Skip to content

Commit 1b05271

Browse files
author
Christer Edwards
committed
Initial toolkit POC
1 parent e4d8b39 commit 1b05271

15 files changed

+474
-2
lines changed

‎LICENSE

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
BSD 3-Clause License
22

3-
Copyright (c) 2018, BastilleBSD
3+
Copyright (c) 2018, Christer Edwards
44
All rights reserved.
55

66
Redistribution and use in source and binary forms, with or without

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1-
# bastille
1+
# Bastille
22
Bastille Jail Management Tool
3+
4+
README pending; still a little bit in flux.

‎bastille-0.1.txz

1.95 KB
Binary file not shown.

‎init.freebsd

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/sh
2+
3+
# $FreeBSD: $
4+
#
5+
# Bastille startup script
6+
#
7+
# PROVIDE: bastille
8+
# REQUIRE: LOGIN
9+
# KEYWORD: shutdown
10+
11+
# Add the following to /etc/rc.conf[.local] to enable this service
12+
#
13+
# bastille_enable (bool): Set to NO by default.
14+
# Set it to YES to enable bastille.
15+
# bastille_list (string): Set to "" by default.
16+
# Space separated list of jails to start.
17+
#
18+
19+
. /etc/rc.subr
20+
21+
name=bastille
22+
rcvar=bastille_enable
23+
24+
load_rc_config ${name}
25+
26+
: ${bastille_enable:=NO}
27+
: ${bastille_list:=""}
28+
29+
start_cmd=bastille_start
30+
stop_cmd=bastille_stop
31+
32+
start_command="/usr/local/bin/bbsd-start"
33+
stop_command="/usr/local/bin/bbsd-stop"
34+
35+
bastille_start()
36+
{
37+
if [ ! -n "${bastille_list}" ]; then
38+
echo "${bastille_list} is undefined"
39+
return 1
40+
fi
41+
42+
local _jail
43+
44+
for _jail in ${bastille_list}; do
45+
echo "Starting Bastille Jail: ${_jail}"
46+
${start_command} ${_jail}
47+
done
48+
}
49+
50+
bastille_stop()
51+
{
52+
if [ ! -n "${bastille_list}" ]; then
53+
echo "${bastille_list} is undefined"
54+
return 1
55+
fi
56+
57+
local _jail
58+
59+
for _jail in ${bastille_list}; do
60+
echo "Stopping Bastille Jail: ${_jail}"
61+
${stop_command} ${_jail}
62+
done
63+
}
64+
65+
run_rc_command "$1"

‎usr/local/bin/bbsd-bootstrap

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/sh
2+
3+
if [ "$#" -lt 3 ]; then
4+
echo "Required: '[activate|update|snapshot]', 'bastille', 'release'"
5+
echo "Supported releases: '11.1-RELEASE', '10.4-RELEASE', '10.3-RELEASE'"
6+
exit 1
7+
fi
8+
9+
echo
10+
echo "###########################"
11+
echo "## args: $1 ##"
12+
echo "## args: $2 ##"
13+
echo "## args: $3 ##"
14+
echo "###########################"
15+
echo
16+
17+
RELEASE="$3"
18+
PREFIX=/usr/local
19+
PLATFORM="${PREFIX}/$2"
20+
VALIDRELEASE=''
21+
22+
if [ "${RELEASE}" == "11.1-RELEASE" -o "${RELEASE}" == "10.4-RELEASE" -o "${RELEASE}" == "10.3-RELEASE" ]; then
23+
VALIDRELEASE="${RELEASE}"
24+
fi
25+
26+
BASETXZPATH="${PLATFORM}/downloads/${RELEASE}/base.txz"
27+
UPSTREAMURL="https://download.freebsd.org/ftp/releases/amd64/${RELEASE}/base.txz"
28+
29+
if [ "$1" == "activate" ]; then
30+
if [ -d "/usr/local/bastille" ]; then
31+
echo "Looks like you're already bootstrapped."
32+
exit 1
33+
else
34+
/sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}" "zroot${PLATFORM}"
35+
/sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/downloads" "zroot${PLATFORM}/downloads"
36+
/sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/jails" "zroot${PLATFORM}/jails"
37+
/sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/logs" "zroot${PLATFORM}/logs"
38+
/sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/fstab" "zroot${PLATFORM}/fstab"
39+
/sbin/zfs create -o compression=lz4 -o atime=off -o mountpoint="${PLATFORM}/releases" "zroot${PLATFORM}/releases"
40+
41+
## create the downloads && releases ZFS volumes
42+
if [ ! -z "${VALIDRELEASE}" ]; then
43+
if [ ! -d "${PLATFORM}"/downloads/"${RELEASE}" ]; then
44+
/sbin/zfs create zroot"${PLATFORM}"/downloads/"${RELEASE}"
45+
fi
46+
if [ ! -d "${PLATFORM}"/releases/"${RELEASE}" ]; then
47+
/sbin/zfs create zroot"${PLATFORM}"/releases/"${RELEASE}"
48+
fi
49+
50+
## fetch && untar base.txz
51+
if [ ! -f "${BASETXZPATH}" ]; then
52+
/usr/bin/fetch "${UPSTREAMURL}" -o "${PLATFORM}/downloads/${RELEASE}"
53+
/usr/bin/tar -C "${PLATFORM}/releases/${RELEASE}" -xf "${PLATFORM}/downloads/${RELEASE}/base.txz"
54+
fi
55+
56+
## freebsd-update && snapshot
57+
env PAGER=/bin/cat /usr/sbin/freebsd-update -b "${PLATFORM}/releases/${RELEASE}" fetch install
58+
/sbin/zfs snapshot "zroot${PLATFORM}/releases/${RELEASE}@$(date +%F)"
59+
fi
60+
fi
61+
fi
62+
63+
if [ "$1" == "update" ]; then
64+
env PAGER=/bin/cat /usr/sbin/freebsd-update -b "${PLATFORM}/releases/${RELEASE}" fetch install
65+
fi
66+
67+
if [ "$1" == "snapshot" ]; then
68+
/sbin/zfs snapshot "zroot${PLATFORM}/releases/${RELEASE}@$(date +%F)"
69+
fi

‎usr/local/bin/bbsd-cmd

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/sh
2+
#
3+
# basic cmd targeting and execution
4+
5+
if [ $# -gt 2 ] || [ $# -lt 2 ]; then
6+
echo "Usage: bbsd-cmd [glob|ALL] 'quoted command'"
7+
exit 1
8+
fi
9+
10+
if [ "$1" = 'ALL' ]; then
11+
JAILS=$(jls -N | awk '!/JID/{print $1}')
12+
echo "Targeting all containers."
13+
echo
14+
for jail in ${JAILS}; do
15+
echo "${jail}:"
16+
jexec ${jail} $2
17+
echo
18+
done
19+
fi
20+
21+
if [ "$1" != 'ALL' ]; then
22+
JAILS=$(jls -N | awk '!/JID/{print $1}' | grep "$1")
23+
echo "Targeting specified containers."
24+
echo "${JAILS}"
25+
echo
26+
for jail in ${JAILS}; do
27+
echo "${jail}:"
28+
jexec ${jail} $2
29+
echo
30+
done
31+
fi

‎usr/local/bin/bbsd-create

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/bin/sh -x
2+
#
3+
# create a new jail
4+
5+
if [ $# -lt 3 ] || [ $# -gt 3 ]; then
6+
echo "Required: name repo release."
7+
exit 1
8+
fi
9+
10+
NAME="$1"
11+
TEMPLATE="$2"
12+
RELEASE="$3"
13+
14+
PREFIX=/usr/local
15+
BASTILLE=${PREFIX}/bastille
16+
JAIL_BASE=${BASTILLE}/jails/${NAME}
17+
18+
JAIL_ROOT=${JAIL_BASE}/root
19+
JAIL_CONF=${JAIL_BASE}/jail.conf
20+
PKGS_CONF=${JAIL_BASE}/pkgs.conf
21+
JAIL_JID=${JAIL_BASE}/${jail}.jid
22+
JAIL_FSTAB="${BASTILLE}/fstab/${NAME}.fstab"
23+
BASEJAIL="${BASTILLE}/releases/${RELEASE}"
24+
25+
## create zfs volume
26+
if [ ! -d ${JAIL_ROOT} ]; then
27+
echo "Creating Jail Base..."
28+
zfs create -o mountpoint=${JAIL_BASE}\
29+
-o compression=lz4\
30+
-o atime=off zroot"${JAIL_BASE}"\
31+
&& echo "Created ZFS volume for jail...[OK]." || echo "Failure: ZFS volume creation."
32+
fi
33+
34+
## clone template into volume
35+
if [ $(find "${JAIL_BASE}" -empty) ]; then
36+
echo "Cloning template..."
37+
git clone "${TEMPLATE}" "${JAIL_BASE}" || echo "Template cloning failed; exiting"
38+
echo "Cloning release contents..."
39+
/bin/cp -an "${BASEJAIL}/etc" "${JAIL_ROOT}"
40+
/bin/cp -an "${BASEJAIL}/root" "${JAIL_ROOT}"
41+
fi
42+
43+
## create fstab; IMPORTANT that this goes before pkgs (below)
44+
if [ ! -f ${JAIL_FSTAB} ]; then
45+
/bin/cat << EOF > ${JAIL_FSTAB}
46+
${BASEJAIL}/bin ${JAIL_ROOT}/bin nullfs ro 0 0
47+
${BASEJAIL}/boot ${JAIL_ROOT}/boot nullfs ro 0 0
48+
${BASEJAIL}/lib ${JAIL_ROOT}/lib nullfs ro 0 0
49+
${BASEJAIL}/libexec ${JAIL_ROOT}/libexec nullfs ro 0 0
50+
${BASEJAIL}/rescue ${JAIL_ROOT}/rescue nullfs ro 0 0
51+
${BASEJAIL}/sbin ${JAIL_ROOT}/sbin nullfs ro 0 0
52+
${BASEJAIL}/usr/bin ${JAIL_ROOT}/usr/bin nullfs ro 0 0
53+
${BASEJAIL}/usr/include ${JAIL_ROOT}/usr/include nullfs ro 0 0
54+
${BASEJAIL}/usr/lib ${JAIL_ROOT}/usr/lib nullfs ro 0 0
55+
${BASEJAIL}/usr/libexec ${JAIL_ROOT}/usr/libexec nullfs ro 0 0
56+
${BASEJAIL}/usr/sbin ${JAIL_ROOT}/usr/sbin nullfs ro 0 0
57+
${BASEJAIL}/usr/share ${JAIL_ROOT}/usr/share nullfs ro 0 0
58+
${BASEJAIL}/usr/libdata ${JAIL_ROOT}/usr/libdata nullfs ro 0 0
59+
EOF
60+
echo "Writing jail fstab (basejail)...[OK]"
61+
fi
62+
63+
## install pkgs
64+
if [ -s ${PKGS_CONF} ]; then
65+
echo "Starting jail; installing pkgs..."
66+
jail -c -f "${JAIL_CONF}" -J "${JAIL_JID}" ${NAME}
67+
pfctl -f /etc/pf.conf
68+
pkg -j ${NAME} install -y $(cat ${PKGS_CONF})
69+
jail -r -f "${JAIL_CONF}" ${NAME}
70+
echo "Stopping jail; installation complete."
71+
elif [ ! -s ${PKGS_CONF} ]; then
72+
echo "pkgs.conf appears empty; not installing anything."
73+
echo "complete"
74+
fi

‎usr/local/bin/bbsd-destroy

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/sh
2+
#
3+
# destroy an existing jail
4+
5+
JAIL_NAME=$1
6+
JAIL_PATH=$2
7+
PREFIX=/usr/local
8+
JLS_NAME="/usr/sbin/jls name"
9+
JLS_PATH="/usr/sbin/jls path"
10+
PLATFORM=${PREFIX}/bastille
11+
FSTAB_PATH=${PLATFORM}/fstab/$1.fstab
12+
JAIL_PATH=${PLATFORM}/jails/$1
13+
14+
if [ $# -lt 2 ]; then
15+
echo "Required: name path."
16+
return 1
17+
fi
18+
19+
if [ ! -d ${JAIL_PATH} ]; then
20+
echo "Path (${JAIL_PATH}) not found."
21+
return 1
22+
fi
23+
24+
if [ $(${JLS_NAME} | grep ${JAIL_NAME}) ]; then
25+
echo "Jail is running."
26+
echo "Stop jail first with bbsd-stop ${JAIL_NAME}."
27+
return 1
28+
fi
29+
30+
if [ $(${JLS_PATH} | grep ${JAIL_PATH}) ]; then
31+
echo "Jail is running."
32+
echo "Stop jail first with bbsd-stop ${JAIL_NAME}."
33+
return 1
34+
fi
35+
36+
if [ -d ${JAIL_PATH} ]; then
37+
zfs destroy -r zroot${JAIL_PATH} || echo "Unable to destroy zroot${JAIL_PATH}."
38+
rm -rf ${JAIL_PATH} || echo "Unable to delete ${JAIL_PATH}."
39+
echo "Jail destroyed. RIP."
40+
fi

‎usr/local/bin/bbsd-init-repo

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/sh
2+
# (christer.edwards@gmail.com)
3+
# initialize a Bastille repo
4+
5+
if [ $# -lt 1 ] || [ $# -gt 1 ]; then
6+
echo "Usage: bbsd-init-repo /path/to/repo"
7+
return 1
8+
fi
9+
10+
REPOPATH=$1
11+
12+
RODIRS="root/bin root/boot root/dev root/lib\
13+
root/libexec root/rescue root/sbin\
14+
root/usr/bin root/usr/include root/usr/lib\
15+
root/usr/libdata root/usr/libexec\
16+
root/usr/sbin root/usr/share root/tmp"
17+
18+
RWDIRS="root/etc root/root root/usr/local root/var"
19+
20+
bbsd_init_repo()
21+
{
22+
local _dir
23+
24+
for _dir in ${RWDIRS}; do
25+
mkdir -p "${REPOPATH}"/"${_dir}"
26+
done
27+
28+
for _dir in ${RODIRS}; do
29+
mkdir -p "${REPOPATH}"/"${_dir}"
30+
cat << EOF > "${_dir}"/.gitignore
31+
# Ignore everything in this directory
32+
# All directory contents will be lost
33+
*
34+
# Except this file
35+
!.gitignore
36+
EOF
37+
done
38+
39+
chmod 1777 root/tmp
40+
}
41+
42+
bbsd_init_repo

‎usr/local/bin/bbsd-login

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/sh
2+
#
3+
# jexec $1 /usr/bin/login -f root
4+
5+
if [ $# -eq 1 ]; then
6+
jexec $1 /usr/bin/login -f root
7+
fi
8+
9+
if [ $# -eq 2 ]; then
10+
jexec $1 /usr/bin/login -f $2
11+
fi

‎usr/local/bin/bbsd-pkg

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/sh
2+
#
3+
# execute $2 inside targeted jail(s)
4+
5+
if [ $# -gt 2 ] || [ $# -lt 2 ]; then
6+
echo "Usage: bbsd-pkg [glob|ALL] 'package command'."
7+
exit 1
8+
fi
9+
10+
if [ "$1" = 'ALL' ]; then
11+
JAILS=$(jls -N | awk '!/JID/{print $1}')
12+
echo "Targeting all containers."
13+
echo
14+
for i in ${JAILS}; do
15+
echo "${i}:"
16+
pkg -j "${i}" "$2"
17+
echo
18+
done
19+
fi
20+
21+
if [ "$1" != 'ALL' ]; then
22+
JAILS=$(jls -N | awk '!/JID/{print $1}' | grep "$1")
23+
echo "Targeting specified containers."
24+
echo "${JAILS}"
25+
echo
26+
for i in ${JAILS}; do
27+
echo "${i}:"
28+
pkg -j "${i}" "$2"
29+
echo
30+
done
31+
fi

0 commit comments

Comments
 (0)