Mirrors/hackacad
2
0
Fork 0
mirror of https://github.com/hackacad/bastille.git synced 2025-12-21 17:52:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'BastilleBSD:master' into multiple-interfaces

Browse Source
This commit is contained in:
tschettervictor
2025-02-23 09:45:55 -07:00
committed by GitHub
parent 6ceed0c5b3 f3e98b796f
commit 609ca801b5
3 changed files with 181 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
docs/chapters/subcommands/destroy.rst
View File

@@ -2,26 +2,29 @@
destroy destroy
======= =======
Containers can be destroyed and thrown away just as easily as they were Jails can be destroyed and thrown away just as easily as they were
created. Note: containers must be stopped before destroyed. created. Note: containers must be stopped before destroyed. Using
the `-a|--auto` option will automatically stop the jail before destroying it.
.. code-block:: shell .. code-block:: shell
ishmael ~ # bastille stop folsom ishmael ~ # bastille destroy -a folsom
[folsom]: [folsom]:
folsom: removed folsom: removed
.. code-block:: shell
ishmael ~ # bastille destroy folsom
Deleting Container: folsom. Deleting Container: folsom.
Note: containers console logs not destroyed. Note: containers console logs not destroyed.
/usr/local/bastille/logs/folsom_console.log /usr/local/bastille/logs/folsom_console.log
Release can be destroyed provided there are no child jails. The `force` option Release can be destroyed provided there are no child jails. The `-c|--no-cache` option
deletes the release cache directory as well: will retain the releas cache directory, if you choose to keep it.
.. code-block:: shell .. code-block:: shell
ishmael ~ # bastille destroy force 14.0-RELEASE ishmael ~ # bastille destroy help
Deleting base: 14.0-RELEASE Usage: bastille destroy [option(s)] [JAIL|RELEASE]
Options:
-a | --auto Auto mode. Start/stop jail(s) if required.
-f | --force Force unmount any mounted datasets when destroying a jail or release (ZFS only).
-c | --no-cache Do no destroy cache when destroying a release.
-x | --debug Enable debug mode.

4
docs/chapters/upgrading.rst
View File

@@ -95,6 +95,6 @@ After upgrading all jails from one release to the next you may find that you now
`bastille list releases` to list all bootstrapped releases. `bastille list releases` to list all bootstrapped releases.
`bastille destroy X.Y-RELEASE` to fully delete the release. `bastille destroy X.Y-RELEASE` to fully delete the release, including the cache.
`bastille destroy [-f|--force] X.Y-RELEASE` to delete the cache directory as well. `bastille destroy [-c|--no-cache] X.Y-RELEASE` to retain the cache directory.

298
usr/local/share/bastille/destroy.sh
View File

@@ -34,79 +34,88 @@
. /usr/local/etc/bastille/bastille.conf . /usr/local/etc/bastille/bastille.conf
usage() { usage() {
error_exit "Usage: bastille destroy [force] | [container|release]" error_notify "Usage: bastille destroy [option(s)] [JAIL|RELEASE]"
cat << EOF
Options:
-a | --auto Auto mode. Start/stop jail(s) if required.
-f | --force Force unmount any mounted datasets when destroying a jail or release (ZFS only).
-c | --no-cache Do no destroy cache when destroying a release.
-x | --debug Enable debug mode.
EOF
exit 1
} }
destroy_jail() { destroy_jail() {
local OPTIONS local OPTIONS
bastille_jail_base="${bastille_jailsdir}/${TARGET}" ## dir
bastille_jail_log="${bastille_logsdir}/${TARGET}_console.log" ## file
if [ "$(/usr/sbin/jls name | awk "/^${TARGET}$/")" ]; then for _jail in ${JAILS}; do
if [ "${FORCE}" = "1" ]; then
bastille stop "${TARGET}" bastille_jail_base="${bastille_jailsdir}/${_jail}" ## dir
bastille_jail_log="${bastille_logsdir}/${_jail}_console.log" ## file
check_target_is_stopped "${_jail}" || if [ "${AUTO}" -eq 1 ]; then
bastille stop "${_jail}"
else else
error_notify "Jail running." error_notify "Jail is running."
error_exit "See 'bastille stop ${TARGET}'." error_continue "Use [-a|--auto] to auto-stop the jail."
fi
fi
if [ ! -d "${bastille_jail_base}" ]; then
error_exit "Jail not found."
fi
if [ -d "${bastille_jail_base}" ]; then
## make sure no filesystem is currently mounted in the jail directory
mount_points=$(mount | cut -d ' ' -f 3 | grep "${bastille_jail_base}"/root/)
if [ -n "${mount_points}" ]; then
error_notify "Failed to destroy jail: ${TARGET}"
error_exit "Jail has mounted filesystems:\n$mount_points"
fi
info "Deleting Jail: ${TARGET}."
if checkyesno bastille_zfs_enable; then
if [ -n "${bastille_zfs_zpool}" ]; then
if [ -n "${TARGET}" ]; then
OPTIONS="-r"
if [ "${FORCE}" = "1" ]; then
OPTIONS="-rf"
fi
## remove jail zfs dataset recursively
zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET}"
fi
fi
fi fi
if [ -d "${bastille_jail_base}" ]; then if [ -d "${bastille_jail_base}" ]; then
## removing all flags ## make sure no filesystem is currently mounted in the jail directory
chflags -R noschg "${bastille_jail_base}" mount_points="$(mount | cut -d ' ' -f 3 | grep ${bastille_jail_base}/root/)"
if [ -n "${mount_points}" ]; then
error_notify "Failed to destroy jail: ${_jail}"
error_continue "Jail has mounted filesystems:\n$mount_points"
fi
info "Deleting Jail: ${_jail}."
if checkyesno bastille_zfs_enable; then
if [ -n "${bastille_zfs_zpool}" ]; then
if [ -n "${_jail}" ]; then
OPTIONS="-r"
if [ "${FORCE}" = "1" ]; then
OPTIONS="-rf"
fi
## remove jail zfs dataset recursively
zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"
fi
fi
fi
## remove jail base if [ -d "${bastille_jail_base}" ]; then
rm -rf "${bastille_jail_base}" ## removing all flags
fi chflags -R noschg "${bastille_jail_base}"
# Remove target from bastille_list if exist ## remove jail base
# Mute sysrc output here as it may be undesirable on large startup list rm -rf "${bastille_jail_base}"
if [ -n "$(sysrc -qn bastille_list | tr -s " " "\n" | awk "/^${TARGET}$/")" ]; then fi
sysrc bastille_list-="${TARGET}" > /dev/null
fi
## archive jail log # Remove target from bastille_list if exist
if [ -f "${bastille_jail_log}" ]; then # Mute sysrc output here as it may be undesirable on large startup list
mv "${bastille_jail_log}" "${bastille_jail_log}"-"$(date +%F)" if [ -n "$(sysrc -qn bastille_list | tr -s " " "\n" | awk "/^${_jail}$/")" ]; then
info "Note: jail console logs archived." sysrc bastille_list-="${_jail}" > /dev/null
info "${bastille_jail_log}-$(date +%F)" fi
fi
## clear any active rdr rules ## archive jail log
if [ ! -z "$(pfctl -a "rdr/${TARGET}" -Psn 2>/dev/null)" ]; then if [ -f "${bastille_jail_log}" ]; then
info "Clearing RDR rules:" mv "${bastille_jail_log}" "${bastille_jail_log}"-"$(date +%F)"
pfctl -a "rdr/${TARGET}" -Fn info "Note: jail console logs archived."
info "${bastille_jail_log}-$(date +%F)"
fi
## clear any active rdr rules
if [ ! -z "$(pfctl -a "rdr/${_jail}" -Psn 2>/dev/null)" ]; then
info "Clearing RDR rules:"
pfctl -a "rdr/${_jail}" -Fn
fi
fi fi
echo done
fi
} }
destroy_rel() { destroy_rel() {
local OPTIONS local OPTIONS
## check release name match before destroy ## check release name match before destroy
@@ -160,7 +169,7 @@ destroy_rel() {
OPTIONS="-rf" OPTIONS="-rf"
fi fi
zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${TARGET}" zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${TARGET}"
if [ "${FORCE}" = "1" ]; then if [ "${NO_CACHE}" = "0" ]; then
if [ -d "${bastille_cachedir}/${TARGET}" ]; then if [ -d "${bastille_cachedir}/${TARGET}" ]; then
zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${TARGET}" zfs destroy "${OPTIONS}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${TARGET}"
fi fi
@@ -177,98 +186,119 @@ destroy_rel() {
rm -rf "${bastille_rel_base}" rm -rf "${bastille_rel_base}"
fi fi
if [ "${FORCE}" = "1" ]; then if [ "${NO_CACHE}" = "0" ]; then
## remove cache on force ## remove cache by default
if [ -d "${bastille_cachedir}/${TARGET}" ]; then if [ -d "${bastille_cachedir}/${TARGET}" ]; then
rm -rf "${bastille_cachedir:?}/${TARGET}" rm -rf "${bastille_cachedir:?}/${TARGET:?}"
fi fi
fi fi
echo
else else
error_notify "Cannot destroy base with child containers." error_notify "Cannot destroy base with child containers."
fi fi
fi fi
} }
# Handle special-case commands first. # Handle options.
case "$1" in AUTO=0
help|-h|--help) FORCE=0
usage NO_CACHE=0
;; while [ "$#" -gt 0 ]; do
esac case "${1}" in
-h|--help|help)
usage
;;
-a|--auto)
AUTO=1
shift
;;
-c|--no-cache)
NO_CACHE=1
shift
;;
-f|--force)
FORCE=1
shift
;;
-x|--debug)
enable_debug
shift
;;
-*)
for _opt in $(echo ${1} | sed 's/-//g' | fold -w1); do
case ${_opt} in
a) AUTO=1 ;;
c) NO_CACHE=1 ;;
f) FORCE=1 ;;
x) enable_debug ;;
*) error_exit "Unknown Option: \"${1}\"" ;;
esac
done
shift
;;
*)
break
;;
esac
done
## reset this options if [ "$#" -ne 1 ]; then
FORCE=""
## handle additional options
case "${1}" in
-f|--force|force)
FORCE="1"
shift
;;
-*)
error_notify "Unknown Option."
usage
;;
esac
TARGET="${1}"
if [ $# -gt 1 ] || [ $# -lt 1 ]; then
usage usage
fi fi
TARGET="${1}"
bastille_root_check bastille_root_check
## check what should we clean ## check what should we clean
case "${TARGET}" in case "${TARGET}" in
*-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current) *-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current)
## check for FreeBSD releases name ## check for FreeBSD releases name
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
destroy_rel destroy_rel
;; ;;
*-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9]) *-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
## check for FreeBSD releases name ## check for FreeBSD releases name
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
destroy_rel destroy_rel
;; ;;
*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
## check for HardenedBSD releases name ## check for HardenedBSD releases name
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g;s/last/LAST/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g;s/last/LAST/g')
destroy_rel destroy_rel
;; ;;
*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
## check for HardenedBSD(specific stable build releases) ## check for HardenedBSD(specific stable build releases)
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g;s/STABLE/stable/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g;s/STABLE/stable/g')
destroy_rel destroy_rel
;; ;;
*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST) *-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
## check for HardenedBSD(latest stable build release) ## check for HardenedBSD(latest stable build release)
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/;s/build/BUILD/g;s/latest/LATEST/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/;s/build/BUILD/g;s/latest/LATEST/g')
destroy_rel destroy_rel
;; ;;
current-build-[0-9]*|CURRENT-BUILD-[0-9]*) current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
## check for HardenedBSD(specific current build releases) ## check for HardenedBSD(specific current build releases)
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g;s/CURRENT/current/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g;s/CURRENT/current/g')
destroy_rel destroy_rel
;; ;;
current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST) current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
## check for HardenedBSD(latest current build release) ## check for HardenedBSD(latest current build release)
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest)$' | sed 's/CURRENT/current/;s/build/BUILD/g;s/latest/LATEST/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest)$' | sed 's/CURRENT/current/;s/build/BUILD/g;s/latest/LATEST/g')
destroy_rel destroy_rel
;; ;;
Ubuntu_1804|Ubuntu_2004|Ubuntu_2204|UBUNTU_1804|UBUNTU_2004|UBUNTU_2204) Ubuntu_1804|Ubuntu_2004|Ubuntu_2204|UBUNTU_1804|UBUNTU_2004|UBUNTU_2204)
## check for Linux releases ## check for Linux releases
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Ubuntu_1804)$|(Ubuntu_2004)$|(Ubuntu_2204)$' | sed 's/UBUNTU/Ubuntu/g;s/ubuntu/Ubuntu/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Ubuntu_1804)$|(Ubuntu_2004)$|(Ubuntu_2204)$' | sed 's/UBUNTU/Ubuntu/g;s/ubuntu/Ubuntu/g')
destroy_rel destroy_rel
;; ;;
Debian10|Debian11|Debian12|DEBIAN10|DEBIAN11|DEBIAN12) Debian10|Debian11|Debian12|DEBIAN10|DEBIAN11|DEBIAN12)
## check for Linux releases ## check for Linux releases
NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Debian10)$|(Debian11)$|(Debian12)$' | sed 's/DEBIAN/Debian/g') NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Debian10)$|(Debian11)$|(Debian12)$' | sed 's/DEBIAN/Debian/g')
destroy_rel destroy_rel
;; ;;
*) *)
## just destroy a jail ## just destroy a jail
destroy_jail set_target "${TARGET}"
;; destroy_jail "${JAILS}"
;;
esac esac