BastilleBSD/bastille
2
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

Merge branch 'master' into master

Browse Source
This commit is contained in:
Nikos Chondros
2023-10-26 20:51:15 +03:00
committed by GitHub
parent b60bc10537 00d5c97f64
commit 445b42ed39
57 changed files with 860 additions and 1387 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
usr/local/share/bastille/bootstrap.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -42,6 +42,8 @@ help|-h|--help)
;;
esac
bastille_root_check
#Validate if ZFS is enabled in rc.conf and bastille.conf.
if [ "$(sysrc -n zfs_enable)" = "YES" ] && [ ! "${bastille_zfs_enable}" = "YES" ]; then
warn "ZFS is enabled in rc.conf but not bastille.conf. Do you want to continue? (N|y)"
@@ -397,7 +399,7 @@ debootstrap_release() {
fi
case "${LINUX_FLAVOR}" in
bionic|stretch|buster|bullseye)
bionic|focal|jammy|buster|bullseye|bookworm)
info "Increasing APT::Cache-Start"
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${DIR_BOOTSTRAP}/etc/apt/apt.conf.d/00aptitude
;;
@@ -514,8 +516,8 @@ case "${1}" in
## check for HardenedBSD(latest stable build release)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-BUILD-LATEST//g')
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-BUILD-//g')
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}"
PLATFORM_OS="HardenedBSD"
validate_release_url
;;
@@ -532,8 +534,8 @@ current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
## check for HardenedBSD(latest current build release)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-BUILD-//g')
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}"
PLATFORM_OS="HardenedBSD"
validate_release_url
;;
@@ -565,10 +567,10 @@ ubuntu_focal|focal|ubuntu-focal)
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
debootstrap_release
;;
debian_stretch|stretch|debian-stretch)
PLATFORM_OS="Debian/Linux"
LINUX_FLAVOR="stretch"
DIR_BOOTSTRAP="Debian9"
ubuntu_jammy|jammy|ubuntu-jammy)
PLATFORM_OS="Ubuntu/Linux"
LINUX_FLAVOR="jammy"
DIR_BOOTSTRAP="Ubuntu_2204"
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
debootstrap_release
;;
@@ -586,6 +588,13 @@ debian_bullseye|bullseye|debian-bullseye)
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
debootstrap_release
;;
debian_bookworm|bookworm|debian-bookworm)
PLATFORM_OS="Debian/Linux"
LINUX_FLAVOR="bookworm"
DIR_BOOTSTRAP="Debian12"
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
debootstrap_release
;;
*)
usage
;;

4
usr/local/share/bastille/clone.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 2 ]; then
usage
fi
bastille_root_check
NEWNAME="${1}"
IP="${2}"

4
usr/local/share/bastille/cmd.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -eq 0 ]; then
usage
fi
bastille_root_check
COUNT=0
RETURN=0

10
usr/local/share/bastille/common.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -33,6 +33,14 @@ COLOR_GREEN=
COLOR_YELLOW=
COLOR_RESET=
bastille_root_check() {
if [ "$(id -u)" -ne 0 ]; then
## permission denied
error_notify "Bastille: Permission Denied"
error_exit "root / sudo / doas required"
fi
}
enable_color() {
. /usr/local/share/bastille/colors.pre.sh
}

4
usr/local/share/bastille/config.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -55,6 +55,8 @@ if [ $# -eq 1 ] || [ $# -gt 3 ]; then
usage
fi
bastille_root_check
ACTION=$1
shift

4
usr/local/share/bastille/console.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 1 ]; then
usage
fi
bastille_root_check
USER="${1}"
validate_user() {

4
usr/local/share/bastille/convert.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 0 ]; then
usage
fi
bastille_root_check
convert_symlinks() {
# Work with the symlinks, revert on first cp error
if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then

4
usr/local/share/bastille/cp.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -54,6 +54,8 @@ if [ $# -ne 2 ]; then
usage
fi
bastille_root_check
case "${OPTION}" in
-q|--quiet)
OPTION="-a"

25
usr/local/share/bastille/create.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -104,10 +104,10 @@ validate_ip() {
if echo "${ip}" | grep -qvE '(SLAAC|DHCP|0[.]0[.]0[.]0)'; then
if [ "${ipx_addr}" = "ip4.addr" ]; then
IP4_ADDR="${ip}"
IP4_DEFINITION="${ipx_addr}=${ip};"
IP4_DEFINITION="${ipx_addr} = ${ip};"
else
IP6_ADDR="${ip}"
IP6_DEFINITION="${ipx_addr}=${ip};"
IP6_DEFINITION="${ipx_addr} = ${ip};"
fi
fi
}
@@ -588,6 +588,8 @@ help|-h|--help)
;;
esac
bastille_root_check
if echo "$3" | grep '@'; then
BASTILLE_JAIL_IP=$(echo "$3" | awk -F@ '{print $2}')
BASTILLE_JAIL_INTERFACES=$( echo "$3" | awk -F@ '{print $1}')
@@ -681,9 +683,9 @@ if [ -n "${LINUX_JAIL}" ]; then
## check for FreeBSD releases name
NAME_VERIFY=ubuntu_focal
;;
debian_stretch|stretch|debian-stretch)
jammy|ubuntu_jammy|ubuntu-jammy)
## check for FreeBSD releases name
NAME_VERIFY=stretch
NAME_VERIFY=ubuntu_jammy
;;
debian_buster|buster|debian-buster)
## check for FreeBSD releases name
@@ -693,6 +695,10 @@ if [ -n "${LINUX_JAIL}" ]; then
## check for FreeBSD releases name
NAME_VERIFY=bullseye
;;
debian_bookworm|bookworm|debian-bookworm)
## check for FreeBSD releases name
NAME_VERIFY=bookworm
;;
*)
error_notify "Unknown Linux."
usage
@@ -753,8 +759,9 @@ if [ -z "${EMPTY_JAIL}" ]; then
NAME_VERIFY=Ubuntu_2004
validate_release
;;
debian_stretch|stretch|debian-stretch)
NAME_VERIFY=Debian9
ubuntu_jammy|jammy|ubuntu-jammy)
UBUNTU="1"
NAME_VERIFY=Ubuntu_2204
validate_release
;;
debian_buster|buster|debian-buster)
@@ -765,6 +772,10 @@ if [ -z "${EMPTY_JAIL}" ]; then
NAME_VERIFY=Debian11
validate_release
;;
debian_bookworm|bookworm|debian-bookworm)
NAME_VERIFY=Debian12
validate_release
;;
*)
error_notify "Unknown Release."
usage

12
usr/local/share/bastille/destroy.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -210,6 +210,8 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then
usage
fi
bastille_root_check
## check what should we clean
case "${TARGET}" in
*-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current)
@@ -247,14 +249,14 @@ current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest)$' | sed 's/CURRENT/current/;s/build/BUILD/g;s/latest/LATEST/g')
destroy_rel
;;
Ubuntu_1804|Ubuntu_2004|UBUNTU_1804|UBUNTU_2004)
Ubuntu_1804|Ubuntu_2004|Ubuntu_2204|UBUNTU_1804|UBUNTU_2004|UBUNTU_2204)
## check for Linux releases
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Ubuntu_1804)$|(Ubuntu_2004)$' | sed 's/UBUNTU/Ubuntu/g;s/ubuntu/Ubuntu/g')
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Ubuntu_1804)$|(Ubuntu_2004)$|(Ubuntu_2204)$' | sed 's/UBUNTU/Ubuntu/g;s/ubuntu/Ubuntu/g')
destroy_rel
;;
Debian9|Debian10|Debian11|DEBIAN9|DEBIAN10|DEBIAN11)
Debian10|Debian11|Debian12|DEBIAN10|DEBIAN11|DEBIAN12)
## check for Linux releases
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Debian9)$|(Debian10)$|(Debian11)$' | sed 's/DEBIAN/Debian/g')
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Debian10)$|(Debian11)$|(Debian12)$' | sed 's/DEBIAN/Debian/g')
destroy_rel
;;
*)

4
usr/local/share/bastille/edit.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -48,6 +48,8 @@ elif [ $# -eq 1 ]; then
TARGET_FILENAME="${1}"
fi
bastille_root_check
if [ -z "${EDITOR}" ]; then
EDITOR=vi
fi

4
usr/local/share/bastille/export.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -71,6 +71,8 @@ if [ $# -gt 5 ] || [ $# -lt 1 ]; then
usage
fi
bastille_root_check
zfs_enable_check() {
# Temporarily disable ZFS so we can create a standard backup archive
if [ "${bastille_zfs_enable}" = "YES" ]; then

4
usr/local/share/bastille/htop.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 0 ]; then
usage
fi
bastille_root_check
for _jail in ${JAILS}; do
bastille_jail_path=$(/usr/sbin/jls -j "${_jail}" path)
if [ ! -x "${bastille_jail_path}/usr/local/bin/htop" ]; then

21
usr/local/share/bastille/import.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -59,6 +59,8 @@ if [ $# -gt 3 ] || [ $# -lt 1 ]; then
usage
fi
bastille_root_check
TARGET="${1}"
OPT_FORCE=
USER_IMPORT=
@@ -150,6 +152,11 @@ update_jailconf() {
sed -i '' "s|path.*=.*;|path = ${bastille_jailsdir}/${TARGET_TRIM}/root;|" "${JAIL_CONFIG}"
sed -i '' "s|mount.fstab.*=.*;|mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;|" "${JAIL_CONFIG}"
fi
# Check for the jib script
if grep -qw "vnet" "${JAIL_CONFIG}"; then
vnet_requirements
fi
fi
}
@@ -207,6 +214,7 @@ generate_config() {
# See if we need to generate a vnet network section
if [ "${IS_VNET_JAIL:-0}" = "1" ]; then
NETBLOCK=$(generate_vnet_jail_netblock "${TARGET_TRIM}" "" "${VNET_DEFAULT_INTERFACE}")
vnet_requirements
else
# If there are multiple IP/NIC let the user configure network
if [ -n "${IPV4_CONFIG}" ]; then
@@ -333,6 +341,17 @@ workout_components() {
fi
}
vnet_requirements() {
# VNET jib script requirement
if [ ! "$(command -v jib)" ]; then
if [ -f "/usr/share/examples/jails/jib" ] && [ ! -f "/usr/local/bin/jib" ]; then
install -m 0544 /usr/share/examples/jails/jib /usr/local/bin/jib
else
warn "Warning: Unable to locate/install jib script required by VNET jails."
fi
fi
}
config_netif() {
# Get interface from bastille configuration
if [ -n "${bastille_network_loopback}" ]; then

4
usr/local/share/bastille/limits.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
# Ressource limits added by Sven R github.com/hackacad
#
@@ -55,6 +55,8 @@ if [ $# -ne 2 ]; then
usage
fi
bastille_root_check
OPTION="${1}"
VALUE="${2}"

235
usr/local/share/bastille/list.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -35,106 +35,114 @@ usage() {
error_exit "Usage: bastille list [-j|-a] [release [-p]|template|(jail|container)|log|limit|(import|export|backup)]"
}
if [ $# -eq 0 ]; then
/usr/sbin/jls -N
if [ "${1}" = help -o "${1}" = "-h" -o "${1}" = "--help" ]; then
usage
fi
if [ "$1" == "-j" ]; then
bastille_root_check
if [ $# -eq 0 ]; then
/usr/sbin/jls
fi
if [ "${1}" == "-j" ]; then
/usr/sbin/jls -N --libxo json
exit 0
fi
if [ $# -gt 0 ]; then
# Handle special-case commands first.
case "$1" in
help|-h|--help)
usage
;;
all|-a|--all)
TARGET=
list_all(){
if [ -d "${bastille_jailsdir}" ]; then
DEFAULT_VALUE="-"
SPACER=2
MAX_LENGTH_JAIL_NAME=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h -m 1 -e "^.* {$" | awk '{ print length($1) }' | sort -nr | head -n 1)
MAX_LENGTH_JAIL_NAME=${MAX_LENGTH_JAIL_NAME:-3}
if [ ${MAX_LENGTH_JAIL_NAME} -lt 3 ]; then MAX_LENGTH_JAIL_NAME=3; fi
if [ "${MAX_LENGTH_JAIL_NAME}" -lt 3 ]; then MAX_LENGTH_JAIL_NAME=3; fi
MAX_LENGTH_JAIL_IP=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 sed -n "s/^[ ]*ip[4,6].addr[ ]*=[ ]*\(.*\);$/\1 /p" | sed 's/\// /g' | awk '{ print length($1) }' | sort -nr | head -n 1)
MAX_LENGTH_JAIL_IP=${MAX_LENGTH_JAIL_IP:-10}
MAX_LENGTH_JAIL_VNET_IP=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -l "vnet;" | grep -h "ifconfig_vnet0=" $(sed -n "s/\(.*\)jail.conf$/\1root\/etc\/rc.conf/p") | sed -n "s/^ifconfig_vnet0=\"\(.*\)\"$/\1/p"| sed "s/\// /g" | awk '{ if ($1 ~ /^[inet|inet6]/) print length($2); else print 15 }' | sort -nr | head -n 1)
MAX_LENGTH_JAIL_VNET_IP=${MAX_LENGTH_JAIL_VNET_IP:-10}
if [ ${MAX_LENGTH_JAIL_VNET_IP} -gt ${MAX_LENGTH_JAIL_IP} ]; then MAX_LENGTH_JAIL_IP=${MAX_LENGTH_JAIL_VNET_IP}; fi
if [ ${MAX_LENGTH_JAIL_IP} -lt 10 ]; then MAX_LENGTH_JAIL_IP=10; fi
if [ "${MAX_LENGTH_JAIL_VNET_IP}" -gt "${MAX_LENGTH_JAIL_IP}" ]; then MAX_LENGTH_JAIL_IP=${MAX_LENGTH_JAIL_VNET_IP}; fi
if [ "${MAX_LENGTH_JAIL_IP}" -lt 10 ]; then MAX_LENGTH_JAIL_IP=10; fi
MAX_LENGTH_JAIL_HOSTNAME=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h -m 1 -e "^[ ]*host.hostname[ ]*=[ ]*\(.*\);" | awk '{ print length(substr($3, 1, length($3)-1)) }' | sort -nr | head -n 1)
MAX_LENGTH_JAIL_HOSTNAME=${MAX_LENGTH_JAIL_HOSTNAME:-8}
if [ ${MAX_LENGTH_JAIL_HOSTNAME} -lt 8 ]; then MAX_LENGTH_JAIL_HOSTNAME=8; fi
if [ "${MAX_LENGTH_JAIL_HOSTNAME}" -lt 8 ]; then MAX_LENGTH_JAIL_HOSTNAME=8; fi
MAX_LENGTH_JAIL_PORTS=$(find ""${bastille_jailsdir}/*/rdr.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 -n1 awk '{ lines++; chars += length($0)} END { chars += lines - 1; print chars }' | sort -nr | head -n 1)
MAX_LENGTH_JAIL_PORTS=${MAX_LENGTH_JAIL_PORTS:-15}
if [ ${MAX_LENGTH_JAIL_PORTS} -lt 15 ]; then MAX_LENGTH_JAIL_PORTS=15; fi
if [ ${MAX_LENGTH_JAIL_PORTS} -gt 30 ]; then MAX_LENGTH_JAIL_PORTS=30; fi
if [ "${MAX_LENGTH_JAIL_PORTS}" -lt 15 ]; then MAX_LENGTH_JAIL_PORTS=15; fi
if [ "${MAX_LENGTH_JAIL_PORTS}" -gt 30 ]; then MAX_LENGTH_JAIL_PORTS=30; fi
MAX_LENGTH_JAIL_RELEASE=$(find ""${bastille_jailsdir}/*/fstab"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h "/releases/.*/root/.bastille.*nullfs" | grep -hE "^USERLAND_VERSION=" $(sed -n "s/^\(.*\) \/.*$/\1\/bin\/freebsd-version/p" | awk '!_[$0]++') | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p" | awk '{ print length($0) }' | sort -nr | head -n 1)
MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_JAIL_RELEASE:-7}
MAX_LENGTH_THICK_JAIL_RELEASE=$(find ""${bastille_jailsdir}/*/root/bin/freebsd-version"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -hE "^USERLAND_VERSION=" | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p" | awk '{ print length($0) }' | sort -nr | head -n 1)
MAX_LENGTH_THICK_JAIL_RELEASE=${MAX_LENGTH_THICK_JAIL_RELEASE:-7}
MAX_LENGTH_LINUX_JAIL_RELEASE=$(find ""${bastille_jailsdir}/*/fstab"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h "/jails/.*/root/proc.*linprocfs" | grep -hE "^NAME=|^VERSION_ID=|^VERSION_CODENAME=" $(sed -n "s/^linprocfs *\(.*\)\/.*$/\1\/etc\/os-release/p") 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | sed "N;N;s/\n/;/g" | sed -n "s/^NAME=\(.*\);VERSION_ID=\(.*\);VERSION_CODENAME=\(.*\)$/\1 \2 (\3)/p" | awk '{ print length($0) }' | sort -nr | head -n 1)
MAX_LENGTH_LINUX_JAIL_RELEASE=${MAX_LENGTH_LINUX_JAIL_RELEASE:-7}
if [ ${MAX_LENGTH_THICK_JAIL_RELEASE} -gt ${MAX_LENGTH_JAIL_RELEASE} ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_THICK_JAIL_RELEASE}; fi
if [ ${MAX_LENGTH_LINUX_JAIL_RELEASE} -gt ${MAX_LENGTH_JAIL_RELEASE} ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_LINUX_JAIL_RELEASE}; fi
if [ ${MAX_LENGTH_JAIL_RELEASE} -lt 7 ]; then MAX_LENGTH_JAIL_RELEASE=7; fi
if [ "${MAX_LENGTH_THICK_JAIL_RELEASE}" -gt "${MAX_LENGTH_JAIL_RELEASE}" ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_THICK_JAIL_RELEASE}; fi
if [ "${MAX_LENGTH_LINUX_JAIL_RELEASE}" -gt "${MAX_LENGTH_JAIL_RELEASE}" ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_LINUX_JAIL_RELEASE}; fi
if [ "${MAX_LENGTH_JAIL_RELEASE}" -lt 7 ]; then MAX_LENGTH_JAIL_RELEASE=7; fi
printf " JID%*sState%*sIP Address%*sPublished Ports%*sHostname%*sRelease%*sPath\n" "$((${MAX_LENGTH_JAIL_NAME} + ${SPACER} - 3))" "" "$((${SPACER}))" "" "$((${MAX_LENGTH_JAIL_IP} + ${SPACER} - 10))" "" "$((${MAX_LENGTH_JAIL_PORTS} + ${SPACER} - 15))" "" "$((${MAX_LENGTH_JAIL_HOSTNAME} + ${SPACER} - 8))" "" "$((${MAX_LENGTH_JAIL_RELEASE} + ${SPACER} - 7))" ""
JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
if [ -n "${TARGET}" ]; then
# Query all info for a specific jail.
JAIL_LIST="${TARGET}"
else
# Query all info for all jails(default).
JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
fi
for _JAIL in ${JAIL_LIST}; do
if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
JAIL_NAME=$(grep -h -m 1 -e "^.* {$" "${bastille_jailsdir}/${_JAIL}/jail.conf" 2> /dev/null | awk '{ print $1 }')
IS_FREEBSD_JAIL=0
if [ -f "${bastille_jailsdir}/${JAIL_NAME}/root/bin/freebsd-version" -o -f "${bastille_jailsdir}/${JAIL_NAME}/root/.bastille/bin/freebsd-version" -o "$(grep -c "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_FREEBSD_JAIL=1; fi
IS_FREEBSD_JAIL=${IS_FREEBSD_JAIL:-0}
IS_LINUX_JAIL=0
if [ "$(grep -c "^linprocfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_LINUX_JAIL=1; fi
IS_LINUX_JAIL=${IS_LINUX_JAIL:-0}
if [ "$(/usr/sbin/jls name | awk "/^${JAIL_NAME}$/")" ]; then
JAIL_STATE="Up"
if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet 2> /dev/null | sed -n "/.inet /{s///;s/ .*//;p;}")
if [ ! ${JAIL_IP} ]; then JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet6 2> /dev/null | awk '/inet6 / && (!/fe80::/ || !/%vnet0/)' | sed -n "/.inet6 /{s///;s/ .*//;p;}"); fi
else
JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip4.addr 2> /dev/null)
if [ ${JAIL_IP} = "-" ]; then JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip6.addr 2> /dev/null); fi
fi
JAIL_HOSTNAME=$(/usr/sbin/jls -j ${JAIL_NAME} host.hostname 2> /dev/null)
JAIL_PORTS=$(pfctl -a "rdr/${JAIL_NAME}" -Psn 2> /dev/null | awk '{ printf "%s/%s:%s"",",$7,$14,$18 }' | sed "s/,$//")
JAIL_PATH=$(/usr/sbin/jls -j ${JAIL_NAME} path 2> /dev/null)
if [ ${IS_FREEBSD_JAIL} -eq 1 ]; then
JAIL_RELEASE=$(jexec -l ${JAIL_NAME} freebsd-version -u 2> /dev/null)
fi
if [ ${IS_LINUX_JAIL} -eq 1 ]; then
JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
fi
JAIL_NAME=$(grep -h -m 1 -e "^.* {$" "${bastille_jailsdir}/${_JAIL}/jail.conf" 2> /dev/null | awk '{ print $1 }')
IS_FREEBSD_JAIL=0
if [ -f "${bastille_jailsdir}/${JAIL_NAME}/root/bin/freebsd-version" -o -f "${bastille_jailsdir}/${JAIL_NAME}/root/.bastille/bin/freebsd-version" -o "$(grep -c "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_FREEBSD_JAIL=1; fi
IS_FREEBSD_JAIL=${IS_FREEBSD_JAIL:-0}
IS_LINUX_JAIL=0
if [ "$(grep -c "^linprocfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_LINUX_JAIL=1; fi
IS_LINUX_JAIL=${IS_LINUX_JAIL:-0}
if [ "$(/usr/sbin/jls name | awk "/^${JAIL_NAME}$/")" ]; then
JAIL_STATE="Up"
if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet 2> /dev/null | sed -n "/.inet /{s///;s/ .*//;p;}")
if [ ! "${JAIL_IP}" ]; then JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet6 2> /dev/null | awk '/inet6 / && (!/fe80::/ || !/%vnet0/)' | sed -n "/.inet6 /{s///;s/ .*//;p;}"); fi
else
JAIL_STATE=$(if [ "$(sed -n "/^${JAIL_NAME} {$/,/^}$/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | awk '$0 ~ /^'${JAIL_NAME}' \{|\}/ { printf "%s",$0 }')" == "${JAIL_NAME} {}" ]; then echo "Down"; else echo "n/a"; fi)
if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
JAIL_IP=$(sed -n 's/^ifconfig_vnet0="\(.*\)"$/\1/p' "${bastille_jailsdir}/${JAIL_NAME}/root/etc/rc.conf" 2> /dev/null | sed "s/\// /g" | awk '{ if ($1 ~ /^[inet|inet6]/) print $2; else print $1 }')
else
JAIL_IP=$(sed -n "s/^[ ]*ip[4,6].addr[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | sed "s/\// /g" | awk '{ print $1 }')
JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip4.addr 2> /dev/null)
if [ "${JAIL_IP}" = "-" ]; then JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip6.addr 2> /dev/null); fi
fi
JAIL_HOSTNAME=$(/usr/sbin/jls -j ${JAIL_NAME} host.hostname 2> /dev/null)
JAIL_PORTS=$(pfctl -a "rdr/${JAIL_NAME}" -Psn 2> /dev/null | awk '{ printf "%s/%s:%s"",",$7,$14,$18 }' | sed "s/,$//")
JAIL_PATH=$(/usr/sbin/jls -j ${JAIL_NAME} path 2> /dev/null)
if [ "${IS_FREEBSD_JAIL}" -eq 1 ]; then
JAIL_RELEASE=$(jexec -l ${JAIL_NAME} freebsd-version -u 2> /dev/null)
fi
if [ "${IS_LINUX_JAIL}" -eq 1 ]; then
JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
fi
else
JAIL_STATE=$(if [ "$(sed -n "/^${JAIL_NAME} {$/,/^}$/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | awk '$0 ~ /^'${JAIL_NAME}' \{|\}/ { printf "%s",$0 }')" == "${JAIL_NAME} {}" ]; then echo "Down"; else echo "n/a"; fi)
if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
JAIL_IP=$(sed -n 's/^ifconfig_vnet0="\(.*\)"$/\1/p' "${bastille_jailsdir}/${JAIL_NAME}/root/etc/rc.conf" 2> /dev/null | sed "s/\// /g" | awk '{ if ($1 ~ /^[inet|inet6]/) print $2; else print $1 }')
else
JAIL_IP=$(sed -n "s/^[ ]*ip[4,6].addr[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | sed "s/\// /g" | awk '{ print $1 }')
fi
JAIL_HOSTNAME=$(sed -n "s/^[ ]*host.hostname[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
if [ -f "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" ]; then JAIL_PORTS=$(awk '$1 ~ /^[tcp|udp]/ { printf "%s/%s:%s,",$1,$2,$3 }' "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" 2> /dev/null | sed "s/,$//"); else JAIL_PORTS=""; fi
JAIL_PATH=$(sed -n "s/^[ ]*path[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
if [ "${JAIL_PATH}" ]; then
if [ "${IS_FREEBSD_JAIL}" -eq 1 ]; then
if [ -f "${JAIL_PATH}/bin/freebsd-version" ]; then
JAIL_RELEASE=$(grep -hE "^USERLAND_VERSION=" "${JAIL_PATH}/bin/freebsd-version" 2> /dev/null | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
else
JAIL_RELEASE=$(grep -h "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null | grep -hE "^USERLAND_VERSION=" $(sed -n "s/^\(.*\) \/.*$/\1\/bin\/freebsd-version/p" | awk '!_[$0]++') | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
fi
fi
JAIL_HOSTNAME=$(sed -n "s/^[ ]*host.hostname[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
if [ -f "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" ]; then JAIL_PORTS=$(awk '$1 ~ /^[tcp|udp]/ { printf "%s/%s:%s,",$1,$2,$3 }' "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" 2> /dev/null | sed "s/,$//"); else JAIL_PORTS=""; fi
JAIL_PATH=$(sed -n "s/^[ ]*path[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
if [ ${JAIL_PATH} ]; then
if [ ${IS_FREEBSD_JAIL} -eq 1 ]; then
if [ -f "${JAIL_PATH}/bin/freebsd-version" ]; then
JAIL_RELEASE=$(grep -hE "^USERLAND_VERSION=" "${JAIL_PATH}/bin/freebsd-version" 2> /dev/null | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
else
JAIL_RELEASE=$(grep -h "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null | grep -hE "^USERLAND_VERSION=" $(sed -n "s/^\(.*\) \/.*$/\1\/bin\/freebsd-version/p" | awk '!_[$0]++') | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
fi
fi
if [ ${IS_LINUX_JAIL} -eq 1 ]; then
JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
fi
else
JAIL_RELEASE=""
if [ "${IS_LINUX_JAIL}" -eq 1 ]; then
JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
fi
else
JAIL_RELEASE=""
fi
fi
if [ ${#JAIL_PORTS} -gt ${MAX_LENGTH_JAIL_PORTS} ]; then JAIL_PORTS="$(echo ${JAIL_PORTS} | cut -c-$((${MAX_LENGTH_JAIL_PORTS} - 3)))..."; fi
if [ "${#JAIL_PORTS}" -gt "${MAX_LENGTH_JAIL_PORTS}" ]; then JAIL_PORTS="$(echo ${JAIL_PORTS} | cut -c-$((${MAX_LENGTH_JAIL_PORTS} - 3)))..."; fi
JAIL_NAME=${JAIL_NAME:-${DEFAULT_VALUE}}
JAIL_STATE=${JAIL_STATE:-${DEFAULT_VALUE}}
JAIL_IP=${JAIL_IP:-${DEFAULT_VALUE}}
@@ -148,48 +156,85 @@ if [ $# -gt 0 ]; then
else
error_exit "unfortunately there are no jails here (${bastille_jailsdir})"
fi
}
list_release(){
if [ -d "${bastille_releasesdir}" ]; then
REL_LIST=$(ls "${bastille_releasesdir}" | sed "s/\n//g")
for _REL in ${REL_LIST}; do
if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" -o -d "${bastille_releasesdir}/${_REL}/debootstrap" ]; then
if [ "${2}" == "-p" -a -f "${bastille_releasesdir}/${_REL}/bin/freebsd-version" ]; then
REL_PATCH_LEVEL=$(sed -n "s/^USERLAND_VERSION=\"\(.*\)\"$/\1/p" "${bastille_releasesdir}/${_REL}/bin/freebsd-version" 2> /dev/null)
REL_PATCH_LEVEL=${REL_PATCH_LEVEL:-${_REL}}
echo "${REL_PATCH_LEVEL}"
else
echo "${_REL}"
fi
fi
done
fi
}
list_template(){
find "${bastille_templatesdir}" -type d -maxdepth 2
}
list_jail(){
if [ -d "${bastille_jailsdir}" ]; then
JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
for _JAIL in ${JAIL_LIST}; do
if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
echo "${_JAIL}"
fi
done
fi
}
list_log(){
find "${bastille_logsdir}" -type f -maxdepth 1
}
list_limit(){
rctl -h jail:
}
list_import(){
ls "${bastille_backupsdir}" | grep -v ".sha256$"
}
if [ $# -gt 0 ]; then
# Handle special-case commands first.
case "${1}" in
all|-a|--all)
list_all
;;
release|releases)
if [ -d "${bastille_releasesdir}" ]; then
REL_LIST=$(ls "${bastille_releasesdir}" | sed "s/\n//g")
for _REL in ${REL_LIST}; do
if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" -o -d "${bastille_releasesdir}/${_REL}/debootstrap" ]; then
if [ "$2" == "-p" -a -f "${bastille_releasesdir}/${_REL}/bin/freebsd-version" ]; then
REL_PATCH_LEVEL=$(sed -n "s/^USERLAND_VERSION=\"\(.*\)\"$/\1/p" "${bastille_releasesdir}/${_REL}/bin/freebsd-version" 2> /dev/null)
REL_PATCH_LEVEL=${REL_PATCH_LEVEL:-${_REL}}
echo "${REL_PATCH_LEVEL}"
else
echo "${_REL}"
fi
fi
done
fi
list_release
;;
template|templates)
find "${bastille_templatesdir}" -type d -maxdepth 2
list_template
;;
jail|jails|container|containers)
if [ -d "${bastille_jailsdir}" ]; then
JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
for _JAIL in ${JAIL_LIST}; do
if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
echo "${_JAIL}"
fi
done
fi
list_jail
;;
log|logs)
find "${bastille_logsdir}" -type f -maxdepth 1
list_log
;;
limit|limits)
rctl -h jail:
list_limit
;;
import|imports|export|exports|backup|backups)
ls "${bastille_backupsdir}" | grep -v ".sha256$"
list_import
exit 0
;;
*)
usage
# Check if we want to query all info for a specific jail instead.
if [ -f "${bastille_jailsdir}/${1}/jail.conf" ]; then
TARGET="${1}"
list_all
else
usage
fi
;;
esac
fi

4
usr/local/share/bastille/mount.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -50,6 +50,8 @@ else
_fstab="$@"
fi
bastille_root_check
## assign needed variables
_hostpath=$(echo "${_fstab}" | awk '{print $1}')
_jailpath=$(echo "${_fstab}" | awk '{print $2}')

4
usr/local/share/bastille/pkg.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -lt 1 ]; then
usage
fi
bastille_root_check
errors=0
for _jail in ${JAILS}; do

31
usr/local/share/bastille/rdr.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,9 +46,12 @@ if [ $# -lt 2 ]; then
usage
fi
bastille_root_check
TARGET="${1}"
JAIL_NAME=""
JAIL_IP=""
JAIL_IP6=""
EXT_IF=""
shift
@@ -71,6 +74,13 @@ check_jail_validity() {
error_exit "Jail IP not found: ${TARGET}"
fi
fi
# Check if jail ip6 address (ip6.addr) is valid (non-VNET only)
if [ "$(bastille config $TARGET get vnet)" != 'enabled' ]; then
if [ "$(bastille config $TARGET get ip6)" != 'disable' ] && [ "$(bastille config $TARGET get ip6)" != 'not set' ]; then
JAIL_IP6=$(/usr/sbin/jls -j "${TARGET}" ip6.addr 2>/dev/null)
fi
fi
# Check if rdr-anchor is defined in pf.conf
if ! (pfctl -sn | grep rdr-anchor | grep 'rdr/\*' >/dev/null); then
@@ -78,9 +88,11 @@ check_jail_validity() {
fi
# Check if ext_if is defined in pf.conf
EXT_IF=$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" /etc/pf.conf)
if [ -z "${EXT_IF}" ]; then
error_exit "bastille_network_pf_ext_if (${bastille_network_pf_ext_if}) not defined in pf.conf"
if [ -n "${bastille_pf_conf}" ]; then
EXT_IF=$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" ${bastille_pf_conf})
if [ -z "${EXT_IF}" ]; then
error_exit "bastille_network_pf_ext_if (${bastille_network_pf_ext_if}) not defined in pf.conf"
fi
fi
}
@@ -106,6 +118,11 @@ load_rdr_rule() {
( pfctl -a "rdr/${JAIL_NAME}" -Psn;
printf '%s\nrdr pass on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "${bastille_network_pf_ext_if}" "$1" "$2" "$JAIL_IP" "$3" ) \
| pfctl -a "rdr/${JAIL_NAME}" -f-
if [ -n "$JAIL_IP6" ]; then
( pfctl -a "rdr/${JAIL_NAME}" -Psn;
printf '%s\nrdr pass on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "${bastille_network_pf_ext_if}" "$1" "$2" "$JAIL_IP6" "$3" ) \
| pfctl -a "rdr/${JAIL_NAME}" -f-
fi
}
# function: load rdr rule with log via pfctl
@@ -116,6 +133,12 @@ log=$@
( pfctl -a "rdr/${JAIL_NAME}" -Psn;
printf '%s\nrdr pass %s on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "${bastille_network_pf_ext_if}" "$proto" "$host_port" "$JAIL_IP" "$jail_port" ) \
| pfctl -a "rdr/${JAIL_NAME}" -f-
if [ -n "$JAIL_IP6" ]; then
( pfctl -a "rdr/${JAIL_NAME}" -Psn;
printf '%s\nrdr pass %s on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "${bastille_network_pf_ext_if}" "$proto" "$host_port" "$JAIL_IP6" "$jail_port" ) \
| pfctl -a "rdr/${JAIL_NAME}" -f-
fi
}
while [ $# -gt 0 ]; do

4
usr/local/share/bastille/rename.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -56,6 +56,8 @@ if [ $# -ne 1 ]; then
usage
fi
bastille_root_check
NEWNAME="${1}"
update_jailconf() {

2
usr/local/share/bastille/restart.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without

4
usr/local/share/bastille/service.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -lt 1 -o $# -gt 2 ]; then
usage
fi
bastille_root_check
for _jail in ${JAILS}; do
info "[${_jail}]:"
jexec -l "${_jail}" /usr/sbin/service "$@"

131
usr/local/share/bastille/setup.sh Normal file
View File

@@ -0,0 +1,131 @@
#!/bin/sh
#
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this
# list of conditions and the following disclaimer.
#
# * Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# * Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
. /usr/local/share/bastille/common.sh
. /usr/local/etc/bastille/bastille.conf
usage() {
error_exit "Usage: bastille setup [pf|bastille0|zfs|vnet]"
}
# Check for too many args
if [ $# -gt 1 ]; then
usage
fi
# Configure bastille0 network interface
configure_bastille0() {
info "Configuring bastille0 loopback interface"
sysrc cloned_interfaces+=lo1
sysrc ifconfig_lo1_name="bastille0"
info "Bringing up new interface: bastille0"
service netif cloneup
}
configure_vnet() {
info "Configuring bridge interface"
sysrc cloned_interfaces+=bridge1
sysrc ifconfig_bridge1_name=bastille1
info "Bringing up new interface: bastille1"
service netif cloneup
}
# Configure pf firewall
configure_pf() {
if [ ! -f "${bastille_pf_conf}" ]; then
local ext_if
ext_if=$(netstat -rn | awk '/default/ {print $4}' | head -n1)
info "Determined default network interface: ($ext_if)"
info "${bastille_pf_conf} does not exist: creating..."
## creating pf.conf
cat << EOF > ${bastille_pf_conf}
## generated by bastille setup
ext_if="$ext_if"
set block-policy return
scrub in on \$ext_if all fragment reassemble
set skip on lo
table <jails> persist
nat on \$ext_if from <jails> to any -> (\$ext_if:0)
rdr-anchor "rdr/*"
block in all
pass out quick keep state
antispoof for \$ext_if inet
pass in inet proto tcp from any to any port ssh flags S/SA keep state
EOF
sysrc pf_enable=YES
else
error_exit "${bastille_pf_conf} already exists. Exiting."
fi
}
# Configure ZFS
configure_zfs() {
if [ ! "$(kldstat -q -m zfs)" ]; then
info "ZFS module not loaded; skipping..."
else
## attempt to determine bastille_zroot from `zpool list`
bastille_zroot=$(zpool list | grep -v NAME | awk '{print $1}')
sysrc -f "${bastille_prefix}/bastille.conf" bastille_zfs_enable=YES
sysrc -f "${bastille_prefix}/bastille.conf" bastille_zfs_zpool="${bastille_zroot}"
fi
}
# Run all base functions (w/o vnet) if no args
if [ $# -eq 0 ]; then
sysrc bastille_enable=YES
configure_bastille0
configure_pf
configure_zfs
fi
# Handle special-case commands first.
case "$1" in
help|-h|--help)
usage
;;
pf|firewall)
configure_pf
;;
bastille0|loopback)
configure_bastille0
;;
zfs|storage)
configure_zfs
;;
bastille1|vnet|bridge)
configure_vnet
;;
esac

4
usr/local/share/bastille/start.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then
usage
fi
bastille_root_check
TARGET="${1}"
shift

4
usr/local/share/bastille/stop.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 0 ]; then
usage
fi
bastille_root_check
for _jail in ${JAILS}; do
## test if running
if [ "$(/usr/sbin/jls name | awk "/^${_jail}$/")" ]; then

4
usr/local/share/bastille/sysrc.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -lt 1 ]; then
usage
fi
bastille_root_check
for _jail in ${JAILS}; do
info "[${_jail}]:"
jexec -l "${_jail}" /usr/sbin/sysrc "$@"

104
usr/local/share/bastille/tags.sh Normal file
View File

@@ -0,0 +1,104 @@
#!/bin/sh
#
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
# Ressource limits added by Lars Engels github.com/bsdlme
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this
# list of conditions and the following disclaimer.
#
# * Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# * Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
. /usr/local/share/bastille/common.sh
. /usr/local/etc/bastille/bastille.conf
usage() {
error_notify "Usage: bastille tags TARGET add tag1[,tag2,...]"
error_notify " bastille tags TARGET delete tag1[,tag2,...]"
error_notify " bastille tags TARGET list [tag]"
echo -e "Example: bastille tags JAILNAME add database,mysql"
echo -e " bastille tags JAILNAME delete mysql"
echo -e " bastille tags ALL list"
echo -e " bastille tags ALL list mysql"
exit 1
}
# Handle special-case commands first.
case "$1" in
help|-h|--help)
usage
;;
esac
if [ $# -lt 1 -o $# -gt 2 ]; then
usage
fi
bastille_root_check
ACTION="${1}"
TAGS="${2}"
for _jail in ${JAILS}; do
bastille_jail_tags="${bastille_jailsdir}/${_jail}/tags"
case ${ACTION} in
add)
for _tag in $(echo ${TAGS} | tr , ' '); do
echo ${_tag} >> "${bastille_jail_tags}"
tmpfile="$(mktemp)"
sort "${bastille_jail_tags}" | uniq > "${tmpfile}"
mv "${tmpfile}" "${bastille_jail_tags}"
done
;;
del*)
for _tag in $(echo ${TAGS} | tr , ' '); do
[ ! -f "${bastille_jail_tags}" ] && break # skip if no tags file
tmpfile="$(mktemp)"
grep -Ev "^${_tag}\$" "${bastille_jail_tags}" > "${tmpfile}"
mv "${tmpfile}" "${bastille_jail_tags}"
# delete tags file if empty
[ ! -s "${bastille_jail_tags}" ] && rm "${bastille_jail_tags}"
done
;;
list)
if [ -n "${TAGS}" ]; then
[ -n "$(echo ${TAGS} | grep ,)" ] && usage # Only one tag per query
[ ! -f "${bastille_jail_tags}" ] && continue # skip if there is no tags file
grep -qE "^${TAGS}\$" "${bastille_jail_tags}"
if [ $? -eq 0 ]; then
echo "${_jail}"
continue
fi
else
if [ -f "${bastille_jail_tags}" ]; then
echo -n "${_jail}: "
xargs < "${bastille_jail_tags}"
fi
fi
;;
*)
usage
;;
esac
done

4
usr/local/share/bastille/template.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -116,6 +116,8 @@ if [ $# -lt 1 ]; then
bastille_usage
fi
bastille_root_check
## global variables
TEMPLATE="${1}"
bastille_template=${bastille_templatesdir}/${TEMPLATE}

4
usr/local/share/bastille/top.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -ne 0 ]; then
usage
fi
bastille_root_check
for _jail in ${JAILS}; do
info "[${_jail}]:"
jexec -l "${_jail}" /usr/bin/top

4
usr/local/share/bastille/umount.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 1 ]; then
usage
fi
bastille_root_check
MOUNT_PATH=$1
for _jail in ${JAILS}; do

8
usr/local/share/bastille/update.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 2 ] || [ $# -lt 1 ]; then
usage
fi
bastille_root_check
TARGET="${1}"
OPTION="${2}"
@@ -116,7 +118,9 @@ release_update() {
fi
env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
fetch install --currently-running "${TARGET_TRIM}"
fetch --currently-running "${TARGET_TRIM}"
env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
install --currently-running "${TARGET_TRIM}"
else
error_exit "${TARGET} not found. See 'bastille bootstrap'."
fi

6
usr/local/share/bastille/upgrade.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 3 ] || [ $# -lt 2 ]; then
usage
fi
bastille_root_check
TARGET="$1"
NEWRELEASE="$2"
OPTION="$3"
@@ -87,7 +89,7 @@ jail_check() {
release_check() {
# Validate the release
if ! echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
if ! echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-[RELEASE,BETA,RC]"; then
error_exit "${NEWRELEASE} is not a valid release."
fi
}

4
usr/local/share/bastille/verify.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -154,6 +154,8 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then
bastille_usage
fi
bastille_root_check
case "$1" in
*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
RELEASE=$1

4
usr/local/share/bastille/zfs.sh
View File

@@ -1,6 +1,6 @@
#!/bin/sh
#
# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -82,6 +82,8 @@ help|-h|--help)
;;
esac
bastille_root_check
## check ZFS enabled
if [ ! "${bastille_zfs_enable}" = "YES" ]; then
error_exit "ZFS not enabled."