Merge pull request #47 from cedwards/master

Release cleanup

LICENSE

@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

README.md

@@ -1,36 +1,23 @@
 Bastille
 ========
-Bastille is a jail automation framework that allows you to quickly and
+Bastille is a jail automation framework that allows you to quickly create and
-easily create and manage FreeBSD jail.
+manage FreeBSD jails.
+
+Looking for [Bastille Templates](https://github.com/BastilleBSD-Templates)?
 
 
 Installation
-------------
+============
-Bastille is not (yet) in the official ports tree, but I have built and verified
+Bastille is available in the official ports tree.
-binary packages.
-
-To install using one of the BETA binary packages, copy the URL for the latest
-release here (TXZ file): https://github.com/bastillebsd/bastille/releases
-
-Then, install via `pkg`. 
-Example:
 
+**pkg**
 ```shell
-pkg add https://github.com/BastilleBSD/bastille/releases/download/0.3.20181130/bastille-0.3.20181130_2.txz
+pkg install bastille
 ```
 
-BETA binary packages are signed. These can be verified with this pubkey:
+**ports**
-
+```shell
-```
+make -C /usr/ports/sysutils/bastille install clean
------BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq28OLDhJ12JmsKKcJpnn
-pCW3fFYBNI1BtdvTvFx57ZXvQ2qecBvnR9+XWi83hKS9ALTKZI6CLC2uTv1fIsZl
-u6rDRRNZwZFfITACSfwI+7UObMXz3oBZjk94J3rIegk49EyjDswKdVWv5k1EiVXF
-SAwXSl2kA2hGfQJkj5NS4nrfoRBc0z6fm+BGdNuHKSTmeZh1dbLEHt9EArD20DJ7
-HIr8vUSPLwONeqJCBFA/MeDO+GpwtwA/ldc2ZZy1RCPctdC2NeiGW7oy1yVDu6wp
-mHCq8qDfmCx5Aex84rWUf9iH8TM92AWmegTaz2p+BgESctpjNRCUuSEwOCBIO6g5
-3wIDAQAB
------END PUBLIC KEY-----
 ```
 
 
@@ -53,6 +40,7 @@ Available Commands:
   list        List jails (running and stopped).
   pkg         Manipulate binary packages within targeted jail(s). See pkg(8).
   restart     Restart a running jail.
+  service     Manage services within targeted jail(s).
   start       Start a stopped jail.
   stop        Stop a running jail.
   sysrc       Safely edit rc files within targeted jail(s).
@@ -60,21 +48,21 @@ Available Commands:
   top         Display and update information about the top(1) cpu processes.
   update      Update jail base -pX release.
   upgrade     Upgrade jail release to X.Y-RELEASE.
+  verify      Compare release against a "known good" index.
+  zfs         Manage (get|set) zfs attributes on targeted jail(s).
 
 Use "bastille -v|--version" for version information.
 Use "bastille command -h|--help" for more information about a command.
 ```
 
 
-## 0.3-beta
+## 0.4-beta
 This document outlines the basic usage of the Bastille jail management
-framework. This release, obviously, is beta quality. I make no guarantees of
+framework. This release is still considered beta.
-quality, and if it screws up your system... Sorry, bro. 
-
-With all that said, here's how to use this tool in its current beta state...
 
 
-## Network Requirements
+Network Requirements
+====================
 In order to segregate jails from the network and from the world, Bastille
 attaches jails to a loopback interface only. The host system then acts as
 the firewall, permitting and denying traffic as needed.
@@ -86,14 +74,16 @@ ishmael ~ # sysrc cloned_interfaces+=lo1
 ishmael ~ # service netif cloneup
 ```
 
-Second, enable NAT through the firewall:
+Second, enable the firewall:
 
 ```shell
 ishmael ~ # sysrc pf_enable="YES"
 ```
 
 Create the firewall config, or merge as necessary.
-### /etc/pf.conf
+
+/etc/pf.conf
+------------
 ```
 ext_if="vtnet0"
 
@@ -101,10 +91,10 @@ set block-policy drop
 scrub in on $ext_if all fragment reassemble
 
 set skip on lo
-nat on $ext_if from !($ext_if) -> ($ext_if:0)
+nat on $ext_if from lo1:network to any -> ($ext_if)
 
 ## rdr example
-## rdr pass inet proto tcp from any to any port {80, 443} -> 10.88.9.45
+## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
 
 block in log all
 pass out quick modulate state
@@ -122,7 +112,7 @@ Note: if you have an existing firewall, the key lines for in/out traffic to jail
 nat on $ext_if from lo1:network to any -> ($ext_if)
 
 ## rdr example
-## rdr pass inet proto tcp from any to any port {80, 443} -> 10.88.9.45
+## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
 ```
 
 The `nat` routes traffic from the loopback interface to the external interface
@@ -130,7 +120,7 @@ for outbound access.
 
 The `rdr pass ...` will redirect traffic from the host firewall on port X to
 the ip of Jail Y. The example shown redirects web traffic (80 & 443) to the
-jails at `10.88.9.45`.
+jails at `10.17.89.45`.
 
 We'll get to that later, but when you're ready to allow traffic inbound to your
 jails, that's where you'd do it.
@@ -147,11 +137,46 @@ session and continue.
 This step only needs to be done once in order to prepare the host.
 
 
+ZFS support
+===========
+
+![BastilleBSD Twitter Poll](/docs/images/bastillebsd-twitter-poll.png)
+
+Bastille 0.4 added initial support for ZFS. `bastille bootstrap` and `bastille
+create` will generate ZFS volumes based on settings found in the
+`bastille.conf`. This section outlines how to enable and configure Bastille for
+ZFS.
+
+Two values are required for Bastille to use ZFS. The default values in the
+`bastille.conf` are empty. Populate these two to enable ZFS.
+
+```shell
+## ZFS options
+bastille_zfs_enable=""                                  ## default: ""
+bastille_zfs_zpool=""                                   ## default: ""
+bastille_zfs_prefix="bastille"                          ## default: "${bastille_zfs_zpool}/bastille"
+bastille_zfs_mountpoint=${bastille_prefix}              ## default: "${bastille_prefix}"
+bastille_zfs_options="-o compress=lz4 -o atime=off"     ## default: "-o compress=lz4 -o atime=off"
+```
+
+**Example**
+
+```shell
+ishmael ~ # sysrc -f /usr/local/etc/bastille/bastille.conf bastille_zfs_enable=YES
+ishmael ~ # sysrc -f /usr/local/etc/bastille/bastille.conf bastille_zfs_zpool=ZPOOL_NAME
+```
+
+Replace `ZPOOL_NAME` with the zpool you want Bastille to use. Tip: `zpool list`
+and `zpool status` will help.
+
+
 bastille bootstrap
 ------------------
-The first step is to "bootstrap" a release. Current supported release is
+Before you can begin creating jails, Bastille needs to "bootstrap" a release.
-11.2-RELEASE, but you can bootstrap anything in the ftp.FreeBSD.org RELEASES
+Current supported releases are 11.2-RELEASE and 12.0-RELEASE, but you can
-directory. 
+bootstrap anything in the ftp.FreeBSD.org RELEASES directory.
+
+**Important: If you need ZFS support see the above section BEFORE bootstrapping.**
 
 Note: your mileage may vary with unsupported releases and releases newer than
 the host system likely will NOT work at all.
@@ -159,48 +184,74 @@ the host system likely will NOT work at all.
 To `bootstrap` a release, run the bootstrap sub-command with the
 release version as the argument.
 
+
+** FreeBSD 12.0-RELEASE **
+```shell
+ishmael ~ # bastille bootstrap 12.0-RELEASE
+```
+
+** FreeBSD 11.2-RELEASE **
 ```shell
 ishmael ~ # bastille bootstrap 11.2-RELEASE
-ishmael ~ # bastille bootstrap 12.0-RELEASE
+```
+
+** HardenedBSD 12-STABLE-LAST **
+```shell
+ishmael ~ # bastille bootstrap 12-STABLE-LAST
+```
+
+** HardenedBSD 11-STABLE-LAST **
+```shell
+ishmael ~ # bastille bootstrap 11-STABLE-LAST
 ```
 
 This command will ensure the required directory structures are in place and
 download the requested release. For each requested release, `bootstrap` will
-download the base.txz and lib32.txz. These are both verified (sha256 via
+download the base.txz. If you need more than base (eg; ports, lib32, src) you
-MANIFEST file) before they are extracted for use.
+can configure the `bastille_bootstrap_archives` in the configuration file. By
+default this value is set to "base". Additional components are added, space
+separated, without extension.
 
-Downloaded artifacts are stored in the `cache` directory. "bootstrapped"
+Bastille will attempt to fetch the required archives if they are not found in
-releases are stored in `releases/version`.
+the `cache/$RELEASE` directory. 
+
+Downloaded artifacts are stored in the `cache/$RELEASE` directory. "bootstrapped"
+releases are stored in `releases/$RELEASE`.
+
+Advanced: If you want to create your own custom base.txz, or use an unsupported
+variant of FreeBSD, drop your own base.txz in `cache/$RELEASE/base.txz` and
+`bastille bootstrap` will attempt to extract and use it.
 
 The bootstrap subcommand is generally only used once to prepare the system. The
-only other use case for the bootstrap command is when a new FreeBSD version is
+other use cases for the bootstrap command are when a new FreeBSD version is
-released and you want to start building jails on that version.
+released and you want to start building jails on that version, or bootstrapping
+templates from GitHub or GitLab.
 
-To update a release as patches are made available, see the `bastille update`
+See `bastille update` to ensure your bootstrapped releases include the latest
-command.
+patches.
 
 
 bastille create
 ---------------
-Bastille create uses any available bootstrapped release to create a lightweight
+`bastille create` uses a bootstrapped release to create a lightweight
-jailized system. To create a jail simply provide a name, release and
+jailed system. To create a jail simply provide a name, release and
 a private (rfc1918) IP address.
 
 - name
 - release (bootstrapped)
 - ip
 
+
 ```shell
-ishmael ~ # bastille create folsom 11.2-RELEASE 10.8.62.1
+ishmael ~ # bastille create folsom 12.0-RELEASE 10.17.89.10
 
-RELEASE: 11.2-RELEASE.
+RELEASE: 12.0-RELEASE.
 NAME: folsom.
-IP: 10.8.62.1.
+IP: 10.17.89.10.
-
 ```
 
-This command will create a 11.2-RELEASE jail assigning the 10.8.62.1 ip address
+This command will create a 12.0-RELEASE jail assigning the 10.17.89.10 ip
-to the new system.
+address to the new system.
 
 I recommend using private (rfc1918) ip address ranges for your jails.
 These ranges include:
@@ -209,8 +260,11 @@ These ranges include:
 - 172.16.0.0/12
 - 192.168.0.0/16
 
+If your Bastille host also uses private (rfc1918) addresses, use a different
+range for your jails. ie; Host uses 192.168.0.0/16, jails use 10.0.0.0/8.
+
 Bastille does its best to validate the submitted ip is valid. This has not been
-thouroughly tested--I generally use the 10/8 range.
+thouroughly tested. I generally use the 10.0.0.0/8 range for jails.
 
 
 bastille start
@@ -219,9 +273,6 @@ To start a jail you can use the `bastille start` command.
 
 ```shell
 ishmael ~ # bastille start folsom
-Targeting specified jails.
-folsom
-
 [folsom]:
 folsom: created
 
@@ -234,9 +285,6 @@ To stop a jail you can use the `bastille stop` command.
 
 ```shell
 ishmael ~ # bastille stop folsom
-Targeting specified jails.
-folsom
-
 [folsom]:
 folsom: removed
 
@@ -249,30 +297,34 @@ To restart a jail you can use the `bastille restart` command.
 
 ```shell
 ishmael ~ # bastille restart folsom
-Targeting specified jails.
-folsom
-
 [folsom]:
 folsom: removed
 
-Targeting specified jails.
-folsom
-
 [folsom]:
 folsom: created
 
 ```
 
 
+bastille service
+----------------
+To restart services inside a jail you can use the `bastille service` command.
+
+```shell
+ishmael ~ # bastille service folsom 'postfix restart'
+[folsom]
+postfix/postfix-script: stopping the Postfix mail system
+postfix/postfix-script: starting the Postfix mail system
+
+```
+
+
 bastille cmd
 ------------
 To execute commands within the jail you can use `bastille cmd`.
 
 ```shell
 ishmael ~ # bastille cmd folsom 'ps -auxw'
-Targeting specified jails.
-folsom
-
 [folsom]:
 USER   PID %CPU %MEM   VSZ  RSS TT  STAT STARTED    TIME COMMAND
 root 71464  0.0  0.0 14536 2000  -  IsJ   4:52PM 0:00.00 /usr/sbin/syslogd -ss
@@ -288,9 +340,6 @@ To manage binary packages within the jail use `bastille pkg`.
 
 ```shell
 ishmael ~ # bastille pkg folsom 'install vim-console git-lite zsh'
-Targeting specified jails.
-folsom
-
 [folsom]:
 The package management tool is not yet installed on your system.
 Do you want to fetch and install it now? [y/N]: y
@@ -361,23 +410,20 @@ Creating user 'git_daemon' with uid '964'.
 [folsom] [9/10] Extracting git-lite-2.19.1: 100%
 [folsom] [10/10] Installing zsh-5.6.2...
 [folsom] [10/10] Extracting zsh-5.6.2: 100%
-
 ```
 
 The PKG sub-command can, of course, do more than just `install`. The
 expectation is that you can fully leverage the pkg manager. This means,
-`install`, `update`, `upgrade`, `audit`, `clean`, `autoremove`, etc., etc.
+`install`, `update`, `upgrade`, `audit`, `clean`, `autoremove`, etc.
 
 ```shell
 ishmael ~ # bastille pkg ALL upgrade
-Targeting all jails.
-
 [bastion]:
-Updating iniquity.io repository catalogue...
+Updating pkg.bastillebsd.org repository catalogue...
 [bastion] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
 [bastion] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
 Processing entries: 100%
-iniquity.io repository update completed. 493 packages processed.
+pkg.bastillebsd.org repository update completed. 493 packages processed.
 All repositories are up to date.
 Checking for upgrades (1 candidates): 100%
 Processing candidates (1 candidates): 100%
@@ -385,11 +431,11 @@ Checking integrity... done (0 conflicting)
 Your packages are up to date.
 
 [unbound0]:
-Updating iniquity.io repository catalogue...
+Updating pkg.bastillebsd.org repository catalogue...
 [unbound0] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
 [unbound0] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
 Processing entries: 100%
-iniquity.io repository update completed. 493 packages processed.
+pkg.bastillebsd.org repository update completed. 493 packages processed.
 All repositories are up to date.
 Checking for upgrades (0 candidates): 100%
 Processing candidates (0 candidates): 100%
@@ -397,11 +443,11 @@ Checking integrity... done (0 conflicting)
 Your packages are up to date.
 
 [unbound1]:
-Updating iniquity.io repository catalogue...
+Updating pkg.bastillebsd.org repository catalogue...
 [unbound1] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
 [unbound1] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
 Processing entries: 100%
-iniquity.io repository update completed. 493 packages processed.
+pkg.bastillebsd.org repository update completed. 493 packages processed.
 All repositories are up to date.
 Checking for upgrades (0 candidates): 100%
 Processing candidates (0 candidates): 100%
@@ -409,11 +455,11 @@ Checking integrity... done (0 conflicting)
 Your packages are up to date.
 
 [squid]:
-Updating iniquity.io repository catalogue...
+Updating pkg.bastillebsd.org repository catalogue...
 [squid] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
 [squid] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
 Processing entries: 100%
-iniquity.io repository update completed. 493 packages processed.
+pkg.bastillebsd.org repository update completed. 493 packages processed.
 All repositories are up to date.
 Checking for upgrades (0 candidates): 100%
 Processing candidates (0 candidates): 100%
@@ -421,11 +467,11 @@ Checking integrity... done (0 conflicting)
 Your packages are up to date.
 
 [nginx]:
-Updating iniquity.io repository catalogue...
+Updating pkg.bastillebsd.org repository catalogue...
 [nginx] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
 [nginx] Fetching packagesite.txz: 100%  118 KiB 121.3kB/s    00:01
 Processing entries: 100%
-iniquity.io repository update completed. 493 packages processed.
+pkg.bastillebsd.org repository update completed. 493 packages processed.
 All repositories are up to date.
 Checking for upgrades (1 candidates): 100%
 Processing candidates (1 candidates): 100%
@@ -458,9 +504,6 @@ Note: jails must be stopped before destroyed.
 
 ```shell
 ishmael ~ # bastille stop folsom
-Targeting specified jails.
-folsom
-
 [folsom]:
 folsom: removed
 
@@ -477,7 +520,7 @@ Bastille supports a templating system allowing you to apply files, pkgs and
 execute commands inside the jail automatically.
 
 Currently supported template hooks are: `PRE`, `CONFIG`, `PKG`, `SYSRC`, `CMD`.
-Planned template hooks include: `FSTAB`, `PF`
+Planned template hooks include: `FSTAB`, `PF`, `LOG`
 
 Templates are created in `${bastille_prefix}/templates` and can leverage any of
 the template hooks. Simply create a new directory named after the template. eg;
@@ -498,12 +541,18 @@ echo "etc root usr" > /usr/local/bastille/templates/base/CONFIG
 Template hooks are executed in specific order and require specific syntax to
 work as expected. This table outlines those requirements:
 
-| HOOK    | format           | example                              |
+| SUPPORTED | format           | example                                                        |
-|---------|------------------|--------------------------------------|
+|-----------|------------------|----------------------------------------------------------------|
-| PRE/CMD | /bin/sh command  | /usr/bin/chsh -s /usr/local/bin/zsh  |
+| PRE/CMD   | /bin/sh command  | /usr/bin/chsh -s /usr/local/bin/zsh                            |
-| CONFIG  | path             | etc root usr                         |
+| CONFIG    | path             | etc root usr                                                   |
-| PKG     | port/pkg name(s) | vim-console zsh git-lite tree htop   |
+| PKG       | port/pkg name(s) | vim-console zsh git-lite tree htop                             |
-| SYSRC   | sysrc command(s) | nginx_enable=YES                     |
+| SYSRC     | sysrc command(s) | nginx_enable=YES                                               |
+
+| PLANNED | format           | example                                                        |
+|---------|------------------|----------------------------------------------------------------|
+| PF      | pf rdr entry     | rdr pass inet proto tcp from any to any port 80 -> 10.17.89.80 |
+| LOG     | path             | /var/log/nginx/access.log                                      |
+| FSTAB   | fstab syntax     | /path/on/host /path/in/jail nullfs ro 0 0                      |
 
 Note: SYSRC requires NO quotes or that quotes (`"`) be escaped. ie; `\"`)
 
@@ -531,6 +580,7 @@ The above example "etc usr" will include anything under "etc" and "usr" inside
 the template. You do not need to list individual files. Just include the
 top-level directory name.
 
+
 Applying Templates
 ------------------
 
@@ -573,10 +623,7 @@ In jail terms, this allows us to toggle on/off services and options at
 startup.
 
 ```shell
-ishmael ~ # bastille sysrc nginx nginx_enable="YES"
+ishmael ~ # bastille sysrc nginx nginx_enable=YES
-Targeting specified jails.
-nginx
-
 [nginx]:
 nginx_enable: NO -> YES
 ```
@@ -591,9 +638,6 @@ password-less root login.
 
 ```shell
 ishmael ~ # bastille console folsom
-Targeting specified jails.
-folsom
-
 [folsom]:
 FreeBSD 11.2-RELEASE-p4 (GENERIC) #0: Thu Sep 27 08:16:24 UTC 2018
 
@@ -623,6 +667,7 @@ At this point you are logged in to the jail and have full shell access.
 The system is yours to use and/or abuse as you like. Any changes made inside
 the jail are limited to the jail. 
 
+
 bastille cp
 -----------
 Note: this sub-command may need a little work. 
@@ -631,8 +676,6 @@ This sub-command allows efficiently copying files from host to jail(s).
 
 ```shell
 ishmael ~ # bastille cp ALL /tmp/resolv.conf-cf etc/resolv.conf
-Targeting all jails.
-
 [bastion]:
 
 [unbound0]:
@@ -657,12 +700,12 @@ This sub-command will show you the running jails on your system.
 ```shell
 ishmael ~ # bastille list
  JID             IP Address      Hostname                      Path
- bastion         10.88.9.65      bastion                       /usr/local/bastille/jails/bastion/root
+ bastion         10.17.89.65      bastion                       /usr/local/bastille/jails/bastion/root
- unbound0        10.88.9.60      unbound0                      /usr/local/bastille/jails/unbound0/root
+ unbound0        10.17.89.60      unbound0                      /usr/local/bastille/jails/unbound0/root
- unbound1        10.88.9.61      unbound1                      /usr/local/bastille/jails/unbound1/root
+ unbound1        10.17.89.61      unbound1                      /usr/local/bastille/jails/unbound1/root
- squid           10.88.9.30      squid                         /usr/local/bastille/jails/squid/root
+ squid           10.17.89.30      squid                         /usr/local/bastille/jails/squid/root
- nginx           10.88.9.45      nginx                         /usr/local/bastille/jails/nginx/root
+ nginx           10.17.89.45      nginx                         /usr/local/bastille/jails/nginx/root
- folsom          10.8.62.1       folsom                        /usr/local/bastille/jails/folsom/root
+ folsom          10.17.89.10      folsom                        /usr/local/bastille/jails/folsom/root
 ```
 
 
@@ -734,32 +777,47 @@ If you see errors or issues here, consider deleting and re-bootstrapping the
 release.
 
 
+bastille zfs
+------------
+This sub-command allows managing zfs attributes for the targeted jail(s).
+Common usage includes setting jail quotas.
+
+** set quota **
+```shell
+ishmael ~ # bastille zfs folsom 'set quota=1G'
+```
+
+** built-in: df **
+```shell
+ishmael ~ # bastille zfs ALL df
+```
+
+** built-in: df **
+```shell
+ishmael ~ # bastille zfs folsom df
+```
+
+
 Example (create, start, console)
 ================================
 This example creates, starts and consoles into the jail.
 
 ```shell
-ishmael ~ # bastille create alcatraz 11.2-RELEASE 10.9.8.7
+ishmael ~ # bastille create alcatraz 11.2-RELEASE 10.17.89.7
 
 RELEASE: 11.2-RELEASE.
 NAME: alcatraz.
-IP: 10.9.8.7.
+IP: 10.17.89.7.
 ```
 
 ```shell
 ishmael ~ # bastille start alcatraz
-Targeting specified jails.
-alcatraz
-
 [alcatraz]:
 alcatraz: created
 ```
 
 ```shell
 ishmael ~ # bastille console alcatraz
-Targeting specified jails.
-alcatraz
-
 [alcatraz]:
 FreeBSD 11.2-RELEASE-p4 (GENERIC) #0: Thu Sep 27 08:16:24 UTC 2018
 
@@ -822,29 +880,28 @@ Possible Jail names
 -------------------
 
 prisons:
+- alcatraz
 - arkham
 - ashecliffe
+- astralqueen
+- attica
 - azkaban
 - coldmountain
+- corcoran
 - dolguldur
+- folsom
 - foxriver
+- leavenworth
 - litchfield
 - oswald
+- pelicanbay
+- rikers
+- sanquentin
 - shawshank
+- singsing
 - stockton
 - stormcage
 - ziggurat
-- astralqueen
-
-- alcatraz
-- rikers
-- leavenworth
-- folsom
-- attica
-- singsing
-- sanquentin
-- corcoran
-- pelicanbay
 
 
 Networking Tips
@@ -854,7 +911,7 @@ Tip #1:
 -------
 Ports and destinations can be defined as lists. eg;
 ```
-rdr pass inet proto tcp from any to any port {80, 443} -> {10.88.9.45, 10.88.9.46, 10.88.9.47, 10.88.9.48}
+rdr pass inet proto tcp from any to any port {80, 443} -> {10.17.89.45, 10.17.89.46, 10.17.89.47, 10.17.89.48}
 ```
 
 This rule would redirect any traffic to the host on ports 80 or 443 and
@@ -865,9 +922,9 @@ Tip #2:
 -------
 Ports can redirect to other ports. eg;
 ```
-rdr pass inet proto tcp from any to any port 8080 -> 10.7.6.5 port 80
+rdr pass inet proto tcp from any to any port 8080 -> 10.17.89.5 port 80
-rdr pass inet proto tcp from any to any port 8081 -> 10.7.6.5 port 8080
+rdr pass inet proto tcp from any to any port 8081 -> 10.17.89.5 port 8080
-rdr pass inet proto tcp from any to any port 8181 -> 10.7.6.5 port 443
+rdr pass inet proto tcp from any to any port 8181 -> 10.17.89.5 port 443
 ```
 
 Tip #3:
@@ -882,9 +939,9 @@ can.
 
 Community Support
 =================
-We would love to hear your feedback on Bastille! Please join us on the
+We would love to hear your feedback on Bastille! Please join us in the
-[BastilleBSD Chat Server](https://chat.bastillebsd.org) and let us know what
+[#bastillebsd](ircs://chat.freenode.net:6697/bastillebsd) and let us know what
-you think. Registration is currently open pending email verification. 
+you think.
 
 Be mindful of the [Bastille Code of
 Conduct](https://github.com/BastilleBSD/bastille/blob/master/CODE-OF-CONDUCT.md)

docs/conf.py

@@ -8,7 +8,7 @@ else:
 # -- Project information -----------------------------------------------------
 
 project = 'Bastille'
-copyright = '2018, Christer Edwards'
+copyright = '2018-2019, Christer Edwards'
 author = 'Christer Edwards'
 
 # The short X.Y version

usr/local/bin/bastille

@@ -1,6 +1,6 @@
 #!/bin/sh
-# 
+#
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -28,16 +28,53 @@
 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+## root check first.
+bastille_root_check() {
+    if [ $(id -u) -ne 0 ]; then
+        ## so we can make it colorful
+        . /usr/local/share/bastille/colors.pre.sh
+
+        ## permission denied
+        echo -e "${COLOR_RED}Bastille: Permission Denied${COLOR_RESET}" 1>&2
+        echo -e "${COLOR_RED}root / sudo / doas required${COLOR_RESET}" 1>&2
+        exit 1
+    fi
+}
+
+bastille_root_check
+
+## we only load the config if root_check passes
+. /usr/local/etc/bastille/bastille.conf
 . /usr/local/share/bastille/colors.pre.sh
+
+
+## bastille_prefix should be 0750
+## this restricts file system access to privileged users
+bastille_perms_check() {
+    if [ -d "${bastille_prefix}" ]; then
+        BASTILLE_PREFIX_PERMS=$(stat -f "%Op" "${bastille_prefix}")
+        if [ "${BASTILLE_PREFIX_PERMS}" != 40750 ]; then
+            echo -e "${COLOR_RED}Insecure permissions on ${bastille_prefix}${COLOR_RESET}" 1>&2
+            echo -e "${COLOR_RED}Try: chmod 0750 ${bastille_prefix}${COLOR_RESET}" 1>&2
+            echo
+            exit 1
+        fi
+    fi
+}
+
+bastille_perms_check
+
+
+## we only load the config if root_check passes
 . /usr/local/etc/bastille/bastille.conf
 
 ## version
-BASTILLE_VERSION="0.3.20190102"
+BASTILLE_VERSION="0.4.20191025"
 
 usage() {
     cat << EOF
-Bastille is a jail automation framework that allows you to quickly and easily
+Bastille is a jail automation framework that allows you to quickly create and
-create and manage FreeBSD jails.
+manage FreeBSD jails.
 
 Usage:
   bastille command [ALL|glob] [args]
@@ -48,12 +85,13 @@ Available Commands:
   console     Console into a running container.
   cp          cp(1) files from host to targeted container(s).
   create      Create a new container.
-  destroy     Destroy a stopped container.
+  destroy     Destroy a stopped container or a FreeBSD release.
   help        Help about any command
   htop        Interactive process viewer (requires htop).
   list        List containers (running and stopped).
   pkg         Manipulate binary packages within targeted container(s). See pkg(8).
   restart     Restart a running container.
+  service     Manage services within targeted jail(s).
   start       Start a stopped container.
   stop        Stop a running container.
   sysrc       Safely edit rc files within targeted container(s).
@@ -61,6 +99,8 @@ Available Commands:
   top         Display and update information about the top(1) cpu processes.
   update      Update container base -pX release.
   upgrade     Upgrade container release to X.Y-RELEASE.
+  verify      Compare release against a "known good" index.
+  zfs         Manage (get|set) zfs attributes on targeted jail(s).
 
 Use "bastille -v|--version" for version information.
 Use "bastille command -h|--help" for more information about a command.
@@ -77,34 +117,37 @@ shift
 # Handle special-case commands first.
 case "${CMD}" in
 version|-v|--version)
-	echo -e "${COLOR_GREEN}${BASTILLE_VERSION}${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}${BASTILLE_VERSION}${COLOR_RESET}"
-	exit 0
+    exit 0
-	;;
+    ;;
 help|-h|--help)
-	usage
+    usage
-	;;
+    ;;
 esac
 
 # Filter out all non-commands
 case "${CMD}" in
 cmd|cp|create|destroy|list|pkg|restart|start|stop|sysrc|template|verify)
-	;;
-update|upgrade)
-	;;
-console|bootstrap|htop|top)
     ;;
-bootstrap|update|upgrade)
+update|upgrade)
-	;;
+    ;;
+service|console|bootstrap|htop|top)
+    ;;
+bootstrap|update|upgrade|zfs)
+    ;;
 *)
-	usage
+usage
-	;;
+    ;;
 esac
 
 SCRIPTPATH="${bastille_sharedir}/${CMD}.sh"
+if [ -f "${SCRIPTPATH}" ]; then
+    : ${UMASK:=022}
+    umask ${UMASK}
 
-: ${UMASK:=022}
+    : ${SH:=sh}
-umask ${UMASK}
 
-: ${SH:=sh}
+    exec ${SH} "${SCRIPTPATH}" "$@"
-
+else
-exec ${SH} "${SCRIPTPATH}" "$@"
+    echo -e "${COLOR_RED}${SCRIPTPATH} not found.${COLOR_RESET}" 1>&2
+fi

usr/local/etc/bastille/bastille.conf

@@ -1,11 +1,37 @@
+#####################
 ## [ BastilleBSD ] ##
 #####################
 
 ## default paths
-bastille_prefix=/usr/local/bastille
+bastille_prefix=/usr/local/bastille                     ## default: "/usr/local/bastille"
-bastille_cachedir=${bastille_prefix}/cache
+bastille_cachedir=${bastille_prefix}/cache              ## default: ${bastille_prefix}/cache
-bastille_jailsdir=${bastille_prefix}/jails
+bastille_jailsdir=${bastille_prefix}/jails              ## default: ${bastille_prefix}/jails
-bastille_logsdir=${bastille_prefix}/logs
+bastille_logsdir=${bastille_prefix}/logs                ## default: ${bastille_prefix}/logs
-bastille_releasesdir=${bastille_prefix}/releases
+bastille_releasesdir=${bastille_prefix}/releases        ## default: ${bastille_prefix}/releases
-bastille_templatesdir=${bastille_prefix}/templates
+bastille_templatesdir=${bastille_prefix}/templates      ## default: ${bastille_prefix}/templates
-bastille_sharedir=/usr/local/share/bastille
+
+## bastille scripts directory (assumed by bastille pkg)
+bastille_sharedir=/usr/local/share/bastille             ## default: "/usr/local/share/bastille"
+
+## bootstrap archives (base, lib32, ports, src, test)
+bastille_bootstrap_archives="base"                      ## default: "base"
+
+## default timezone
+bastille_tzdata="etc/UTC"                               ## default: "etc/UTC"
+
+## default jail resolv.conf
+bastille_resolv_conf="/etc/resolv.conf"                 ## default: "/etc/resolv.conf"
+
+## ZFS options
+bastille_zfs_enable=""                                  ## default: ""
+bastille_zfs_zpool=""                                   ## default: ""
+bastille_zfs_prefix="bastille"                          ## default: "${bastille_zfs_zpool}/bastille"
+bastille_zfs_mountpoint=${bastille_prefix}              ## default: "${bastille_prefix}"
+bastille_zfs_options="-o compress=lz4 -o atime=off"     ## default: "-o compress=lz4 -o atime=off"
+
+## Networking
+bastille_jail_loopback="lo1"                            ## default: "lo1"
+bastille_jail_interface="bastille0"                     ## default: "bastille0"
+bastille_jail_external=""                               ## default: ""
+bastille_jail_addr="10.17.89.10"                        ## default: "10.17.89.10"
+bastille_jail_gateway=""                                ## default: ""

usr/local/share/bastille/bootstrap.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -43,44 +43,244 @@ help|-h|--help)
     ;;
 esac
 
-bootstrap_release() {
+# Validate ZFS parameters first.
+if [ "${bastille_zfs_enable}" = "YES" ]; then
+    ## check for the ZFS pool and bastille prefix
+    if [ -z "${bastille_zfs_zpool}" ]; then
+        echo -e "${COLOR_RED}ERROR: Missing ZFS parameters, see bastille_zfs_zpool.${COLOR_RESET}"
+        exit 1
+	elif [ -z "${bastille_zfs_prefix}" ]; then
+        echo -e "${COLOR_RED}ERROR: Missing ZFS parameters, see bastille_zfs_prefix.${COLOR_RESET}"
+        exit 1
+    elif ! zfs list "${bastille_zfs_zpool}" > /dev/null 2>&1; then
+        echo -e "${COLOR_RED}ERROR: ${bastille_zfs_zpool} is not a ZFS pool.${COLOR_RESET}"
+        exit 1
+    fi
+
+    ## check for the ZFS dataset prefix if already exist
+	if [ -d "/${bastille_zfs_zpool}/${bastille_zfs_prefix}" ]; then
+        if ! zfs list "${bastille_zfs_zpool}/${bastille_zfs_prefix}" > /dev/null 2>&1; then
+            echo -e "${COLOR_RED}ERROR: ${bastille_zfs_zpool}/${bastille_zfs_prefix} is not a ZFS dataset.${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+fi
+
+bootstrap_network_interfaces() {
+
+    ## test for both options empty
+    if [ -z ${bastille_jail_loopback} ] && [ -z ${bastille_jail_external} ]; then
+        echo -e "${COLOR_RED}Please set preferred loopback or external interface.${COLOR_RESET}"
+        echo -e "${COLOR_RED}See bastille.conf.${COLOR_RESET}"
+        exit 1
+    fi
+
+    ## test for required variables -- external
+    if [ -z ${bastille_jail_loopback} ] && [ ! -z ${bastille_jail_external} ]; then
+
+       ## test for existing interface
+       ifconfig ${bastille_jail_external} 2>&1 >/dev/null
+           if [ $? = 0 ]; then
+
+               ## create ifconfig alias
+               ifconfig ${bastille_jail_external} inet ${bastille_jail_addr} alias && \
+                   echo -e "${COLOR_GREEN}IP alias added to ${bastille_jail_external} successfully.${COLOR_RESET}"
+                   echo
+
+               ## attempt to ping gateway
+               echo -e "${COLOR_YELLOW}Attempting to ping default gateway...${COLOR_RESET}"
+               ping -c3 -t3 -S ${bastille_jail_addr} ${bastille_jail_gateway}
+               if [ $? = 0 ]; then
+                   echo
+                   echo -e "${COLOR_GREEN}External networking appears functional.${COLOR_RESET}"
+                   echo
+               else
+                   echo -e "${COLOR_RED}Unable to ping default gateway.${COLOR_RESET}"
+               fi
+           fi
+    fi
+
+    ## test for required variables -- loopback
+    if [ -z ${bastille_jail_external} ] && [ ! -z ${bastille_jail_loopback} ] && \
+       [ ! -z ${bastille_jail_addr} ]; then
+
+       echo -e "${COLOR_GREEN}Detecting...${COLOR_RESET}"
+       ## test for existing interface
+       ifconfig ${bastille_jail_interface} >&2 >/dev/null
+
+       ## if above return code is 1; create interface
+       if [ $? = 1 ]; then
+           sysrc ifconfig_${bastille_jail_loopback}_name | grep ${bastille_jail_interface} >&2 >/dev/null
+           if [ $? = 1 ]; then
+               echo
+               echo -e "${COLOR_GREEN}Defining secure loopback interface.${COLOR_RESET}"
+               sysrc cloned_interfaces+="${bastille_jail_loopback}" &&
+               sysrc ifconfig_${bastille_jail_loopback}_name="${bastille_jail_interface}"
+               sysrc ifconfig_${bastille_jail_interface}_aliases+="inet ${bastille_jail_addr}/32"
+
+               ## create and name interface; assign address
+               echo
+               echo -e "${COLOR_GREEN}Creating secure loopback interface.${COLOR_RESET}"
+               ifconfig ${bastille_jail_loopback} create name ${bastille_jail_interface}
+               ifconfig ${bastille_jail_interface} up
+               ifconfig ${bastille_jail_interface} inet ${bastille_jail_addr}/32
+
+               ## reload firewall
+               pfctl -f /etc/pf.conf
+
+               ## look for nat rule for bastille_jail_addr
+               echo -e "${COLOR_GREEN}Detecting NAT from bastille0 interface...${COLOR_RESET}"
+               pfctl -s nat | grep nat | grep ${bastille_jail_addr}
+               if [ $? = 0 ]; then
+                   ## test connectivity; ping from bastille_jail_addr
+                   echo
+                   echo -e "${COLOR_YELLOW}Attempting to ping default gateway...${COLOR_RESET}"
+                   ping -c3 -t3 -S ${bastille_jail_addr} ${bastille_jail_gateway}
+                   if [ $? = 0 ]; then
+                       echo
+                       echo -e "${COLOR_GREEN}Private networking appears functional.${COLOR_RESET}"
+                       echo
+                   else
+                       echo -e "${COLOR_RED}Unable to ping default gateway.${COLOR_RESET}"
+                       echo -e "${COLOR_YELLOW}See https://github.com/BastilleBSD/bastille/blob/master/README.md#etcpfconf.${COLOR_RESET}"
+                       echo -e
+                   fi
+               else
+                   echo -e "${COLOR_RED}Unable to detect firewall 'nat' rule.${COLOR_RESET}"
+                   echo -e "${COLOR_YELLOW}See https://github.com/BastilleBSD/bastille/blob/master/README.md#etcpfconf.${COLOR_RESET}"
+               fi
+           else
+               echo -e "${COLOR_RED}Interface ${bastille_jail_loopback} already configured; bailing out.${COLOR_RESET}"
+           fi
+       else
+           echo -e "${COLOR_RED}Interface ${bastille_jail_interface} already active; bailing out.${COLOR_RESET}"
+       fi
+    fi
+}
+
+bootstrap_directories() {
     ## ensure required directories are in place
-    if [ ! -d ${bastille_jailsdir} ]; then
+
-        mkdir -p ${bastille_jailsdir}
+    ## ${bastille_prefix}
-    fi
+    if [ ! -d "${bastille_prefix}" ]; then
-    if [ ! -d ${bastille_logsdir} ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ];then
-        mkdir -p ${bastille_logsdir}
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
-    fi
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_prefix} ${bastille_zfs_zpool}/${bastille_zfs_prefix}
-    if [ ! -d ${bastille_templatesdir} ]; then
+            fi
-        mkdir -p ${bastille_templatesdir}
+        else
-    fi
+            mkdir -p "${bastille_prefix}"
-    if [ ! -d "${bastille_cachedir}/${RELEASE}" ]; then
+            chmod 0750 "${bastille_prefix}"
-        mkdir -p "${bastille_cachedir}/${RELEASE}"
+        fi
     fi
 
-    ### create $bastille_base/release/$release directory
+    ## ${bastille_cachedir}
-    ### fetch $release/base.txz -o $bastille_base/cache/$release/base.txz
+    if [ ! -d "${bastille_cachedir}" ]; then
-    ### fetch $release/lib32.txz -o $bastille_base/cache/$release/lib32.txz
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
-    ### extract $release/base.txz to $bastille_base/release/$release
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
-    ### extract $release/lib32.txz to $bastille_base/release/$release
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_cachedir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache
-    if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_cachedir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}
-        mkdir -p "${bastille_releasesdir}/${RELEASE}"
+            fi
-        sh ${bastille_sharedir}/freebsd_dist_fetch.sh -r ${RELEASE} base lib32
+        else
+            mkdir -p "${bastille_cachedir}/${RELEASE}"
+        fi
+    ## create subsequent cache/XX.X-RELEASE datasets
+    elif [ ! -d "${bastille_cachedir}/${RELEASE}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_cachedir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}
+            fi
+        else
+            mkdir -p "${bastille_cachedir}/${RELEASE}"
+        fi
+    fi
 
-        echo
+    ## ${bastille_jailsdir}
-        echo -e "${COLOR_GREEN}Extracting FreeBSD ${RELEASE} base.txz.${COLOR_RESET}"
+    if [ ! -d "${bastille_jailsdir}" ]; then
-        /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/base.txz"
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_jailsdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails
+            fi
+        else
+            mkdir -p "${bastille_jailsdir}"
+        fi
+    fi
 
-        echo -e "${COLOR_GREEN}Extracting FreeBSD ${RELEASE} lib32.txz.${COLOR_RESET}"
+    ## ${bastille_logsdir}
-        /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/lib32.txz"
+    if [ ! -d "${bastille_logsdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_logsdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/logs
+            fi
+        else
+            mkdir -p "${bastille_logsdir}"
+        fi
+    fi
 
-        echo -e "${COLOR_GREEN}Bootstrap successful.${COLOR_RESET}"
+    ## ${bastille_templatesdir}
-        echo -e "${COLOR_GREEN}See 'bastille --help' for available commands.${COLOR_RESET}"
+    if [ ! -d "${bastille_templatesdir}" ]; then
-        echo
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
-    else
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_templatesdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates
+            fi
+        else
+            mkdir -p "${bastille_templatesdir}"
+        fi
+    fi
+
+    ## ${bastille_releasesdir}
+    if [ ! -d "${bastille_releasesdir}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_releasesdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_releasesdir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}
+            fi
+        else
+            mkdir -p "${bastille_releasesdir}/${RELEASE}"
+        fi
+    ## create subsequent releases/XX.X-RELEASE datasets
+    elif [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_releasesdir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}
+            fi
+       else
+           mkdir -p "${bastille_releasesdir}/${RELEASE}"
+       fi
+    fi
+}
+
+bootstrap_release() {
+    ## if release exists, quit
+    if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
         echo -e "${COLOR_RED}Bootstrap appears complete.${COLOR_RESET}"
         exit 1
     fi
+
+    for _archive in ${bastille_bootstrap_archives}; do
+        ## check if the dist files already exists then extract
+        if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+            echo -e "${COLOR_GREEN}Extracting FreeBSD ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
+            /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
+        else
+           for _archive in ${bastille_bootstrap_archives}; do
+                ## fetch for missing dist files
+                if [ ! -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+                    fetch ${UPSTREAM_URL}/${_archive}.txz -o ${bastille_cachedir}/${RELEASE}/${_archive}.txz
+                fi
+
+                ## extract the fetched dist files
+                if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
+                    echo -e "${COLOR_GREEN}Extracting FreeBSD ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
+                    /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
+                fi
+            done
+        fi
+    done
+    echo
+
+    echo -e "${COLOR_GREEN}Bootstrap successful.${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}See 'bastille --help' for available commands.${COLOR_RESET}"
+    echo
 }
 
 bootstrap_template() {
@@ -90,24 +290,11 @@ bootstrap_template() {
     _repo=${BASTILLE_TEMPLATE_REPO}
     _template=${bastille_templatesdir}/${_user}/${_repo}
 
-    ## verify essential directories are in place
-    if [ ! -d ${bastille_jailsdir} ]; then
-        mkdir -p ${bastille_jailsdir}
-    fi
-    if [ ! -d ${bastille_logsdir} ]; then
-        mkdir -p ${bastille_logsdir}
-    fi
-    if [ ! -d ${bastille_templatesdir} ]; then
-        mkdir -p ${bastille_templatesdir}
-    fi
-    if [ ! -d ${_template} ]; then
-        mkdir -p ${_template}
-    fi
-
     ## support for non-git
     if [ ! -x /usr/local/bin/git ]; then
-	echo -e "${COLOR_RED}We're gonna have to use fetch. Strap in.${COLOR_RESET}"
+        echo -e "${COLOR_RED}We're gonna have to use fetch. Strap in.${COLOR_RESET}"
-	echo -e "${COLOR_RED}Not yet implemented...${COLOR_RESET}"
+        echo -e "${COLOR_RED}Not yet implemented...${COLOR_RESET}"
+        exit 1
     fi
 
     ## support for git
@@ -135,14 +322,24 @@ bootstrap_template() {
             echo
         fi
     done
-    if [ -s ${_template}/CONFIG ]; then
+
+    # template overlay
+    if [ -s ${_template}/OVERLAY ]; then
         _hook_validate=$((_hook_validate+1))
+        echo -e "${COLOR_GREEN}Detected OVERLAY hook.${COLOR_RESET}"
+        while read _dir; do
+            echo -e "${COLOR_GREEN}[${_dir}]:${COLOR_RESET}"
+            tree -a ${_template}/${_dir}
+        done < ${_template}/OVERLAY
+        echo
+    fi
+    if [ -s ${_template}/CONFIG ]; then
         echo -e "${COLOR_GREEN}Detected CONFIG hook.${COLOR_RESET}"
+        echo -e "${COLOR_YELLOW}CONFIG deprecated; rename to OVERLAY.${COLOR_RESET}"
         while read _dir; do
             echo -e "${COLOR_GREEN}[${_dir}]:${COLOR_RESET}"
             tree -a ${_template}/${_dir}
         done < ${_template}/CONFIG
-        echo
     fi
 
     ## remove bad templates
@@ -150,7 +347,7 @@ bootstrap_template() {
         echo -e "${COLOR_GREEN}Template validation failed.${COLOR_RESET}"
         echo -e "${COLOR_GREEN}Deleting template.${COLOR_RESET}"
         rm -rf ${_template}
-	exit 1
+        exit 1
     fi
 
     ## if validated; ready to use 
@@ -160,36 +357,71 @@ bootstrap_template() {
     fi
 }
 
-#Usage: bastille bootstrap [release|template].${COLOR_RESET}"
+HW_MACHINE=$(sysctl hw.machine | awk '{ print $2 }')
+HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }')
 
 # Filter sane release names
 case "${1}" in
-10.1-RELEASE|10.2-RELEASE|10.3-RELEASE|10.4-RELEASE)
-    RELEASE="${1}"
-    bootstrap_release
-    echo -e "${COLOR_RED}WARNING: FreeBSD 10.1-RELEASE HAS PASSED ITS END-OF-LIFE DATE.${COLOR_RESET}"
-    ;;
-11.0-RELEASE|11.1-RELEASE)
-    RELEASE="${1}"
-    bootstrap_release
-    echo -e "${COLOR_RED}WARNING: FreeBSD 11.0-RELEASE HAS PASSED ITS END-OF-LIFE DATE.${COLOR_RESET}"
-    ;;
 11.2-RELEASE)
     RELEASE="${1}"
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/11.2-RELEASE"
+    bootstrap_directories
+    bootstrap_release
+    ;;
+11.3-RELEASE)
+    RELEASE="${1}"
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/11.3-RELEASE"
+    bootstrap_directories
     bootstrap_release
     ;;
 12.0-RELEASE)
     RELEASE="${1}"
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/12.0-RELEASE"
+    bootstrap_directories
     bootstrap_release
     ;;
-http?://github.com/*/*)
+12.1-RC1)
+    RELEASE="${1}"
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/12.1-RC1"
+    bootstrap_directories
+    bootstrap_release
+    ;;
+12.1-RC2)
+    RELEASE="${1}"
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/12.1-RC2"
+    bootstrap_directories
+    bootstrap_release
+    ;;
+12.1-RELEASE)
+    RELEASE="${1}"
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/12.1-RELEASE"
+    bootstrap_directories
+    bootstrap_release
+    ;;
+11-stable-LAST)
+    RELEASE="${1}"
+    UPSTREAM_URL="https://installer.hardenedbsd.org/pub/HardenedBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-11-stable-LAST"
+    bootstrap_directories
+    bootstrap_release
+    ;;
+12-stable-LAST)
+    RELEASE="${1}"
+    UPSTREAM_URL="https://installer.hardenedbsd.org/pub/HardenedBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-12-stable-LAST"
+    bootstrap_directories
+    bootstrap_release
+    ;;
+http?://github.com/*/*|http?://gitlab.com/*/*)
     BASTILLE_TEMPLATE_URL=${1}
     BASTILLE_TEMPLATE_USER=$(echo "${1}" | awk -F / '{ print $4 }')
     BASTILLE_TEMPLATE_REPO=$(echo "${1}" | awk -F / '{ print $5 }')
     echo -e "${COLOR_GREEN}Template: ${1}${COLOR_RESET}"
     echo
+    bootstrap_directories
     bootstrap_template
     ;;
+network)
+    bootstrap_network_interfaces
+    ;;
 *)
     usage
     ;;

usr/local/share/bastille/cmd.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/console.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/cp.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -57,6 +57,6 @@ fi
 for _jail in ${JAILS}; do
     bastille_jail_path="$(jls -j "${_jail}" path)"
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    cp -a "$2" "${bastille_jail_path}/$3"
+    cp -av "$2" "${bastille_jail_path}/$3"
     echo
 done

usr/local/share/bastille/create.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -32,7 +32,7 @@
 . /usr/local/etc/bastille/bastille.conf
 
 usage() {
-    echo -e "${COLOR_RED}Usage: bastille create name release ip.${COLOR_RESET}"
+    echo -e "${COLOR_RED}Usage: bastille create name release ip | interface.${COLOR_RESET}"
     exit 1
 }
 
@@ -41,8 +41,8 @@ running_jail() {
 }
 
 validate_ip() {
+    local IFS
     ip=${IP}
-    
     if expr "$ip" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; then
       IFS=.
       set $ip
@@ -54,10 +54,22 @@ validate_ip() {
       done
       echo -e "${COLOR_GREEN}Valid: ($ip).${COLOR_RESET}"
     else
+      echo -e "${COLOR_RED}Invalid: ($ip).${COLOR_RESET}"
       exit 1
     fi
 }
 
+validate_netif() {
+    local LIST_INTERFACES=$(ifconfig -l)
+    interface=${INTERFACE}
+    if echo "${LIST_INTERFACES}" | grep -qwo "${INTERFACE}"; then
+        echo -e "${COLOR_GREEN}Valid: ($interface).${COLOR_RESET}"
+    else
+        echo -e "${COLOR_RED}Invalid: ($interface).${COLOR_RESET}"
+        exit 1
+    fi
+}
+
 create_jail() {
     bastille_jail_base="${bastille_jailsdir}/${NAME}/root/.bastille"  ## dir
     bastille_jail_template="${bastille_jailsdir}/${NAME}/root/.template"  ## dir
@@ -65,9 +77,19 @@ create_jail() {
     bastille_jail_fstab="${bastille_jailsdir}/${NAME}/fstab"  ## file
     bastille_jail_conf="${bastille_jailsdir}/${NAME}/jail.conf"  ## file
     bastille_jail_log="${bastille_logsdir}/${NAME}_console.log"  ## file
-    bastille_jail_rc_conf="${bastille_jailsdir}/${NAME}/root/etc/rc.conf.local" ## file
+    bastille_jail_rc_conf="${bastille_jailsdir}/${NAME}/root/etc/rc.conf" ## file
     bastille_jail_resolv_conf="${bastille_jailsdir}/${NAME}/root/etc/resolv.conf" ## file
 
+    if [ ! -d "${bastille_jailsdir}/${NAME}" ]; then
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_jailsdir}/${NAME} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}
+            fi
+        else
+            mkdir -p "${bastille_jailsdir}/${NAME}"
+        fi
+    fi
+
     if [ ! -d "${bastille_jail_base}" ]; then
         mkdir -p "${bastille_jail_base}"
         mkdir -p "${bastille_jail_path}/usr/home"
@@ -83,14 +105,23 @@ create_jail() {
     fi
 
     if [ ! -f "${bastille_jail_conf}" ]; then
-	echo -e "interface = lo1;\nhost.hostname = ${NAME};\nexec.consolelog =\
+        if [ -z ${bastille_jail_loopback} ] && [ ! -z ${bastille_jail_external} ]; then
-	${bastille_jail_log};\npath = ${bastille_jail_path};\nip6 =\
+            local bastille_jail_conf_interface=${bastille_jail_external}
-	disable;\nsecurelevel = 2;\ndevfs_ruleset = 4;\nenforce_statfs =\
+        fi
-	2;\nexec.start = '/bin/sh /etc/rc';\nexec.stop = '/bin/sh\
+        if [ ! -z ${bastille_jail_loopback} ] && [ -z ${bastille_jail_external} ]; then
-	/etc/rc.shutdown';\nexec.clean;\nmount.devfs;\nmount.fstab =\
+            local bastille_jail_conf_interface=${bastille_jail_interface}
-	${bastille_jail_fstab};\n\n${NAME} {\n\tip4.addr = ${IP};\n}" >\
+        fi
-	${bastille_jail_conf}
+        if [ ! -z  ${INTERFACE} ]; then
-    fi
+            local bastille_jail_conf_interface=${INTERFACE}
+        fi
+echo -e "interface = ${bastille_jail_conf_interface};\nhost.hostname = ${NAME};\nexec.consolelog = \
+${bastille_jail_log};\npath = ${bastille_jail_path};\nip6 = \
+disable;\nsecurelevel = 2;\ndevfs_ruleset = 4;\nenforce_statfs = \
+2;\nexec.start = '/bin/sh /etc/rc';\nexec.stop = '/bin/sh \
+/etc/rc.shutdown';\nexec.clean;\nmount.devfs;\nmount.fstab = \
+${bastille_jail_fstab};\n\n${NAME} {\n\tip4.addr = ${IP};\n}" > \
+${bastille_jail_conf}
+fi
 
     ## using relative paths here
     ## MAKE SURE WE'RE IN THE RIGHT PLACE
@@ -98,6 +129,9 @@ create_jail() {
     echo
     echo -e "${COLOR_GREEN}NAME: ${NAME}.${COLOR_RESET}"
     echo -e "${COLOR_GREEN}IP: ${IP}.${COLOR_RESET}"
+    if [ ! -z  ${INTERFACE} ]; then
+        echo -e "${COLOR_GREEN}INTERFACE: ${INTERFACE}.${COLOR_RESET}"
+    fi
     echo -e "${COLOR_GREEN}RELEASE: ${RELEASE}.${COLOR_RESET}"
     echo
 
@@ -124,22 +158,25 @@ create_jail() {
     cp -a "${bastille_releasesdir}/${RELEASE}/usr/obj" "${bastille_jail_path}"
     if [ "${RELEASE}" == "11.2-RELEASE" ]; then cp -a "${bastille_releasesdir}/${RELEASE}/usr/tests" "${bastille_jail_path}"; fi
 
-    ## rc.conf.local
+    ## rc.conf
     ##  + syslogd_flags="-ss"
     ##  + sendmail_none="NONE"
     ##  + cron_flags="-J 60" ## cedwards 20181118
-    ## resolv.conf
     if [ ! -f "${bastille_jail_rc_conf}" ]; then
-        echo -e "syslogd_flags=\"-ss\"\nsendmail_enable=\"NONE\"" > ${bastille_jail_rc_conf}
+        touch "${bastille_jail_rc_conf}"
-	echo -e "cron_flags=\"-J 60\"" >> ${bastille_jail_rc_conf}
+        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" syslogd_flags=-ss
+        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" sendmail_enable=NONE
+        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" cron_flags='-J 60'
+        echo
     fi
 
+    ## resolv.conf (default: copy from host)
     if [ ! -f "${bastille_jail_resolv_conf}" ]; then
-        echo -e "nameserver 1.1.1.1\nnameserver 1.0.0.1\noptions edns0 rotate" > ${bastille_jail_resolv_conf}
+        cp -L ${bastille_resolv_conf} ${bastille_jail_resolv_conf}
     fi
 
-    ## TZ: UTC
+    ## TZ: configurable (default: etc/UTC)
-    ln -s /usr/share/zoneinfo/Etc/UTC etc/localtime
+    ln -s /usr/share/zoneinfo/${bastille_tzdata} etc/localtime
 }
 
 # Handle special-case commands first.
@@ -149,60 +186,36 @@ help|-h|--help)
     ;;
 esac
 
-if [ $# -gt 3 ] || [ $# -lt 3 ]; then
+if [ $# -gt 4 ] || [ $# -lt 3 ]; then
     usage
 fi
 
+if [ $(echo $3 | grep '@' ) ]; then
+    BASTILLE_JAIL_IP=$(echo $3 | awk -F@ '{print $2}')
+    BASTILLE_JAIL_INTERFACES=$( echo $3 | awk -F@ '{print $1}')
+fi
+
 NAME="$1"
 RELEASE="$2"
 IP="$3"
+INTERFACE="$4"
 
 ## verify release
 case "${RELEASE}" in
-10.1-RELEASE)
+11.3-RELEASE|11.3-release)
-    RELEASE="10.1-RELEASE"
+    RELEASE="11.3-RELEASE"
-	;;
-10.2-RELEASE)
-    RELEASE="10.2-RELEASE"
-	;;
-10.3-RELEASE)
-    RELEASE="10.3-RELEASE"
-	;;
-10.4-RELEASE)
-    RELEASE="10.4-RELEASE"
     ;;
-11.0-RELEASE)
+11.2-RELEASE|11.2-release)
-    RELEASE="11.0-RELEASE"
-    ;;
-11.1-RELEASE)
-    RELEASE="11.1-RELEASE"
-    ;;
-11.2-RELEASE)
     RELEASE="11.2-RELEASE"
     ;;
-12.0-RELEASE)
+12.0-RELEASE|12.0-release)
     RELEASE="12.0-RELEASE"
     ;;
-12.0-BETA1)
+11-stable-LAST|11-STABLE-last|11-stable-last|11-STABLE-LAST)
-    RELEASE="12.0-BETA1"
+    RELEASE="11-stable-LAST"
     ;;
-12.0-BETA2)
+12-stable-LAST|12-STABLE-last|12-stable-last|12-STABLE-LAST)
-    RELEASE="12.0-BETA2"
+    RELEASE="12-stable-LAST"
-    ;;
-12.0-BETA3)
-    RELEASE="12.0-BETA3"
-    ;;
-12.0-BETA4)
-    RELEASE="12.0-BETA4"
-    ;;
-12.0-RC1)
-    RELEASE="12.0-RC1"
-    ;;
-12.0-RC2)
-    RELEASE="12.0-RC2"
-    ;;
-12.0-RC3)
-    RELEASE="12.0-RC3"
     ;;
 *)
     echo -e "${COLOR_RED}Unknown Release.${COLOR_RESET}"
@@ -216,6 +229,12 @@ if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then
     exit 1
 fi
 
+## check for required release
+if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+    echo -e "${COLOR_RED}Release must be bootstrapped first; see `bastille bootstrap`.${COLOR_RESET}"
+    exit 1
+fi
+
 ## check if a running jail matches name
 if running_jail ${NAME}; then
     echo -e "${COLOR_RED}A running jail matches name.${COLOR_RESET}"
@@ -224,8 +243,15 @@ if running_jail ${NAME}; then
 fi
 
 ## check if ip address is valid
-if ! validate_ip ${IP}; then
+if [ ! -z ${IP} ]; then
-    echo -e "${COLOR_RED}Invalid: ($ip).${COLOR_RESET}"
+    validate_ip
+else
+    usage
 fi
 
-create_jail ${NAME} ${RELEASE} ${IP}
+## check if interface is valid
+if [ ! -z  ${INTERFACE} ]; then
+    validate_netif
+fi
+
+create_jail ${NAME} ${RELEASE} ${IP} ${INTERFACE}

usr/local/share/bastille/destroy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -53,10 +53,53 @@ destroy_jail() {
 
     if [ -d "${bastille_jail_base}" ]; then
         echo -e "${COLOR_GREEN}Deleting Jail: ${NAME}.${COLOR_RESET}"
-        chflags -R noschg ${bastille_jail_base}
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
-        rm -rf ${bastille_jail_base}
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
-        echo -e "${COLOR_GREEN}Note: jail console logs not destroyed.${COLOR_RESET}"
+                zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}
-	echo -e "${COLOR_GREEN}${bastille_jail_log}${COLOR_RESET}"
+            fi
+        fi
+
+        if [ -d "${bastille_jail_base}" ]; then
+            ## removing all flags
+            chflags -R noschg ${bastille_jail_base}
+
+            ## remove jail base
+            rm -rf ${bastille_jail_base}
+        fi
+
+        ## archive jail log
+        if [ -f "${bastille_jail_log}" ]; then
+            mv ${bastille_jail_log} ${bastille_jail_log}-$(date +%F)
+            echo -e "${COLOR_GREEN}Note: jail console logs archived.${COLOR_RESET}"
+            echo -e "${COLOR_GREEN}${bastille_jail_log}-$(date +%F)${COLOR_RESET}"
+        fi
+        echo
+    fi
+}
+
+destroy_rel() {
+    bastille_rel_base="${bastille_releasesdir}/${NAME}"  ## dir
+
+    if [ ! -d "${bastille_rel_base}" ]; then
+        echo -e "${COLOR_RED}Release base not found.${COLOR_RESET}"
+        exit 1
+    fi
+
+    if [ -d "${bastille_rel_base}" ]; then
+        echo -e "${COLOR_GREEN}Deleting base: ${NAME}.${COLOR_RESET}"
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ ! -z "${bastille_zfs_zpool}" ]; then
+                zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${NAME}
+            fi
+        fi
+
+        if [ -d "${bastille_rel_base}" ]; then
+            ## removing all flags
+            chflags -R noschg ${bastille_rel_base}
+
+            ## remove jail base
+            rm -rf ${bastille_rel_base}
+        fi
         echo
     fi
 }
@@ -74,4 +117,9 @@ fi
 
 NAME="$1"
 
-destroy_jail
+## check what should we clean
+if echo "${NAME}" | grep -qwE '^([0-9]{1,2})\.[0-9]-RELEASE$'; then
+    destroy_rel
+else
+    destroy_jail
+fi

usr/local/share/bastille/freebsd_dist_fetch.sh

@@ -1,52 +0,0 @@
-#!/bin/sh
-# https://pastebin.com/T6eThbKu
-
-. /usr/local/etc/bastille/bastille.conf
-
-DEVICE_SELF_SCAN_ALL=NO
-[ "$_SCRIPT_SUBR" ] || . /usr/share/bsdconfig/script.subr
-usage(){ echo "Usage: ${0##*/} [-r releaseName] [dists ...]" >&2; exit 1; }
-while getopts hr: flag; do
-	case "$flag" in
-	r) releaseName="$OPTARG" ;;
-	*) usage
-	esac
-done
-shift $(( $OPTIND - 1 ))
-nonInteractive=1
-MEDIA_TIMEOUT=3 # because ftp.f.o has no SRV records
-_ftpPath=ftp://ftp.freebsd.org
-mediaSetFTP
-mediaOpen
-set -e
-#debug=1
-REL_DIST=${bastille_cachedir}/$releaseName
-download() # $src to $dest
-{
-	size=$( f_device_get device_media "$1" $PROBE_SIZE )
-	f_device_get device_media "$1" | dpv -kb "BastilleBSD" \
-		-t "bootstrap" -p "Downloading $releaseName" \
-		-o "$3" "$size:$1"
-}
-sign() # $file
-{
-	dpv -kb "BastilleBSD" -t "bootstrap" \
-		-p "Signing $releaseName" -mx "sha256 >&2" \
-		"$size:${1##*/}" "$1" 2>&1 >&$TERMINAL_STDOUT_PASSTHRU
-}
-mkdir -p $REL_DIST
-MANIFEST=$REL_DIST/MANIFEST
-download MANIFEST to $MANIFEST
-dists="$*"
-for dist in ${dists:-$( awk '$0=$4' $MANIFEST )}; do
-	eval "$( awk -v dist=$dist '$4 == dist {
-		print "distfile=" $1
-		print "sig=" $2
-		exit found = 1
-	} END { exit ! found }' $MANIFEST )"
-	destfile=$REL_DIST/$distfile
-	download $distfile to $destfile
-	[ "$( sign $destfile )" = $sig ] ||
-		f_die "$distfile signature mismatch!"
-done
-f_dialog_info "All dists successfully downloaded/verified."

usr/local/share/bastille/htop.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/list.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -37,7 +37,7 @@ usage() {
 }
 
 if [ $# -eq 0 ]; then
-    jls -N
+    jls -N | grep -v 'poudriere'
 fi
 
 if [ $# -gt 0 ]; then
@@ -47,16 +47,26 @@ if [ $# -gt 0 ]; then
         usage
         ;;
     release|releases)
-        ls "${bastille_releasesdir}" | sed "s/\n//g"
+        REL_LIST=$(ls "${bastille_releasesdir}" | sed "s/\n//g")
+        for _REL in ${REL_LIST}; do
+            if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" ]; then
+                echo "${bastille_releasesdir}/${_REL}"
+            fi
+        done
         ;;
     template|templates)
-	ls "${bastille_templatesdir}" | sed "s/\n//g"
+        find "${bastille_templatesdir}" -type d -maxdepth 2
         ;;
     jail|jails)
-	ls "${bastille_jailsdir}" | sed "s/\n//g"
+        JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+        for _JAIL in ${JAIL_LIST}; do
+            if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
+                echo "${_JAIL}"
+            fi
+        done
         ;;
     log|logs)
-        ls "${bastille_logsdir}" | sed "s/\n//g"
+        find "${bastille_logsdir}" -type f -maxdepth 1
         ;;
     *)
         usage

usr/local/share/bastille/pkg.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/restart.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/service.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/start.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -60,7 +60,9 @@ for _jail in ${JAILS}; do
     elif [ ! $(jls name | grep ${_jail}) ]; then
         echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
         jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -c ${_jail}
-        pfctl -f /etc/pf.conf
+        if [ ! -z ${bastille_jail_loopback} ]; then
+            pfctl -f /etc/pf.conf
+        fi
     fi
     echo
 done

usr/local/share/bastille/stop.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -57,6 +57,8 @@ fi
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
     jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -r ${_jail}
-    pfctl -f /etc/pf.conf
+    if [ ! -z ${bastille_jail_loopback} ]; then
+        pfctl -f /etc/pf.conf
+    fi
     echo
 done

usr/local/share/bastille/sysrc.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/template.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -60,11 +60,12 @@ bastille_template=${bastille_templatesdir}/${TEMPLATE}
 bastille_template_TARGET=${bastille_template}/TARGET
 bastille_template_INCLUDE=${bastille_template}/INCLUDE
 bastille_template_PRE=${bastille_template}/PRE
-bastille_template_CONFIG=${bastille_template}/CONFIG
+bastille_template_OVERLAY=${bastille_template}/OVERLAY
 bastille_template_FSTAB=${bastille_template}/FSTAB
 bastille_template_PF=${bastille_template}/PF
 bastille_template_PKG=${bastille_template}/PKG
 bastille_template_SYSRC=${bastille_template}/SYSRC
+bastille_template_SERVICE=${bastille_template}/SERVICE
 bastille_template_CMD=${bastille_template}/CMD
 
 for _jail in ${JAILS}; do
@@ -91,40 +92,57 @@ for _jail in ${JAILS}; do
     if [ -s "${bastille_template_INCLUDE}" ]; then
         echo -e "${COLOR_GREEN}Detected INCLUDE.${COLOR_RESET}"
         while read _include; do
-            echo -e "${COLOR_GREEN}${_include}${COLOR_RESET}"
+            echo
+            echo -e "${COLOR_GREEN}INCLUDE: ${_include}${COLOR_RESET}"
+            echo -e "${COLOR_GREEN}Bootstrapping ${_include}...${COLOR_RESET}"
+            bastille bootstrap ${_include}
+
+            echo
+            echo -e "${COLOR_GREEN}Applying ${_include}...${COLOR_RESET}"
+            BASTILLE_TEMPLATE_PROJECT=$(echo "${_include}" | awk -F / '{ print $4}')
+            BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $5}')
+            bastille template ${_jail} ${BASTILLE_TEMPLATE_PROJECT}/${BASTILLE_TEMPLATE_REPO}
         done < "${bastille_template_INCLUDE}"
     fi
 
-    ## pre
+    ## PRE
     if [ -s "${bastille_template_PRE}" ]; then
         echo -e "${COLOR_GREEN}Executing PRE-command(s).${COLOR_RESET}"
         jexec -l ${_jail} /bin/sh < "${bastille_template_PRE}"
     fi
 
-    ## config
+    ## CONFIG / OVERLAY
-    if [ -s "${bastille_template_CONFIG}" ]; then
+    if [ -s "${bastille_template_OVERLAY}" ]; then
         echo -e "${COLOR_GREEN}Copying files...${COLOR_RESET}"
         while read _dir; do
             cp -a "${bastille_template}/${_dir}" "${bastille_jail_path}"
-        done < ${bastille_template_CONFIG}
+        done < ${bastille_template_OVERLAY}
+        echo -e "${COLOR_GREEN}Copy complete.${COLOR_RESET}"
+    fi
+    if [ -s "${bastille_template}/CONFIG" ]; then
+        echo -e "${COLOR_YELLOW}CONFIG deprecated; rename to OVERLAY.${COLOR_RESET}"
+        echo -e "${COLOR_GREEN}Copying files...${COLOR_RESET}"
+        while read _dir; do
+            cp -a "${bastille_template}/${_dir}" "${bastille_jail_path}"
+        done < ${bastille_template}/CONFIG
         echo -e "${COLOR_GREEN}Copy complete.${COLOR_RESET}"
     fi
 
-    ## fstab
+    ## FSTAB
     if [ -s "${bastille_template_FSTAB}" ]; then
         bastille_templatefstab=$(cat "${bastille_template_FSTAB}")
         echo -e "${COLOR_GREEN}Updating fstab.${COLOR_RESET}"
         echo -e "${COLOR_GREEN}NOT YET IMPLEMENTED.${COLOR_RESET}"
     fi
 
-    ## pf
+    ## PF
     if [ -s "${bastille_template_PF}" ]; then
         bastille_templatepf=$(cat "${bastille_template_PF}")
         echo -e "${COLOR_GREEN}Generating PF profile.${COLOR_RESET}"
         echo -e "${COLOR_GREEN}NOT YET IMPLEMENTED.${COLOR_RESET}"
     fi
 
-    ## pkg (bootstrap + pkg)
+    ## PKG (bootstrap + pkg)
     if [ -s "${bastille_template_PKG}" ]; then
         echo -e "${COLOR_GREEN}Installing packages.${COLOR_RESET}"
         jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg bootstrap
@@ -132,7 +150,7 @@ for _jail in ${JAILS}; do
         jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg install $(cat ${bastille_template_PKG})
     fi
 
-    ## sysrc
+    ## SYSRC
     if [ -s "${bastille_template_SYSRC}" ]; then
         echo -e "${COLOR_GREEN}Updating services.${COLOR_RESET}"
         while read _sysrc; do
@@ -140,7 +158,15 @@ for _jail in ${JAILS}; do
         done < "${bastille_template_SYSRC}"
     fi
 
-    ## cmd
+    ## SERVICE
+    if [ -s "${bastille_template_SERVICE}" ]; then
+        echo -e "${COLOR_GREEN}Managing services.${COLOR_RESET}"
+        while read _sysrc; do
+            jexec -l ${_jail} /usr/sbin/service "${_sysrc}"
+        done < "${bastille_template_SERVICE}"
+    fi
+
+    ## CMD
     if [ -s "${bastille_template_CMD}" ]; then
         echo -e "${COLOR_GREEN}Executing final command(s).${COLOR_RESET}"
         jexec -l ${_jail} /bin/sh < "${bastille_template_CMD}"

usr/local/share/bastille/top.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without

usr/local/share/bastille/update.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -49,6 +49,11 @@ fi
 
 RELEASE=$1
 
+if [ ! -z "$(freebsd-version | grep -i HBSD)" ]; then
+    echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
+    exit 1
+fi
+
 if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
     freebsd-update -b "${bastille_releasesdir}/${RELEASE}" fetch install --currently-running ${RELEASE}
 else

usr/local/share/bastille/upgrade.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -50,6 +50,12 @@ fi
 RELEASE=$1
 NEWRELEASE=$2
 
+if [ ! -z "$(freebsd-version | grep -i HBSD)" ]; then
+    echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
+    exit 1
+fi
+
+
 if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
     freebsd-update -b "${bastille_releasesdir}/${RELEASE}" -r ${NEWRELEASE} upgrade
 else

usr/local/share/bastille/verify.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 # 
-# Copyright (c) 2018, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # 
 # Redistribution and use in source and binary forms, with or without
@@ -49,6 +49,11 @@ fi
 
 RELEASE=$1
 
+if [ ! -z "$(freebsd-version | grep -i HBSD)" ]; then
+    echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
+    exit 1
+fi
+
 if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
     freebsd-update -b "${bastille_releasesdir}/${RELEASE}" IDS
 else

usr/local/share/bastille/zfs.sh

@@ -0,0 +1,121 @@
+#!/bin/sh
+# 
+# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+# 
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+# 
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+# 
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille zfs [ALL|glob] [set|get|snap] [key=value|date]'${COLOR_RESET}"
+    exit 1
+}
+
+zfs_snapshot() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs snapshot ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}@${TAG}
+    echo
+done
+}
+
+zfs_set_value() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs $ATTRIBUTE ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}
+    echo
+done
+}
+
+zfs_get_value() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs get $ATTRIBUTE ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}
+    echo
+done
+}
+
+zfs_disk_usage() {
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    zfs list -t all -o name,used,avail,refer,mountpoint,compress,ratio -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}
+    echo
+done
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+## check ZFS enabled
+if [ ! "${bastille_zfs_enable}" = "YES" ]; then
+    echo -e "${COLOR_RED}ZFS not enabled.'${COLOR_RESET}"
+    exit 1
+fi
+
+## check zpool defined
+if [ -z "${bastille_zfs_zpool}" ]; then
+    echo -e "${COLOR_RED}ZFS zpool not defined.'${COLOR_RESET}"
+    exit 1
+fi
+
+if [ $# -gt 3 ] || [ $# -lt 2 ]; then
+    usage
+fi
+
+if [ "$1" = 'ALL' ]; then
+    JAILS=$(jls name)
+fi
+
+if [ "$1" != 'ALL' ]; then
+    JAILS=$(jls name | grep -E "(^|\b)${1}($|\b)")
+fi
+
+case "$2" in
+set)
+    ATTRIBUTE=$3
+    JAILS=${JAILS}
+    zfs_set_value
+    ;;
+get)
+    ATTRIBUTE=$3
+    JAILS=${JAILS}
+    zfs_get_value
+    ;;
+snap|snapshot)
+    TAG=$3
+    JAILS=${JAILS}
+    zfs_snapshot
+    ;;
+df|usage)
+    zfs_disk_usage
+    ;;
+esac