Merge pull request #224 from cedwards/update-20200714

update to 0.7.20200714

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,26 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG]"
+labels: bug
+assignees: ''
+
+---
+
+**[MANDATORY] Describe the bug [MANDATORY]**
+A clear and concise description of what the bug is.
+
+**[MANDATORY] Bastille and FreeBSD version (paste ``bastille -v && freebsd-version -kru`` output)**
+
+**[MANDATORY] How did you install bastille? (port/pkg/git)**
+
+**[optional] Steps to reproduce?**
+
+**[optional] Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**[optional] Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**[optional]  Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Enhancement & Feature Request
+title: "[ENHANCEMENT]"
+labels: enhancement
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

AUTHORS.md

@@ -2,35 +2,34 @@
 
 ## Lead
 
-Christer Edwards [christer.edwards@gmail.com]  
+Christer Edwards [christer.edwards@gmail.com]
 
 ## Contributors (code)
-
+- Barry McCormick
-Barry McCormick  
+- Brian Downs
-Brian Downs  
+- Dave Cottlehuber
-Dave Cottlehuber  
+- Giacomo Olgeni
-Giacomo Olgeni  
+- JP Mens
-JP Mens  
+- Jose Rivera
-Jose Rivera  
+- Lars E.
-Lars E.  
+- Paul C.
-Paul C.  
+- Sven R.
-Sven R.  
 
 ### Special thanks
 Software doesn't happen in a vacuum. Thank you to the following people who may
 not be found in the commit history but have influenced Bastille's development
 in some way.
 
-Carlos Meza  
+- Carlos Meza
-Casandra Woodcox  
+- Casandra Woodcox
-Clint Savage  
+- Clint Savage
-G. Clifford Williams  
+- G. Clifford Williams
-Jack Thomasson  
+- Jack Thomasson
-Jun C Park  
+- Jun C Park
-Justin Desilets  
+- Justin Desilets
-Larry Raab  
+- Larry Raab
-Nate Taylor  
+- Nate Taylor
-Peter Czanik  
+- Peter Czanik
-Ryan Simpkins  
+- Ryan Simpkins
-Tim Gelter  
+- Tim Gelter
-Trevor Sharpe  
+- Trevor Sharpe

CODE-OF-CONDUCT.md

@@ -71,4 +71,3 @@ This Code of Conduct is adapted from the [Contributor Covenant][homepage], versi
 available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
 
 [homepage]: https://www.contributor-covenant.org
-

Makefile

@@ -21,7 +21,8 @@ uninstall:
 	@rm -rvf /usr/local/share/man/man1/bastille.1.gz
 	@echo
 	@echo "removing configuration file"
-	@rm -rvf /usr/local/etc/bastille
+	@rm -rvf /usr/local/etc/bastille/bastille.conf.sample
 	@echo
 	@echo "removing startup script"
 	@rm -vf /usr/local/etc/rc.d/bastille
+	@echo "You may need to manually remove /usr/local/etc/bastille/bastille.conf if it is no longer needed."

README.md

@@ -1,11 +1,10 @@
-Bastille: Automate Container Security
+Bastille
-=====================================
+========
 [Bastille](https://bastillebsd.org/) is an open-source system for automating
 deployment and management of containerized applications on FreeBSD.
 
 Looking for [Bastille Templates](https://gitlab.com/BastilleBSD-Templates/)?
 
-
 Installation
 ============
 Bastille is available in the official FreeBSD ports tree.
@@ -21,7 +20,7 @@ portsnap fetch auto
 make -C /usr/ports/sysutils/bastille install clean
 ```
 
-**Git**
+**Git** (bleeding edge / unstable -- primarily for developers)
 ```shell
 git clone https://github.com/BastilleBSD/bastille.git
 cd bastille
@@ -44,18 +43,21 @@ Usage:
 
 Available Commands:
   bootstrap   Bootstrap a FreeBSD release for container base.
+  clone       Clone an existing container.
   cmd         Execute arbitrary command on targeted container(s).
   console     Console into a running container.
   convert     Convert a thin container into a thick container.
   cp          cp(1) files from host to targeted container(s).
   create      Create a new thin or thick container.
   destroy     Destroy a stopped container or a bootstrapped release.
+  edit        Edit container configuration files (advanced).
   export      Exports a container archive or image.
   help        Help about any command
   htop        Interactive process viewer (requires htop).
   import      Import a container archive or image.
   limits      Apply resources limits to targeted container(s). See rctl(8).
   list        List containers, releases, templates, logs, limits or backups.
+  mount       Mount a volume inside the targeted container(s).
   pkg         Manipulate binary packages within targeted container(s). See pkg(8).
   rdr         Redirect host port to container port.
   restart     Restart a running container.
@@ -65,6 +67,7 @@ Available Commands:
   sysrc       Safely edit rc files within targeted container(s).
   template    Apply automation templates to targeted container(s).
   top         Display and update information about the top(1) cpu processes.
+  umount      Unmount a volume from within the targeted container(s).
   update      Update container base -pX release.
   upgrade     Upgrade container release to X.Y-RELEASE.
   verify      Verify bootstrapped release or automation template.
@@ -75,7 +78,7 @@ Use "bastille command -h|--help" for more information about a command.
 
 ```
 
-## 0.6-beta
+## 0.7-beta
 This document outlines the basic usage of the Bastille container management
 framework. This release is still considered beta.
 
@@ -121,9 +124,9 @@ table <jails> persist
 nat on $ext_if from <jails> to any -> ($ext_if)
 
 ## static rdr example
-## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
+# rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
 
-# Enable dynamic rdr (see below)
+## Enable dynamic rdr (see below)
 rdr-anchor "rdr/*"
 
 block in all
@@ -131,7 +134,7 @@ pass out quick modulate state
 antispoof for $ext_if inet
 pass in inet proto tcp from any to any port ssh flags S/SA keep state
 
-# make sure you also open up ports that you are going to use for dynamic rdr
+## make sure you also open up ports that you are going to use for dynamic rdr
 # pass in inet proto tcp from any to any port <rdr-start>:<rdr-end> flags S/SA keep state
 # pass in inet proto udp from any to any port <rdr-start>:<rdr-end> flags S/SA keep state
 
@@ -161,9 +164,9 @@ container at `10.17.89.45`.
 
 Finally, enable and (re)start the firewall:
 
-## dynamic rdr 
+## dynamic rdr
 
-The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the 
+The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
 `bastille rdr` command at runtime - eg.
 
 ```
@@ -174,7 +177,7 @@ The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
 ```
 
   Note that if you are rediirecting ports where the host is also listening
-  (eg. ssh) you should make sure that the host service is not listening on 
+  (eg. ssh) you should make sure that the host service is not listening on
   the cloned interface - eg. for ssh set sshd_flags in rc.conf
 
 ## Enable pf rules
@@ -241,11 +244,6 @@ release version as the argument.
 ishmael ~ # bastille bootstrap 11.3-RELEASE
 ```
 
-**FreeBSD 12.0-RELEASE**
-```shell
-ishmael ~ # bastille bootstrap 12.0-RELEASE
-```
-
 **FreeBSD 12.1-RELEASE**
 ```shell
 ishmael ~ # bastille bootstrap 12.1-RELEASE
@@ -271,7 +269,7 @@ default this value is set to "base". Additional components are added, space
 separated, without file extension.
 
 Bastille will attempt to fetch the required archives if they are not found in
-the `cache/$RELEASE` directory. 
+the `cache/$RELEASE` directory.
 
 Downloaded artifacts are stored in the `cache/RELEASE` directory. "bootstrapped"
 releases are stored in `releases/RELEASE`.
@@ -298,26 +296,81 @@ IP at container creation.
 
 - name
 - release (bootstrapped)
-- ip
+- ip (ip4 or ip6)
 - interface (optional)
 
 
+**ip4**
 ```shell
-ishmael ~ # bastille create folsom 12.0-RELEASE 10.17.89.10
+ishmael ~ # bastille create folsom 12.1-RELEASE 10.17.89.10
 Valid: (10.17.89.10).
 
 NAME: folsom.
 IP: 10.17.89.10.
-RELEASE: 12.0-RELEASE.
+RELEASE: 12.1-RELEASE.
 
 syslogd_flags: -s -> -ss
 sendmail_enable: NO -> NONE
 cron_flags:  -> -J 60
 ```
 
-This command will create a 12.0-RELEASE container assigning the 10.17.89.10 ip
+This command will create a 12.1-RELEASE container assigning the 10.17.89.10 ip
 address to the new system.
 
+**ip6**
+```shell
+ishmael ~ # bastille create folsom 12.1-RELEASE fd35:f1fd:2cb6:6c5c::13
+Valid: (fd35:f1fd:2cb6:6c5c::13).
+
+NAME: folsom.
+IP: fd35:f1fd:2cb6:6c5c::13
+RELEASE: 12.1-RELEASE.
+
+syslogd_flags: -s -> -ss
+sendmail_enable: NO -> NONE
+cron_flags:  -> -J 60
+```
+
+This command will create a 12.1-RELEASE container assigning the
+fd35:f1fd:2cb6:6c5c::13  ip address to the new system.
+
+**VNET**
+```shell
+ishmael ~ # bastille create -V vnetjail 12.1-RELEASE 192.168.87.55/24 em0
+Valid: (192.168.87.55/24).
+Valid: (em0).
+
+NAME: vnettest0.
+IP: 192.168.87.55/24.
+INTERFACE: em0.
+RELEASE: 12.1-RELEASE.
+
+syslogd_flags: -s -> -ss
+sendmail_enable: NO -> NONE
+cron_flags:  -> -J 60
+ifconfig_e0b_bastille0_name:  -> vnet0
+ifconfig_vnet0:  -> inet 192.168.87.55/24
+```
+
+This command will create a 12.1-RELEASE container assigning the
+192.168.87.55/24 ip address to the new system.
+
+VNET-enabled containers are attached to a virtual bridge interface for
+connectivity. This bridge interface is defined by the interface argument in the
+create command (in this case, em0).
+
+VNET also requires a custom `devfs` ruleset. Create the file as needed on the host system:
+
+**/etc/devfs.rules**
+```
+[bastille_vnet=13]
+add include $devfsrules_hide_all
+add include $devfsrules_unhide_basic
+add include $devfsrules_unhide_login
+add include $devfsrules_jail
+add path 'bpf*' unhide
+```
+
 Optionally `bastille create [ -T | --thick ]` will create a container with a
 private base. This is sometimes referred to as a "thick" container (whereas the
 shared base container is a "thin").
@@ -613,7 +666,7 @@ work as expected. This table outlines that order and those requirements:
 
 | PLANNED | format           | example                                                        |
 |---------|------------------|----------------------------------------------------------------|
-| PF      | pf rdr entry     | rdr pass inet proto tcp from any to any port 80 -> 10.17.89.80 |
+| RDR     | pf rdr entry     | rdr pass inet proto tcp from any to any port 80 -> 10.17.89.80 |
 | LOG     | path             | /var/log/nginx/access.log                                      |
 
 Note: SYSRC requires NO quotes or that quotes (`"`) be escaped. ie; `\"`)
@@ -644,6 +697,31 @@ The above example will include anything under "etc" and "usr" inside
 the template. You do not need to list individual files. Just include the
 top-level directory name.
 
+For more control over the order of operations when applying a template,
+create a `Bastillefile` inside the base template directory. Each line in
+the file should begin with an uppercase reference to a Bastille command
+followed by its arguments (omitting the target, which is deduced from the
+`template` arguments). Lines beginning with `#` are treated as comments.
+
+Bastillefile example:
+
+```shell
+LIMITS memoryuse 1G
+
+# Install and start nginx.
+PKG nginx
+SYSRC nginx_enable=YES
+SERVICE nginx restart
+
+# Copy files to nginx.
+CP www/ usr/local/www/nginx-dist/
+
+# Create a file on the server containing the jail's hostname.
+CMD hostname > /usr/local/www/nginx-dist/hostname.txt
+
+# Forward TCP port 80 on the host to port 80 in the container.
+RDR tcp 80 80
+```
 
 Applying Templates
 ------------------
@@ -730,7 +808,7 @@ root@folsom:~ #
 
 At this point you are logged in to the container and have full shell access.
 The system is yours to use and/or abuse as you like. Any changes made inside
-the container are limited to the container. 
+the container are limited to the container.
 
 
 bastille cp
@@ -752,16 +830,16 @@ ishmael ~ # bastille cp ALL /tmp/resolv.conf-cf etc/resolv.conf
 /tmp/resolv.conf-cf -> /usr/local/bastille/jails/unbound0/root/etc/resolv.conf
 ```
 
-bastille-rdr
+bastille rdr
 ------------
 
 `bastille rdr` allows you to configure dynamic rdr rules for your containers
-without modifying pf.conf (assuming you are using the `bastille0` interface 
+without modifying pf.conf (assuming you are using the `bastille0` interface
-for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf 
+for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf
 as described in the Networking section).
 
 ```shell
-    # bastille rdr --help
+    # bastille rdr help
     Usage: bastille rdr TARGET [clear] | [list] | [tcp <host_port> <jail_port>] | [udp <host_port> <jail_port>]
     # bastille rdr dev1 tcp 2001 22
     # bastille rdr dev1 list
@@ -855,7 +933,7 @@ Note: On UFS systems containers must be stopped before export.
 ishmael ~ # bastille export folsom
 Exporting 'folsom' to a compressed .xz archive.
 Sending zfs data stream...
-  100 %     1057.2 KiB / 9231.5 KiB = 0.115                   0:01             
+  100 %     1057.2 KiB / 9231.5 KiB = 0.115                   0:01
 Exported '/usr/local/bastille/jails/backups/folsom_2020-01-26-19:23:04.xz' successfully.
 
 ```
@@ -871,10 +949,48 @@ File validation successful!
 Importing 'folsom' from compressed .xz archive.
 Receiving zfs data stream...
 /usr/local/bastille/jails/backups/folsom_2020-01-26-19:22:23.xz (1/1)
-  100 %      626.4 KiB / 9231.5 KiB = 0.068                   0:02             
+  100 %      626.4 KiB / 9231.5 KiB = 0.068                   0:02
 Container 'folsom' imported successfully.
 ```
 
+bastille clone
+---------------
+`bastille clone` will duplicate an existing container.
+Please be aware that no host specific keys or hashes will be regenerated.
+E. g. remove OpenSSH host keys to avoid duplicate host keys `rm /etc/ssh/ssh_host_*`
+
+Usage: `bastille clone [TARGET] [NEWJAIL] [NEW_IPADRRESS]`
+
+```shell
+ishmael ~ # bastille clone sourcejail targetjail 10.17.89.11
+```
+
+bastille mount
+---------------
+`bastille mount` will nullfs mount a path from the host inside the container.
+Uses the same format as an fstab entry.
+Filesystem type, options, dump, and pass number are optional and default to: nullfs ro 0 0
+
+Usage: `bastille mount [TARGET] [HOST_PATH] [CONTAINER_PATH] [FILESYSTEM_TYPE] [OPTIONS] [DUMP] [PASS_NUMBER]`
+
+```shell
+ishmael ~ # bastille mount targetjail /host/path container/path
+[targetjail]:
+Added: /host/path container/path nullfs ro 0 0
+```
+
+bastille umount
+---------------
+`bastille umount` will unmount a volume from inside the container.
+
+Usage: `bastille umount [TARGET] [CONTAINER_PATH]`
+
+```shell
+ishmael ~ # bastille umount targetjail container/path
+[targetjail]:
+Unmounted: container/path
+```
+
 Example (create, start, console)
 ================================
 This example creates, starts and consoles into the container.
@@ -956,7 +1072,7 @@ limit the target areas available to anyone that has (or has gained) access.
 Networking Tips
 ===============
 
-Tip #1: 
+Tip #1:
 -------
 Ports and destinations can be defined as lists. eg;
 ```
@@ -968,7 +1084,7 @@ round-robin between containers with ips 45, 46, 47, and 48 (on ports 80 or
 443).
 
 
-Tip #2: 
+Tip #2:
 -------
 Ports can redirect to other ports. eg;
 ```

Vagrantfile

@@ -0,0 +1,24 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+VAGRANTFILE_API_VERSION = "2"
+
+Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
+
+  config.vm.define "bastille" do |vm_config|
+
+    vm_config.ssh.shell = "sh"
+
+    vm_config.vm.box = "freebsd/FreeBSD-12.1-RELEASE"
+    vm_config.vm.box_version = "2019.11.01"
+
+    vm_config.vm.provider "virtualbox" do |vb|
+      vb.name = "bastille"
+      vb.cpus = "1"
+      vb.memory = "1024"
+    end
+
+    vm_config.vm.provision "shell", inline: "cd /vagrant; make install"
+
+  end
+end

docs/Makefile

@@ -16,4 +16,4 @@ help:
 # Catch-all target: route all unknown targets to Sphinx using the new
 # "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
 %: Makefile
-	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

docs/chapters/installation.rst

@@ -4,7 +4,7 @@ Bastille is available in the official FreeBSD ports tree at
 `sysutils/bastille`. Binary packages available in `quarterly` and `latest`
 repositories.
 
-Current version is `0.6.20200202`.
+Current version is `0.7.20200714`.
 
 To install from the FreeBSD package repository:
 

docs/chapters/jail-config.rst

@@ -17,7 +17,7 @@ template looks like this:
     devfs_ruleset = 4;
     enforce_statfs = 2;
     exec.clean;
-    exec.consolelog = /usr/local/bastille/logs/{name}_console.log;
+    exec.consolelog = /var/log/bastille/{name}_console.log;
     exec.start = '/bin/sh /etc/rc';
     exec.stop = '/bin/sh /etc/rc.shutdown';
     host.hostname = {name};
@@ -45,7 +45,7 @@ devfs_ruleset
     effective and enforce_statfs is set to a value lower than 2.
     Devfs rules and rulesets cannot be viewed or modified from inside
     a jail.
-   
+
     NOTE: It is important that only appropriate device nodes in devfs
     be exposed to a jail; access to disk devices in the jail may
     permit processes in the jail to bypass the jail sandboxing by
@@ -178,13 +178,13 @@ cases.
   The kernel runs with five different security levels.  Any super-user
   process can raise the level, but no process can lower it.  The security
   levels are:
-   
+
   -1    Permanently insecure mode - always run the system in insecure mode.
         This is the default initial value.
-   
+
   0     Insecure mode - immutable and append-only flags may be turned off.
         All devices may be read or written subject to their permissions.
-   
+
   1     Secure mode - the system immutable and system append-only flags may
         not be turned off; disks for mounted file systems, /dev/mem and
         /dev/kmem may not be opened for writing; /dev/io (if your platform
@@ -192,18 +192,17 @@ cases.
         not be loaded or unloaded.  The kernel debugger may not be entered
         using the debug.kdb.enter sysctl.  A panic or trap cannot be forced
         using the debug.kdb.panic and other sysctl's.
-   
+
   2     Highly secure mode - same as secure mode, plus disks may not be
         opened for writing (except by mount(2)) whether mounted or not.
         This level precludes tampering with file systems by unmounting
         them, but also inhibits running newfs(8) while the system is multi-
         user.
-   
+
         In addition, kernel time changes are restricted to less than or
         equal to one second.  Attempts to change the time by more than this
         will log the message "Time adjustment clamped to +1 second".
-   
+
   3     Network secure mode - same as highly secure mode, plus IP packet
         filter rules (see ipfw(8), ipfirewall(4) and pfctl(8)) cannot be
         changed and dummynet(4) or pf(4) configuration cannot be adjusted.
-

docs/chapters/networking.rst

@@ -5,29 +5,26 @@ to get started putting applications in secure little containers, but how do I
 get these containers on the network?
 
 Bastille tries to be flexible about how to network containerized applications.
-The two most common methods are described here. Consider both options to decide
+Three methods are described here. Consider each options when deciding
-which design work best for your needs. One of the methods works better across
+which design work best for your needs. One of the methods works better in the 
-clouds while the other is simpler if used in local area networks.
+cloud while the others are simpler if used in local area networks.
-
-As you've probably seen, Bastille containers require certain information when
-they are created. An IP address has to be assigned to the container through
-which all network traffic will flow.
-
-When the container is started the IP address assigned at creation will be bound
-to a network interface. In FreeBSD these interfaces have different names, but
-look something like `em0`, `bge0`, `re0`, etc. On a virtual machine it may be
-`vtnet0`. You get the idea...
 
 **Note: if you are running in the cloud and only have a single public IP you
 may want the Public Network option. See below.**
 
 
 Local Area Network
-------------------
+==================
 I will cover the local area network (LAN) method first. This method is simpler
 to get going and works well in a home network (or similar) where adding alias
 IP addresses is no problem.
 
+Shared Interface (IP alias)
+---------------------------
+In FreeBSD network interfaces have different names, but look something like
+`em0`, `bge0`, `re0`, etc. On a virtual machine it may be `vtnet0`. You get the
+idea...
+
 Bastille allows you to define the interface you want the IP attached to when
 you create it. An example:
 
@@ -43,13 +40,59 @@ reach services at that address.
 This method is the simplest. All you need to know is the name of your network
 interface and a free IP on your current network.
 
-(Bastille does try to verify that the interface name you provide it is a valid
+Bastille tries to verify that the interface name you provide it is a valid
-interface. This validation has not been exhaustively tested yet in Bastille's
+interface. It also checks for a valid syntax IP4 or IP6 address.
-beta state.)
+
+Virtual Network (VNET)
+----------------------
+(Added in 0.6.x) VNET is supported on FreeBSD 12+ only.
+
+Virtual Network (VNET) creates a private network interface for a container.
+This includes a unique hardware address. This is required for VPN, DHCP, and
+similar containers.
+
+To create a VNET based container use the `-V` option, an IP/netmask and
+external interface.
+
+.. code-block:: shell
+
+  bastille create -V azkaban 12.1-RELEASE 192.168.1.50/24 em0
+
+Bastille will automagically create the bridge interface and connect /
+disconnect containers as they are started and stopped. A new interface will be
+created on the host matching the pattern `interface0bridge`. In the example
+here, `em0bridge`. 
+
+The `em0` interface will be attached to the bridge along with the unique
+container interfaces as they are started and stopped. These interface names
+match the pattern `eXb_bastilleX`. Internally to the containers these
+interfaces are presented as `vnet0`.
+
+VNET also requires a custom devfs ruleset. Create the file as needed on the
+host system:
+
+.. code-block:: shell
+
+  ## /etc/devfs.rules (NOT .conf)
+  
+  [bastille_vnet=13]
+  add include $devfsrules_hide_all
+  add include $devfsrules_unhide_basic
+  add include $devfsrules_unhide_login
+  add include $devfsrules_jail
+  add path 'bpf*' unhide
+
+Lastly, you may want to consider these three `sysctl` values:
+
+.. code-block:: shell
+
+  net.link.bridge.pfil_bridge=0
+  net.link.bridge.pfil_onlyip=0
+  net.link.bridge.pfil_member=0
 
 
 Public Network
---------------
+==============
 In this section I'll describe how to network containers in a public network
 such as a cloud hosting provider (AWS, digital ocean, vultr, etc)
 
@@ -58,9 +101,11 @@ addresses for your virtual machines. This means if you want to create multiple
 containers and assign them all IP addresses, you'll need to create a new
 network.
 
+loopback (bastille0)
+--------------------
 What I recommend is creating a cloned loopback interface (`bastille0`) and
 assigning all the containers private (rfc1918) addresses on that interface. The
-setup I develop on and use Bastille day to day uses the `10.0.0.0/8` address
+setup I develop on and use Bastille day-to-day uses the `10.0.0.0/8` address
 range. I have the ability to use whatever address I want within that range
 because I've created my own private network. The host system then acts as the
 firewall, permitting and denying traffic as needed.
@@ -95,20 +140,20 @@ Create the firewall rules:
 .. code-block:: shell
 
   ext_if="vtnet0"
-  
+
   set block-policy return
   scrub in on $ext_if all fragment reassemble
   set skip on lo
 
   table <jails> persist
   nat on $ext_if from <jails> to any -> ($ext_if)
-  
+
   ## static rdr example
   ## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
 
   ## dynamic rdr anchor (see below)
   rdr-anchor "rdr/*"
-  
+
   block in all
   pass out quick modulate state
   antispoof for $ext_if inet
@@ -127,7 +172,7 @@ to containers are:
 .. code-block:: shell
 
   nat on $ext_if from <jails> to any -> ($ext_if)
-  
+
   ## static rdr example
   ## rdr pass inet proto tcp from any to any port {80, 443} -> 10.17.89.45
 
@@ -141,7 +186,7 @@ containers at `10.17.89.45`.
   ## dynamic rdr anchor (see below)
   rdr-anchor "rdr/*"
 
-The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the 
+The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
 `bastille rdr` command at runtime - eg.
 
   bastille rdr <jail> tcp 2001 22 # Redirects tcp port 2001 on host to 22 on jail
@@ -150,7 +195,7 @@ The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
   bastille rdr <jail> clear       # Clear dynamic rdr rules
 
   Note that if you are redirecting ports where the host is also listening
-  (eg. ssh) you should make sure that the host service is not listening on 
+  (eg. ssh) you should make sure that the host service is not listening on
   the cloned interface - eg. for ssh set sshd_flags in rc.conf
 
   sshd_flags="-o ListenAddress=<hostname>"

docs/chapters/subcommands/bootstrap.rst

@@ -1,3 +1,4 @@
+=========
 bootstrap
 =========
 
@@ -25,9 +26,8 @@ To `bootstrap` a release, run the bootstrap sub-command with the
 release version as the argument.
 
 .. code-block:: shell
-    
+
-  ishmael ~ # bastille bootstrap 11.3-RELEASE [update]
+  ishmael ~ # bastille bootstrap 11.4-RELEASE [update]
-  ishmael ~ # bastille bootstrap 12.0-RELEASE
   ishmael ~ # bastille bootstrap 12.1-RELEASE
 
 This command will ensure the required directory structures are in place and

docs/chapters/subcommands/clone.rst

@@ -0,0 +1,17 @@
+=====
+clone
+=====
+
+To clone a container and make a duplicate use the `bastille clone`
+sub-command..
+
+.. code-block:: shell
+
+  ishmael ~ # bastille clone azkaban rikers ip
+  [azkaban]:
+
+Syntax requires a name for the new container and an IP address assignment.
+
+.. code-block:: shell
+
+  Usage: bastille clone [TARGET] [NEW_NAME] [IPADRESS].

docs/chapters/subcommands/cmd.rst

@@ -6,7 +6,7 @@ To execute commands within the container you can use `bastille cmd`.
 
 .. code-block:: shell
 
-  ishmael ~ # bastille cmd folsom 'ps -auxw'
+  ishmael ~ # bastille cmd folsom ps -auxw
   [folsom]:
   USER   PID %CPU %MEM   VSZ  RSS TT  STAT STARTED    TIME COMMAND
   root 71464  0.0  0.0 14536 2000  -  IsJ   4:52PM 0:00.00 /usr/sbin/syslogd -ss

docs/chapters/subcommands/console.rst

@@ -1,3 +1,4 @@
+=======
 console
 =======
 
@@ -8,27 +9,6 @@ root login.
 
   ishmael ~ # bastille console folsom
   [folsom]:
-  FreeBSD 12.1-RELEASE-p1 GENERIC
-  
-  Welcome to FreeBSD!
-  
-  Release Notes, Errata: https://www.FreeBSD.org/releases/
-  Security Advisories:   https://www.FreeBSD.org/security/
-  FreeBSD Handbook:      https://www.FreeBSD.org/handbook/
-  FreeBSD FAQ:           https://www.FreeBSD.org/faq/
-  Questions List: https://lists.FreeBSD.org/mailman/listinfo/freebsd-questions/
-  FreeBSD Forums:        https://forums.FreeBSD.org/
-  
-  Documents installed with the system are in the /usr/local/share/doc/freebsd/
-  directory, or can be installed later with:  pkg install en-freebsd-doc
-  For other languages, replace "en" with a language code like de or fr.
-  
-  Show the version of FreeBSD installed:  freebsd-version ; uname -a
-  Please include that output and any error messages when posting questions.
-  Introduction to manual pages:  man man
-  FreeBSD directory layout:      man hier
-  
-  Edit /etc/motd to change this login announcement.
   root@folsom:~ #
 
 At this point you are logged in to the container and have full shell access.  The

docs/chapters/subcommands/convert.rst

@@ -0,0 +1,16 @@
+=======
+convert
+=======
+
+To convert a thin container to a thick container use `bastille convert`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille convert azkaban
+  [azkaban]:
+
+Syntax requires only the target container to convert.
+
+.. code-block:: shell
+
+  Usage: bastille convert TARGET

docs/chapters/subcommands/cp.rst

@@ -1,3 +1,4 @@
+==
 cp
 ==
 
@@ -7,15 +8,15 @@ This command allows efficiently copying files from host to container(s).
 
   ishmael ~ # bastille cp ALL /tmp/resolv.conf-cf etc/resolv.conf
   [bastion]:
-  
+
   [unbound0]:
-  
+
   [unbound1]:
-  
+
   [squid]:
-  
+
   [nginx]:
-  
+
   [folsom]:
 
 Unless you see errors reported in the output the `cp` was successful.

docs/chapters/subcommands/create.rst

@@ -1,3 +1,4 @@
+======
 create
 ======
 
@@ -13,7 +14,7 @@ bootstrapped release and a private (rfc1918) IP address.
 .. code-block:: shell
 
   ishmael ~ # bastille create folsom 11.3-RELEASE 10.17.89.10 [interface]
-  
+
   RELEASE: 11.3-RELEASE.
   NAME: folsom.
   IP: 10.17.89.10.

docs/chapters/subcommands/destroy.rst

@@ -1,3 +1,4 @@
+=======
 destroy
 =======
 

docs/chapters/subcommands/edit.rst

@@ -0,0 +1,16 @@
+====
+edit
+====
+
+To edit container configuration use `bastille edit`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille edit azkaban [filename]
+
+Syntax requires a target an optional filename. By default the file edited will
+be `jail.conf`. Other common filenames are `fstab` or `rctl.conf`.
+
+.. code-block:: shell
+
+  Usage: bastille edit TARGET

docs/chapters/subcommands/export.rst

@@ -0,0 +1,18 @@
+======
+export
+======
+
+Exporting a container creates an archive or image that can be sent to a
+different machine to be imported later. These exported archives can be used as
+container backups.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille export azkaban
+
+The export sub-command supports both UFS and ZFS storage. ZFS based containers
+will use ZFS snapshots. UFS based containers will use `txz` archives.
+
+.. code-block:: shell
+
+  Usage: bastille export TARGET

docs/chapters/subcommands/htop.rst

@@ -2,7 +2,7 @@
 htop
 ====
 
-This one runs `htop` inside the container. 
+This one runs `htop` inside the container.
 note: won't work if you don't have htop installed in the container.
 
 

docs/chapters/subcommands/import.rst

@@ -0,0 +1,16 @@
+======
+import
+======
+
+Import a container backup image or archive.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille import /path/to/archive.file
+
+The import sub-command supports both UFS and ZFS storage. ZFS based containers
+will use ZFS snapshots. UFS based containers will use `txz` archives.
+
+.. code-block:: shell
+
+  Usage: bastille import file [option]

docs/chapters/subcommands/index.rst

@@ -7,18 +7,27 @@ Bastille sub-commands
 
    bootstrap
    cmd
+   clone
    console
+   convert
    cp
    create
    destroy
+   edit
+   export
    htop
+   import
+   mount
    pkg
+   rdr
+   rename
    restart
    service
    start
    stop
    sysrc
    top
+   umount
    update
    upgrade
    verify

docs/chapters/subcommands/mount.rst

@@ -0,0 +1,16 @@
+=====
+mount
+=====
+
+To mount storage within the container use `bastille mount`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille mount azkaban /storage/foo /media/foo nullfs ro 0 0
+  [azkaban]:
+
+Syntax follows standard `/etc/fstab` format:
+
+.. code-block:: shell
+
+  Usage: bastille mount TARGET host_path container_path [filesystem_type options dump pass_number]

docs/chapters/subcommands/pkg.rst

@@ -23,7 +23,7 @@ To manage binary packages within the container use `bastille pkg`.
   All repositories are up to date.
   Updating database digests format: 100%
   The following 10 package(s) will be affected (of 0 checked):
-  
+
   New packages to be INSTALLED:
       vim-console: 8.1.0342
       git-lite: 2.19.1
@@ -35,12 +35,12 @@ To manage binary packages within the container use `bastille pkg`.
       pcre: 8.42
       gettext-runtime: 0.19.8.1_1
       indexinfo: 0.3.1
-  
+
   Number of packages to be installed: 10
-  
+
   The process will require 77 MiB more space.
   17 MiB to be downloaded.
-  
+
   Proceed with this action? [y/N]: y
   [folsom] [1/10] Fetching vim-console-8.1.0342.txz: 100%    5 MiB   5.8MB/s    00:01
   [folsom] [2/10] Fetching git-lite-2.19.1.txz: 100%    4 MiB   2.1MB/s    00:02
@@ -77,7 +77,7 @@ To manage binary packages within the container use `bastille pkg`.
   [folsom] [9/10] Extracting git-lite-2.19.1: 100%
   [folsom] [10/10] Installing zsh-5.6.2...
   [folsom] [10/10] Extracting zsh-5.6.2: 100%
-    
+
 
 The PKG sub-command can, of course, do more than just `install`. The
 expectation is that you can fully leverage the pkg manager. This means,
@@ -97,7 +97,7 @@ expectation is that you can fully leverage the pkg manager. This means,
   Processing candidates (1 candidates): 100%
   Checking integrity... done (0 conflicting)
   Your packages are up to date.
-  
+
   [unbound0]:
   Updating pkg.bastillebsd.org repository catalogue...
   [unbound0] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
@@ -109,7 +109,7 @@ expectation is that you can fully leverage the pkg manager. This means,
   Processing candidates (0 candidates): 100%
   Checking integrity... done (0 conflicting)
   Your packages are up to date.
-  
+
   [unbound1]:
   Updating pkg.bastillebsd.org repository catalogue...
   [unbound1] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
@@ -121,7 +121,7 @@ expectation is that you can fully leverage the pkg manager. This means,
   Processing candidates (0 candidates): 100%
   Checking integrity... done (0 conflicting)
   Your packages are up to date.
-  
+
   [squid]:
   Updating pkg.bastillebsd.org repository catalogue...
   [squid] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
@@ -133,7 +133,7 @@ expectation is that you can fully leverage the pkg manager. This means,
   Processing candidates (0 candidates): 100%
   Checking integrity... done (0 conflicting)
   Your packages are up to date.
-  
+
   [nginx]:
   Updating pkg.bastillebsd.org repository catalogue...
   [nginx] Fetching meta.txz: 100%    560 B   0.6kB/s    00:01
@@ -144,14 +144,14 @@ expectation is that you can fully leverage the pkg manager. This means,
   Checking for upgrades (1 candidates): 100%
   Processing candidates (1 candidates): 100%
   The following 1 package(s) will be affected (of 0 checked):
-  
+
   Installed packages to be UPGRADED:
       nginx-lite: 1.14.0_14,2 -> 1.14.1,2
-  
+
   Number of packages to be upgraded: 1
-  
+
   315 KiB to be downloaded.
-  
+
   Proceed with this action? [y/N]: y
   [nginx] [1/1] Fetching nginx-lite-1.14.1,2.txz: 100%  315 KiB 322.8kB/s    00:01
   Checking integrity... done (0 conflicting)

docs/chapters/subcommands/rdr.rst

@@ -3,12 +3,12 @@ rdr
 ===
 
 `bastille rdr` allows you to configure dynamic rdr rules for your containers
-without modifying pf.conf (assuming you are using the `bastille0` interface 
+without modifying pf.conf (assuming you are using the `bastille0` interface
-for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf 
+for a private network and have enabled `rdr-anchor 'rdr/*'` in /etc/pf.conf
 as described in the Networking section).
 
-Note: you need to be careful if host services are configured to run 
+Note: you need to be careful if host services are configured to run
-on all interfaces as this will include the jail interface - you should 
+on all interfaces as this will include the jail interface - you should
 sepcify the interface they run on in rc.conf (or other config files)
 
 .. code-block:: shell
@@ -24,5 +24,3 @@ sepcify the interface they run on in rc.conf (or other config files)
     rdr on em0 inet proto udp from any to any port = 2053 -> 10.17.89.1 port 53
     # bastille rdr dev1 clear
     nat cleared
-
-

docs/chapters/subcommands/rename.rst

@@ -0,0 +1,13 @@
+======
+rename
+======
+
+Rename a container.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille rename azkaban arkham
+
+.. code-block:: shell
+
+  Usage: bastille rename TARGET new_name

docs/chapters/subcommands/restart.rst

@@ -1,3 +1,4 @@
+=======
 restart
 =======
 
@@ -8,6 +9,6 @@ To restart a container you can use the `bastille restart` command.
   ishmael ~ # bastille restart folsom
   [folsom]:
   folsom: removed
-  
+
   [folsom]:
   folsom: created

docs/chapters/subcommands/start.rst

@@ -1,3 +1,4 @@
+=====
 start
 =====
 

docs/chapters/subcommands/stop.rst

@@ -1,3 +1,4 @@
+====
 stop
 ====
 

docs/chapters/subcommands/top.rst

@@ -2,7 +2,7 @@
 top
 ===
 
-This one runs `top` in that container. 
+This one runs `top` in that container.
 
 
 .. image:: ../../images/top.png

docs/chapters/subcommands/umount.rst

@@ -0,0 +1,16 @@
+======
+umount
+======
+
+To unmount storage from a container use `bastille umount`.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille umount azkaban /media/foo
+  [azkaban]:
+
+Syntax requires only the container path to unmount:
+
+.. code-block:: shell
+
+  Usage: bastille umount TARGET container_path

docs/chapters/subcommands/update.rst

@@ -16,7 +16,7 @@ If no updates are available, a message will be shown:
   Fetching metadata index... done.
   Inspecting system... done.
   Preparing to download files... done.
-  
+
   No updates needed to update system to 11.2-RELEASE-p4.
   No updates are available to install.
 
@@ -34,7 +34,7 @@ The older the release, however, the more updates will be available:
   Fetching 2 metadata files... done.
   Inspecting system... done.
   Preparing to download files... done.
-  
+
   The following files will be added as part of updating to 10.4-RELEASE-p13:
   ...[snip]...
 

docs/chapters/subcommands/upgrade.rst

@@ -7,5 +7,4 @@ workflow this can be similar to a `bootstrap`.
 
 .. code-block:: shell
 
-  ishmael ~ # bastille upgrade 11.2-RELEASE 12.0-RELEASE
+  ishmael ~ # bastille upgrade 12.0-RELEASE 12.1-RELEASE
-

docs/chapters/targeting.rst

@@ -1,12 +1,12 @@
 Targeting
 =========
 
-Bastille uses a `command-target-args` syntax, meaning that each command
+Bastille uses a `command target arguments` syntax, meaning that each command
 requires a target. Targets are usually containers, but can also be releases.
 
-Targeting a containers is done by providing the exact containers name.
+Targeting a container is done by providing the exact containers name.
 
-Targeting a release is done by providing the release name. (Note: do note
+Targeting a release is done by providing the release name. (Note: do not
 include the `-pX` point-release version.)
 
 Bastille includes a pre-defined keyword ALL to target all running containers.
@@ -25,24 +25,24 @@ Examples: Containers
 | command   | target | args             | description                                                 |
 +===========+========+==================+=============================================================+
 | cmd       | ALL    | 'sockstat -4'    | execute `sockstat -4` in ALL containers (ip4 sockets)       |
-+-----------+--------+-----+------------+-------------------------------------------------------------+ 
++-----------+--------+-----+------------+-------------------------------------------------------------+
 | console   | mariadb02    | ---        | console (shell) access to mariadb02                         |
-+----+------+----+---------+------------+--------------+----------------------------------------------+ 
++----+------+----+---------+------------+--------------+----------------------------------------------+
 | pkg       | web01  | 'install nginx'  | install nginx package in web01 container                    |
 +-----------+--------+------------------+-------------------------------------------------------------+
 | pkg       | ALL    | upgrade          | upgrade packages in ALL containers                          |
-+-----------+--------+------------------+-------------------------------------------------------------+ 
++-----------+--------+------------------+-------------------------------------------------------------+
 | pkg       | ALL    | audit            | (CVE) audit packages in ALL containers                      |
-+-----------+--------+------------------+-------------------------------------------------------------+ 
++-----------+--------+------------------+-------------------------------------------------------------+
 | sysrc     | web01  | nginx_enable=YES | execute `sysrc nginx_enable=YES` in web01 container         |
-+-----------+--------+------------------+-------------------------------------------------------------+ 
++-----------+--------+------------------+-------------------------------------------------------------+
 | template  | ALL    | username/base    | apply `username/base` template to ALL containers            |
-+-----------+--------+------------------+-------------------------------------------------------------+ 
++-----------+--------+------------------+-------------------------------------------------------------+
 | start     | web02  | ---              | start web02 container                                       |
-+-----------+--------+-----+------------+-------------------------------------------------------------+ 
++-----------+--------+-----+------------+-------------------------------------------------------------+
 | cp | bastion03 | /tmp/resolv.conf-cf etc/resolv.conf | copy host-path to container-path in bastion03|
-+----+------+----+---+------------------+--------------+----------------------------------------------+ 
++----+------+----+---+------------------+--------------+----------------------------------------------+
-| create    | folsom | 12.0-RELEASE 10.17.89.10        | create 12.0 container named `folsom` with IP |
+| create    | folsom | 12.1-RELEASE 10.17.89.10        | create 12.1 container named `folsom` with IP |
 +-----------+--------+------------------+--------------+----------------------------------------------+
 
 
@@ -56,11 +56,11 @@ Examples: Releases
 +-----------+--------------+--------------+-------------------------------------------------------------+
 | command   | target       | args         | description                                                 |
 +===========+==============+==============+=============================================================+
-| bootstrap | 12.0-RELEASE | ---          | bootstrap 12.0-RELEASE release                              |
+| bootstrap | 12.1-RELEASE | ---          | bootstrap 12.1-RELEASE release                              |
-+-----------+--------------+--------------+-------------------------------------------------------------+ 
++-----------+--------------+--------------+-------------------------------------------------------------+
-| update    | 11.3-RELEASE | ---          | update 11.2-RELEASE release                                 |
+| update    | 11.4-RELEASE | ---          | update 11.4-RELEASE release                                 |
-+-----------+--------------+--------------+-------------------------------------------------------------+ 
++-----------+--------------+--------------+-------------------------------------------------------------+
-| upgrade   | 11.2-RELEASE | 11.3-RELEASE | update 11.2-RELEASE release                                 |
+| upgrade   | 11.3-RELEASE | 11.4-RELEASE | update 11.4-RELEASE release                                 |
-+-----------+--------------+--------------+-------------------------------------------------------------+ 
++-----------+--------------+--------------+-------------------------------------------------------------+
-| verify    | 11.3-RELEASE | ---          | update 11.2-RELEASE release                                 |
+| verify    | 11.4-RELEASE | ---          | update 11.4-RELEASE release                                 |
-+-----------+--------------+--------------+-------------------------------------------------------------+ 
++-----------+--------------+--------------+-------------------------------------------------------------+

docs/chapters/template.rst

@@ -9,27 +9,20 @@ execute commands inside the containers automatically.
 
 Currently supported template hooks are: `LIMITS`, `INCLUDE`, `PRE`, `FSTAB`,
 `PKG`, `OVERLAY`, `SYSRC`, `SERVICE`, `CMD`.
-Planned template hooks include: `PF`, `LOG`.
 
 Templates are created in `${bastille_prefix}/templates` and can leverage any of
-the template hooks. Simply create a new directory named after the template. eg;
+the template hooks.
 
-.. code-block:: shell
+Bastille 0.7.x
-
+--------------
-  mkdir -p /usr/local/bastille/templates/username/base
+Bastille 0.7.x introduces a template syntax that is more flexible and allows
-
+any-order scripting. Previous versions had a hard template execution order and
-To leverage a template hook, create an UPPERCASE file in the root of the
+instructions were spread across multiple files. The new syntax is done in a
-template directory named after the hook you want to execute. eg;
+`Bastillefile` and the template hook (see below) files are replaced with
-
+template hook commands.
-.. code-block:: shell
-
-  echo "zsh vim-console git-lite htop" > /usr/local/bastille/templates/username/base/PKG
-  echo "/usr/bin/chsh -s /usr/local/bin/zsh" > /usr/local/bastille/templates/username/base/CMD
-  echo "usr" > /usr/local/bastille/templates/username/base/OVERLAY
-
-Template hooks are executed in specific order and require specific syntax to
-work as expected. This table outlines those requirements:
 
+Template Automation Hooks
+-------------------------
 
 +---------+-------------------+-----------------------------------------+
 | HOOK    | format            | example                                 |
@@ -56,13 +49,16 @@ work as expected. This table outlines those requirements:
 Note: SYSRC requires that NO quotes be used or that quotes (`"`) be escaped
 ie; (`\\"`)
 
+Place these uppercase template hook commands into a `Bastillefile` in any order
+and automate container setup as needed.
+
 In addition to supporting template hooks, Bastille supports overlaying
 files into the container. This is done by placing the files in their full path,
 using the template directory as "/".
 
-An example here may help. Think of `bastille/templates/username/base`, our
+An example here may help. Think of `bastille/templates/username/template`, our
 example template, as the root of our filesystem overlay. If you create an
-`etc/hosts` or `etc/resolv.conf` *inside* the base template directory, these
+`etc/hosts` or `etc/resolv.conf` *inside* the template directory, these
 can be overlayed into your container.
 
 Note: due to the way FreeBSD segregates user-space, the majority of your
@@ -75,7 +71,7 @@ use, be sure to include `usr` in the template OVERLAY definition. eg;
 
 .. code-block:: shell
 
-  echo "usr" > /usr/local/bastille/templates/username/base/OVERLAY
+  echo "usr" > /usr/local/bastille/templates/username/template/OVERLAY
 
 The above example "usr" will include anything under "usr" inside the template.
 You do not need to list individual files. Just include the top-level directory
@@ -92,7 +88,7 @@ directory names in the `bastille/templates` directory.
 
 .. code-block:: shell
 
-  ishmael ~ # bastille template ALL username/base
+  ishmael ~ # bastille template ALL username/template
   [proxy01]:
   Copying files...
   Copy complete.
@@ -115,7 +111,7 @@ directory names in the `bastille/templates` directory.
   Executing final command(s).
   chsh: user information updated
   Template Complete.
-  
+
   [web01]:
   Copying files...
   Copy complete.
@@ -143,4 +139,3 @@ directory names in the `bastille/templates` directory.
   Executing final command(s).
   chsh: user information updated
   Template Complete.
-

docs/chapters/usage.rst

@@ -3,35 +3,45 @@ Usage
 
 .. code-block:: shell
 
-    ishmael ~ # bastille -h
+    ishmael ~ # bastille help
     Bastille is an open-source system for automating deployment and management of
     containerized applications on FreeBSD.
-    
+
     Usage:
-      bastille command [ALL|glob] [args]
+      bastille command TARGET [args]
-    
+
     Available Commands:
       bootstrap   Bootstrap a FreeBSD release for container base.
       cmd         Execute arbitrary command on targeted container(s).
+      clone       Clone an existing container.
       console     Console into a running container.
+      convert     Convert a Thin container into a Thick container.
       cp          cp(1) files from host to targeted container(s).
       create      Create a new thin container or a thick container if -T|--thick option specified.
       destroy     Destroy a stopped container or a FreeBSD release.
-      help        Help about any command
+      edit        Edit container configuration files (advanced).
+      export      Exports a specified container.
+      help        Help about any command.
       htop        Interactive process viewer (requires htop).
-      list        List containers, releases, templates, or logs.
+      import      Import a specified container.
+      list        List containers (running and stopped).
+      mount       Mount a volume inside the targeted container(s).
       pkg         Manipulate binary packages within targeted container(s). See pkg(8).
+      rdr         Redirect host port to container port.
+      rename      Rename a container.
       restart     Restart a running container.
-      service     Manage services within targeted containers(s).
+      service     Manage services within targeted container(s).
       start       Start a stopped container.
       stop        Stop a running container.
       sysrc       Safely edit rc files within targeted container(s).
       template    Apply file templates to targeted container(s).
       top         Display and update information about the top(1) cpu processes.
+      umount      Unmount a volume from within the targeted container(s).
       update      Update container base -pX release.
       upgrade     Upgrade container release to X.Y-RELEASE.
       verify      Compare release against a "known good" index.
       zfs         Manage (get|set) zfs attributes on targeted container(s).
-    
+
     Use "bastille -v|--version" for version information.
     Use "bastille command -h|--help" for more information about a command.
+

docs/conf.py

@@ -12,9 +12,9 @@ copyright = '2018-2020, Christer Edwards'
 author = 'Christer Edwards'
 
 # The short X.Y version
-version = '0.6.20200202'
+version = '0.7.20200714'
 # The full version, including alpha/beta/rc tags
-release = '0.6.20200202-beta'
+release = '0.7.20200714-beta'
 
 
 # -- General configuration ---------------------------------------------------

usr/local/bin/bastille

@@ -2,21 +2,21 @@
 #
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -28,14 +28,17 @@
 # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+PATH=${PATH}:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+
+bastille_colors_pre() {
+    ## so we can make it colorful
+    . /usr/local/share/bastille/colors.pre.sh
+}
 
 ## root check first.
 bastille_root_check() {
     if [ "$(id -u)" -ne 0 ]; then
-        ## so we can make it colorful
+        bastille_colors_pre
-        . /usr/local/share/bastille/colors.pre.sh
-
         ## permission denied
         echo -e "${COLOR_RED}Bastille: Permission Denied${COLOR_RESET}" 1>&2
         echo -e "${COLOR_RED}root / sudo / doas required${COLOR_RESET}" 1>&2
@@ -45,9 +48,19 @@ bastille_root_check() {
 
 bastille_root_check
 
-## we only load the config if root_check passes
+## check for config existance
+bastille_conf_check() {
+    if [ ! -r "/usr/local/etc/bastille/bastille.conf" ]; then
+        bastille_colors_pre
+        echo -e "${COLOR_RED}Missing Configuration${COLOR_RESET}" 1>&2
+        exit 1
+    fi
+}
+
+bastille_conf_check
+
+## we only load the config if conf_check passes
 . /usr/local/etc/bastille/bastille.conf
-. /usr/local/share/bastille/colors.pre.sh
 
 ## bastille_prefix should be 0750
 ## this restricts file system access to privileged users
@@ -55,6 +68,7 @@ bastille_perms_check() {
     if [ -d "${bastille_prefix}" ]; then
         BASTILLE_PREFIX_PERMS=$(stat -f "%Op" "${bastille_prefix}")
         if [ "${BASTILLE_PREFIX_PERMS}" != 40750 ]; then
+            bastille_colors_pre
             echo -e "${COLOR_RED}Insecure permissions on ${bastille_prefix}${COLOR_RESET}" 1>&2
             echo -e "${COLOR_RED}Try: chmod 0750 ${bastille_prefix}${COLOR_RESET}" 1>&2
             echo
@@ -65,11 +79,8 @@ bastille_perms_check() {
 
 bastille_perms_check
 
-## we only load the config if root_check passes
-. /usr/local/etc/bastille/bastille.conf
-
 ## version
-BASTILLE_VERSION="0.6.20200202"
+BASTILLE_VERSION="0.7.20200714"
 
 usage() {
     cat << EOF
@@ -82,18 +93,22 @@ Usage:
 Available Commands:
   bootstrap   Bootstrap a FreeBSD release for container base.
   cmd         Execute arbitrary command on targeted container(s).
+  clone       Clone an existing container.
   console     Console into a running container.
   convert     Convert a Thin container into a Thick container.
   cp          cp(1) files from host to targeted container(s).
   create      Create a new thin container or a thick container if -T|--thick option specified.
   destroy     Destroy a stopped container or a FreeBSD release.
+  edit        Edit container configuration files (advanced).
   export      Exports a specified container.
   help        Help about any command.
   htop        Interactive process viewer (requires htop).
   import      Import a specified container.
   list        List containers (running and stopped).
+  mount       Mount a volume inside the targeted container(s).
   pkg         Manipulate binary packages within targeted container(s). See pkg(8).
   rdr         Redirect host port to container port.
+  rename      Rename a container.
   restart     Restart a running container.
   service     Manage services within targeted container(s).
   start       Start a stopped container.
@@ -101,6 +116,7 @@ Available Commands:
   sysrc       Safely edit rc files within targeted container(s).
   template    Apply file templates to targeted container(s).
   top         Display and update information about the top(1) cpu processes.
+  umount      Unmount a volume from within the targeted container(s).
   update      Update container base -pX release.
   upgrade     Upgrade container release to X.Y-RELEASE.
   verify      Compare release against a "known good" index.
@@ -121,6 +137,7 @@ shift
 # Handle special-case commands first.
 case "${CMD}" in
 version|-v|--version)
+    bastille_colors_pre
     echo -e "${COLOR_GREEN}${BASTILLE_VERSION}${COLOR_RESET}"
     exit 0
     ;;
@@ -131,11 +148,11 @@ esac
 
 # Filter out all non-commands
 case "${CMD}" in
-bootstrap|cmd|console|convert|cp|create)
+bootstrap|clone|cmd|console|convert|cp|create)
     ;;
-destroy|export|htop|import|limits|list)
+destroy|edit|export|htop|import|limits|list|mount)
     ;;
-pkg|rdr|restart|service|start|stop|sysrc)
+pkg|rdr|rename|restart|service|start|stop|sysrc|umount)
     ;;
 template|top|update|upgrade|verify|zfs)
     ;;
@@ -153,5 +170,6 @@ if [ -f "${SCRIPTPATH}" ]; then
 
     exec "${SH}" "${SCRIPTPATH}" "$@"
 else
+    bastille_colors_pre
     echo -e "${COLOR_RED}${SCRIPTPATH} not found.${COLOR_RESET}" 1>&2
 fi

usr/local/etc/bastille/bastille.conf.sample

@@ -3,22 +3,29 @@
 #####################
 
 ## default paths
-bastille_prefix=/usr/local/bastille                                   ## default: "/usr/local/bastille"
+bastille_prefix="/usr/local/bastille"                                 ## default: "/usr/local/bastille"
-bastille_backupsdir=${bastille_prefix}/backups                        ## default: ${bastille_prefix}/backups
+bastille_backupsdir="${bastille_prefix}/backups"                      ## default: "${bastille_prefix}/backups"
-bastille_cachedir=${bastille_prefix}/cache                            ## default: ${bastille_prefix}/cache
+bastille_cachedir="${bastille_prefix}/cache"                          ## default: "${bastille_prefix}/cache"
-bastille_jailsdir=${bastille_prefix}/jails                            ## default: ${bastille_prefix}/jails
+bastille_jailsdir="${bastille_prefix}/jails"                          ## default: "${bastille_prefix}/jails"
-bastille_logsdir=${bastille_prefix}/logs                              ## default: ${bastille_prefix}/logs
+bastille_releasesdir="${bastille_prefix}/releases"                    ## default: "${bastille_prefix}/releases"
-bastille_releasesdir=${bastille_prefix}/releases                      ## default: ${bastille_prefix}/releases
+bastille_templatesdir="${bastille_prefix}/templates"                  ## default: "${bastille_prefix}/templates"
-bastille_templatesdir=${bastille_prefix}/templates                    ## default: ${bastille_prefix}/templates
+bastille_logsdir="/var/log/bastille"                                  ## default: "/var/log/bastille"
 
 ## bastille scripts directory (assumed by bastille pkg)
-bastille_sharedir=/usr/local/share/bastille                           ## default: "/usr/local/share/bastille"
+bastille_sharedir="/usr/local/share/bastille"                         ## default: "/usr/local/share/bastille"
 
-## bootstrap archives (base, lib32, ports, src, test)
+## bootstrap archives, which components of the OS to install.
+## base  - The base OS, kernel + userland
+## lib32 - Libraries for compatibility with 32 bit binaries
+## ports - The FreeBSD ports (3rd party applications) tree
+## src   - The source code to the kernel + userland
+## test  - The FreeBSD test suite
+## this is a whitespace separated list:
+## bastille_bootstrap_archives="base lib32 ports src test"
 bastille_bootstrap_archives="base"                                    ## default: "base"
 
 ## default timezone
-bastille_tzdata="etc/UTC"                                             ## default: "etc/UTC"
+bastille_tzdata="Etc/UTC"                                             ## default: "Etc/UTC"
 
 ## default jail resolv.conf
 bastille_resolv_conf="/etc/resolv.conf"                               ## default: "/etc/resolv.conf"
@@ -38,8 +45,6 @@ bastille_compress_xz_options="-0 -v"                                  ## default
 bastille_decompress_xz_options="-c -d -v"                             ## default "-c -d -v"
 
 ## Networking
-bastille_jail_loopback="lo1"                                          ## default: "lo1"
+bastille_network_loopback="bastille0"                                 ## default: "bastille0"
-bastille_jail_interface="bastille0"                                   ## default: "bastille0"
+bastille_network_shared=""                                            ## default: ""
-bastille_jail_external=""                                             ## default: ""
+bastille_network_gateway=""                                           ## default: ""
-bastille_jail_addr="10.17.89.10"                                      ## default: "10.17.89.10"
-bastille_jail_gateway=""                                              ## default: ""

usr/local/share/bastille/bootstrap.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -74,6 +74,7 @@ validate_release_url() {
             echo -e "${COLOR_RED}Unable to fetch MANIFEST, See 'bootstrap urls'.${COLOR_RESET}"
             exit 1
         fi
+        echo -e "${COLOR_GREEN}Bootstrapping ${PLATFORM_OS} distfiles...${COLOR_RESET}"
         bootstrap_directories
         bootstrap_release
     else
@@ -81,106 +82,15 @@ validate_release_url() {
     fi
 }
 
-bootstrap_network_interfaces() {
-
-    ## test for both options empty
-    if [ -z "${bastille_jail_loopback}" ] && [ -z "${bastille_jail_external}" ]; then
-        echo -e "${COLOR_RED}Please set preferred loopback or external interface.${COLOR_RESET}"
-        echo -e "${COLOR_RED}See bastille.conf.${COLOR_RESET}"
-        exit 1
-    fi
-
-    ## test for required variables -- external
-    if [ -z "${bastille_jail_loopback}" ] && [ ! -z "${bastille_jail_external}" ]; then
-
-       ## test for existing interface
-       ifconfig ${bastille_jail_external} 2>&1 >/dev/null
-           if [ $? = 0 ]; then
-
-               ## create ifconfig alias
-               ifconfig ${bastille_jail_external} inet ${bastille_jail_addr} alias && \
-                   echo -e "${COLOR_GREEN}IP alias added to ${bastille_jail_external} successfully.${COLOR_RESET}"
-                   echo
-
-               ## attempt to ping gateway
-               echo -e "${COLOR_YELLOW}Attempting to ping default gateway...${COLOR_RESET}"
-               ping -c3 -t3 -S ${bastille_jail_addr} ${bastille_jail_gateway}
-               if [ $? = 0 ]; then
-                   echo
-                   echo -e "${COLOR_GREEN}External networking appears functional.${COLOR_RESET}"
-                   echo
-               else
-                   echo -e "${COLOR_RED}Unable to ping default gateway.${COLOR_RESET}"
-               fi
-           fi
-    fi
-
-    ## test for required variables -- loopback
-    if [ -z "${bastille_jail_external}" ] && [ ! -z "${bastille_jail_loopback}" ] && \
-       [ ! -z "${bastille_jail_addr}" ]; then
-
-       echo -e "${COLOR_GREEN}Detecting...${COLOR_RESET}"
-       ## test for existing interface
-       ifconfig ${bastille_jail_interface} >&2 >/dev/null
-
-       ## if above return code is 1; create interface
-       if [ $? = 1 ]; then
-           sysrc ifconfig_${bastille_jail_loopback}_name | grep ${bastille_jail_interface} >&2 >/dev/null
-           if [ $? = 1 ]; then
-               echo
-               echo -e "${COLOR_GREEN}Defining secure loopback interface.${COLOR_RESET}"
-               sysrc cloned_interfaces+="${bastille_jail_loopback}" &&
-               sysrc ifconfig_${bastille_jail_loopback}_name="${bastille_jail_interface}"
-               sysrc ifconfig_${bastille_jail_interface}_aliases+="inet ${bastille_jail_addr}/32"
-
-               ## create and name interface; assign address
-               echo
-               echo -e "${COLOR_GREEN}Creating secure loopback interface.${COLOR_RESET}"
-               ifconfig ${bastille_jail_loopback} create name ${bastille_jail_interface}
-               ifconfig ${bastille_jail_interface} up
-               ifconfig ${bastille_jail_interface} inet ${bastille_jail_addr}/32
-
-               ## reload firewall
-               pfctl -f /etc/pf.conf
-
-               ## look for nat rule for bastille_jail_addr
-               echo -e "${COLOR_GREEN}Detecting NAT from bastille0 interface...${COLOR_RESET}"
-               pfctl -s nat | grep nat | grep ${bastille_jail_addr}
-               if [ $? = 0 ]; then
-                   ## test connectivity; ping from bastille_jail_addr
-                   echo
-                   echo -e "${COLOR_YELLOW}Attempting to ping default gateway...${COLOR_RESET}"
-                   ping -c3 -t3 -S ${bastille_jail_addr} ${bastille_jail_gateway}
-                   if [ $? = 0 ]; then
-                       echo
-                       echo -e "${COLOR_GREEN}Private networking appears functional.${COLOR_RESET}"
-                       echo
-                   else
-                       echo -e "${COLOR_RED}Unable to ping default gateway.${COLOR_RESET}"
-                       echo -e "${COLOR_YELLOW}See https://github.com/BastilleBSD/bastille/blob/master/README.md#etcpfconf.${COLOR_RESET}"
-                       echo -e
-                   fi
-               else
-                   echo -e "${COLOR_RED}Unable to detect firewall 'nat' rule.${COLOR_RESET}"
-                   echo -e "${COLOR_YELLOW}See https://github.com/BastilleBSD/bastille/blob/master/README.md#etcpfconf.${COLOR_RESET}"
-               fi
-           else
-               echo -e "${COLOR_RED}Interface ${bastille_jail_loopback} already configured; bailing out.${COLOR_RESET}"
-           fi
-       else
-           echo -e "${COLOR_RED}Interface ${bastille_jail_interface} already active; bailing out.${COLOR_RESET}"
-       fi
-    fi
-}
-
 bootstrap_directories() {
     ## ensure required directories are in place
 
     ## ${bastille_prefix}
     if [ ! -d "${bastille_prefix}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ];then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_prefix} ${bastille_zfs_zpool}/${bastille_zfs_prefix}
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_prefix}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}"
+                chmod 0750 "${bastille_prefix}"
             fi
         else
             mkdir -p "${bastille_prefix}"
@@ -191,8 +101,9 @@ bootstrap_directories() {
     ## ${bastille_backupsdir}
     if [ ! -d "${bastille_backupsdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ];then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_backupsdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/backups
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_backupsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/backups"
+                chmod 0750 "${bastille_backupsdir}"
             fi
         else
             mkdir -p "${bastille_backupsdir}"
@@ -203,9 +114,9 @@ bootstrap_directories() {
     ## ${bastille_cachedir}
     if [ ! -d "${bastille_cachedir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_cachedir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache"
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_cachedir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
             fi
         else
             mkdir -p "${bastille_cachedir}/${RELEASE}"
@@ -213,8 +124,8 @@ bootstrap_directories() {
     ## create subsequent cache/XX.X-RELEASE datasets
     elif [ ! -d "${bastille_cachedir}/${RELEASE}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_cachedir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
             fi
         else
             mkdir -p "${bastille_cachedir}/${RELEASE}"
@@ -224,8 +135,8 @@ bootstrap_directories() {
     ## ${bastille_jailsdir}
     if [ ! -d "${bastille_jailsdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_jailsdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_jailsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails"
             fi
         else
             mkdir -p "${bastille_jailsdir}"
@@ -235,8 +146,8 @@ bootstrap_directories() {
     ## ${bastille_logsdir}
     if [ ! -d "${bastille_logsdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_logsdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/logs
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_logsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/logs"
             fi
         else
             mkdir -p "${bastille_logsdir}"
@@ -246,8 +157,8 @@ bootstrap_directories() {
     ## ${bastille_templatesdir}
     if [ ! -d "${bastille_templatesdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_templatesdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_templatesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates"
             fi
         else
             mkdir -p "${bastille_templatesdir}"
@@ -257,18 +168,19 @@ bootstrap_directories() {
     ## ${bastille_releasesdir}
     if [ ! -d "${bastille_releasesdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_releasesdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases"
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_releasesdir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
             fi
         else
             mkdir -p "${bastille_releasesdir}/${RELEASE}"
         fi
+
     ## create subsequent releases/XX.X-RELEASE datasets
     elif [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_releasesdir}/${RELEASE} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
             fi
        else
            mkdir -p "${bastille_releasesdir}/${RELEASE}"
@@ -281,9 +193,9 @@ bootstrap_release() {
     if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
         ## check distfiles list and skip existing cached files
         bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/base//")
-        bastille_cached_files=$(ls ${bastille_cachedir}/${RELEASE} | grep -v "MANIFEST" | tr -d ".txz")
+        bastille_cached_files=$(ls "${bastille_cachedir}/${RELEASE}" | grep -v "MANIFEST" | tr -d ".txz")
         for distfile in ${bastille_cached_files}; do
-            bastille_bootstrap_archives=$(echo ${bastille_bootstrap_archives} | sed "s/${distfile}//")
+            bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/${distfile}//")
         done
 
         ## check if release already bootstrapped, else continue bootstrapping
@@ -299,48 +211,51 @@ bootstrap_release() {
         ## check if the dist files already exists then extract
         FETCH_VALIDATION="0"
         if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
-            echo -e "${COLOR_GREEN}Extracting FreeBSD ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
+            echo -e "${COLOR_GREEN}Extracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
-            /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
+            if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
-            if [ $? -ne 0 ]; then
+                ## silence motd at container login
+                touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
+                touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
+            else
                 echo -e "${COLOR_RED}Failed to extract ${_archive}.txz.${COLOR_RESET}"
                 exit 1
             fi
         else
-                ## get the manifest for dist files checksum validation
+            ## get the manifest for dist files checksum validation
-                if [ ! -f "${bastille_cachedir}/${RELEASE}/MANIFEST" ]; then
+            if [ ! -f "${bastille_cachedir}/${RELEASE}/MANIFEST" ]; then
-                    fetch ${UPSTREAM_URL}/MANIFEST -o ${bastille_cachedir}/${RELEASE}/MANIFEST || FETCH_VALIDATION="1"
+                fetch "${UPSTREAM_URL}/MANIFEST" -o "${bastille_cachedir}/${RELEASE}/MANIFEST" || FETCH_VALIDATION="1"
-                fi
+            fi
 
-                if [ "${FETCH_VALIDATION}" -ne "0" ]; then
+            if [ "${FETCH_VALIDATION}" -ne "0" ]; then
-                    ## perform cleanup only for stale/empty directories on failure
+                ## perform cleanup only for stale/empty directories on failure
-                    if [ "${bastille_zfs_enable}" = "YES" ]; then
+                if [ "${bastille_zfs_enable}" = "YES" ]; then
-                        if [ ! -z "${bastille_zfs_zpool}" ]; then
+                    if [ -n "${bastille_zfs_zpool}" ]; then
-                            if [ ! "$(ls -A ${bastille_cachedir}/${RELEASE})" ]; then
+                        if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
-                                zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}
+                            zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
-                            fi
-                            if [ ! "$(ls -A ${bastille_releasesdir}/${RELEASE})" ]; then
-                                zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}
-                            fi
-                            fi
                         fi
-                        if [ -d "${bastille_cachedir}/${RELEASE}" ]; then
+                        if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
-                            if [ ! "$(ls -A ${bastille_cachedir}/${RELEASE})" ]; then
+                            zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
-                                rm -rf ${bastille_cachedir}/${RELEASE}
-                            fi
                         fi
-                        if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
-                            if [ ! "$(ls -A ${bastille_releasesdir}/${RELEASE})" ]; then
-                                rm -rf ${bastille_releasesdir}/${RELEASE}
-                            fi
                         fi
-                        echo -e "${COLOR_RED}Bootstrap failed.${COLOR_RESET}"
-                        exit 1
                     fi
+                    if [ -d "${bastille_cachedir}/${RELEASE}" ]; then
+                        if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
+                            rm -rf "${bastille_cachedir}/${RELEASE}"
+                        fi
+                    fi
+                    if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
+                        if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
+                            rm -rf "${bastille_releasesdir}/${RELEASE}"
+                        fi
+                    fi
+                    echo -e "${COLOR_RED}Bootstrap failed.${COLOR_RESET}"
+                    exit 1
+                fi
 
                 ## fetch for missing dist files
                 if [ ! -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
-                    fetch ${UPSTREAM_URL}/${_archive}.txz -o ${bastille_cachedir}/${RELEASE}/${_archive}.txz
+                    fetch "${UPSTREAM_URL}/${_archive}.txz" -o "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
-                    if [ $? -ne 0 ]; then
+                    if [ "$?" -ne 0 ]; then
                         ## alert only if unable to fetch additional dist files
                         echo -e "${COLOR_RED}Failed to fetch ${_archive}.txz.${COLOR_RESET}"
                     fi
@@ -348,11 +263,11 @@ bootstrap_release() {
 
                 ## compare checksums on the fetched dist files
                 if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
-                    SHA256_DIST=$(grep -w "${_archive}.txz" ${bastille_cachedir}/${RELEASE}/MANIFEST | awk '{print $2}')
+                    SHA256_DIST=$(grep -w "${_archive}.txz" "${bastille_cachedir}/${RELEASE}/MANIFEST" | awk '{print $2}')
-                    SHA256_FILE=$(sha256 -q ${bastille_cachedir}/${RELEASE}/${_archive}.txz)
+                    SHA256_FILE=$(sha256 -q "${bastille_cachedir}/${RELEASE}/${_archive}.txz")
                     if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
                         echo -e "${COLOR_RED}Failed validation for ${_archive}.txz, please retry bootstrap!${COLOR_RESET}"
-                        rm ${bastille_cachedir}/${RELEASE}/${_archive}.txz
+                        rm "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
                         exit 1
                     else
                         echo -e "${COLOR_GREEN}Validated checksum for ${RELEASE}:${_archive}.txz.${COLOR_RESET}"
@@ -363,9 +278,12 @@ bootstrap_release() {
 
                 ## extract the fetched dist files
                 if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
-                    echo -e "${COLOR_GREEN}Extracting FreeBSD ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
+                    echo -e "${COLOR_GREEN}Extracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz.${COLOR_RESET}"
-                    /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
+                    if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
-                    if [ $? -ne 0 ]; then
+                        ## silence motd at container login
+                        touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
+                        touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
+                    else
                         echo -e "${COLOR_RED}Failed to extract ${_archive}.txz.${COLOR_RESET}"
                         exit 1
                     fi
@@ -384,8 +302,8 @@ bootstrap_template() {
     ## ${bastille_templatesdir}
     if [ ! -d "${bastille_templatesdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                zfs create ${bastille_zfs_options} -o mountpoint=${bastille_templatesdir} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates
+                zfs create ${bastille_zfs_options} -o mountpoint="${bastille_templatesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates"
             fi
         else
             mkdir -p "${bastille_templatesdir}"
@@ -408,12 +326,12 @@ bootstrap_template() {
             $(which git) clone "${_url}" "${_template}" ||\
                 echo -e "${COLOR_RED}Clone unsuccessful.${COLOR_RESET}"
         elif [ -d "${_template}/.git" ]; then
-            cd ${_template} && $(which git) pull ||\
+            cd "${_template}" && $(which git) pull ||\
                 echo -e "${COLOR_RED}Template update unsuccessful.${COLOR_RESET}"
         fi
     fi
 
-    bastille verify ${_user}/${_repo}
+    bastille verify "${_user}/${_repo}"
 }
 
 HW_MACHINE=$(sysctl hw.machine | awk '{ print $2 }')
@@ -426,44 +344,50 @@ case "${1}" in
     ## check for FreeBSD releases name
     NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
     UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}"
+    PLATFORM_OS="FreeBSD"
     validate_release_url
     ;;
 *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
     ## check for HardenedBSD releases name(previous infrastructure, keep for reference)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
     UPSTREAM_URL="${bastille_url_hardenedbsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-${NAME_VERIFY}"
+    PLATFORM_OS="HardenedBSD"
     validate_release_url
     ;;
 *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
     ## check for HardenedBSD(specific stable build releases)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
-    NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-build-[0-9]\{1,3\}//g')
-    NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
     UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
     validate_release_url
     ;;
-*-stable-build-latest|*-STABLE-BUILD-LATEST)
+*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
     ## check for HardenedBSD(latest stable build release)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest|-STABLE-BUILD-LATEST)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
-    NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-BUILD-LATEST//g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-BUILD-LATEST//g')
-    NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
     UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
     validate_release_url
     ;;
-current-build-[0-9]*|*-CURRENT-BUILD-[0-9]*)
+current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
     ## check for HardenedBSD(specific current build releases)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build|-CURRENT-BUILD)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
-    NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/current-.*/current/g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
-    NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/current-//g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
     UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
     validate_release_url
     ;;
-current-build-latest|*-CURRENT-BUILD-LATEST)
+current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
     ## check for HardenedBSD(latest current build release)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest|-CURRENT-BUILD-LATEST)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
-    NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/current-.*/current/g')
+    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
-    NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/current-//g')
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
     UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    PLATFORM_OS="HardenedBSD"
     validate_release_url
     ;;
 http?://github.com/*/*|http?://gitlab.com/*/*)
@@ -472,9 +396,6 @@ http?://github.com/*/*|http?://gitlab.com/*/*)
     BASTILLE_TEMPLATE_REPO=$(echo "${1}" | awk -F / '{ print $5 }')
     bootstrap_template
     ;;
-network)
-    bootstrap_network_interfaces
-    ;;
 *)
     usage
     ;;

usr/local/share/bastille/clone.sh

@@ -0,0 +1,217 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille clone [TARGET] [NEW_NAME] [IPADRESS].${COLOR_RESET}"
+    exit 1
+}
+
+error_notify() {
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+# Handle special-case commands first
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -ne 3 ]; then
+    usage
+fi
+
+TARGET="${1}"
+NEWNAME="${2}"
+IP="${3}"
+shift
+
+validate_ip() {
+    IPX_ADDR="ip4.addr"
+    IP6_MODE="disable"
+    ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))')
+    if [ -n "${ip6}" ]; then
+        echo -e "${COLOR_GREEN}Valid: (${ip6}).${COLOR_RESET}"
+        IPX_ADDR="ip6.addr"
+        IP6_MODE="new"
+    else
+        local IFS
+        if echo "${IP}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
+            TEST_IP=$(echo "${IP}" | cut -d / -f1)
+            IFS=.
+            set ${TEST_IP}
+            for quad in 1 2 3 4; do
+                if eval [ \$$quad -gt 255 ]; then
+                    echo "Invalid: (${TEST_IP})"
+                    exit 1
+                fi
+            done
+            if ifconfig | grep -qw "${TEST_IP}"; then
+                echo -e "${COLOR_YELLOW}Warning: ip address already in use (${TEST_IP}).${COLOR_RESET}"
+            else
+                echo -e "${COLOR_GREEN}Valid: (${IP}).${COLOR_RESET}"
+            fi
+        else
+            echo -e "${COLOR_RED}Invalid: (${IP}).${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+}
+
+update_jailconf() {
+    # Update jail.conf
+    JAIL_CONFIG="${bastille_jailsdir}/${NEWNAME}/jail.conf"
+    if [ -f "${JAIL_CONFIG}" ]; then
+        if ! grep -qw "path = ${bastille_jailsdir}/${NEWNAME}/root;" "${JAIL_CONFIG}"; then
+            sed -i '' "s|host.hostname = ${TARGET};|host.hostname = ${NEWNAME};|" "${JAIL_CONFIG}"
+            sed -i '' "s|exec.consolelog = .*;|exec.consolelog = ${bastille_logsdir}/${NEWNAME}_console.log;|" "${JAIL_CONFIG}"
+            sed -i '' "s|path = .*;|path = ${bastille_jailsdir}/${NEWNAME}/root;|" "${JAIL_CONFIG}"
+            sed -i '' "s|mount.fstab = .*;|mount.fstab = ${bastille_jailsdir}/${NEWNAME}/fstab;|" "${JAIL_CONFIG}"
+            sed -i '' "s|${TARGET} {|${NEWNAME} {|" "${JAIL_CONFIG}"
+            sed -i '' "s|${IPX_ADDR} = .*;|${IPX_ADDR} = ${IP};|" "${JAIL_CONFIG}"
+        fi
+    fi
+
+    if grep -qw "vnet;" "${JAIL_CONFIG}"; then
+        update_jailconf_vnet
+    fi
+}
+
+update_jailconf_vnet() {
+    bastille_jail_rc_conf="${bastille_jailsdir}/${NEWNAME}/root/etc/rc.conf"
+
+    # Determine number of containers and define an uniq_epair
+    local list_jails_num=$(bastille list jails | wc -l | awk '{print $1}')
+    local num_range=$(expr "${list_jails_num}" + 1)
+    jail_list=$(bastille list jail)
+    for _num in $(seq 0 "${num_range}"); do
+        if [ -n "${jail_list}" ]; then
+            if ! grep -q "e0b_bastille${_num}" "${bastille_jailsdir}"/*/jail.conf; then
+                uniq_epair="bastille${_num}"
+                sed -i '' "s|vnet.interface = e0b_bastille.*;|vnet.interface = e0b_${uniq_epair};|" "${JAIL_CONFIG}"
+                break
+            fi
+        fi
+    done
+
+    # Rename interface to new uniq_epair
+    sed -i '' "s|ifconfig_e0b_bastille.*_name|ifconfig_e0b_${uniq_epair}_name|" "${bastille_jail_rc_conf}"
+
+    # If 0.0.0.0 set DHCP, else set static IP address
+    if [ "${IP}" == "0.0.0.0" ]; then
+        sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="DHCP"
+    else
+        sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="inet ${IP}"
+    fi
+}
+
+update_fstab() {
+    # Update fstab to use the new name
+    FSTAB_CONFIG="${bastille_jailsdir}/${NEWNAME}/fstab"
+    if [ -f "${FSTAB_CONFIG}" ]; then
+        FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+        FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET}/root/.bastille" "${FSTAB_CONFIG}")
+        FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${NEWNAME}/root/.bastille nullfs ro 0 0"
+        if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
+            # If both variables are set, update as needed
+            if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${NEWNAME}/root/.bastille" "${FSTAB_CONFIG}"; then
+                sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" "${FSTAB_CONFIG}"
+            fi
+        fi
+    fi
+}
+
+clone_jail() {
+    # Attempt container clone
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_GREEN}Attempting to clone '${TARGET}' to ${NEWNAME}...${COLOR_RESET}"
+        if ! [ -d "${bastille_jailsdir}/${NEWNAME}" ]; then
+            if [ "${bastille_zfs_enable}" = "YES" ]; then
+                if [ -n "${bastille_zfs_zpool}" ]; then
+                    # Replicate the existing container
+                    DATE=$(date +%F-%H%M%S)
+                    zfs snapshot -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_clone_${DATE}"
+                    zfs send -R "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_clone_${DATE}" | zfs recv "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}"
+
+                    # Cleanup source temporary snapshots
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}/root@bastille_clone_${DATE}"
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_clone_${DATE}"
+
+                    # Cleanup target temporary snapshots
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}/root@bastille_clone_${DATE}"
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}@bastille_clone_${DATE}"
+                fi
+            else
+                # Just clone the jail directory
+                # Check if container is running
+                if [ -n "$(jls name | awk "/^${TARGET}$/")" ]; then
+                    error_notify "${COLOR_RED}${TARGET} is running, See 'bastille stop ${TARGET}'.${COLOR_RESET}"
+                fi
+
+                # Perform container file copy(archive mode)
+                cp -a "${bastille_jailsdir}/${TARGET}" "${bastille_jailsdir}/${NEWNAME}"
+            fi
+        else
+            error_notify "${COLOR_RED}${NEWNAME} already exists.${COLOR_RESET}"
+        fi
+    else
+        error_notify "${COLOR_RED}${TARGET} not found. See bootstrap.${COLOR_RESET}"
+    fi
+
+    # Generate jail configuration files
+    update_jailconf
+    update_fstab
+
+    # Display the exist status
+    if [ "$?" -ne 0 ]; then
+        error_notify "${COLOR_RED}An error has occurred while attempting to clone '${TARGET}'.${COLOR_RESET}"
+    else
+        echo -e "${COLOR_GREEN}Cloned '${TARGET}' to '${NEWNAME}' successfully.${COLOR_RESET}"
+    fi
+}
+
+## don't allow for dots(.) in container names
+if echo "${NEWNAME}" | grep -q "[.]"; then
+    echo -e "${COLOR_RED}Container names may not contain a dot(.)!${COLOR_RESET}"
+    exit 1
+fi
+
+## check if ip address is valid
+if [ -n "${IP}" ]; then
+    validate_ip
+else
+    usage
+fi
+
+clone_jail

usr/local/share/bastille/cmd.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -58,6 +58,6 @@ fi
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    jexec -l ${_jail} $@
+    jexec -l "${_jail}" "$@"
     echo
 done

usr/local/share/bastille/colors.pre.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2014-2015 Bryan Drewery <bdrewery@FreeBSD.org>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
@@ -11,7 +11,7 @@
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
 #    documentation and/or other materials provided with the distribution.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

usr/local/share/bastille/console.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -58,11 +58,11 @@ if [ "${TARGET}" != 'ALL' ]; then
 fi
 
 validate_user() {
-    if jexec -l ${_jail} id "${USER}" >/dev/null 2>&1; then
+    if jexec -l "${_jail}" id "${USER}" >/dev/null 2>&1; then
-        USER_SHELL="$(jexec -l ${_jail} getent passwd "${USER}" | cut -d: -f7)"
+        USER_SHELL="$(jexec -l "${_jail}" getent passwd "${USER}" | cut -d: -f7)"
         if [ -n "${USER_SHELL}" ]; then
-            if jexec -l ${_jail} grep -qwF "${USER_SHELL}" /etc/shells; then
+            if jexec -l "${_jail}" grep -qwF "${USER_SHELL}" /etc/shells; then
-                jexec -l ${_jail} /usr/bin/login -f "${USER}"
+                jexec -l "${_jail}" /usr/bin/login -f "${USER}"
             else
                 echo "Invalid shell for user ${USER}"
             fi
@@ -76,10 +76,10 @@ validate_user() {
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    if [ ! -z "${USER}" ]; then
+    if [ -n "${USER}" ]; then
         validate_user
     else
-        jexec -l ${_jail} /usr/bin/login -f root
+        jexec -l "${_jail}" /usr/bin/login -f root
     fi
     echo
 done

usr/local/share/bastille/convert.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -63,7 +63,7 @@ convert_symlinks() {
         # Retrieve old symlinks temporarily
         for _link in ${SYMLINKS}; do
             if [ -L "${_link}" ]; then
-                mv ${_link} ${_link}.old
+                mv "${_link}" "${_link}.old"
             fi
         done
 
@@ -73,7 +73,7 @@ convert_symlinks() {
                 if [ -d "${bastille_releasesdir}/${RELEASE}/${_link}" ]; then
                     cp -a "${bastille_releasesdir}/${RELEASE}/${_link}" "${bastille_jailsdir}/${TARGET}/root/${_link}"
                 fi
-                if [ $? -ne 0 ]; then
+                if [ "$?" -ne 0 ]; then
                     revert_convert
                 fi
             fi
@@ -82,11 +82,11 @@ convert_symlinks() {
         # Remove the old symlinks on success
         for _link in ${SYMLINKS}; do
             if [ -L "${_link}.old" ]; then
-                rm -r ${_link}.old
+                rm -r "${_link}.old"
             fi
         done
     else
-        error_notify "${COLOR_RED}Release must be bootstrapped first, See `bastille bootstrap`.${COLOR_RESET}"
+        error_notify "${COLOR_RED}Release must be bootstrapped first, See 'bastille bootstrap'.${COLOR_RESET}"
     fi
 }
 
@@ -103,7 +103,7 @@ revert_convert() {
     # Restore previous symlinks
     for _link in ${SYMLINKS}; do
         if [ -L "${_link}.old" ]; then
-            mv ${_link}.old ${_link}
+            mv "${_link}.old" "${_link}"
         fi
     done
     error_notify "${COLOR_GREEN}Changes for '${TARGET}' has been reverted.${COLOR_RESET}"
@@ -115,8 +115,8 @@ start_convert() {
         echo -e "${COLOR_GREEN}Converting '${TARGET}' into a thickjail, this may take a while...${COLOR_RESET}"
 
         # Set some variables
-        RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])' ${bastille_jailsdir}/${TARGET}/fstab)
+        RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${bastille_jailsdir}/${TARGET}/fstab")
-        FSTABMOD=$(grep -w "${bastille_releasesdir}/${RELEASE} ${bastille_jailsdir}/${TARGET}/root/.bastille" ${bastille_jailsdir}/${TARGET}/fstab)
+        FSTABMOD=$(grep -w "${bastille_releasesdir}/${RELEASE} ${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab")
         SYMLINKS="bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/ports usr/sbin usr/share usr/src"
 
         if [ -n "${RELEASE}" ]; then
@@ -127,26 +127,21 @@ start_convert() {
 
             # Comment the line containing .bastille and rename mountpoint
             sed -i '' -E "s|${FSTABMOD}|# Converted from thin to thick container on $(date)|g" "${bastille_jailsdir}/${TARGET}/fstab"
-            mv ${bastille_jailsdir}/${TARGET}/root/.bastille ${bastille_jailsdir}/${TARGET}/root/.bastille.old
+            mv "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/root/.bastille.old"
 
             echo -e "${COLOR_GREEN}Conversion of '${TARGET}' completed successfully!${COLOR_RESET}"
             exit 0
         else
-            error_notify "${COLOR_RED}Can't determine release version, See `bastille bootstrap`.${COLOR_RESET}"
+            error_notify "${COLOR_RED}Can't determine release version, See 'bastille bootstrap'.${COLOR_RESET}"
         fi
-     else
+    else
-        error_notify "${COLOR_RED}${TARGET} not found. See bootstrap.${COLOR_RESET}"
+        error_notify "${COLOR_RED}${TARGET} not found. See 'bastille create'.${COLOR_RESET}"
     fi
 }
 
-# Check compatibility
-if [ -n "$(freebsd-version | grep -i HBSD)" ]; then
-    error_notify "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
-fi
-
 # Check if container is running
 if [ -n "$(jls name | awk "/^${TARGET}$/")" ]; then
-    error_notify "${COLOR_RED}${TARGET} is running, See `bastille stop`.${COLOR_RESET}"
+    error_notify "${COLOR_RED}${TARGET} is running, See 'bastille stop'.${COLOR_RESET}"
 fi
 
 # Check if is a thin container

usr/local/share/bastille/cp.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

usr/local/share/bastille/create.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -36,36 +36,56 @@ usage() {
     exit 1
 }
 
+error_notify() {
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
 running_jail() {
     if [ -n "$(jls name | awk "/^${NAME}$/")" ]; then
-        echo -e "${COLOR_RED}A running jail matches name.${COLOR_RESET}"
+        error_notify "${COLOR_RED}A running jail matches name.${COLOR_RESET}"
-        exit 1
     elif [ -d "${bastille_jailsdir}/${NAME}" ]; then
-        echo -e "${COLOR_RED}Jail: ${NAME} already created.${COLOR_RESET}"
+        error_notify "${COLOR_RED}Jail: ${NAME} already created.${COLOR_RESET}"
-        exit 1
+    fi
+}
+
+validate_name() {
+    local NAME_VERIFY=${NAME}
+    local NAME_SANITY=$(echo "${NAME_VERIFY}" | tr -c -d 'a-zA-Z0-9-_')
+    if [ "${NAME_VERIFY}" != "${NAME_SANITY}" ]; then
+        error_notify "${COLOR_RED}Container names may not contain special characters!${COLOR_RESET}"
     fi
 }
 
 validate_ip() {
-    local IFS
+    IPX_ADDR="ip4.addr"
-    ip=${IP}
+    IP6_MODE="disable"
-    if expr "$ip" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; then
+    ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))')
-      IFS=.
+    if [ -n "${ip6}" ]; then
-      set $ip
+        echo -e "${COLOR_GREEN}Valid: (${ip6}).${COLOR_RESET}"
-      for quad in 1 2 3 4; do
+        IPX_ADDR="ip6.addr"
-        if eval [ \$$quad -gt 255 ]; then
+        IP6_MODE="new"
-          echo "fail ($ip)"
-          exit 1
-        fi
-      done
-      if ifconfig | grep -w "$ip" >/dev/null; then
-        echo -e "${COLOR_YELLOW}Warning: ip address already in use ($ip).${COLOR_RESET}"
-      else
-        echo -e "${COLOR_GREEN}Valid: ($ip).${COLOR_RESET}"      
-      fi
     else
-      echo -e "${COLOR_RED}Invalid: ($ip).${COLOR_RESET}"
+        local IFS
-      exit 1
+        if echo "${IP}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
+            TEST_IP=$(echo "${IP}" | cut -d / -f1)
+            IFS=.
+            set ${TEST_IP}
+            for quad in 1 2 3 4; do
+                if eval [ \$$quad -gt 255 ]; then
+                    echo "Invalid: (${TEST_IP})"
+                    exit 1
+                fi
+            done
+            if ifconfig | grep -qw "${TEST_IP}"; then
+                echo -e "${COLOR_YELLOW}Warning: ip address already in use (${TEST_IP}).${COLOR_RESET}"
+            else
+                echo -e "${COLOR_GREEN}Valid: (${IP}).${COLOR_RESET}"
+            fi
+        else
+            error_notify "${COLOR_RED}Invalid: (${IP}).${COLOR_RESET}"
+        fi
     fi
 }
 
@@ -74,29 +94,13 @@ validate_netif() {
     if echo "${LIST_INTERFACES} VNET" | grep -qwo "${INTERFACE}"; then
         echo -e "${COLOR_GREEN}Valid: (${INTERFACE}).${COLOR_RESET}"
     else
-        echo -e "${COLOR_RED}Invalid: (${INTERFACE}).${COLOR_RESET}"
+        error_notify "${COLOR_RED}Invalid: (${INTERFACE}).${COLOR_RESET}"
-        exit 1
     fi
 }
 
 validate_netconf() {
-    if [ -n "${bastille_jail_loopback}" ] && [ -n "${bastille_jail_interface}" ] && [ -n "${bastille_jail_external}" ]; then
+    if [ -n "${bastille_network_loopback}" ] && [ -n "${bastille_network_shared}" ]; then
-        echo -e "${COLOR_RED}Invalid network configuration.${COLOR_RESET}"
+        error_notify "${COLOR_RED}Invalid network configuration.${COLOR_RESET}"
-        exit 1
-    fi
-    if [ ! -z "${bastille_jail_external}" ]; then
-        break
-    elif [ ! -z "${bastille_jail_loopback}" ] && [ -z "${bastille_jail_external}" ]; then
-        if [ -z "${bastille_jail_interface}" ]; then
-            echo -e "${COLOR_RED}Invalid network configuration.${COLOR_RESET}"
-            exit 1
-        fi
-    elif [ -z "${bastille_jail_loopback}" ] && [ ! -z "${bastille_jail_interface}" ]; then
-        echo -e "${COLOR_RED}Invalid network configuration.${COLOR_RESET}"
-        exit 1
-    elif [ -z "${bastille_jail_external}" ]; then
-        echo -e "${COLOR_RED}Invalid network configuration.${COLOR_RESET}"
-        exit 1
     fi
 }
 
@@ -109,6 +113,80 @@ validate_release() {
     fi
 }
 
+generate_minimal_conf() {
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  host.hostname = ${NAME};
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+}
+EOF
+    touch "${bastille_jail_fstab}"
+}
+
+generate_jail_conf() {
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  devfs_ruleset = 4;
+  enforce_statfs = 2;
+  exec.clean;
+  exec.consolelog = ${bastille_jail_log};
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${NAME};
+  mount.devfs;
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+  securelevel = 2;
+
+  interface = ${bastille_jail_conf_interface};
+  ${IPX_ADDR} = ${IP};
+  ip6 = ${IP6_MODE};
+}
+EOF
+}
+
+generate_vnet_jail_conf() {
+    ## determine number of containers + 1
+    ## iterate num and grep all jail configs
+    ## define uniq_epair
+    local jail_list=$(bastille list jails)
+    if [ -n "${jail_list}" ]; then
+        local list_jails_num=$(echo "${jail_list}" | wc -l | awk '{print $1}')
+        local num_range=$(expr "${list_jails_num}" + 1)
+        for _num in $(seq 0 "${num_range}"); do
+            if ! grep -q "e0b_bastille${_num}" "${bastille_jailsdir}"/*/jail.conf; then
+                uniq_epair="bastille${_num}"
+                break
+            fi
+        done
+    else
+        uniq_epair="bastille0"
+    fi
+
+    ## generate config
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  devfs_ruleset = 13;
+  enforce_statfs = 2;
+  exec.clean;
+  exec.consolelog = ${bastille_jail_log};
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${NAME};
+  mount.devfs;
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+  securelevel = 2;
+
+  vnet;
+  vnet.interface = e0b_${uniq_epair};
+  exec.prestart += "jib addm ${uniq_epair} ${INTERFACE}";
+  exec.poststop += "jib destroy ${uniq_epair}";
+}
+EOF
+}
+
 create_jail() {
     bastille_jail_base="${bastille_jailsdir}/${NAME}/root/.bastille"  ## dir
     bastille_jail_template="${bastille_jailsdir}/${NAME}/root/.template"  ## dir
@@ -121,171 +199,195 @@ create_jail() {
 
     if [ ! -d "${bastille_jailsdir}/${NAME}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                ## create required zfs datasets
+                ## create required zfs datasets, mountpoint inherited from system
-                zfs create ${bastille_zfs_options} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}
+                zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}"
                 if [ -z "${THICK_JAIL}" ]; then
-                    zfs create ${bastille_zfs_options} -o mountpoint=${bastille_jailsdir}/${NAME}/root ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root
+                    zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
                 fi
             fi
         else
-            mkdir -p "${bastille_jailsdir}/${NAME}"
+            mkdir -p "${bastille_jailsdir}/${NAME}/root"
         fi
     fi
 
-    if [ ! -d "${bastille_jail_base}" ]; then
+    if [ -z "${EMPTY_JAIL}" ]; then
-        mkdir -p "${bastille_jail_base}"
+        if [ ! -d "${bastille_jail_base}" ]; then
-    fi
+            mkdir -p "${bastille_jail_base}"
-
-    if [ ! -d "${bastille_jail_path}/usr/home" ]; then
-        mkdir -p "${bastille_jail_path}/usr/home"
-    fi
-
-    if [ ! -d "${bastille_jail_path}/usr/local" ]; then
-        mkdir -p "${bastille_jail_path}/usr/local"
-    fi
-
-    if [ ! -d "${bastille_jail_template}" ]; then
-        mkdir -p "${bastille_jail_template}"
-    fi
-
-    if [ ! -f "${bastille_jail_fstab}" ]; then
-        if [ -z "${THICK_JAIL}" ]; then
-            echo -e "${bastille_releasesdir}/${RELEASE} ${bastille_jail_base} nullfs ro 0 0" > ${bastille_jail_fstab}
-        else
-            touch ${bastille_jail_fstab}
-        fi
-    fi
-
-    if [ ! -f "${bastille_jail_conf}" ]; then
-        if [ -z "${bastille_jail_loopback}" ] && [ ! -z "${bastille_jail_external}" ]; then
-            local bastille_jail_conf_interface=${bastille_jail_external}
-        fi
-        if [ ! -z "${bastille_jail_loopback}" ] && [ -z "${bastille_jail_external}" ]; then
-            local bastille_jail_conf_interface=${bastille_jail_interface}
-        fi
-        if [ ! -z  ${INTERFACE} ]; then
-            local bastille_jail_conf_interface=${INTERFACE}
         fi
 
-        ## generate the jail configuration file 
+        if [ ! -d "${bastille_jail_path}/usr/local" ]; then
-        cat << EOF > ${bastille_jail_conf}
+            mkdir -p "${bastille_jail_path}/usr/local"
-interface = ${bastille_jail_conf_interface};
+        fi
-host.hostname = ${NAME};
-exec.consolelog = ${bastille_jail_log};
-path = ${bastille_jail_path};
-ip6 = disable;
-securelevel = 2;
-devfs_ruleset = 4;
-enforce_statfs = 2;
-exec.start = '/bin/sh /etc/rc';
-exec.stop = '/bin/sh /etc/rc.shutdown';
-exec.clean;
-mount.devfs;
-mount.fstab = ${bastille_jail_fstab};
 
-${NAME} {
+        if [ ! -d "${bastille_jail_template}" ]; then
-	ip4.addr = ${IP};
+            mkdir -p "${bastille_jail_template}"
-}
+        fi
-EOF
-    fi
 
-    ## using relative paths here
+        if [ ! -f "${bastille_jail_fstab}" ]; then
-    ## MAKE SURE WE'RE IN THE RIGHT PLACE
+            if [ -z "${THICK_JAIL}" ]; then
-    cd "${bastille_jail_path}"
+                echo -e "${bastille_releasesdir}/${RELEASE} ${bastille_jail_base} nullfs ro 0 0" > "${bastille_jail_fstab}"
-    echo
+            else
-    echo -e "${COLOR_GREEN}NAME: ${NAME}.${COLOR_RESET}"
+                touch "${bastille_jail_fstab}"
-    echo -e "${COLOR_GREEN}IP: ${IP}.${COLOR_RESET}"
-    if [ ! -z  ${INTERFACE} ]; then
-        echo -e "${COLOR_GREEN}INTERFACE: ${INTERFACE}.${COLOR_RESET}"
-    fi
-    echo -e "${COLOR_GREEN}RELEASE: ${RELEASE}.${COLOR_RESET}"
-    echo
-
-    if [ -z "${THICK_JAIL}" ]; then
-        for _link in bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/sbin usr/share usr/src; do
-            ln -sf /.bastille/${_link} ${_link}
-        done
-    fi
-
-    ## link home properly
-    ln -s usr/home home
-
-    if [ -z "${THICK_JAIL}" ]; then
-        ## rw
-        ## copy only required files for thin jails
-        FILE_LIST=".cshrc .profile COPYRIGHT dev etc media mnt net proc root tmp var usr/obj usr/tests"
-        for files in ${FILE_LIST}; do
-            if [ -f "${bastille_releasesdir}/${RELEASE}/${files}" ] || [ -d "${bastille_releasesdir}/${RELEASE}/${files}" ]; then
-                cp -a "${bastille_releasesdir}/${RELEASE}/${files}" "${bastille_jail_path}/${files}"
-                if [ $? -ne 0 ]; then
-                    ## notify and clean stale files/directories
-                    echo -e "${COLOR_RED}Failed to copy release files, please retry create!${COLOR_RESET}"
-                    bastille destroy ${NAME}
-                    exit 1
-                fi
-            fi
-        done
-    else
-        echo -e "${COLOR_GREEN}Creating a thickjail, this may take a while...${COLOR_RESET}"
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
-                ## perform release base replication
-
-                ## sane bastille zfs options 
-                ZFS_OPTIONS=$(echo ${bastille_zfs_options} | sed 's/-o//g')
-
-                ## take a temp snapshot of the base release
-                SNAP_NAME="bastille-$(date +%Y-%m-%d-%H%M%S)"
-                zfs snapshot ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}@${SNAP_NAME}
-
-                ## replicate the release base to the new thickjail and set the default mountpoint
-                zfs send -R ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}@${SNAP_NAME} | \
-                zfs receive ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root
-                zfs set ${ZFS_OPTIONS} mountpoint=${bastille_jailsdir}/${NAME}/root ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root
-
-                ## cleanup temp snapshots initially
-                zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}@${SNAP_NAME}
-                zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root@${SNAP_NAME}
-
-                if [ $? -ne 0 ]; then
-                    ## notify and clean stale files/directories
-                    echo -e "${COLOR_RED}Failed release base replication, please retry create!${COLOR_RESET}"
-                    bastille destroy ${NAME}
-                    exit 1
-                fi
-            fi
-        else
-            ## copy all files for thick jails
-            cp -a "${bastille_releasesdir}/${RELEASE}/" "${bastille_jail_path}"
-            if [ $? -ne 0 ]; then
-                ## notify and clean stale files/directories
-                echo -e "${COLOR_RED}Failed to copy release files, please retry create!${COLOR_RESET}"
-                bastille destroy ${NAME}
-                exit 1
             fi
         fi
-    fi
 
-    ## rc.conf
+        if [ ! -f "${bastille_jail_conf}" ]; then
-    ##  + syslogd_flags="-ss"
+            if [ -z "${bastille_network_loopback}" ] && [ -n "${bastille_network_shared}" ]; then
-    ##  + sendmail_none="NONE"
+                local bastille_jail_conf_interface=${bastille_network_shared}
-    ##  + cron_flags="-J 60" ## cedwards 20181118
+            fi
-    if [ ! -f "${bastille_jail_rc_conf}" ]; then
+            if [ -n "${bastille_network_loopback}" ] && [ -z "${bastille_network_shared}" ]; then
-        touch "${bastille_jail_rc_conf}"
+                local bastille_jail_conf_interface=${bastille_network_loopback}
-        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" syslogd_flags=-ss
+            fi
-        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" sendmail_enable=NONE
+            if [ -n "${INTERFACE}" ]; then
-        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" cron_flags='-J 60'
+                local bastille_jail_conf_interface=${INTERFACE}
+            fi
+
+            ## generate the jail configuration file
+            if [ -n "${VNET_JAIL}" ]; then
+                generate_vnet_jail_conf
+            else
+                generate_jail_conf
+            fi
+        fi
+
+        ## using relative paths here
+        ## MAKE SURE WE'RE IN THE RIGHT PLACE
+        cd "${bastille_jail_path}"
+        echo
+        echo -e "${COLOR_GREEN}NAME: ${NAME}.${COLOR_RESET}"
+        echo -e "${COLOR_GREEN}IP: ${IP}.${COLOR_RESET}"
+        if [ -n  "${INTERFACE}" ]; then
+            echo -e "${COLOR_GREEN}INTERFACE: ${INTERFACE}.${COLOR_RESET}"
+        fi
+        echo -e "${COLOR_GREEN}RELEASE: ${RELEASE}.${COLOR_RESET}"
         echo
-    fi
 
-    ## resolv.conf (default: copy from host)
+        if [ -z "${THICK_JAIL}" ]; then
-    if [ ! -f "${bastille_jail_resolv_conf}" ]; then
+            LINK_LIST="bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/sbin usr/share usr/src"
-        cp -L ${bastille_resolv_conf} ${bastille_jail_resolv_conf}
+            for _link in ${LINK_LIST}; do
-    fi
+                ln -sf /.bastille/${_link} ${_link}
+            done
+        fi
 
-    ## TZ: configurable (default: etc/UTC)
+        if [ -z "${THICK_JAIL}" ]; then
-    ln -s /usr/share/zoneinfo/${bastille_tzdata} etc/localtime
+            ## rw
+            ## copy only required files for thin jails
+            FILE_LIST=".cshrc .profile COPYRIGHT dev etc media mnt net proc root tmp var usr/obj usr/tests"
+            for files in ${FILE_LIST}; do
+                if [ -f "${bastille_releasesdir}/${RELEASE}/${files}" ] || [ -d "${bastille_releasesdir}/${RELEASE}/${files}" ]; then
+                    cp -a "${bastille_releasesdir}/${RELEASE}/${files}" "${bastille_jail_path}/${files}"
+                    if [ "$?" -ne 0 ]; then
+                        ## notify and clean stale files/directories
+                        bastille destroy "${NAME}"
+                        error_notify "${COLOR_RED}Failed to copy release files, please retry create!${COLOR_RESET}"
+                    fi
+                fi
+            done
+        else
+            echo -e "${COLOR_GREEN}Creating a thickjail, this may take a while...${COLOR_RESET}"
+            if [ "${bastille_zfs_enable}" = "YES" ]; then
+                if [ -n "${bastille_zfs_zpool}" ]; then
+                    ## perform release base replication
+
+                    ## sane bastille zfs options
+                    ZFS_OPTIONS=$(echo ${bastille_zfs_options} | sed 's/-o//g')
+
+                    ## take a temp snapshot of the base release
+                    SNAP_NAME="bastille-$(date +%Y-%m-%d-%H%M%S)"
+                    zfs snapshot "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"@"${SNAP_NAME}"
+
+                    ## replicate the release base to the new thickjail and set the default mountpoint
+                    zfs send -R "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"@"${SNAP_NAME}" | \
+                    zfs receive "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+                    zfs set ${ZFS_OPTIONS} mountpoint=none "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+                    zfs inherit mountpoint "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"
+
+                    ## cleanup temp snapshots initially
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"@"${SNAP_NAME}"
+                    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME}/root"@"${SNAP_NAME}"
+
+                    if [ "$?" -ne 0 ]; then
+                        ## notify and clean stale files/directories
+                        bastille destroy "${NAME}"
+                        error_notify "${COLOR_RED}Failed release base replication, please retry create!${COLOR_RESET}"
+                    fi
+                fi
+            else
+                ## copy all files for thick jails
+                cp -a "${bastille_releasesdir}/${RELEASE}/" "${bastille_jail_path}"
+                if [ "$?" -ne 0 ]; then
+                    ## notify and clean stale files/directories
+                    bastille destroy "${NAME}"
+                    error_notify "${COLOR_RED}Failed to copy release files, please retry create!${COLOR_RESET}"
+                fi
+            fi
+        fi
+
+        ## create home directory if missing
+        if [ ! -d "${bastille_jail_path}/usr/home" ]; then
+            mkdir -p "${bastille_jail_path}/usr/home"
+        fi
+        ## link home properly
+        if [ ! -L "home" ]; then
+            ln -s usr/home home
+        fi
+
+        ## rc.conf
+        ## + syslogd_flags="-ss"
+        ## + sendmail_enable="NO"
+        ## + sendmail_submit_enable="NO"
+        ## + sendmail_outbound_enable="NO"
+        ## + sendmail_msp_queue_enable="NO"
+        ## + cron_flags="-J 60" ## cedwards 20181118
+        if [ ! -f "${bastille_jail_rc_conf}" ]; then
+            touch "${bastille_jail_rc_conf}"
+            sysrc -f "${bastille_jail_rc_conf}" syslogd_flags="-ss"
+            sysrc -f "${bastille_jail_rc_conf}" sendmail_enable="NO"
+            sysrc -f "${bastille_jail_rc_conf}" sendmail_submit_enable="NO"
+            sysrc -f "${bastille_jail_rc_conf}" sendmail_outbound_enable="NO"
+            sysrc -f "${bastille_jail_rc_conf}" sendmail_msp_queue_enable="NO"
+            sysrc -f "${bastille_jail_rc_conf}" cron_flags="-J 60"
+
+            ## VNET specific
+            if [ -n "${VNET_JAIL}" ]; then
+                ## rename interface to generic vnet0
+                uniq_epair=$(grep vnet.interface "${bastille_jailsdir}/${NAME}/jail.conf" | awk '{print $3}' | sed 's/;//')
+                /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" "ifconfig_${uniq_epair}_name"=vnet0
+
+                ## if 0.0.0.0 set DHCP
+                ## else set static address
+                if [ "${IP}" == "0.0.0.0" ]; then
+                    /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="SYNCDHCP"
+                else
+                    /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" ifconfig_vnet0="inet ${IP}"
+                    if [ -n "${bastille_network_gateway}" ]; then
+                        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" defaultrouter="${bastille_network_gateway}"
+                    else
+                        /usr/sbin/sysrc -f "${bastille_jail_rc_conf}" defaultrouter="$(netstat -rn | awk '/default/ {print $2}')"
+                    fi
+                fi
+
+                ## VNET requires jib script
+                if [ ! "$(command -v jib)" ]; then
+                    if [ -f /usr/share/examples/jails/jib ] && [ ! -f /usr/local/bin/jib ]; then
+                        install -m 0544 /usr/share/examples/jails/jib /usr/local/bin/jib
+                    fi
+                fi
+            fi
+        fi
+
+        ## resolv.conf (default: copy from host)
+        if [ ! -f "${bastille_jail_resolv_conf}" ]; then
+            cp -L "${bastille_resolv_conf}" "${bastille_jail_resolv_conf}"
+        fi
+
+        ## TZ: configurable (default: Etc/UTC)
+        ln -s "/usr/share/zoneinfo/${bastille_tzdata}" etc/localtime
+    else
+        ## Generate minimal configuration for empty jail
+        generate_minimal_conf
+    fi
 }
 
 # Handle special-case commands first.
@@ -295,96 +397,129 @@ help|-h|--help)
     ;;
 esac
 
-if [ $(echo $3 | grep '@' ) ]; then
+if echo "$3" | grep '@'; then
-    BASTILLE_JAIL_IP=$(echo $3 | awk -F@ '{print $2}')
+    BASTILLE_JAIL_IP=$(echo "$3" | awk -F@ '{print $2}')
-    BASTILLE_JAIL_INTERFACES=$( echo $3 | awk -F@ '{print $1}')
+    BASTILLE_JAIL_INTERFACES=$( echo "$3" | awk -F@ '{print $1}')
 fi
 
-TYPE="$1"
+## reset this options
-NAME="$2"
+EMPTY_JAIL=""
-RELEASE="$3"
+THICK_JAIL=""
-IP="$4"
+VNET_JAIL=""
-INTERFACE="$5"
 
-## handle additional options
+## handle combined options then shift
-case "${TYPE}" in
+if [ "${1}" = "-T" -o "${1}" = "--thick" -o "${1}" = "thick" ] && \
--T|--thick|thick)
+    [ "${2}" = "-V" -o "${2}" = "--vnet" -o "${2}" = "vnet" ]; then
-    if [ $# -gt 5 ] || [ $# -lt 4 ]; then
+    THICK_JAIL="1"
+    VNET_JAIL="1"
+    shift 2
+else
+    ## handle single options
+    case "${1}" in
+        -E|--empty|empty)
+            shift
+            EMPTY_JAIL="1"
+            ;;
+        -T|--thick|thick)
+            shift
+            THICK_JAIL="1"
+            ;;
+        -V|--vnet|vnet)
+            shift
+            VNET_JAIL="1"
+            ;;
+        -*)
+            echo -e "${COLOR_RED}Unknown Option.${COLOR_RESET}"
+            usage
+            ;;
+    esac
+fi
+
+NAME="$1"
+RELEASE="$2"
+IP="$3"
+INTERFACE="$4"
+
+if [ -n "${EMPTY_JAIL}" ]; then
+    if [ $# -ne 1 ]; then
         usage
     fi
-    THICK_JAIL="0"
+else
-    break
-    ;;
--*)
-    echo -e "${COLOR_RED}Unknown Option.${COLOR_RESET}"
-    usage
-    ;;
-*)
     if [ $# -gt 4 ] || [ $# -lt 3 ]; then
         usage
     fi
-    THICK_JAIL=""
-    NAME="$1"
-    RELEASE="$2"
-    IP="$3"
-    INTERFACE="$4"
-    ;;
-esac
-
-## don't allow for dots(.) in container names
-if [ $(echo "${NAME}" | grep "[.]") ]; then
-    echo -e "${COLOR_RED}Container names may not contain a dot(.)!${COLOR_RESET}"
-    exit 1
 fi
 
-## verify release
+## validate jail name
-case "${RELEASE}" in
+if [ -n "${NAME}" ]; then
-*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+    validate_name
-    ## check for FreeBSD releases name
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
-    validate_release
-    ;;
-*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
-    ## check for HardenedBSD releases name(previous infrastructure)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
-    validate_release
-    ;;
-*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
-    ## check for HardenedBSD(specific stable build releases)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
-    validate_release
-    ;;
-*-stable-build-latest|*-STABLE-BUILD-LATEST)
-    ## check for HardenedBSD(latest stable build release)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest|-STABLE-BUILD-LATEST)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
-    validate_release
-    ;;
-current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
-    ## check for HardenedBSD(specific current build releases)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build|-CURRENT-BUILD)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
-    validate_release
-    ;;
-current-build-latest|CURRENT-BUILD-LATEST)
-    ## check for HardenedBSD(latest current build release)
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest|-CURRENT-BUILD-LATEST)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
-    validate_release
-    ;;
-*)
-    echo -e "${COLOR_RED}Unknown Release.${COLOR_RESET}"
-    usage
-    ;;
-esac
-
-## check for name/root/.bastille
-if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then
-    echo -e "${COLOR_RED}Jail: ${NAME} already created. ${NAME}/root/.bastille exists.${COLOR_RESET}"
-    exit 1
 fi
 
-## check for required release
+if [ -z "${EMPTY_JAIL}" ]; then
-if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+    ## verify release
-    echo -e "${COLOR_RED}Release must be bootstrapped first; see `bastille bootstrap`.${COLOR_RESET}"
+    case "${RELEASE}" in
-    exit 1
+    *-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+        ## check for FreeBSD releases name
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
+        validate_release
+        ;;
+    *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
+        ## check for HardenedBSD releases name(previous infrastructure)
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+        validate_release
+        ;;
+    *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
+        ## check for HardenedBSD(specific stable build releases)
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+        validate_release
+        ;;
+    *-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
+        ## check for HardenedBSD(latest stable build release)
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+        validate_release
+        ;;
+    current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
+        ## check for HardenedBSD(specific current build releases)
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
+        validate_release
+        ;;
+    current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
+        ## check for HardenedBSD(latest current build release)
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+        validate_release
+        ;;
+    *)
+        echo -e "${COLOR_RED}Unknown Release.${COLOR_RESET}"
+        usage
+        ;;
+    esac
+
+    ## check for name/root/.bastille
+    if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then
+        error_notify "${COLOR_RED}Jail: ${NAME} already created. ${NAME}/root/.bastille exists.${COLOR_RESET}"
+    fi
+
+    ## check for required release
+    if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
+        error_notify "${COLOR_RED}Release must be bootstrapped first; see 'bastille bootstrap'.${COLOR_RESET}"
+    fi
+
+    ## check if ip address is valid
+    if [ -n "${IP}" ]; then
+        validate_ip
+    else
+        usage
+    fi
+
+    ## check if interface is valid
+    if [ -n  "${INTERFACE}" ]; then
+        validate_netif
+        validate_netconf
+    else
+        validate_netconf
+    fi
+else
+    echo -e "${COLOR_GREEN}Creating empty jail: ${NAME}.${COLOR_RESET}"
 fi
 
 ## check if a running jail matches name or already exist
@@ -392,18 +527,4 @@ if [ -n "${NAME}" ]; then
     running_jail
 fi
 
-## check if ip address is valid
+create_jail "${NAME}" "${RELEASE}" "${IP}" "${INTERFACE}"
-if [ ! -z "${IP}" ]; then
-    validate_ip
-else
-    usage
-fi
-
-## check if interface is valid
-if [ ! -z  ${INTERFACE} ]; then
-    validate_netif
-else
-    validate_netconf
-fi
-
-create_jail ${NAME} ${RELEASE} ${IP} ${INTERFACE}

usr/local/share/bastille/destroy.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -37,12 +37,13 @@ usage() {
 }
 
 destroy_jail() {
+    local OPTIONS
     bastille_jail_base="${bastille_jailsdir}/${TARGET}"            ## dir
     bastille_jail_log="${bastille_logsdir}/${TARGET}_console.log"  ## file
 
     if [ "$(jls name | awk "/^${TARGET}$/")" ]; then
         if [ "${FORCE}" = "1" ]; then
-            bastille stop ${TARGET}
+            bastille stop "${TARGET}"
         else
             echo -e "${COLOR_RED}Jail running.${COLOR_RESET}"
             echo -e "${COLOR_RED}See 'bastille stop ${TARGET}'.${COLOR_RESET}"
@@ -58,37 +59,48 @@ destroy_jail() {
     if [ -d "${bastille_jail_base}" ]; then
         echo -e "${COLOR_GREEN}Deleting Jail: ${TARGET}.${COLOR_RESET}"
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                if [ ! -z "${TARGET}" ]; then
+                if [ -n "${TARGET}" ]; then
+                    OPTIONS="-r"
+                    if [ "${FORCE}" = "1" ]; then
+                        OPTIONS="-rf"
+                    fi
                     ## remove jail zfs dataset recursively
-                    zfs destroy -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}
+                    zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}"
                 fi
             fi
         fi
 
         if [ -d "${bastille_jail_base}" ]; then
             ## removing all flags
-            chflags -R noschg ${bastille_jail_base}
+            chflags -R noschg "${bastille_jail_base}"
 
             ## remove jail base
-            rm -rf ${bastille_jail_base}
+            rm -rf "${bastille_jail_base}"
         fi
 
         ## archive jail log
         if [ -f "${bastille_jail_log}" ]; then
-            mv ${bastille_jail_log} ${bastille_jail_log}-$(date +%F)
+            mv "${bastille_jail_log}" "${bastille_jail_log}"-"$(date +%F)"
             echo -e "${COLOR_GREEN}Note: jail console logs archived.${COLOR_RESET}"
             echo -e "${COLOR_GREEN}${bastille_jail_log}-$(date +%F)${COLOR_RESET}"
         fi
+
+        ## clear any active rdr rules
+        if [ ! -z "$(pfctl -a "rdr/${TARGET}" -Psn 2>/dev/null)" ]; then
+            echo -e "${COLOR_GREEN}Clearing RDR rules:${COLOR_RESET}"
+            pfctl -a "rdr/${TARGET}" -Fn
+        fi
         echo
     fi
 }
 
 destroy_rel() {
+    local OPTIONS
+
     ## check release name match before destroy
     if [ -n "${NAME_VERIFY}" ]; then
         TARGET="${NAME_VERIFY}"
-        break
     else
         usage
     fi
@@ -100,7 +112,7 @@ destroy_rel() {
     if [ -d "${bastille_jailsdir}" ]; then
         JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
         for _jail in ${JAIL_LIST}; do
-            if grep -qwo "${TARGET}" ${bastille_jailsdir}/${_jail}/fstab 2>/dev/null; then
+            if grep -qwo "${TARGET}" "${bastille_jailsdir}/${_jail}/fstab" 2>/dev/null; then
                 echo -e "${COLOR_RED}Notice: (${_jail}) depends on ${TARGET} base.${COLOR_RESET}"
                 BASE_HASCHILD="1"
             fi
@@ -114,11 +126,17 @@ destroy_rel() {
         if [ "${BASE_HASCHILD}" -eq "0" ]; then
             echo -e "${COLOR_GREEN}Deleting base: ${TARGET}.${COLOR_RESET}"
             if [ "${bastille_zfs_enable}" = "YES" ]; then
-                if [ ! -z "${bastille_zfs_zpool}" ]; then
+                if [ -n "${bastille_zfs_zpool}" ]; then
-                    zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${TARGET}
+                    if [ -n "${TARGET}" ]; then
-                    if [ "${FORCE}" = "1" ]; then
+                        OPTIONS="-r"
-                        if [ -d "${bastille_cachedir}/${TARGET}" ]; then
+                        if [ "${FORCE}" = "1" ]; then
-                            zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${TARGET}
+                            OPTIONS="-rf"
+                        fi
+                        zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${TARGET}"
+                        if [ "${FORCE}" = "1" ]; then
+                            if [ -d "${bastille_cachedir}/${TARGET}" ]; then
+                                zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${TARGET}"
+                            fi
                         fi
                     fi
                 fi
@@ -126,10 +144,10 @@ destroy_rel() {
 
             if [ -d "${bastille_rel_base}" ]; then
                 ## removing all flags
-                chflags -R noschg ${bastille_rel_base}
+                chflags -R noschg "${bastille_rel_base}"
 
                 ## remove jail base
-                rm -rf ${bastille_rel_base}
+                rm -rf "${bastille_rel_base}"
             fi
 
             if [ "${FORCE}" = "1" ]; then
@@ -152,29 +170,27 @@ help|-h|--help)
     ;;
 esac
 
-OPTION="${1}"
+## reset this options
-TARGET="${2}"
+FORCE=""
 
 ## handle additional options
-case "${OPTION}" in
+case "${1}" in
--f|--force)
+    -f|--force|force)
-    if [ $# -gt 2 ] || [ $# -lt 2 ]; then
+        FORCE="1"
+        shift
+        ;;
+    -*)
+        echo -e "${COLOR_RED}Unknown Option.${COLOR_RESET}"
         usage
-    fi
+        ;;
-    FORCE="1"
-    ;;
--*)
-    echo -e "${COLOR_RED}Unknown Option.${COLOR_RESET}"
-    usage
-    ;;
-*)
-    if [ $# -gt 1 ] || [ $# -lt 1 ]; then
-        usage
-    fi
-    TARGET="${1}"
-    ;;
 esac
 
+TARGET="${1}"
+
+if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
 ## check what should we clean
 case "${TARGET}" in
 *-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
@@ -184,27 +200,27 @@ case "${TARGET}" in
     ;;
 *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
     ## check for HardenedBSD releases name
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
     destroy_rel
     ;;
 *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
     ## check for HardenedBSD(specific stable build releases)
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
     destroy_rel
     ;;
-*-stable-build-latest|*-STABLE-BUILD-LATEST)
+*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
     ## check for HardenedBSD(latest stable build release)
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build-latest|-STABLE-BUILD-LATEST)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
     destroy_rel
     ;;
 current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
     ## check for HardenedBSD(specific current build releases)
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build|-CURRENT-BUILD)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
     destroy_rel
     ;;
-current-build-latest|CURRENT-BUILD-LATEST)
+current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
     ## check for HardenedBSD(latest current build release)
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest|-CURRENT-BUILD-LATEST)$' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest)$' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
     destroy_rel
     ;;
 *)

usr/local/share/bastille/edit.sh

@@ -0,0 +1,72 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille edit TARGET [filename]${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 1 ]; then
+    usage
+fi
+
+TARGET="${1}"
+if [ $# == 2 ]; then
+    TARGET_FILENAME="${2}"
+fi
+
+if [ -z "${EDITOR}" ]; then
+    EDITOR=vi
+fi
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(bastille list jails)
+fi
+if [ "${TARGET}" != 'ALL' ]; then
+    JAILS=$(bastille list jails | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    if [ -n "${TARGET_FILENAME}" ]; then
+        "${EDITOR}" "${bastille_jailsdir}/${_jail}/${TARGET_FILENAME}"
+    else
+        "${EDITOR}" "${bastille_jailsdir}/${_jail}/jail.conf"
+    fi
+done

usr/local/share/bastille/export.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -60,35 +60,35 @@ error_notify()
 jail_export()
 {
     # Attempt to export the container
-    DATE=$(date +%F-%H:%M:%S)
+    DATE=$(date +%F-%H%M%S)
     if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
                 FILE_EXT="xz"
                 echo -e "${COLOR_GREEN}Exporting '${TARGET}' to a compressed .${FILE_EXT} archive.${COLOR_RESET}"
                 echo -e "${COLOR_GREEN}Sending zfs data stream...${COLOR_RESET}"
                 # Take a recursive temporary snapshot
-                SNAP_NAME="bastille_export-${DATE}"
+                zfs snapshot -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_export_${DATE}"
-                zfs snapshot -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@${SNAP_NAME}
 
                 # Export the container recursively and cleanup temporary snapshots
-                zfs send -R ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@${SNAP_NAME} | \
+                zfs send -R "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_export_${DATE}" | \
-                xz ${bastille_compress_xz_options} > ${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}
+                xz ${bastille_compress_xz_options} > "${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}"
-                zfs destroy -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@${SNAP_NAME}
+                zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}/root@bastille_export_${DATE}"
+                zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}@bastille_export_${DATE}"
             fi
         else
             # Create standard backup archive
             FILE_EXT="txz"
             echo -e "${COLOR_GREEN}Exporting '${TARGET}' to a compressed .${FILE_EXT} archive...${COLOR_RESET}"
-            cd ${bastille_jailsdir} && tar -cf - ${TARGET} | xz ${bastille_compress_xz_options} > ${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}
+            cd "${bastille_jailsdir}" && tar -cf - "${TARGET}" | xz ${bastille_compress_xz_options} > "${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}"
         fi
 
-        if [ $? -ne 0 ]; then
+        if [ "$?" -ne 0 ]; then
             error_notify "${COLOR_RED}Failed to export '${TARGET}' container.${COLOR_RESET}"
         else
             # Generate container checksum file
-            cd ${bastille_backupsdir}
+            cd "${bastille_backupsdir}"
-            sha256 -q ${TARGET}_${DATE}.${FILE_EXT} > ${TARGET}_${DATE}.sha256
+            sha256 -q "${TARGET}_${DATE}.${FILE_EXT}" > "${TARGET}_${DATE}.sha256"
             echo -e "${COLOR_GREEN}Exported '${bastille_backupsdir}/${TARGET}_${DATE}.${FILE_EXT}' successfully.${COLOR_RESET}"
             exit 0
         fi
@@ -97,6 +97,13 @@ jail_export()
     fi
 }
 
+# Check for user specified file location
+if echo "${TARGET}" | grep -q '\/'; then
+    GETDIR="${TARGET}"
+    TARGET=$(echo ${TARGET} | awk -F '\/' '{print $NF}')
+    bastille_backupsdir=$(echo ${GETDIR} | sed "s/${TARGET}//")
+fi
+
 # Check if backups directory/dataset exist
 if [ ! -d "${bastille_backupsdir}" ]; then
     error_notify "${COLOR_RED}Backups directory/dataset does not exist, See 'bastille bootstrap'.${COLOR_RESET}"

usr/local/share/bastille/htop.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

usr/local/share/bastille/import.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -32,7 +32,7 @@
 . /usr/local/etc/bastille/bastille.conf
 
 usage() {
-    echo -e "${COLOR_RED}Usage: bastille import backup_file.${COLOR_RESET}"
+    echo -e "${COLOR_RED}Usage: bastille import file [option].${COLOR_RESET}"
     exit 1
 }
 
@@ -43,11 +43,12 @@ help|-h|--help)
     ;;
 esac
 
-if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+if [ $# -gt 2 ] || [ $# -lt 1 ]; then
     usage
 fi
 
 TARGET="${1}"
+OPTION="${2}"
 shift
 
 error_notify() {
@@ -58,25 +59,47 @@ error_notify() {
 
 validate_archive() {
     # Compare checksums on the target archive
-    if [ -f "${bastille_backupsdir}/${TARGET}" ]; then
+    # Skip validation for unsupported archives
-        echo -e "${COLOR_GREEN}Validating file: ${TARGET}...${COLOR_RESET}"
+    if [ "${FILE_EXT}" != ".tar.gz" ] && [ "${FILE_EXT}" != ".tar" ]; then
-        SHA256_DIST=$(cat ${bastille_backupsdir}/${FILE_TRIM}.sha256)
+        if [ -f "${bastille_backupsdir}/${TARGET}" ]; then
-        SHA256_FILE=$(sha256 -q ${bastille_backupsdir}/${TARGET})
+            if [ -f "${bastille_backupsdir}/${FILE_TRIM}.sha256" ]; then
-        if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
+                echo -e "${COLOR_GREEN}Validating file: ${TARGET}...${COLOR_RESET}"
-            error_notify "${COLOR_RED}Failed validation for ${TARGET}.${COLOR_RESET}"
+                SHA256_DIST=$(cat "${bastille_backupsdir}/${FILE_TRIM}.sha256")
-        else
+                SHA256_FILE=$(sha256 -q "${bastille_backupsdir}/${TARGET}")
-            echo -e "${COLOR_GREEN}File validation successful!${COLOR_RESET}"
+                if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
+                    error_notify "${COLOR_RED}Failed validation for ${TARGET}.${COLOR_RESET}"
+                else
+                    echo -e "${COLOR_GREEN}File validation successful!${COLOR_RESET}"
+                fi
+            else
+                # Check if user opt to force import
+                if [ "${OPTION}" = "-f" -o "${OPTION}" = "force" ]; then
+                    echo -e "${COLOR_YELLOW}Warning: Skipping archive validation!${COLOR_RESET}"
+                else
+                    error_notify "${COLOR_RED}Checksum file not found, See 'bastille import TARGET -f'${COLOR_RESET}"
+                fi
+            fi
         fi
+    else
+        echo -e "${COLOR_YELLOW}Warning: Skipping archive validation!${COLOR_RESET}"
     fi
 }
 
 update_zfsmount() {
     # Update the mountpoint property on the received zfs data stream
-    OLD_ZFS_MOUNTPOINT=$(zfs get -H mountpoint ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root | awk '{print $3}')
+    OLD_ZFS_MOUNTPOINT=$(zfs get -H mountpoint "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root" | awk '{print $3}')
     NEW_ZFS_MOUNTPOINT="${bastille_jailsdir}/${TARGET_TRIM}/root"
     if [ "${NEW_ZFS_MOUNTPOINT}" != "${OLD_ZFS_MOUNTPOINT}" ]; then
         echo -e "${COLOR_GREEN}Updating zfs mountpoint...${COLOR_RESET}"
-        zfs set mountpoint=${bastille_jailsdir}/${TARGET_TRIM}/root ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root
+        zfs set mountpoint="${bastille_jailsdir}/${TARGET_TRIM}/root" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+    fi
+
+    # Mount new container ZFS datasets
+    if ! zfs mount | grep -qw "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}$"; then
+        zfs mount "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+    fi
+    if ! zfs mount | grep -qw "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root$"; then
+        zfs mount "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
     fi
 }
 
@@ -84,11 +107,11 @@ update_jailconf() {
     # Update jail.conf paths
     JAIL_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
     if [ -f "${JAIL_CONFIG}" ]; then
-        if ! grep -qw "path = ${bastille_jailsdir}/${TARGET_TRIM}/root;" ${JAIL_CONFIG}; then
+        if ! grep -qw "path = ${bastille_jailsdir}/${TARGET_TRIM}/root;" "${JAIL_CONFIG}"; then
             echo -e "${COLOR_GREEN}Updating jail.conf...${COLOR_RESET}"
-            sed -i '' "s|exec.consolelog = .*;|exec.consolelog = ${bastille_logsdir}/${TARGET_TRIM}_console.log;|" ${JAIL_CONFIG}
+            sed -i '' "s|exec.consolelog.*=.*;|exec.consolelog = ${bastille_logsdir}/${TARGET_TRIM}_console.log;|" "${JAIL_CONFIG}"
-            sed -i '' "s|path = .*;|path = ${bastille_jailsdir}/${TARGET_TRIM}/root;|" ${JAIL_CONFIG}
+            sed -i '' "s|path.*=.*;|path = ${bastille_jailsdir}/${TARGET_TRIM}/root;|" "${JAIL_CONFIG}"
-            sed -i '' "s|mount.fstab = .*;|mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;|" ${JAIL_CONFIG}
+            sed -i '' "s|mount.fstab.*=.*;|mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;|" "${JAIL_CONFIG}"
         fi
     fi
 }
@@ -97,67 +120,329 @@ update_fstab() {
     # Update fstab .bastille mountpoint on thin containers only
     # Set some variables
     FSTAB_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/fstab"
-    FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2]|-stable-build-[0-9]{1,3})' ${FSTAB_CONFIG})
+    FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
-    FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET_TRIM}/root/.bastille" ${FSTAB_CONFIG})
+    FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET_TRIM}/root/.bastille" "${FSTAB_CONFIG}")
     FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0"
     if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
         # If both variables are set, compare and update as needed
-        if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille" ${FSTAB_CONFIG}; then
+        if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille" "${FSTAB_CONFIG}"; then
             echo -e "${COLOR_GREEN}Updating fstab...${COLOR_RESET}"
-            sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" ${FSTAB_CONFIG}
+            sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" "${FSTAB_CONFIG}"
         fi
     fi
 }
 
+generate_config() {
+    # Attempt to read previous config file and set required variables accordingly
+    # If we can't get a valid interface, fallback to lo1 and warn user
+    echo -e "${COLOR_GREEN}Generating jail.conf...${COLOR_RESET}"
+
+    if [ "${FILE_EXT}" = ".zip" ]; then
+        # Gather some bits from foreign/iocage config files
+        JSON_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/config.json"
+        if [ -n "${JSON_CONFIG}" ]; then
+            IPV4_CONFIG=$(grep -wo '\"ip4_addr\": \".*\"' "${JSON_CONFIG}" | tr -d '" ' | sed 's/ip4_addr://')
+            IPV6_CONFIG=$(grep -wo '\"ip6_addr\": \".*\"' "${JSON_CONFIG}" | tr -d '" ' | sed 's/ip6_addr://')
+        fi
+    elif [ "${FILE_EXT}" = ".tar.gz" ]; then
+        # Gather some bits from foreign/ezjail config files
+        PROP_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/prop.ezjail-${FILE_TRIM}-*"
+        if [ -n "${PROP_CONFIG}" ]; then
+            IPVX_CONFIG=$(grep -wo "jail_${TARGET_TRIM}_ip=.*" ${PROP_CONFIG} | tr -d '" ' | sed "s/jail_${TARGET_TRIM}_ip=//")
+        fi
+    fi
+
+    # If there are multiple IP/NIC let the user configure network
+    if [ -n "${IPV4_CONFIG}" ]; then
+        if ! echo "${IPV4_CONFIG}" | grep -q '.*,.*'; then
+            NETIF_CONFIG=$(echo "${IPV4_CONFIG}" | grep '.*|' | sed 's/|.*//g')
+            if [ -z "${NETIF_CONFIG}" ]; then
+                config_netif
+            fi
+            IPX_ADDR="ip4.addr"
+            IP_CONFIG="${IPV4_CONFIG}"
+            IP6_MODE="disable"
+        fi
+    elif [ -n "${IPV6_CONFIG}" ]; then
+        if ! echo "${IPV6_CONFIG}" | grep -q '.*,.*'; then
+            NETIF_CONFIG=$(echo "${IPV6_CONFIG}" | grep '.*|' | sed 's/|.*//g')
+            if [ -z "${NETIF_CONFIG}" ]; then
+                config_netif
+            fi
+            IPX_ADDR="ip6.addr"
+            IP_CONFIG="${IPV6_CONFIG}"
+            IP6_MODE="new"
+        fi
+    elif [ -n "${IPVX_CONFIG}" ]; then
+        if ! echo "${IPVX_CONFIG}" | grep -q '.*,.*'; then
+            NETIF_CONFIG=$(echo "${IPVX_CONFIG}" | grep '.*|' | sed 's/|.*//g')
+            if [ -z "${NETIF_CONFIG}" ]; then
+                config_netif
+            fi
+            IPX_ADDR="ip4.addr"
+            IP_CONFIG="${IPVX_CONFIG}"
+            IP6_MODE="disable"
+            if echo "${IPVX_CONFIG}" | sed 's/.*|//' | grep -Eq '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))'; then
+                IPX_ADDR="ip6.addr"
+                IP6_MODE="new"
+            fi
+        fi
+    fi
+
+    # Let the user configure network manually
+    if [ -z "${NETIF_CONFIG}" ]; then
+        NETIF_CONFIG="lo1"
+        IPX_ADDR="ip4.addr"
+        IP_CONFIG="-"
+        IP6_MODE="disable"
+        echo -e "${COLOR_YELLOW}Warning: See 'bastille edit ${TARGET_TRIM} jail.conf' for manual network configuration${COLOR_RESET}"
+    fi
+
+    if [ "${FILE_EXT}" = ".tar.gz" ]; then
+        CONFIG_RELEASE=$(echo ${PROP_CONFIG} | grep -o '[0-9]\{2\}\.[0-9]_RELEASE' | sed 's/_/-/g')
+        if [ -z "${CONFIG_RELEASE}" ]; then
+            # Fallback to host version
+            CONFIG_RELEASE=$(freebsd-version | sed 's/\-[pP].*//')
+            echo -e "${COLOR_YELLOW}Warning: ${CONFIG_RELEASE} was set by default!${COLOR_RESET}"
+        fi
+        mkdir "${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille"
+        echo "${bastille_releasesdir}/${CONFIG_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0" \
+        >> "${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+
+        # Work with the symlinks
+        cd "${bastille_jailsdir}/${TARGET_TRIM}/root"
+        update_symlinks
+    else
+        # Generate new empty fstab file
+        touch "${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+    fi
+
+    # Generate a basic jail configuration file on foreign imports
+    cat << EOF > "${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+${TARGET_TRIM} {
+  devfs_ruleset = 4;
+  enforce_statfs = 2;
+  exec.clean;
+  exec.consolelog = ${bastille_logsdir}/${TARGET_TRIM}_console.log;
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${TARGET_TRIM};
+  mount.devfs;
+  mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;
+  path = ${bastille_jailsdir}/${TARGET_TRIM}/root;
+  securelevel = 2;
+
+  interface = ${NETIF_CONFIG};
+  ${IPX_ADDR} = ${IP_CONFIG};
+  ip6 = ${IP6_MODE};
+}
+EOF
+}
+
+update_config() {
+    # Update an existing jail configuration
+    # The config on select archives does not provide a clear way to determine
+    # the base release, so lets try to get it from the base/COPYRIGHT file,
+    # otherwise warn user and fallback to host system release
+    CONFIG_RELEASE=$(grep -wo 'releng/[0-9]\{2\}.[0-9]/COPYRIGHT' "${bastille_jailsdir}/${TARGET_TRIM}/root/COPYRIGHT" | sed 's|releng/||;s|/COPYRIGHT|-RELEASE|')
+    if [ -z "${CONFIG_RELEASE}" ]; then
+        # Fallback to host version
+        CONFIG_RELEASE=$(freebsd-version | sed 's/\-[pP].*//')
+        echo -e "${COLOR_YELLOW}Warning: ${CONFIG_RELEASE} was set by default!${COLOR_RESET}"
+    fi
+    mkdir "${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille"
+    echo "${bastille_releasesdir}/${CONFIG_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0" \
+    >> "${bastille_jailsdir}/${TARGET_TRIM}/fstab"
+
+    # Work with the symlinks
+    cd "${bastille_jailsdir}/${TARGET_TRIM}/root"
+    update_symlinks
+}
+
+workout_components() {
+    if [ "${FILE_EXT}" = ".tar" ]; then
+        # Workaround to determine the tarball path/components before extract(assumes path/jails/target)
+        JAIL_PATH=$(tar -tvf ${bastille_backupsdir}/${TARGET} | grep -wo "/.*/jails/${TARGET_TRIM}" | tail -n1)
+        JAIL_DIRS=$(echo ${JAIL_PATH} | grep -o '/' | wc -l)
+        DIRS_PLUS=$(expr ${JAIL_DIRS} + 1)
+
+        # Workaround to determine the jail.conf path before extract(assumes path/qjail.config/target)
+        JAIL_CONF=$(tar -tvf ${bastille_backupsdir}/${TARGET} | grep -wo "/.*/qjail.config/${TARGET_TRIM}")
+        CONF_TRIM=$(echo ${JAIL_CONF} | grep -o '/' | wc -l)
+    fi
+}
+
+config_netif() {
+    # Get interface from bastille configuration
+    if [ -n "${bastille_network_loopback}" ]; then
+        NETIF_CONFIG="${bastille_network_loopback}"
+    elif [ -n "${bastille_network_shared}" ]; then
+        NETIF_CONFIG="${bastille_network_shared}"
+    else
+        NETIF_CONFIG=
+    fi
+}
+
+update_symlinks() {
+    # Work with the symlinks
+    SYMLINKS="bin boot lib libexec rescue sbin usr/bin usr/include usr/lib usr/lib32 usr/libdata usr/libexec usr/ports usr/sbin usr/share usr/src"
+
+    # Just warn user to bootstrap the release if missing
+    if [ ! -d "${bastille_releasesdir}/${CONFIG_RELEASE}" ]; then
+        echo -e "${COLOR_YELLOW}Warning: ${CONFIG_RELEASE} must be bootstrapped, See 'bastille bootstrap'.${COLOR_RESET}"
+    fi
+
+    # Update old symlinks
+    echo -e "${COLOR_GREEN}Updating symlinks...${COLOR_RESET}"
+    for _link in ${SYMLINKS}; do
+        if [ -L "${_link}" ]; then
+            ln -sf /.bastille/${_link} ${_link}
+        fi
+    done
+}
+
+create_zfs_datasets() {
+    # Prepare the ZFS environment and restore from file
+    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from foreign compressed ${FILE_EXT} archive.${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}Preparing zfs environment...${COLOR_RESET}"
+
+    # Create required ZFS datasets, mountpoint inherited from system
+    zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+    zfs create ${bastille_zfs_options} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+}
+
+remove_zfs_datasets() {
+    # Perform cleanup on failure
+    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root"
+    zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+    error_notify "${COLOR_RED}Failed to extract files from '${TARGET}' archive.${COLOR_RESET}"
+}
+
 jail_import() {
     # Attempt to import container from file
-    FILE_TRIM=$(echo ${TARGET} | sed 's/.[txz]\{2,3\}//')
+    FILE_TRIM=$(echo "${TARGET}" | sed 's/\.xz//g;s/\.txz//g;s/\.zip//g;s/\.tar\.gz//g;s/\.tar//g')
-    FILE_EXT=$(echo ${TARGET} | cut -d '.' -f2)
+    FILE_EXT=$(echo "${TARGET}" | sed "s/${FILE_TRIM}//g")
     validate_archive
     if [ -d "${bastille_jailsdir}" ]; then
         if [ "${bastille_zfs_enable}" = "YES" ]; then
-            if [ ! -z "${bastille_zfs_zpool}" ]; then
+            if [ -n "${bastille_zfs_zpool}" ]; then
-                if [ "${FILE_EXT}" = "xz" ]; then
+                if [ "${FILE_EXT}" = ".xz" ]; then
                     # Import from compressed xz on ZFS systems
-                    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from compressed .${FILE_EXT} archive.${COLOR_RESET}"
+                    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from compressed ${FILE_EXT} archive.${COLOR_RESET}"
                     echo -e "${COLOR_GREEN}Receiving zfs data stream...${COLOR_RESET}"
-                    xz ${bastille_decompress_xz_options} ${bastille_backupsdir}/${TARGET} | \
+                    xz ${bastille_decompress_xz_options} "${bastille_backupsdir}/${TARGET}" | \
-                    zfs receive -u ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}
+                    zfs receive -u "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
 
                     # Update ZFS mountpoint property if required
-                    # This is required on foreign imports only
                     update_zfsmount
 
-                    # Mount new container ZFS datasets
+                elif [ "${FILE_EXT}" = ".txz" ]; then
-                    zfs mount ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}
+                    # Prepare the ZFS environment and restore from existing .txz file
-                    zfs mount ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root
+                    create_zfs_datasets
-                elif [ "${FILE_EXT}" = "txz" ]; then
-                    # Prepare the ZFS environment and restore from existing tar.xz file
-                    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' form .${FILE_EXT} archive.${COLOR_RESET}"
-                    echo -e "${COLOR_GREEN}Preparing zfs environment...${COLOR_RESET}"
-                    zfs create ${bastille_zfs_options} ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}
-                    zfs create ${bastille_zfs_options} -o mountpoint=${bastille_jailsdir}/${TARGET_TRIM}/root \
-                    ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root
 
                     # Extract required files to the new datasets
                     echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
-                    tar --exclude='root' -Jxf ${bastille_backupsdir}/${TARGET} --strip-components 1 -C ${bastille_jailsdir}/${TARGET_TRIM} 
+                    tar --exclude='root' -Jxf "${bastille_backupsdir}/${TARGET}" --strip-components 1 -C "${bastille_jailsdir}/${TARGET_TRIM}"
-                    tar -Jxf ${bastille_backupsdir}/${TARGET} --strip-components 2 -C ${bastille_jailsdir}/${TARGET_TRIM}/root ${TARGET_TRIM}/root
+                    tar -Jxf "${bastille_backupsdir}/${TARGET}" --strip-components 2 -C "${bastille_jailsdir}/${TARGET_TRIM}/root" "${TARGET_TRIM}/root"
-                    if [ $? -ne 0 ]; then
+                    if [ "$?" -ne 0 ]; then
-                        zfs destroy -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}
+                        remove_zfs_datasets
+                    fi
+                elif [ "${FILE_EXT}" = ".zip" ]; then
+                    # Attempt to import a foreign/iocage container
+                    echo -e "${COLOR_GREEN}Importing '${TARGET_TRIM}' from foreign compressed ${FILE_EXT} archive.${COLOR_RESET}"
+                    # Sane bastille zfs options
+                    ZFS_OPTIONS=$(echo ${bastille_zfs_options} | sed 's/-o//g')
+
+                    # Extract required files from the zip archive
+                    cd "${bastille_backupsdir}" && unzip -j "${TARGET}"
+                    if [ "$?" -ne 0 ]; then
                         error_notify "${COLOR_RED}Failed to extract files from '${TARGET}' archive.${COLOR_RESET}"
+                        rm -f "${FILE_TRIM}" "${FILE_TRIM}_root"
+                    fi
+                    echo -e "${COLOR_GREEN}Receiving zfs data stream...${COLOR_RESET}"
+                    zfs receive -u "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}" < "${FILE_TRIM}"
+                    zfs set ${ZFS_OPTIONS} "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}"
+                    zfs receive -u "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET_TRIM}/root" < "${FILE_TRIM}_root"
+
+                    # Update ZFS mountpoint property if required
+                    update_zfsmount
+
+                    # Keep old configuration files for user reference
+                    if [ -f "${bastille_jailsdir}/${TARGET_TRIM}/fstab" ]; then
+                        mv "${bastille_jailsdir}/${TARGET_TRIM}/fstab" "${bastille_jailsdir}/${TARGET_TRIM}/fstab.old"
+                    fi
+
+                    # Cleanup unwanted files
+                    rm -f "${FILE_TRIM}" "${FILE_TRIM}_root"
+
+                    # Generate fstab and jail.conf files
+                    generate_config
+                elif [ "${FILE_EXT}" = ".tar.gz" ]; then
+                    # Attempt to import a foreign/ezjail container
+                    # Prepare the ZFS environment and restore from existing .tar.gz file
+                    create_zfs_datasets
+
+                    # Extract required files to the new datasets
+                    echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                    tar --exclude='ezjail/' -xf "${bastille_backupsdir}/${TARGET}" -C "${bastille_jailsdir}/${TARGET_TRIM}"
+                    tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components 1 -C "${bastille_jailsdir}/${TARGET_TRIM}/root"
+                    if [ "$?" -ne 0 ]; then
+                        remove_zfs_datasets
+                    else
+                        generate_config
+                    fi
+                elif [ "${FILE_EXT}" = ".tar" ]; then
+                    # Attempt to import a foreign/qjail container
+                    # Prepare the ZFS environment and restore from existing .tar file
+                    create_zfs_datasets
+                    workout_components
+
+                    # Extract required files to the new datasets
+                    echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                    tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${CONF_TRIM}" -C "${bastille_jailsdir}/${TARGET_TRIM}" "${JAIL_CONF}"
+                    tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${DIRS_PLUS}" -C "${bastille_jailsdir}/${TARGET_TRIM}/root" "${JAIL_PATH}"
+                    if [ -f "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" ]; then
+                        mv "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" "${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+                    fi
+
+                    if [ "$?" -ne 0 ]; then
+                        remove_zfs_datasets
+                    else
+                        update_config
                     fi
                 else
                     error_notify "${COLOR_RED}Unknown archive format.${COLOR_RESET}"
                 fi
             fi
         else
-            # Import from standard tar.xz archive on UFS systems
+            # Import from standard supported archives on UFS systems
-            echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+            if [ "${FILE_EXT}" = ".txz" ]; then
-            tar -Jxf  ${bastille_backupsdir}/${TARGET} -C ${bastille_jailsdir}
+                echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                tar -Jxf  "${bastille_backupsdir}/${TARGET}" -C "${bastille_jailsdir}"
+            elif [ "${FILE_EXT}" = ".tar.gz" ]; then
+                # Attempt to import/configure foreign/ezjail container
+                echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                mkdir "${bastille_jailsdir}/${TARGET_TRIM}"
+                tar -xf "${bastille_backupsdir}/${TARGET}" -C "${bastille_jailsdir}/${TARGET_TRIM}"
+                mv "${bastille_jailsdir}/${TARGET_TRIM}/ezjail" "${bastille_jailsdir}/${TARGET_TRIM}/root"
+                generate_config
+            elif [ "${FILE_EXT}" = ".tar" ]; then
+                # Attempt to import/configure foreign/qjail container
+                echo -e "${COLOR_GREEN}Extracting files from '${TARGET}' archive...${COLOR_RESET}"
+                mkdir -p "${bastille_jailsdir}/${TARGET_TRIM}/root"
+                workout_components
+                tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${CONF_TRIM}" -C "${bastille_jailsdir}/${TARGET_TRIM}" "${JAIL_CONF}"
+                tar -xf "${bastille_backupsdir}/${TARGET}" --strip-components "${DIRS_PLUS}" -C "${bastille_jailsdir}/${TARGET_TRIM}/root" "${JAIL_PATH}"
+                if [ -f "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" ]; then
+                    mv "${bastille_jailsdir}/${TARGET_TRIM}/${TARGET_TRIM}" "${bastille_jailsdir}/${TARGET_TRIM}/jail.conf"
+                fi
+                update_config
+            else
+                error_notify "${COLOR_RED}Unsupported archive format.${COLOR_RESET}"
+            fi
         fi
 
-        if [ $? -ne 0 ]; then
+        if [ "$?" -ne 0 ]; then
             error_notify "${COLOR_RED}Failed to import from '${TARGET}' archive.${COLOR_RESET}"
         else
             # Update the jail.conf and fstab if required
@@ -172,14 +457,28 @@ jail_import() {
     fi
 }
 
+# Check for user specified file location
+if echo "${TARGET}" | grep -q '\/'; then
+    GETDIR="${TARGET}"
+    TARGET=$(echo ${TARGET} | awk -F '\/' '{print $NF}')
+    bastille_backupsdir=$(echo ${GETDIR} | sed "s/${TARGET}//")
+fi
+
 # Check if backups directory/dataset exist
 if [ ! -d "${bastille_backupsdir}" ]; then
     error_notify "${COLOR_RED}Backups directory/dataset does not exist, See 'bastille bootstrap'.${COLOR_RESET}"
 fi
 
 # Check if archive exist then trim archive name
-if [ "$(ls "${bastille_backupsdir}" | awk "/^${TARGET}$/")" ]; then
+if [ -f "${bastille_backupsdir}/${TARGET}" ]; then
-    TARGET_TRIM=$(echo ${TARGET} | sed "s/_[0-9]*-[0-9]*-[0-9]*-[0-9]*:[0-9]*:[0-9]*.[txz]\{2,3\}//")
+    # Filter unsupported/unknown archives
+    if echo "${TARGET}" | grep -q '_[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}-[0-9]\{6\}.xz$\|_[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}-[0-9]\{6\}.txz$\|_[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}.zip$\|-[0-9]\{12\}.[0-9]\{2\}.tar.gz$\|@[0-9]\{12\}.[0-9]\{2\}.tar$'; then
+        if ls "${bastille_backupsdir}" | awk "/^${TARGET}$/" >/dev/null; then
+            TARGET_TRIM=$(echo "${TARGET}" | sed "s/_[0-9]*-[0-9]*-[0-9]*-[0-9]*.xz//;s/_[0-9]*-[0-9]*-[0-9]*-[0-9]*.txz//;s/_[0-9]*-[0-9]*-[0-9]*.zip//;s/-[0-9]\{12\}.[0-9]\{2\}.tar.gz//;s/@[0-9]\{12\}.[0-9]\{2\}.tar//")
+        fi
+    else
+        error_notify "${COLOR_RED}Unrecognized archive name.${COLOR_RESET}"
+    fi
 else
     error_notify "${COLOR_RED}Archive '${TARGET}' not found.${COLOR_RESET}"
 fi

usr/local/share/bastille/limits.sh

@@ -1,23 +1,23 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # Ressource limits added by Sven R github.com/hackacad
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -30,6 +30,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 . /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
 
 usage() {
     echo -e "${COLOR_RED}Usage: bastille limits TARGET option value${COLOR_RESET}"
@@ -40,6 +41,7 @@ usage() {
 RACCT_ENABLE=$(sysctl -n kern.racct.enable)
 if [ "${RACCT_ENABLE}" != '1' ]; then
     echo "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
+#    exit 1
 fi
 
 # Handle special-case commands first.
@@ -68,7 +70,15 @@ fi
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    echo -e "${TYPE} ${VALUE}"
+
-     rctl -a jail:${_jail}:${OPTION}:deny=${VALUE}/jail
+    _rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail"
+
+    ## if entry doesn't exist, add; else show existing entry
+    if ! grep -qs "${_rctl_rule}" "${bastille_jailsdir}/${_jail}/rctl.conf"; then
+        echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
+    fi
+
+    echo -e "${OPTION} ${VALUE}"
+    rctl -a "${_rctl_rule}"
     echo -e "${COLOR_RESET}"
 done

usr/local/share/bastille/list.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

usr/local/share/bastille/mount.sh

@@ -0,0 +1,131 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille mount TARGET host_path container_path [filesystem_type options dump pass_number]${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET=$1
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+else
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+if [ $# -eq 2 ]; then
+    _fstab="$@ nullfs ro 0 0"
+else
+    _fstab="$@"
+fi
+
+## assign needed variables
+_hostpath=$(echo "${_fstab}" | awk '{print $1}')
+_jailpath=$(echo "${_fstab}" | awk '{print $2}')
+_type=$(echo "${_fstab}" | awk '{print $3}')
+_perms=$(echo "${_fstab}" | awk '{print $4}')
+_checks=$(echo "${_fstab}" | awk '{print $5" "$6}')
+
+## if any variables are empty, bail out
+if [ -z "${_hostpath}" ] || [ -z "${_jailpath}" ] || [ -z "${_type}" ] || [ -z "${_perms}" ] || [ -z "${_checks}" ]; then
+    echo -e "${COLOR_RED}FSTAB format not recognized.${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+    exit 1
+fi
+
+## if host path doesn't exist or type is not "nullfs"
+if [ ! -d "${_hostpath}" ] || [ "${_type}" != "nullfs" ]; then
+    echo -e "${COLOR_RED}Detected invalid host path or incorrect mount type in FSTAB.${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+    exit 1
+fi
+
+## if mount permissions are not "ro" or "rw"
+if [ "${_perms}" != "ro" ] && [ "${_perms}" != "rw" ]; then
+    echo -e "${COLOR_RED}Detected invalid mount permissions in FSTAB.${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+    exit 1
+fi
+
+## if check & pass are not "0 0 - 1 1"; bail out
+if [ "${_checks}" != "0 0" ] && [ "${_checks}" != "1 0" ] && [ "${_checks}" != "0 1" ] && [ "${_checks}" != "1 1" ]; then
+    echo -e "${COLOR_RED}Detected invalid fstab options in FSTAB.${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+    echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+    exit 1
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+
+    ## aggregate variables into FSTAB entry
+    _jailpath="${bastille_jailsdir}/${_jail}/root/${_jailpath}"
+    _fstab_entry="${_hostpath} ${_jailpath} ${_type} ${_perms} ${_checks}"
+
+    ## Create mount point if it does not exist. -- cwells
+    if [ ! -d "${bastille_jailsdir}/${_jail}/root/${_jailpath}" ]; then
+        if ! mkdir -p "${bastille_jailsdir}/${_jail}/root/${_jailpath}"; then
+            echo -e "${COLOR_RED}Failed to create mount point inside jail.${COLOR_RESET}"
+            exit 1
+        fi
+    fi
+
+    ## if entry doesn't exist, add; else show existing entry
+    if ! egrep -q "[[:blank:]]${_jailpath}[[:blank:]]" "${bastille_jailsdir}/${_jail}/fstab" 2> /dev/null; then
+        if ! echo "${_fstab_entry}" >> "${bastille_jailsdir}/${_jail}/fstab"; then
+            echo -e "${COLOR_RED}Failed to create fstab entry: ${_fstab_entry}${COLOR_RESET}"
+            exit 1
+        fi
+        echo "Added: ${_fstab_entry}"
+    else
+        egrep "[[:blank:]]${_jailpath}[[:blank:]]" "${bastille_jailsdir}/${_jail}/fstab"
+    fi
+    mount -F "${bastille_jailsdir}/${_jail}/fstab" -a
+    echo
+done

usr/local/share/bastille/pkg.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -58,6 +58,6 @@ fi
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    jexec -l ${_jail} /usr/sbin/pkg $@
+    jexec -l "${_jail}" /usr/sbin/pkg "$@"
     echo
 done

usr/local/share/bastille/rdr.sh

@@ -1,19 +1,19 @@
 #!/bin/sh
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -68,7 +68,7 @@ if [ -z "${JAIL_IP}" -o "${JAIL_IP}" = "-" ]; then
 fi
 
 # Check rdr-anchor is setup in pf.conf
-if !(pfctl -sn | grep rdr-anchor | grep 'rdr/\*' >/dev/null); then
+if ! (pfctl -sn | grep rdr-anchor | grep 'rdr/\*' >/dev/null); then
     echo -e "${COLOR_RED}rdr-anchor not found in pf.conf${COLOR_RESET}"
     exit 1
 fi
@@ -94,7 +94,7 @@ while [ $# -gt 0 ]; do
             if [ $# -lt 3 ]; then
                 usage
             fi
-            ( pfctl -a "rdr/${JAIL_NAME}" -Psn; 
+            ( pfctl -a "rdr/${JAIL_NAME}" -Psn;
               printf '%s\nrdr on $ext_if inet proto tcp to port %d -> %s port %d\n' "$EXT_IF" "$2" "$JAIL_IP" "$3" ) \
                   | pfctl -a "rdr/${JAIL_NAME}" -f-
             shift 3
@@ -103,7 +103,7 @@ while [ $# -gt 0 ]; do
             if [ $# -lt 3 ]; then
                 usage
             fi
-            ( pfctl -a "rdr/${JAIL_NAME}" -Psn; 
+            ( pfctl -a "rdr/${JAIL_NAME}" -Psn;
               printf '%s\nrdr on $ext_if inet proto udp to port %d -> %s port %d\n' "$EXT_IF" "$2" "$JAIL_IP" "$3" ) \
                   | pfctl -a "rdr/${JAIL_NAME}" -f-
             shift 3
@@ -113,6 +113,3 @@ while [ $# -gt 0 ]; do
             ;;
     esac
 done
-
-
-

usr/local/share/bastille/rename.sh

@@ -0,0 +1,163 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille rename [TARGET] [NEW_NAME].${COLOR_RESET}"
+    exit 1
+}
+
+error_notify() {
+    # Notify message on error and exit
+    echo -e "$*" >&2
+    exit 1
+}
+
+validate_name() {
+    local NAME_VERIFY=${NEWNAME}
+    local NAME_SANITY=$(echo "${NAME_VERIFY}" | tr -c -d 'a-zA-Z0-9-_')
+    if [ "${NAME_VERIFY}" != "${NAME_SANITY}" ]; then
+        error_notify "${COLOR_RED}Container names may not contain special characters!${COLOR_RESET}"
+    fi
+}
+
+# Handle special-case commands first
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -gt 2 ] || [ $# -lt 2 ]; then
+    usage
+fi
+
+TARGET="${1}"
+NEWNAME="${2}"
+shift
+
+update_jailconf() {
+    # Update jail.conf
+    JAIL_CONFIG="${bastille_jailsdir}/${NEWNAME}/jail.conf"
+    if [ -f "${JAIL_CONFIG}" ]; then
+        if ! grep -qw "path = ${bastille_jailsdir}/${NEWNAME}/root;" "${JAIL_CONFIG}"; then
+            sed -i '' "s|host.hostname.*=.*${TARGET};|host.hostname = ${NEWNAME};|" "${JAIL_CONFIG}"
+            sed -i '' "s|exec.consolelog.*=.*;|exec.consolelog = ${bastille_logsdir}/${NEWNAME}_console.log;|" "${JAIL_CONFIG}"
+            sed -i '' "s|path.*=.*;|path = ${bastille_jailsdir}/${NEWNAME}/root;|" "${JAIL_CONFIG}"
+            sed -i '' "s|mount.fstab.*=.*;|mount.fstab = ${bastille_jailsdir}/${NEWNAME}/fstab;|" "${JAIL_CONFIG}"
+            sed -i '' "s|${TARGET}.*{|${NEWNAME} {|" "${JAIL_CONFIG}"
+        fi
+    fi
+}
+
+update_fstab() {
+    # Update fstab to use the new name
+    FSTAB_CONFIG="${bastille_jailsdir}/${NEWNAME}/fstab"
+    if [ -f "${FSTAB_CONFIG}" ]; then
+        FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+        FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET}/root/.bastille" "${FSTAB_CONFIG}")
+        FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${NEWNAME}/root/.bastille nullfs ro 0 0"
+        if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
+            # If both variables are set, update as needed
+            if ! grep -qw "${bastille_releasesdir}/${FSTAB_RELEASE}.*${bastille_jailsdir}/${NEWNAME}/root/.bastille" "${FSTAB_CONFIG}"; then
+                sed -i '' "s|${FSTAB_CURRENT}|${FSTAB_NEWCONF}|" "${FSTAB_CONFIG}"
+            fi
+        fi
+    fi
+}
+
+change_name() {
+    # Attempt container name change
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_GREEN}Attempting to rename '${TARGET}' to ${NEWNAME}...${COLOR_RESET}"
+        if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if [ -n "${bastille_zfs_zpool}" ] && [ -n "${bastille_zfs_prefix}" ]; then
+                # Check and rename container ZFS dataset accordingly
+                # Perform additional checks in case of non-zfs existing containers
+                if zfs list | grep -qw "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}"; then
+                    if ! zfs rename -f "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NEWNAME}"; then
+                        error_notify "${COLOR_RED}Can't rename '${TARGET}' dataset.${COLOR_RESET}"
+                    fi
+                else
+                    # Check and rename container directory instead
+                    if ! zfs list | grep -qw "jails/${TARGET}$"; then
+                        mv "${bastille_jailsdir}/${TARGET}" "${bastille_jailsdir}/${NEWNAME}"
+                    fi
+                fi
+            fi
+        else
+            # Check if container is a zfs/dataset before rename attempt
+            # Perform additional checks in case of bastille.conf miss-configuration
+            if zfs list | grep -qw "jails/${TARGET}$"; then
+                ZFS_DATASET_ORIGIN=$(zfs list | grep -w "jails/${TARGET}$" | awk '{print $1}')
+                ZFS_DATASET_TARGET=$(echo "${ZFS_DATASET_ORIGIN}" | sed "s|\/${TARGET}||")
+                if [ -n "${ZFS_DATASET_ORIGIN}" ] && [ -n "${ZFS_DATASET_TARGET}" ]; then
+                    if ! zfs rename -f "${ZFS_DATASET_ORIGIN}" "${ZFS_DATASET_TARGET}/${NEWNAME}"; then
+                        error_notify "${COLOR_RED}Can't rename '${TARGET}' dataset.${COLOR_RESET}"
+                    fi
+                else
+                    error_notify "${COLOR_RED}Can't determine the zfs origin path of '${TARGET}'.${COLOR_RESET}"
+                fi
+            else
+                # Just rename the jail directory
+                mv "${bastille_jailsdir}/${TARGET}" "${bastille_jailsdir}/${NEWNAME}"
+            fi
+        fi
+    else
+        error_notify "${COLOR_RED}${TARGET} not found. See bootstrap.${COLOR_RESET}"
+    fi
+
+    # Update jail configuration files accordingly
+    update_jailconf
+    update_fstab
+
+    # Check exit status and notify
+    if [ "$?" -ne 0 ]; then
+        error_notify "${COLOR_RED}An error has occurred while attempting to rename '${TARGET}'.${COLOR_RESET}"
+    else
+        echo -e "${COLOR_GREEN}Renamed '${TARGET}' to '${NEWNAME}' successfully.${COLOR_RESET}"
+    fi
+}
+
+## check if a running jail matches name or already exist
+if [ "$(jls name | awk "/^${TARGET}$/")" ]; then
+    error_notify "${COLOR_RED}Warning: ${TARGET} is running or the name does match.${COLOR_RESET}"
+elif [ -d "${bastille_jailsdir}/${NEWNAME}" ]; then
+    error_notify "${COLOR_RED}Jail: ${NEWNAME} already exist.${COLOR_RESET}"
+fi
+
+## validate jail name
+if [ -n "${NEWNAME}" ]; then
+    validate_name
+fi
+
+change_name

usr/local/share/bastille/restart.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

usr/local/share/bastille/service.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -59,6 +59,6 @@ fi
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    jexec -l ${_jail} /usr/sbin/service $@
+    jexec -l "${_jail}" /usr/sbin/service "$@"
     echo
 done

usr/local/share/bastille/start.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -55,6 +55,10 @@ if [ "${TARGET}" = 'ALL' ]; then
 fi
 if [ "${TARGET}" != 'ALL' ]; then
     JAILS=$(bastille list jails | awk "/^${TARGET}$/")
+    ## check if exist
+    if [ ! -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_RED}[${TARGET}]: Not found.${COLOR_RESET}"
+    fi
 fi
 
 for _jail in ${JAILS}; do
@@ -64,16 +68,18 @@ for _jail in ${JAILS}; do
 
     ## test if not running
     elif [ ! "$(jls name | awk "/^${_jail}$/")" ]; then
-	## warn if matching configured (but not online) ip4.addr
+        ## warn if matching configured (but not online) ip4.addr, ignore if there's no ip4.addr entry
         ip=$(grep 'ip4.addr' "${bastille_jailsdir}/${_jail}/jail.conf" | awk '{print $3}' | sed 's/\;//g')
-        if ifconfig | grep -w "$ip" >/dev/null; then
+        if [ -n "${ip}" ]; then
-          echo -e "${COLOR_RED}Error: IP address ($ip) already in use.${COLOR_RESET}"
+            if ifconfig | grep -w "${ip}" >/dev/null; then
-          exit 1
+                echo -e "${COLOR_RED}Error: IP address (${ip}) already in use.${COLOR_RESET}"
+                exit 1
+            fi
         fi
 
-	## start the container
+        ## start the container
         echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -c ${_jail}
+        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -c "${_jail}"
 
         ## add rctl limits
         if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
@@ -83,8 +89,10 @@ for _jail in ${JAILS}; do
         fi
 
         ## add ip4.addr to firewall table:jails
-        if [ ! -z "${bastille_jail_loopback}" ]; then
+        if [ -n "${bastille_network_loopback}" ]; then
-            pfctl -q -t jails -T add $(jls -j ${_jail} ip4.addr)
+            if grep -qw "interface.*=.*${bastille_network_loopback}" "${bastille_jailsdir}/${_jail}/jail.conf"; then
+                pfctl -q -t jails -T add "$(jls -j ${_jail} ip4.addr)"
+            fi
         fi
     fi
     echo

usr/local/share/bastille/stop.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -55,8 +55,10 @@ if [ "${TARGET}" = 'ALL' ]; then
 fi
 if [ "${TARGET}" != 'ALL' ]; then
     JAILS=$(jls name | awk "/^${TARGET}$/")
-    ## test if not running
+    ## check if exist or not running
-    if [ ! "$(jls name | awk "/^${TARGET}$/")" ]; then
+    if [ ! -d "${bastille_jailsdir}/${TARGET}" ]; then
+        echo -e "${COLOR_RED}[${TARGET}]: Not found.${COLOR_RESET}"
+    elif [ ! "$(jls name | awk "/^${TARGET}$/")" ]; then
         echo -e "${COLOR_RED}[${TARGET}]: Not started.${COLOR_RESET}"
     fi
 fi
@@ -65,8 +67,10 @@ for _jail in ${JAILS}; do
     ## test if running
     if [ "$(jls name | awk "/^${_jail}$/")" ]; then
         ## remove ip4.addr from firewall table:jails
-        if [ ! -z "${bastille_jail_loopback}" ]; then
+        if [ -n "${bastille_network_loopback}" ]; then
-            pfctl -q -t jails -T delete $(jls -j ${_jail} ip4.addr)
+            if grep -qw "interface.*=.*${bastille_network_loopback}" "${bastille_jailsdir}/${_jail}/jail.conf"; then
+                pfctl -q -t jails -T delete "$(jls -j ${_jail} ip4.addr)"
+            fi
         fi
 
         ## remove rctl limits
@@ -78,7 +82,7 @@ for _jail in ${JAILS}; do
 
         ## stop container
         echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -r ${_jail}
+        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -r "${_jail}"
     fi
     echo
 done

usr/local/share/bastille/sysrc.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -59,6 +59,6 @@ fi
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    jexec -l ${_jail} /usr/sbin/sysrc $@
+    jexec -l "${_jail}" /usr/sbin/sysrc "$@"
     echo -e "${COLOR_RESET}"
 done

usr/local/share/bastille/template.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -60,226 +60,147 @@ fi
 TEMPLATE="${1}"
 shift
 
-if [ ! -d "${bastille_templatesdir}/${TEMPLATE}" ]; then
+case ${TEMPLATE} in
-    echo -e "${COLOR_RED}${TEMPLATE} not found.${COLOR_RESET}"
+    http?://github.com/*/*|http?://gitlab.com/*/*)
-    exit 1
+        TEMPLATE_DIR=$(echo "${TEMPLATE}" | awk -F / '{ print $4 "/" $5 }')
-fi
+        if [ ! -d "${bastille_templatesdir}/${TEMPLATE_DIR}" ]; then
+            echo -e "${COLOR_GREEN}Bootstrapping ${TEMPLATE}...${COLOR_RESET}"
+            if ! bastille bootstrap "${TEMPLATE}"; then
+                echo -e "${COLOR_RED}Failed to bootstrap template: ${TEMPLATE}.${COLOR_RESET}"
+                exit 1
+            fi
+        fi
+        TEMPLATE="${TEMPLATE_DIR}"
+        ;;
+    */*)
+        if [ ! -d "${bastille_templatesdir}/${TEMPLATE}" ]; then
+            echo -e "${COLOR_RED}${TEMPLATE} not found.${COLOR_RESET}"
+            exit 1
+        fi
+        ;;
+    *)
+        echo -e "${COLOR_RED}Template name/URL not recognized.${COLOR_RESET}"
+        exit 1
+esac
 
 if [ -z "${JAILS}" ]; then
     echo -e "${COLOR_RED}Container ${TARGET} is not running.${COLOR_RESET}"
     exit 1
 fi
 
+if [ -z "${HOOKS}" ]; then
+    HOOKS='LIMITS INCLUDE PRE FSTAB PF PKG OVERLAY CONFIG SYSRC SERVICE CMD'
+fi
+
 ## global variables
 bastille_template=${bastille_templatesdir}/${TEMPLATE}
 for _jail in ${JAILS}; do
-    ## jail-specific variables. 
+    ## jail-specific variables.
     bastille_jail_path=$(jls -j "${_jail}" path)
 
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+    echo -e "${COLOR_GREEN}Applying template: ${TEMPLATE}...${COLOR_RESET}"
 
     ## TARGET
     if [ -s "${bastille_template}/TARGET" ]; then
-        if [ $(grep -w "${_jail}" ${bastille_template}/TARGET) ]; then
+        if grep -qw "${_jail}" "${bastille_template}/TARGET"; then
             echo -e "${COLOR_GREEN}TARGET: !${_jail}.${COLOR_RESET}"
             echo
             continue
         fi
-    if [ ! $(grep -E "(^|\b)(${_jail}|ALL)($|\b)" ${bastille_template}/TARGET) ]; then
+    if ! grep -Eq "(^|\b)(${_jail}|ALL)($|\b)" "${bastille_template}/TARGET"; then
             echo -e "${COLOR_GREEN}TARGET: ?${_jail}.${COLOR_RESET}"
             echo
             continue
         fi
     fi
 
-    ## LIMITS (RCTL)
+    if [ -s "${bastille_template}/Bastillefile" ]; then
-    if [ -s "${bastille_template}/LIMITS" ]; then
+        # Ignore blank lines and comments. -- cwells
-        echo -e "${COLOR_GREEN}[${_jail}]:LIMITS -- START${COLOR_RESET}"
+        SCRIPT=$(grep -v '^\s*$' "${bastille_template}/Bastillefile" | grep -v '^\s*#')
-        RACCT_ENABLE=$(sysctl -n kern.racct.enable)
+        # Use a newline as the separator. -- cwells
-        if [ "${RACCT_ENABLE}" != '1' ]; then
+        IFS='
-            echo "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
+'
-            continue
+        set -f
-        fi
+        for _line in ${SCRIPT}; do
-        while read _limits; do
+            _cmd=$(echo "${_line}" | awk '{print tolower($1);}')
-            ## define the key and value
+            _args=$(echo "${_line}" | awk '{$1=""; sub(/^ */, ""); print;}')
-            _limit_key=$(echo "${_limits}" | awk '{print $1}')
-            _limit_value=$(echo "${_limits}" | awk '{print $2}')
-            _rctl_rule="jail:${_jail}:${_limit_key}:deny=${_limit_value}/jail"
 
-            ## if entry doesn't exist, add; else show existing entry
+            # Apply overrides for commands/aliases and arguments. -- cwells
-            if [ ! "$(grep -qs "${_rctl_rule}" "${bastille_jailsdir}/${_jail}/rctl.conf")" ]; then
+            case $_cmd in
-                echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
+                cmd)
-                echo "${_limits}"
+                    # Allow redirection within the jail. -- cwells
-            else
+                    _args="sh -c '${_args}'"
-                echo "${_limits}"
+                    ;;
-            fi
+                cp)
-
+                    # Convert relative "from" path into absolute path inside the template directory. -- cwells
-            ## apply limits to system
+                    if [ "${_args%${_args#?}}" != '/' ]; then
-            rctl -a "${_rctl_rule}" || exit 1
+                        _args="${bastille_template}/${_args}"
-        done < "${bastille_template}/LIMITS"
+                    fi
-        echo -e "${COLOR_GREEN}[${_jail}]:LIMITS -- END${COLOR_RESET}"
+                    ;;
-        echo
+                include)
-    fi
+                    _cmd='template' ;;
-
+                pkg)
-    ## INCLUDE
+                    _args="install -y ${_args}" ;;
-    if [ -s "${bastille_template}/INCLUDE" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:INCLUDE -- START${COLOR_RESET}"
-        while read _include; do
-            echo
-            echo -e "${COLOR_GREEN}INCLUDE: ${_include}${COLOR_RESET}"
-            echo -e "${COLOR_GREEN}Bootstrapping ${_include}...${COLOR_RESET}"
-
-            case ${_include} in
-                http?://github.com/*/*|http?://gitlab.com/*/*)
-                    bastille bootstrap ${_include}
-                ;;
-                */*)
-                    BASTILLE_TEMPLATE_USER=$(echo "${_include}" | awk -F / '{ print $1 }')
-                    BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $2 }')
-                    bastille template ${_jail} ${BASTILLE_TEMPLATE_USER}/${BASTILLE_TEMPLATE_REPO}
-                ;;
-                *)
-                    echo -e "${COLOR_RED}Template INCLUDE content not recognized.${COLOR_RESET}"
-                    exit 1
-            ;;
             esac
 
-            echo
+            if ! eval "bastille ${_cmd} ${_jail} ${_args}"; then
-            echo -e "${COLOR_GREEN}Applying ${_include}...${COLOR_RESET}"
+                echo -e "${COLOR_RED}Failed to execute command: ${BASTILLE_COMMAND}${COLOR_RESET}"
-            BASTILLE_TEMPLATE_PROJECT=$(echo "${_include}" | awk -F / '{ print $4}')
+                set +f
-            BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $5}')
+                unset IFS
-            bastille template ${_jail} ${BASTILLE_TEMPLATE_PROJECT}/${BASTILLE_TEMPLATE_REPO}
+                exit 1
-        done < "${bastille_template}/INCLUDE"
+            fi
-        echo -e "${COLOR_GREEN}[${_jail}]:INCLUDE -- END${COLOR_RESET}"
+        done
-        echo
+        set +f
+        unset IFS
     fi
 
-    ## PRE
+    for _hook in ${HOOKS}; do
-    if [ -s "${bastille_template}/PRE" ]; then
+        if [ -s "${bastille_template}/${_hook}" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:PRE -- START${COLOR_RESET}"
+        	# Default command is the lowercase hook name and default args are the line from the file. -- cwells
-        jexec -l ${_jail} /bin/sh < "${bastille_template}/PRE" || exit 1
+        	_cmd=$(echo "${_hook}" | awk '{print tolower($1);}')
-        echo -e "${COLOR_GREEN}[${_jail}]:PRE -- END${COLOR_RESET}"
+            _args_template='${_line}'
-        echo
-    fi
 
-    ## FSTAB
+            # Override default command/args for some hooks. -- cwells
-    if [ -s "${bastille_template}/FSTAB" ]; then
+            case ${_hook} in
-        echo -e "${COLOR_GREEN}[${_jail}]:FSTAB -- START${COLOR_RESET}"
+                CONFIG)
-        while read _fstab; do
+                    echo -e "${COLOR_YELLOW}CONFIG deprecated; rename to OVERLAY.${COLOR_RESET}"
-            ## assign needed variables
+                    _args_template='${bastille_template}/${_line} /'
-            _hostpath=$(echo "${_fstab}" | awk '{print $1}')
+                    _cmd='cp' ;;
-            _jailpath=$(echo "${_fstab}" | awk '{print $2}')
+                FSTAB)
-            _type=$(echo "${_fstab}" | awk '{print $3}')
+                    _cmd='mount' ;;
-            _perms=$(echo "${_fstab}" | awk '{print $4}')
+                INCLUDE)
-            _checks=$(echo "${_fstab}" | awk '{print $5" "$6}')
+                    _cmd='template' ;;
+                OVERLAY)
+                    _args_template='${bastille_template}/${_line} /'
+                    _cmd='cp' ;;
+                PF)
+                    echo -e "${COLOR_GREEN}NOT YET IMPLEMENTED.${COLOR_RESET}"
+                    continue ;;
+                PRE)
+                    _cmd='cmd' ;;
+            esac
 
-            ## if any variables are empty, bail out
+            echo -e "${COLOR_GREEN}[${_jail}]:${_hook} -- START${COLOR_RESET}"
-            if [ -z "${_hostpath}" ] || [ -z "${_jailpath}" ] || [ -z "${_type}" ] || [ -z "${_perms}" ] || [ -z "${_checks}" ]; then
+            if [ "${_hook}" = 'CMD' ] || [ "${_hook}" = 'PRE' ]; then
-                echo -e "${COLOR_RED}FSTAB format not recognized.${COLOR_RESET}"
+                bastille cmd "${_jail}" /bin/sh < "${bastille_template}/${_hook}" || exit 1
-                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
+            elif [ "${_hook}" = 'PKG' ]; then
-                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
+                bastille pkg "${_jail}" install -y $(cat "${bastille_template}/PKG") || exit 1
-                exit 1
+                bastille pkg "${_jail}" audit -F
-            fi
-            ## if host path doesn't exist or type is not "nullfs"
-            if [ ! -d "${_hostpath}" ] || [ "${_type}" != "nullfs" ]; then
-                echo -e "${COLOR_RED}Detected invalid host path or incorrect mount type in FSTAB.${COLOR_RESET}"
-                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
-                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
-                exit 1
-            fi
-            ## if mount permissions are not "ro" or "rw"
-            if [ "${_perms}" != "ro" ] && [ "${_perms}" != "rw" ]; then
-                echo -e "${COLOR_RED}Detected invalid mount permissions in FSTAB.${COLOR_RESET}"
-                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
-                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
-                exit 1
-            fi
-            ## if check & pass are not "0 0 - 1 1"; bail out
-            if [ "${_checks}" != "0 0" ] && [ "${_checks}" != "1 0" ] && [ "${_checks}" != "0 1" ] && [ "${_checks}" != "1 1" ]; then
-                echo -e "${COLOR_RED}Detected invalid fstab options in FSTAB.${COLOR_RESET}"
-                echo -e "${COLOR_YELLOW}Format: /host/path jail/path nullfs ro 0 0${COLOR_RESET}"
-                echo -e "${COLOR_YELLOW}Read: ${_fstab}${COLOR_RESET}"
-                exit 1
-            fi
-
-            ## aggregate variables into FSTAB entry
-            _fstab_entry="${_hostpath} ${bastille_jailsdir}/${_jail}/root/${_jailpath} ${_type} ${_perms} ${_checks}"
-
-            ## if entry doesn't exist, add; else show existing entry
-            if [ ! "$(grep "${_jailpath}" "${bastille_jailsdir}/${_jail}/fstab")" ]; then
-                echo "${_fstab_entry}" >> "${bastille_jailsdir}/${_jail}/fstab"
-                echo "Added: ${_fstab_entry}"
             else
-                echo "$(grep "${_jailpath}" "${bastille_jailsdir}/${_jail}/fstab")"
+                while read _line; do
+                	if [ -z "${_line}" ]; then
+                	    continue
+                	fi
+                    eval "_args=\"${_args_template}\""
+                    bastille "${_cmd}" "${_jail}" ${_args} || exit 1
+                done < "${bastille_template}/${_hook}"
             fi
-        done < "${bastille_template}/FSTAB"
+            echo -e "${COLOR_GREEN}[${_jail}]:${_hook} -- END${COLOR_RESET}"
-        mount -F "${bastille_jailsdir}/${_jail}/fstab" -a
+            echo
-        echo -e "${COLOR_GREEN}[${_jail}]:FSTAB -- END${COLOR_RESET}"
+        fi
-        echo
+    done
-    fi
 
-    ## PF
+    echo -e "${COLOR_GREEN}Template complete.${COLOR_RESET}"
-    if [ -s "${bastille_template}/PF" ]; then
-        echo -e "${COLOR_GREEN}NOT YET IMPLEMENTED.${COLOR_RESET}"
-    fi
-
-    ## PKG (bootstrap + pkg)
-    if [ -s "${bastille_template}/PKG" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:PKG -- START${COLOR_RESET}"
-        jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg bootstrap || exit 1
-        jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg install $(cat ${bastille_template}/PKG) || exit 1
-        jexec -l "${_jail}" env ASSUME_ALWAYS_YES=YES /usr/sbin/pkg audit -F
-        echo -e "${COLOR_GREEN}[${_jail}]:PKG -- END${COLOR_RESET}"
-        echo
-    fi
-
-    ## CONFIG / OVERLAY
-    if [ -s "${bastille_template}/OVERLAY" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:OVERLAY -- START${COLOR_RESET}"
-        while read _dir; do
-            cp -av "${bastille_template}/${_dir}" "${bastille_jail_path}" || exit 1
-        done < ${bastille_template}/OVERLAY
-        echo -e "${COLOR_GREEN}[${_jail}]:OVERLAY -- END${COLOR_RESET}"
-        echo
-    fi
-    if [ -s "${bastille_template}/CONFIG" ]; then
-        echo -e "${COLOR_YELLOW}CONFIG deprecated; rename to OVERLAY.${COLOR_RESET}"
-        echo -e "${COLOR_GREEN}[${_jail}]:CONFIG -- START${COLOR_RESET}"
-        while read _dir; do
-            cp -av "${bastille_template}/${_dir}" "${bastille_jail_path}" || exit 1
-        done < ${bastille_template}/CONFIG
-        echo -e "${COLOR_GREEN}[${_jail}]:CONFIG -- END${COLOR_RESET}"
-        echo
-    fi
-
-    ## SYSRC
-    if [ -s "${bastille_template}/SYSRC" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:SYSRC -- START${COLOR_RESET}"
-        while read _sysrc; do
-            jexec -l ${_jail} /usr/sbin/sysrc "${_sysrc}" || exit 1
-        done < "${bastille_template}/SYSRC"
-        echo -e "${COLOR_GREEN}[${_jail}]:SYSRC -- END${COLOR_RESET}"
-        echo
-    fi
-
-    ## SERVICE
-    if [ -s "${bastille_template}/SERVICE" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:SERVICE -- START${COLOR_RESET}"
-        while read _service; do
-            jexec -l ${_jail} /usr/sbin/service ${_service} || exit 1
-        done < "${bastille_template}/SERVICE"
-        echo -e "${COLOR_GREEN}[${_jail}]:SERVICE -- END${COLOR_RESET}"
-        echo
-    fi
-
-    ## CMD
-    if [ -s "${bastille_template}/CMD" ]; then
-        echo -e "${COLOR_GREEN}[${_jail}]:CMD -- START${COLOR_RESET}"
-        jexec -l ${_jail} /bin/sh < "${bastille_template}/CMD" || exit 1
-        echo -e "${COLOR_GREEN}[${_jail}]:CMD -- END${COLOR_RESET}"
-        echo
-    fi
-
-    echo -e "${COLOR_GREEN}Template Complete.${COLOR_RESET}"
     echo
 done

usr/local/share/bastille/top.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -59,6 +59,6 @@ fi
 
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    jexec -l ${_jail} /usr/bin/top
+    jexec -l "${_jail}" /usr/bin/top
     echo -e "${COLOR_RESET}"
 done

usr/local/share/bastille/umount.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/colors.pre.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    echo -e "${COLOR_RED}Usage: bastille umount TARGET container_path${COLOR_RESET}"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -ne 2 ]; then
+    usage
+fi
+
+TARGET=$1
+shift
+
+MOUNT_PATH=$1
+shift
+
+if [ "${TARGET}" = 'ALL' ]; then
+    JAILS=$(jls name)
+else
+    JAILS=$(jls name | awk "/^${TARGET}$/")
+fi
+
+for _jail in ${JAILS}; do
+    echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
+
+    _jailpath="${bastille_jailsdir}/${_jail}/root/${MOUNT_PATH}"
+
+    if [ ! -d "${_jailpath}" ]; then
+        echo -e "${COLOR_RED}The specified mount point does not exist inside the jail.${COLOR_RESET}"
+        exit 1
+    fi
+
+    # Unmount the volume. -- cwells
+    if ! umount "${_jailpath}"; then
+        echo -e "${COLOR_RED}Failed to unmount volume: ${MOUNT_PATH}${COLOR_RESET}"
+        exit 1
+    fi
+
+    # Remove the entry from fstab so it is not automounted in the future. -- cwells
+    if ! sed -E -i '' "\, +${_jailpath} +,d" "${bastille_jailsdir}/${_jail}/fstab"; then
+        echo -e "${COLOR_RED}Failed to delete fstab entry: ${_fstab_entry}${COLOR_RESET}"
+        exit 1
+    fi
+
+    echo "Unmounted: ${MOUNT_PATH}"
+    echo
+done

usr/local/share/bastille/update.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -50,7 +50,7 @@ fi
 TARGET="${1}"
 shift
 
-if [ ! -z "$(freebsd-version | grep -i HBSD)" ]; then
+if freebsd-version | grep -qi HBSD; then
     echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
     exit 1
 fi
@@ -59,7 +59,7 @@ if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
     if ! grep -qw ".bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
             if [ "$(jls name | awk "/^${TARGET}$/")" ]; then
                 # Update a thick container.
-                CURRENT_VERSION=$(/usr/sbin/jexec -l ${TARGET} freebsd-version 2>/dev/null)
+                CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
                 if [ -z "${CURRENT_VERSION}" ]; then
                     echo -e "${COLOR_RED}Can't determine '${TARGET}' version.${COLOR_RESET}"
                     exit 1

usr/local/share/bastille/upgrade.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -51,7 +51,7 @@ RELEASE="$1"
 shift
 NEWRELEASE="$1"
 
-if [ ! -z "$(freebsd-version | grep -i HBSD)" ]; then
+if freebsd-version | grep -qi HBSD; then
     echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
     exit 1
 fi

usr/local/share/bastille/verify.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -37,13 +37,13 @@ bastille_usage() {
 }
 
 verify_release() {
-    if [ ! -z "$(freebsd-version | grep -i HBSD)" ]; then
+    if freebsd-version | grep -qi HBSD; then
         echo -e "${COLOR_RED}Not yet supported on HardenedBSD.${COLOR_RESET}"
         exit 1
     fi
 
     if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
-        freebsd-update -b "${bastille_releasesdir}/${RELEASE}" --currently-running ${RELEASE} IDS
+        freebsd-update -b "${bastille_releasesdir}/${RELEASE}" --currently-running "${RELEASE}" IDS
     else
         echo -e "${COLOR_RED}${RELEASE} not found. See bootstrap.${COLOR_RESET}"
         exit 1
@@ -61,7 +61,7 @@ verify_template() {
             echo -e "${COLOR_GREEN}Detected ${_hook} hook.${COLOR_RESET}"
 
             ## line count must match newline count
-            if [ $(wc -l ${_path} | awk '{print $1}') -ne $(grep -c $'\n' ${_path}) ]; then
+            if [ $(wc -l "${_path}" | awk '{print $1}') -ne $(grep -c $'\n' "${_path}") ]; then
                 echo -e "${COLOR_GREEN}[${_hook}]:${COLOR_RESET}"
                 echo -e "${COLOR_RED}${BASTILLE_TEMPLATE}:${_hook} [failed].${COLOR_RESET}"
                 echo -e "${COLOR_RED}Line numbers don't match line breaks.${COLOR_RESET}"
@@ -79,19 +79,19 @@ verify_template() {
 
                     case ${_include} in
                         http?://github.com/*/*|http?://gitlab.com/*/*)
-                            bastille bootstrap ${_include}
+                            bastille bootstrap "${_include}"
                         ;;
                         */*)
                             BASTILLE_TEMPLATE_USER=$(echo "${_include}" | awk -F / '{ print $1 }')
                             BASTILLE_TEMPLATE_REPO=$(echo "${_include}" | awk -F / '{ print $2 }')
-                            bastille verify ${BASTILLE_TEMPLATE_USER}/${BASTILLE_TEMPLATE_REPO}
+                            bastille verify "${BASTILLE_TEMPLATE_USER}/${BASTILLE_TEMPLATE_REPO}"
                         ;;
                         *)
                             echo -e "${COLOR_RED}Template INCLUDE content not recognized.${COLOR_RESET}"
                             exit 1
                     ;;
                     esac
-                done < ${_path}
+                done < "${_path}"
 
             ## if tree; tree -a bastille_template/_dir
             elif [ ${_hook} = 'OVERLAY' ]; then
@@ -101,12 +101,12 @@ verify_template() {
                 while read _dir; do
                     echo -e "${COLOR_GREEN}[${_hook}]:[${_dir}]:${COLOR_RESET}"
                         if [ -x /usr/local/bin/tree ]; then
-                            /usr/local/bin/tree -a ${_template_path}/${_dir}
+                            /usr/local/bin/tree -a "${_template_path}/${_dir}"
                         else
                            find "${_template_path}/${_dir}" -print | sed -e 's;[^/]*/;|___;g;s;___|; |;g'
                         fi
                     echo
-                done < ${_path}
+                done < "${_path}"
             else
                 echo -e "${COLOR_GREEN}[${_hook}]:${COLOR_RESET}"
                 cat "${_path}"
@@ -119,7 +119,7 @@ verify_template() {
     if [ ${_hook_validate} -lt 1 ]; then
         echo -e "${COLOR_RED}No valid template hooks found.${COLOR_RESET}"
         echo -e "${COLOR_RED}Template discarded.${COLOR_RESET}"
-        rm -rf ${bastille_template}
+        rm -rf "${bastille_template}"
         exit 1
     fi
 

usr/local/share/bastille/zfs.sh

@@ -1,22 +1,22 @@
 #!/bin/sh
-# 
+#
 # Copyright (c) 2018-2020, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
-# 
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-# 
+#
 # * Redistributions of source code must retain the above copyright notice, this
 #   list of conditions and the following disclaimer.
-# 
+#
 # * Redistributions in binary form must reproduce the above copyright notice,
 #   this list of conditions and the following disclaimer in the documentation
 #   and/or other materials provided with the distribution.
-# 
+#
 # * Neither the name of the copyright holder nor the names of its
 #   contributors may be used to endorse or promote products derived from
 #   this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -39,7 +39,7 @@ usage() {
 zfs_snapshot() {
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    zfs snapshot ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}@${TAG}
+    zfs snapshot -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"@"${TAG}"
     echo
 done
 }
@@ -47,7 +47,7 @@ done
 zfs_set_value() {
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    zfs $ATTRIBUTE ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}
+    zfs "${ATTRIBUTE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
     echo
 done
 }
@@ -55,7 +55,7 @@ done
 zfs_get_value() {
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    zfs get $ATTRIBUTE ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}
+    zfs get "${ATTRIBUTE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
     echo
 done
 }
@@ -63,7 +63,7 @@ done
 zfs_disk_usage() {
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
-    zfs list -t all -o name,used,avail,refer,mountpoint,compress,ratio -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}
+    zfs list -t all -o name,used,avail,refer,mountpoint,compress,ratio -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
     echo
 done
 }