using the '${ezjail_admin} config -i attach ${ezjail_hostname}' command."
  ;;
######################## ezjail-admin DELETE ########################
delete)
  # Clean variables, prevent polution
  unset ezjail_wipeme ezjail_forcestop

  shift; while getopts :wf arg; do case ${arg} in
    w) ezjail_wipeme="YES";;
    f) ezjail_forcestop="YES";;
    ?) exerr ${ezjail_usage_delete};;
  esac; done; shift $(( $OPTIND - 1 ))

  # we need name of jail to vanish
  [ $# -eq 1 ] || exerr ${ezjail_usage_delete}

  # Get all info we have on that jail
  fetchjailinfo $1

  # check for existence of jail in our records
  [ "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."

  if [ "${ezjail_id}" ]; then
    # if jail is still running, refuse to go any further
    [ "${ezjail_forcestop}" ] || exerr "Error: Jail appears to be still running, stop it first (or use delete -f for force stop)."

    # This one will also exerr on failure
    start_stop_jail_by_script stop
  fi

  if [ "${ezjail_attached}" ]; then
    # if jail is attached and detach is not forced, refuse to go any further
    [ "${ezjail_forcestop}" ] || exerr "Error: Jail image file ${ezjail_image} is attached as ${ezjail_device}. '${ezjail_admin} config -i detach' it first, or (or use delete -f for force detach)."

    detach_images keep

    # See, if it successfully detached
    fetchjailinfo ${ezjail_name}
    [ "${ezjail_attached}" ] && exerr "Error: Could not detach ${ezjail_name}. You need to detach it by hand."
  fi

  # now we know everything we need to let the jail be gone. remove entry
  # from ezjail resource structure, delete fstab.JAILNAME
  rm -f "${ezjail_config}" "/etc/fstab.${ezjail_safename}"

  # if there is a soft link pointing to the jail root, remove it
  [ -L "${ezjail_softlink}" ] && rm -f "${ezjail_softlink}"

  # if wiping the jail was requested, remove it
  if [ "${ezjail_wipeme}" ]; then
    [ "${ezjail_image}" ] && rm -f "${ezjail_image}" "${ezjail_image%.img}.device"
    rm -rf "${ezjail_rootdir}"
  fi

  ;;
######################## ezjail-admin LIST ########################
list)
  [ $# -eq 1 ] || exerr ${ezjail_usage_list}
  unset ezjail_list

  [ -d "${ezjail_prefix}/etc/ezjail/" ] && cd "${ezjail_prefix}/etc/ezjail/" && ezjail_list=`ls | xargs rcorder`

  printf "%-3s %-5s %-15s %-28s %s\\n" STA JID IP Hostname "Root Directory"
  echo   "--- ----- --------------- ---------------------------- -------------------------"
  for ezjail in ${ezjail_list}; do
    fetchjailinfo ${ezjail%.norun}
    case ${ezjail_imagetype} in simple) ezjail_state="I";; bde) ezjail_state="B";; eli) ezjail_state="E";; *) ezjail_state="D";; esac
    if [ "${ezjail_id}" ]; then
      ezjail_state="${ezjail_state}R"
    else
      [ "${ezjail_attached}" ] && ezjail_state="${ezjail_state}A" || ezjail_state="${ezjail_state}S"
    fi
    [ "${ezjail_safename}" != "${ezjail}" ] && ezjail_state="${ezjail_state}N"

    printf "%-3s %-5s %-15s %-28s %s\\n" "${ezjail_state}" "${ezjail_id:-N/A}" "${ezjail_ip}" "${ezjail_hostname}" "${ezjail_rootdir}"
  done

  ;;
######################## ezjail-admin UPDATE ########################
setup|update)
  # Clean variables, prevent polution
  unset ezjail_provideports
  ezjail_installaction="world"

  shift; while getopts :ipPs: arg; do case ${arg} in
    i) ezjail_installaction="installworld";;
    s) ezjail_sourcetree=${OPTARG};;
    p) ezjail_provideports="YES";;
    P) ezjail_provideports="YES"; ezjail_installaction="none";;
    ?) exerr ${ezjail_usage_update};;
  esac; done; shift $(( ${OPTIND} - 1 ))

  [ $# -eq 0 ] || exerr ${ezjail_usage_update}

  if [ "${ezjail_installaction}" = "none" ]; then
    # check, whether ezjail has been setup correctly. existence of
    # ezjail_jailbase is our indicator
    [ -d "${ezjail_jailbase}" ] || exerr "Error: base jail does not exist. You cannot fill base jails ports tree before creating it. Please run '${ezjail_admin} update' or '${ezjail_admin} install' first."
  else
    # Bump the user for some of the most common errors
    [ -d "${ezjail_sourcetree}" ] || exerr "Cannot find your copy of the FreeBSD source tree in ${ezjail_sourcetree}."
    [ -e "${ezjail_sourcetree}/Makefile" ] || exerr "Your source tree in ${ezjail_sourcetree} seems to be incomplete (Makefile missing)."
    [ "`sysctl -n kern.securelevel`" -gt 0 ] && exerr "You're running in a secure level higher than 0. ezjail will not run correctly."

    # Normally fulljail should be renamed by past ezjail-admin commands.
    # However those may have failed
    [ -d "${ezjail_jailfull}" ] && chflags -R noschg "${ezjail_jailfull}" && rm -rf "${ezjail_jailfull}"
    mkdir -p "${ezjail_jailfull}" || exerr "Cannot create temporary Jail directory."

    # make and setup our world, then split basejail and newjail
    cd "${ezjail_sourcetree}" && env DESTDIR="${ezjail_jailfull}" make ${ezjail_installaction} || exerr "make ${ezjail_installaction} failed."
    cd "${ezjail_sourcetree}/etc" && env DESTDIR="${ezjail_jailfull}" make distribution || exerr "make distribution failed."
    ezjail_splitworld

  fi # installaction="none"

  # Provide a copy of ports tree in basejail
  [ "${ezjail_provideports}" = "YES" ] && ezjail_updateports

  ;;
######################## ezjail-admin INSTALL ########################
install)
  # Clean variables, prevent polution
  unset ezjail_release ezjail_installmanpages ezjail_installports ezjail_installsources ezjail_dir ezjail_reldir ezjail_ftpserverqueried

  shift; while getopts :mpsh:r: arg; do case ${arg} in
    m) ezjail_installmanpages=" manpages";;
    s) ezjail_installsources=" src";;
    p) ezjail_installports="YES";;
    h) ezjail_ftphost=${OPTARG};;
    r) ezjail_release=${OPTARG};;
    ?) exerr ${ezjail_usage_install};;
  esac; done; shift $(( ${OPTIND} - 1 ))

  [ $# -eq 0 ] || exerr ${ezjail_usage_install}

  ezjail_installarch=`uname -p`
  ezjail_ftphost=${ezjail_ftphost:-"ftp.freebsd.org"}
  ezjail_ftphost=${ezjail_ftphost#ftp://}
  ezjail_dir=${ezjail_ftphost#file://}
  [ "${ezjail_dir%%[!/]*}" ] || ezjail_reldir=`pdw -P`

  [ "`sysctl -n kern.securelevel`" -gt 0 ] && exerr "You're running in a secure level higher than 0. ezjail will not run correctly."

  # ftp servers normally wont provide non-RELEASE-builds
  if [ -z "${ezjail_release}" -a "${ezjail_dir}" = "${ezjail_ftphost}" ]; then
    ezjail_release=`uname -r`
    case ${ezjail_release} in *-STABLE) ezjail_release="${ezjail_release%-STABLE}-RELEASE";; esac
    if [ "${ezjail_release%-RELEASE}" = "${ezjail_release}" ]; then
      echo "Your system is ${ezjail_release}. Normally FTP-servers don't provide non-RELEASE-builds."
      ezjail_queryftpserver || echo "... I'll continue anyway."
      echo -n "Release [ ${ezjail_release} ]: "
      read ezjail_releasetmp
      [ "${ezjail_releasetmp}" ] && ezjail_release=${ezjail_releasetmp}
    fi
  fi

  # Normally fulljail should be renamed by past ezjail-admin commands.
  # However those may have failed
  [ -d "${ezjail_jailfull}" ] && chflags -R noschg "${ezjail_jailfull}" && rm -rf "${ezjail_jailfull}"
  mkdir -p "${ezjail_jailfull}" || exerr "Cannot create temporary Jail directory."
  DESTDIR=${ezjail_jailfull}

  rm -rf "${ezjail_jailtemp}"
  for pkg in ${ezjail_basesystem} ${ezjail_installmanpages} ${ezjail_installsources}; do

    # The first case means, that a remote host has been specified.
    if [ "${ezjail_dir}" = "${ezjail_ftphost}" ]; then
      # Create and try to access temp dir
      mkdir -p "${ezjail_jailtemp}" || exerr "Could not create temporary base jail directory ${ezjail_jailtemp}."
      cd "${ezjail_jailtemp}" || exerr "Could not cd to ${ezjail_jailtemp}."

      # Try all paths as stolen from sysinstall, break on success.
      for ezjail_path in pub/FreeBSD/releases pub/FreeBSD/snapshot pub/FreeBSD releases snapshots NO; do
        if [ "${ezjail_path}" = "NO" ]; then
          echo -e "\nCould not fetch ${pkg} from ${ezjail_ftphost}.\nMaybe your release (${ezjail_release}) is specified incorrectly or the host ${ezjail_ftphost} does not provide that release build.\nUse the -r option to specify an existing release or the -h option to specify an alternative ftp server." >&2
          [ "${ezjail_ftpserverqueried}" ] || ezjail_queryftpserver
          exit 1
        fi
        ftp "${ezjail_ftphost}:${ezjail_path}/${ezjail_installarch}/${ezjail_release}/${pkg}/*" && break
      done

      # These actions are really ugly: sources want $1 to contain the set
      # of sources to install, base asks the user if he is sure, hence the
      # yes and the set -- all
      [ "${pkg}" = "base" ] && echo "Ignore the next question, ezjail answers it for you."
      set -- all
      [ -f install.sh ] && yes | . install.sh
      [ $? -eq 0 ] || exerr "Package install script for ${pkg} failed."

      rm -rf "${ezjail_jailtemp}"
    else
      cd "${ezjail_reldir}/${ezjail_dir}/${pkg}" || exerr "Could not cd to ${ezjail_dir}."
      set -- all
      [ -f install.sh ] && yes | . install.sh
      [ $? -eq 0 ] || exerr "Package install script for ${pkg} failed."
    fi
  done

  # Split basejail and newjail
  ezjail_splitworld

  # Fill ports, if requested
  [ "${ezjail_installports}" = "YES" ] && ezjail_updateports

  ;;
######################## ezjail-admin SHORTCUT ########################
*start|*stop|*startcrypto|*stopcrypto)
  [ -x "${ezjail_prefix}/etc/rc.d/ezjail" ] && exec "${ezjail_prefix}/etc/rc.d/ezjail" $@
  [ -x "${ezjail_prefix}/etc/rc.d/ezjail.sh" ] && exec "${ezjail_prefix}/etc/rc.d/ezjail.sh" $@

  exerr "Could not find ezjail's rc.d script in ${ezjail_prefix}/etc/rc.d/. You need to type it the long way."
  ;;
######################## ezjail-admin CONSOLE ########################
console)
  # Clean variables, prevent polution
  unset ezjail_execute ezjail_forcestart

  shift; while getopts :e:f arg; do case ${arg} in
    e) ezjail_execute=${OPTARG};;
    f) ezjail_forcestart="YES";;
    ?) exerr ${ezjail_usage_console};;
  esac; done; shift $(( $OPTIND - 1 ))

  # we need name of jail to attach to
  [ $# -eq 1 ] || exerr ${ezjail_usage_console}

  # Get all info we have on that jail
  fetchjailinfo $1

  # check for existence of jail in our records
  [ "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."

  # if jail is not running, we either try to force start it or fail
  if [ -z "${ezjail_id}" ]; then

    # If force start is requested, try that
    [ "$ezjail_forcestart}" ] || exerr "Error: Jail ${ezjail_name} appears not to be running, start it first (or use console -f for force start)."

    # This one will also exerr on failure
    start_stop_jail_by_script start
  fi

  # Try to attach to jail
  [ "${ezjail_execute}" ] && exec jexec ${ezjail_id} ${ezjail_execute}

  exec jexec ${ezjail_id} ${ezjail_default_execute}
  ;;
######################## ezjail-admin ARCHIVE ########################
archive)
  # Clean variables, prevent polution
  unset ezjail_archive ezjail_archive_tag ezjail_force ezjail_archivealljails ezjail_addfiles

  shift; while getopts :Afa:d: arg; do case ${arg} in
    f) ezjail_force="YES";;
    a) ezjail_archive=${OPTARG};;
    d) ezjail_archivedir=${OPTARG};;
    A) ezjail_archivealljails="YES";;
    ?) exerr ${ezjail_usage_archive};;
  esac; done; shift $(( ${OPTIND} - 1 ))

  # Specifying no jails only is acceptable if archiving all jails
  [ $# -lt 1 -a -z "${ezjail_archivealljails}" ] && exerr ${ezjail_usage_archive}

  # Default archive directory to .
  ezjail_archivedir=${ezjail_archivedir:-`pwd -P`}

  # Will not backup more than one jail per archive
  [ "${ezjail_archive}" -a "${ezjail_archivealljails}" ] && exerr "Error: Must not specify an archive location for multiple archives."

  # Will not backup more than one jail per archive
  [ $# -gt 1 -a "${ezjail_archive}" ] && exerr "Error: Must not specify an archive location for multiple archives."

  # Either all or only some. Decide.
  [ $# -gt 0 -a "${ezjail_archivealljails}" ] && exerr "Error: Must not specify an ezjail to backup with -A."

  # Fetch list of all ezjails
  [ "${ezjail_archivealljails}" -a -d "${ezjail_prefix}/etc/ezjail/" ] && cd "${ezjail_prefix}/etc/ezjail/" && set - `ls | xargs rcorder`

  for ezjail in $@; do
    unset ezjail_imagesize

    # Jail name mandatory
    fetchjailinfo ${ezjail%.norun}

    # Check for existence of jail in our records
    [ "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."

    # If jail is still running, refuse to go any further - unless forced
    if [ "${ezjail_id}" -a -z "${ezjail_force}" ]; then
      echo "Warning: Jail ${ezjail_name} appears to be still running, stop it first or [-f]orce archiving."
      continue
    fi

    # Attach non-attached jails, if they can be attached non blocking
    if [ "${ezjail_imagetype}" -a -z "${ezjail_attached}" ]; then
      if [ "${ezjail_attachblocking}" ]; then
        echo "Warning: Jail ${ezjail_name} is an image jail and can not be attached automatically."
        echo "         Use ezjail-admin config -i attach ${ezjail_name} to attach it first."
        continue
      fi
      $0 config -i attach ${ezjail_name} || exerr "Error: Can not attach ${ezjail_image} for ${ezjail_name}"
      ezjail_imagesize=-`stat -f %z ${ezjail_image}`
    fi

    # This one goes into archive to identify jail by name and restore date
    ezjail_archive_tag="${ezjail_safename}-`date +%Y%m%d%H%M.%S`"

    # If no archive name was specified, make one up
    [ "${ezjail_archive}" ] || ezjail_archive="${ezjail_archive_tag}.tar.gz"

    # Archives need to now, where they came from. Restore by default only
    # reinstalls jails on the same machine. We also warn on OS upgrades and
    # processor type changes
    ezjail_hostsystem_name=$( echo -n `uname -n` | tr -c '[:alnum:].' _ )
    ezjail_hostsystem_version=$( echo -n `uname -r` | tr -c '[:alnum:].' _ )
    ezjail_hostsystem_cpu=$( echo -n `uname -p` | tr -c '[:alnum:].' _ )

    ezjail_archive_tag="${ezjail_archive_tag}-${ezjail_hostsystem_name}-${ezjail_hostsystem_version}-${ezjail_hostsystem_cpu}${ezjail_imagesize}"

    # If archive location is not absolute, prepend archive directory
    ezjail_makeabsolute ezjail_archive ${ezjail_archivedir}

    # It's a tar archive, after all
    case ${ezjail_archive} in
      *.tar.gz|*.tgz|-) ;;
      *) ezjail_archive="${ezjail_archive}.tar.gz";;
    esac

    # For stdout do specify nothing
    [ "${ezjail_archive}" = "-" ] && unset ezjail_archive_opt || ezjail_archive_opt="-f ${ezjail_archive}"

    [ -f "/etc/fstab.${ezjail_safename}" ] && ezjail_addfiles=/etc/fstab.${ezjail_safename}

    cd "${ezjail_rootdir}" || exerr "Error: can't cd to ${ezjail_root}."
    pax -wzXt -x ustar ${ezjail_archive_opt} \
      -s:"^[^\\.].*/${ezjail_safename}\$":prop.ezjail-${ezjail_archive_tag}: \
      -s:"^[^\\.].*/${ezjail_safename}.norun\$":prop.ezjail-${ezjail_archive_tag}.norun: \
      -s:"etc/fstab.${ezjail_safename}\$":fstab.ezjail: \
      -s:"^\\.":ezjail: \
      "${ezjail_config}" ${ezjail_addfiles} .

    ezjail_paxresult=$?

    # Detach previously attached jail
    [ "${ezjail_imagesize}" ] && cd / && $0 config -i detach ${ezjail_name}

    # An error on a jail not running is bad
    [ ${ezjail_paxresult} -eq 0 -o "${ezjail_force}" ] || exerr "Error: Archiving jail failed. You might want to check ${ezjail_archive}."

    # When archiving a running jail, some errors might occur
    [ ${ezjail_paxresult} -eq 0 ] || echo "Warning: Archiving jail ${ezjail_name} was not completely successful. For a running jail this is not unusual. You might want to check ${ezjail_archive}."

    unset ezjail_archive ezjail_archive_opt ezjail_addfiles
  done
  ;;
####################### ezjail-admin RESTORE ########################
restore)
  # Clean variables, prevent polution
  unset ezjail_archivedir ezjail_safename

  shift; while getopts :d: arg; do case ${arg} in
    d) ezjail_archivedir=${OPTARG};;
    ?) exerr ${ezjail_usage_restore};;
  esac; done; shift $(( ${OPTIND} - 1 ))

  [ $# -eq 0 ] && exerr ${ezjail_usage_restore}

  # Default archive directory to .
  ezjail_archivedir=${ezjail_archivedir:-`pwd -P`}

  for ezjail_fromarchive in $@; do
    unset ezjail_safename ezjail_imagedata ezjail_nameprop

    # if archive location is absolute and doesn't exist, fail
    [ "${ezjail_fromarchive%%[!/]*}" -a ! -f "${ezjail_fromarchive}" ] && exerr "Error: File for archive ${ezjail_fromarchive} not found."
    if [ -z "${ezjail_fromarchive%%[!/]*}" ]; then
      # Try archive location
      if [ -r "${ezjail_archivedir}/${ezjail_fromarchive}" ]; then
        ezjail_fromarchive="${ezjail_archivedir}/${ezjail_fromarchive}"
      else
        # If archive is not found, try guessing by jail name
        ezjail_safename=`echo -n "${ezjail_fromarchive}" | tr -c '[:alnum:]' _`
        unset ezjail_fromarchive
        for ezjail_archive in "${ezjail_archivedir}/${ezjail_safename}"*; do
          [ -z "${ezjail_fromarchive}" -a -f "${ezjail_archive}" ] && ezjail_fromarchive=${ezjail_archive}
          [ "${ezjail_archive}" -nt "${ezjail_fromarchive}" ] && ezjail_fromarchive=${ezjail_archive}
        done
        [ -f "${ezjail_fromarchive}" ] || exerr "Error: No archive for pattern $1 can be found."
      fi
    fi

    # We want to parse some content from archive. In order to reduce
    # security implication this may have, we check owner and permission.
    #
    # However, this does not protect against admins transporting
    # archives over insecure lines over the net.
    [ `stat -f %u "${ezjail_fromarchive}"` -eq 0 ] || exerr "Error: Insecure ownership of archive ${ezjail_fromarchive}. Please check the file and chown it to root if you trust its source."
    [ $(( `stat -f %OLp "${ezjail_fromarchive}"` & 0022 )) -eq 0 ] || exerr "Error: Insecure permissions for archive ${ezjail_fromarchive}. Please check the file and fix permission (chmod og-w) if you trust its source."

    ezjail_nameprop=`pax -zn -f ${ezjail_fromarchive} prop.ezjail-\*`
    [ $? -eq 0 -a "${ezjail_nameprop}" ] || exerr "Error: File ${ezjail_fromarchive} is not an ezjail archive."

    # Figure out, what jail and jail enviroment archive claims to contain
    TIFS=${IFS}; IFS=-; set - ${ezjail_nameprop}
    ezjail_nameprop_safename=$2 ezjail_nameprop_hsname=$4 ezjail_nameprop_hsversion=$5 ezjail_nameprop_hscpu=$6 ezjail_nameprop_imgagesize=$7
    IFS=${TIFS}

    # Figure out current system environment
    ezjail_hsname=$( echo -n `uname -n` | tr -c '[:alnum:].' _ )
    ezjail_hsversion=$( echo -n `uname -r` | tr -c '[:alnum:].' _ )
    ezjail_hscpu=$( echo -n `uname -p` | tr -c '[:alnum:].' _ )

    # Catch all errors that will likely create a broken backup
    [ "${ezjail_safename}" -a "${ezjail_safename}" != "${ezjail_nameprop_safename}" ] && exerr "Error: Archive name ${ezjail_fromarchive} does not match archived jail ${ezjail_nameprop_safename}."
    [ "${ezjail_hsname}" != "${ezjail_nameprop_hsname}" ] && exerr "Error: Archive was created on host named ${ezjail_hsname}. Can only use restore on the same machine. Consider using \"ezjail-admin create -a\" when migrating ezjails."
    [ "${ezjail_hscpu}" != "${ezjail_nameprop_hscpu}" ] && exerr "Error: Archive was created on a different CPU. Can not restore. Consider using \"ezjail-admin create -a\" when migrating ezjails."

    # Save config to tempfile and source it
    ezjail_config=`mktemp /tmp/ezjail.prop.XXXXXXXX`
    [ $? -ne 0 ] && exerr "Error: Can't create temporary file."
    pax -rzn -s:${ezjail_nameprop}:${ezjail_config}: -f ${ezjail_fromarchive} ${ezjail_nameprop}
    fetchjailinfo ${ezjail_safename} ${ezjail_config}

    # Now all parameters are here, invoke ezjail-admin create
    if [ "${ezjail_imagetype}" ]; then
      ezjail_imagedata="-c ${ezjail_imagetype} -C '${ezjail_attachparams}' -s ${ezjail_nameprop_imgagesize}"
    fi

    echo $0 create -a "${ezjail_fromarchive}" -A "${ezjail_config}" ${ezjail_imagedata} -r "${ezjail_rootdir}" "${ezjail_hostname}" "${ezjail_ip}"
    $0 create -a "${ezjail_fromarchive}" -A "${ezjail_config}" ${ezjail_imagedata} -r "${ezjail_rootdir}" "${ezjail_hostname}" "${ezjail_ip}" || exerr "Error: create failed."
    rm -f "${ezjail_config}"

  done
  ;;
######################## ezjail-admin CONFIG ########################
config)
  # Clean variables, prevent polution
  unset ezjail_setrunnable ezjail_imageaction ezjail_new_name

  shift; while getopts :r:i:n: arg; do case ${arg} in
    i) ezjail_imageaction=${OPTARG};;
    r) ezjail_setrunnable=${OPTARG};;
    n) ezjail_new_name=${OPTARG};;
    ?) exerr ${ezjail_usage_config};;
  esac; done; shift $(( ${OPTIND} - 1 ))

  [ $# -eq 1 ] || exerr ${ezjail_usage_config}

  # Jail name mandatory
  fetchjailinfo $1

  # check for existence of jail in our records
  [ "${ezjail_config}" ] || exerr "Error: Nothing known about jail ${ezjail_name}."

  # Nothing to be configured?
  [ "${ezjail_setrunnable}" -o "${ezjail_new_name}" -o "${ezjail_imageaction}" ] || echo "Warning: No config option specified."

  # Do we want a new name for our jail?
  if [ "${ezjail_new_name}" ]; then
    # if jail is still running, refuse to go any further
    [ "${ezjail_id}" ] && exerr "Error: Jail appears to be still running, stop it first."

    # Cannot rename an attached jail
    [ "${ezjail_attached}" ] && exerr "Error: Jail image file ${ezjail_image} is attached as ${ezjail_device}. '${ezjail_admin} config -i detach' it first."

    # The new values for the jail
    ezjail_new_hostname=`echo -n ${ezjail_new_name} | tr '/~' '__'`
    ezjail_new_safename=`echo -n "${ezjail_new_name}" | tr -c '[:alnum:]' _`
    ezjail_new_rootdir=`dirname -- ${ezjail_rootdir}`/${ezjail_new_hostname}
    ezjail_new_config="${ezjail_jailcfgs}/${ezjail_new_safename}"
    [ "${ezjail_config}" = "${ezjail_config%.norun}" ] || ezjail_new_config="${ezjail_jailcfgs}/${ezjail_new_safename}.norun"
    ezjail_new_softlink=${ezjail_jaildir}/`basename -- "${ezjail_new_rootdir}"`

    # those are just copied
    eval ezjail_new_ip=\"\$jail_${ezjail_safename}_ip\"
    eval ezjail_new_exec=\"\$jail_${ezjail_safename}_exec\"
    eval ezjail_new_mount_enable=\"\$jail_${ezjail_safename}_mount_enable\"
    eval ezjail_new_devfs_enable=\"\$jail_${ezjail_safename}_devfs_enable\"
    eval ezjail_new_devfs_ruleset=\"\$jail_${ezjail_safename}_devfs_ruleset\"
    eval ezjail_new_procfs_enable=\"\$jail_${ezjail_safename}_devfs_enable\"
    eval ezjail_new_fdescfs_enable=\"\$jail_${ezjail_safename}_fdescfs_enable\"
    eval ezjail_new_attachparams=\"\$jail_${ezjail_safename}_attachparams\"
    eval ezjail_new_attachblocking=\"\$jail_${ezjail_safename}_attachblocking\"
    eval ezjail_new_forceblocking=\"\$jail_${ezjail_safename}_forceblocking\"
    eval ezjail_new_imagetype=\"\$jail_${ezjail_safename}_imagetype\"

    # This scenario really will only lead to real troubles in the 'fulljail'
    # case, but I should still explain this to the user and not claim that
    # "an ezjail would already exist"
    case ${ezjail_new_hostname} in basejail|newjail|fulljail|flavours|ezjailtemp) exerr "Error: ezjail needs the ${ezjail_new_hostname} directory for its own administrative purposes. Please rename the ezjail.";; esac
  
    # jail names may lead to identical configs, eg. foo.bar.com == foo-bar.com
    # so check, whether we might be running into problems
    [ -e "${ezjail_new_config}" -o -e "${ezjail_new_config}.norun" ] && exerr "Error: an ezjail config already exists at ${ezjail_new_config}. Please rename the ezjail."

    # since we just used the old rootdir prefix and added the new hostname,
    # we might end up at an existing directory
    [ -e "${ezjail_new_rootdir}" ] && exerr "Error: An object already exists at ${ezjail_new_rootdir}, cant rename."

    # prevent trouble with creating our softlink
    [ -L "${ezjail_softlink}" -a -e "${ezjail_new_softlink}" ] && exerr "Error: An object already exists at ${ezjail_new_softlink}, cant create softlink there."

    # need to rename the image?
    if [ "${ezjail_image}" ]; then
      # Do we have an auto generated image name?
      if [ "${ezjail_rootdir}.img" = "${ezjail_image}" ]; then
        ezjail_new_image="${ezjail_new_rootdir}.img"
        [ -e "${ezjail_new_image}" ] && exerr "Error: An object already exists at ${ezjail_new_image}, cant rename image."
        mv "${ezjail_image}" "${ezjail_new_image}"
      else
        ezjail_new_image=${ezjail_image}
        echo "Warning: Image file for jail ${ezjail_name} remains ${ezjail_image}, as it was not auto generated"
      fi
    else
      unset ezjail_new_image
    fi

    # adjust softlink
    if [ -L "${ezjail_softlink}" ]; then
      rm -f "${ezjail_softlink}"
      ln -s "${ezjail_new_rootdir}" "${ezjail_new_softlink}"
    fi

    # rename rootdir
    mv "${ezjail_rootdir}" "${ezjail_new_rootdir}"

    # rename fstab
    echo -n > "/etc/fstab.${ezjail_new_safename}"
    [ "${ezjail_new_imagetype}" ] && \
    echo ${ezjail_new_rootdir}.device ${ezjail_new_rootdir} ufs rw 0 0 >> "/etc/fstab.${ezjail_new_safename}"
    echo ${ezjail_jailbase} ${ezjail_new_rootdir}/basejail nullfs ro 0 0 >> "/etc/fstab.${ezjail_new_safename}"
    rm -f "/etc/fstab.${ezjail_safename}"

    # rename config file, preserve comments
    (
    grep -e ^\# "${ezjail_config}"
    echo
    echo export jail_${ezjail_new_safename}_hostname=\"${ezjail_new_hostname}\"
    echo export jail_${ezjail_new_safename}_ip=\"${ezjail_new_ip}\"
    echo export jail_${ezjail_new_safename}_rootdir=\"${ezjail_new_rootdir}\"
    echo export jail_${ezjail_new_safename}_exec=\"${ezjail_new_exec}\"
    echo export jail_${ezjail_new_safename}_mount_enable=\"${ezjail_new_mount_enable}\"
    echo export jail_${ezjail_new_safename}_devfs_enable=\"${ezjail_new_devfs_enable}\"
    echo export jail_${ezjail_new_safename}_devfs_ruleset=\"${ezjail_new_devfs_ruleset}\"
    echo export jail_${ezjail_new_safename}_procfs_enable=\"${ezjail_new_procfs_enable}\"
    echo export jail_${ezjail_new_safename}_fdescfs_enable=\"${ezjail_new_fdescfs_enable}\"
    echo export jail_${ezjail_new_safename}_image=\"${ezjail_new_image}\"
    echo export jail_${ezjail_new_safename}_imagetype=\"${ezjail_new_imagetype}\"
    echo export jail_${ezjail_new_safename}_attachparams=\"${ezjail_new_attachparams}\"
    echo export jail_${ezjail_new_safename}_attachblocking=\"${ezjail_new_attachblocking}\"
    echo export jail_${ezjail_new_safename}_forceblocking=\"${ezjail_new_forceblocking}\"
    ) > "${ezjail_new_config}"

    # remove old config
    rm -f "${ezjail_config}"

    # usually that doesnt go smoothly, but the user wanted it
    # that way ;)
    echo "Jail has been renamed. You might want to check ${ezjail_new_config} and /etc/fstab.${ezjail_new_safename} to ensure everything has gone smoothly."
    echo "Also check settings in your Jail's /etc/ directory (especially /etc/rc.conf)."

    # reread config
    fetchjailinfo ${ezjail_new_safename}
  fi

  case "${ezjail_setrunnable}" in
    run)   [ "${ezjail_config}" = "${ezjail_config%.norun}" ] || mv "${ezjail_config}" "${ezjail_config%.norun}";;
    norun) [ "${ezjail_config}" = "${ezjail_config%.norun}" ] && mv "${ezjail_config}" "${ezjail_config}.norun" ;;
  esac

  [ "${ezjail_imageaction}" -a -z "${ezjail_image}" ] && exerr "Error: Jail ${ezjail_name} not an image jail."

  case "${ezjail_imageaction}" in
    attach)
      # Check, if image already attached
      [ "${ezjail_attached}" ] && exerr "Error: Jail image file ${ezjail_image} already attached as ${ezjail_device}."
      rm -f "${ezjail_devicelink}"

      # Attach images by type
      attach_images

      # Clean image
      fsck -t ufs -p -B "/dev/${ezjail_device}"

      mount "/dev/${ezjail_device}" "${ezjail_rootdir}" || detach_images keep || exerr "Error: Could not mount /dev/${ezjail_device} to ${ezjail_rootdir}."
      # relink image device
      ln -s "/dev/${ezjail_device}" "${ezjail_devicelink}"

      ;;
    detach)
      # Check, if image really attached or running
      [ "${ezjail_id}" ] && exerr "Error: Jail ${ezjail_name} still running. Can not detach."
      [ "${ezjail_attached}" ] || exerr "Error: Jail image file ${ezjail_name} is not attached."

      # Unmount/detach everything
      detach_images keep
      ;;
    fsck)
      # Check, if image already attached
      [ "${ezjail_attached}" ] && exerr "Error: Jail image file ${ezjail_image} already attached as ${ezjail_device}."
      rm -f "${ezjail_devicelink}"

      # Attach images by type
      attach_images

      # Clean image
      fsck -t ufs "/dev/${ezjail_device}"

      # Detach images by type
      detach_images keep
      ;;
    esac
  ;;
*)
  exerr "${ezjail_usage_ezjailadmin}"
  ;;
esac