Mirrors/hackacad
2
0
Fork 0
mirror of https://github.com/hackacad/bastille.git synced 2025-12-22 10:10:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into patch-2

Browse Source
This commit is contained in:
tschettervictor
2025-02-03 13:46:40 -07:00
committed by GitHub
parent 73d510aae4 0c722acf4b
commit 7b6e7c4f8d
6 changed files with 237 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
usr/local/bin/bastille
View File

@@ -165,11 +165,10 @@ version|-v|--version)
help|-h|--help) help|-h|--help)
usage usage
;; ;;
bootstrap|clone|console|create|cp|destroy|etcupdate|export|htop|import|jcp|list|mount|pkg|rcp|rdr|rename|restart|setup|start|stop|top|umount|update|upgrade|verify)
bootstrap|clone|console|create|cp|destroy|etcupdate|export|htop|import|jcp|list|mount|rcp|rdr|rename|restart|setup|start|stop|top|umount|update|upgrade|verify)
# Nothing "extra" to do for these commands. -- cwells # Nothing "extra" to do for these commands. -- cwells
;; ;;
config|cmd|convert|edit|limits|pkg|service|sysrc|tags|template|zfs) config|cmd|convert|edit|limits|service|sysrc|tags|template|zfs)
# Parse the target and ensure it exists. -- cwells # Parse the target and ensure it exists. -- cwells
if [ $# -eq 0 ]; then # No target was given, so show the command's help. -- cwells if [ $# -eq 0 ]; then # No target was given, so show the command's help. -- cwells
PARAMS='help' PARAMS='help'

20
usr/local/share/bastille/clone.sh
View File

@@ -108,13 +108,10 @@ if echo "${NEWNAME}" | grep -q "[.]"; then
fi fi
validate_ip() { validate_ip() {
IPX_ADDR="ip4.addr"
IP6_MODE="disable" IP6_MODE="disable"
ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))') ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))')
if [ -n "${ip6}" ]; then if [ -n "${ip6}" ]; then
info "Valid: (${ip6})." info "Valid: (${ip6})."
IPX_ADDR="ip6.addr"
# shellcheck disable=SC2034
IP6_MODE="new" IP6_MODE="new"
else else
local IFS local IFS
@@ -159,17 +156,22 @@ update_jailconf() {
# IP4 # IP4
if [ "${_ip4}" != "not set" ]; then if [ "${_ip4}" != "not set" ]; then
for _ip in ${_ip4}; do for _ip in ${_ip4}; do
_ip="$(echo ${_ip} | awk -F"|" '{print $2}')" if echo ${_ip} | grep -q "|"; then
sed -i '' "/${IPX_ADDR} = .*/ s/${_ip}/${IP}/" "${JAIL_CONFIG}" _ip="$(echo ${_ip} | awk -F"|" '{print $2}')"
sed -i '' "/${IPX_ADDR} += .*/ s/${_ip}/127.0.0.1/" "${JAIL_CONFIG}" fi
sed -i '' "/ip4.addr = .*/ s/${_ip}/${IP}/" "${JAIL_CONFIG}"
sed -i '' "/ip4.addr += .*/ s/${_ip}/127.0.0.1/" "${JAIL_CONFIG}"
done done
fi fi
# IP6 # IP6
if [ "${_ip6}" != "not set" ]; then if [ "${_ip6}" != "not set" ]; then
for _ip in ${_ip6}; do for _ip in ${_ip6}; do
_ip="$(echo ${_ip} | awk -F"|" '{print $2}')" if echo ${_ip} | grep -q "|"; then
sed -i '' "/${IPX_ADDR} = .*/ s/${_ip}/${IP}/" "${JAIL_CONFIG}" _ip="$(echo ${_ip} | awk -F"|" '{print $2}')"
sed -i '' "/${IPX_ADDR} += .*/ s/${_ip}/127.0.0.1/" "${JAIL_CONFIG}" fi
sed -i '' "/ip6.addr = .*/ s/${_ip}/${IP}/" "${JAIL_CONFIG}"
sed -i '' "/ip6.addr += .*/ s/${_ip}/127.0.0.1/" "${JAIL_CONFIG}"
sed -i '' "s/ip6 = .*/ip6 = ${IP6_MODE};/" "${JAIL_CONFIG}"
done done
fi fi
fi fi

157
usr/local/share/bastille/create.sh
View File

@@ -656,6 +656,7 @@ VNET_JAIL=""
LINUX_JAIL="" LINUX_JAIL=""
STATIC_MAC="" STATIC_MAC=""
DUAL_STACK="" DUAL_STACK=""
VALIDATE_RELEASE="1"
while [ $# -gt 0 ]; do while [ $# -gt 0 ]; do
case "${1}" in case "${1}" in
-h|--help|help) -h|--help|help)
@@ -694,6 +695,10 @@ while [ $# -gt 0 ]; do
CLONE_JAIL="1" CLONE_JAIL="1"
shift shift
;; ;;
--no-validate|no-validate)
VALIDATE_RELEASE=""
shift
;;
-*) -*)
for _opt in $(echo ${1} | sed 's/-//g' | fold -w1); do for _opt in $(echo ${1} | sed 's/-//g' | fold -w1); do
case ${_opt} in case ${_opt} in
@@ -750,7 +755,7 @@ if [ -n "${NAME}" ]; then
validate_name validate_name
fi fi
if [ -n "${LINUX_JAIL}" ]; then if [ -n "${LINUX_JAIL}" ] && [ -n "${VALIDATE_RELEASE}" ]; then
case "${RELEASE}" in case "${RELEASE}" in
bionic|ubuntu_bionic|ubuntu|ubuntu-bionic) bionic|ubuntu_bionic|ubuntu|ubuntu-bionic)
## check for FreeBSD releases name ## check for FreeBSD releases name
@@ -784,80 +789,82 @@ if [ -n "${LINUX_JAIL}" ]; then
fi fi
if [ -z "${EMPTY_JAIL}" ]; then if [ -z "${EMPTY_JAIL}" ]; then
## verify release if [ -n "${VALIDATE_RELEASE}" ]; then
case "${RELEASE}" in ## verify release
2.[0-9]*) case "${RELEASE}" in
## check for MidnightBSD releases name 2.[0-9]*)
NAME_VERIFY=$(echo "${RELEASE}") ## check for MidnightBSD releases name
validate_release NAME_VERIFY=$(echo "${RELEASE}")
;; validate_release
*-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current) ;;
## check for FreeBSD releases name *-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') ## check for FreeBSD releases name
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
;; validate_release
*-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9]) ;;
## check for FreeBSD releases name *-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') ## check for FreeBSD releases name
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
;; validate_release
*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) ;;
## check for HardenedBSD releases name(previous infrastructure) *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') ## check for HardenedBSD releases name(previous infrastructure)
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
;; validate_release
*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) ;;
## check for HardenedBSD(specific stable build releases) *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') ## check for HardenedBSD(specific stable build releases)
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
;; validate_release
*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST) ;;
## check for HardenedBSD(latest stable build release) *-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') ## check for HardenedBSD(latest stable build release)
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
;; validate_release
current-build-[0-9]*|CURRENT-BUILD-[0-9]*) ;;
## check for HardenedBSD(specific current build releases) current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g') ## check for HardenedBSD(specific current build releases)
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
;; validate_release
current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST) ;;
## check for HardenedBSD(latest current build release) current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') ## check for HardenedBSD(latest current build release)
validate_release NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
;; validate_release
ubuntu_bionic|bionic|ubuntu-bionic) ;;
UBUNTU="1" ubuntu_bionic|bionic|ubuntu-bionic)
NAME_VERIFY=Ubuntu_1804 UBUNTU="1"
validate_release NAME_VERIFY=Ubuntu_1804
;; validate_release
ubuntu_focal|focal|ubuntu-focal) ;;
UBUNTU="1" ubuntu_focal|focal|ubuntu-focal)
NAME_VERIFY=Ubuntu_2004 UBUNTU="1"
validate_release NAME_VERIFY=Ubuntu_2004
;; validate_release
ubuntu_jammy|jammy|ubuntu-jammy) ;;
UBUNTU="1" ubuntu_jammy|jammy|ubuntu-jammy)
NAME_VERIFY=Ubuntu_2204 UBUNTU="1"
validate_release NAME_VERIFY=Ubuntu_2204
;; validate_release
debian_buster|buster|debian-buster) ;;
NAME_VERIFY=Debian10 debian_buster|buster|debian-buster)
validate_release NAME_VERIFY=Debian10
;; validate_release
debian_bullseye|bullseye|debian-bullseye) ;;
NAME_VERIFY=Debian11 debian_bullseye|bullseye|debian-bullseye)
validate_release NAME_VERIFY=Debian11
;; validate_release
debian_bookworm|bookworm|debian-bookworm) ;;
NAME_VERIFY=Debian12 debian_bookworm|bookworm|debian-bookworm)
validate_release NAME_VERIFY=Debian12
;; validate_release
*) ;;
error_notify "Unknown Release." *)
usage error_notify "Unknown Release."
;; usage
esac ;;
esac
fi
## check for name/root/.bastille ## check for name/root/.bastille
if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then

38
usr/local/share/bastille/mount.sh
View File

@@ -34,18 +34,41 @@
. /usr/local/etc/bastille/bastille.conf . /usr/local/etc/bastille/bastille.conf
usage() { usage() {
error_exit "Usage: bastille mount [option(s)] TARGET HOST_PATH JAIL_PATH [filesystem_type options dump pass_number]" error_notify "Usage: bastille mount [option(s)] TARGET HOST_PATH JAIL_PATH [filesystem_type options dump pass_number]"
cat << EOF
Options:
-a | --auto Auto mode. Start/stop jail(s) if required.
-x | --debug Enable debug mode.
EOF
exit 1
} }
# Handle options. # Handle options.
AUTO=0
while [ "$#" -gt 0 ]; do while [ "$#" -gt 0 ]; do
case "${1}" in case "${1}" in
-h|--help|help) -h|--help|help)
usage usage
;; ;;
--*|-*) -a|--auto)
error_notify "Unknown Option." AUTO=1
usage shift
;;
-x|--debug)
enable_debug
shift
;;
-*)
for _opt in $(echo ${1} | sed 's/-//g' | fold -w1); do
case ${_opt} in
a) AUTO=1 ;;
x) enable_debug ;;
*) error_exit "Unknown Option: \"${1}\""
esac
done
shift
;; ;;
*) *)
break break
@@ -120,6 +143,13 @@ for _jail in ${JAILS}; do
info "[${_jail}]:" info "[${_jail}]:"
check_target_is_running "${_jail}" || if [ "${AUTO}" -eq 1 ]; then
bastille start "${_jail}"
else
error_notify "Jail is not running."
error_exit "Use [-a|--auto] to auto-start the jail."
fi
_fullpath_fstab="$( echo "${bastille_jailsdir}/${_jail}/root/${_jailpath_fstab}" 2>/dev/null | sed 's#//#/#' )" _fullpath_fstab="$( echo "${bastille_jailsdir}/${_jail}/root/${_jailpath_fstab}" 2>/dev/null | sed 's#//#/#' )"
_fullpath="$( echo "${bastille_jailsdir}/${_jail}/root/${_jailpath}" 2>/dev/null | sed 's#//#/#' )" _fullpath="$( echo "${bastille_jailsdir}/${_jail}/root/${_jailpath}" 2>/dev/null | sed 's#//#/#' )"
_fstab_entry="${_hostpath_fstab} ${_fullpath_fstab} ${_type} ${_perms} ${_checks}" _fstab_entry="${_hostpath_fstab} ${_fullpath_fstab} ${_type} ${_perms} ${_checks}"

73
usr/local/share/bastille/pkg.sh
View File

@@ -31,29 +31,82 @@
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
. /usr/local/share/bastille/common.sh . /usr/local/share/bastille/common.sh
. /usr/local/etc/bastille/bastille.conf
usage() { usage() {
error_exit "Usage: bastille pkg [-H|--host] TARGET command [args]" error_notify "Usage: bastille pkg [option(s)] TARGET COMMAND args"
cat << EOF
Options:
-a | --auto Auto mode. Start/stop jail(s) if required.
-H | --host Use host 'pkg'.
-x | --debug Enable debug mode.
EOF
exit 1
} }
# Handle special-case commands first. # Handle options.
case "$1" in AUTO=0
help|-h|--help) USE_HOST_PKG=0
usage while [ "$#" -gt 0 ]; do
;; case "${1}" in
esac -h|--help|help)
usage
;;
-a|--auto)
AUTO=1
shift
;;
-H|--host)
USE_HOST_PKG=1
shift
;;
-x|--debug)
enable_debug
shift
;;
-*)
for _opt in $(echo ${1} | sed 's/-//g' | fold -w1); do
case ${_opt} in
a) AUTO=1 ;;
H) USE_HOST_PKG=1 ;;
x) enable_debug ;;
*) error_exit "Unknown Option: \"${1}\"" ;;
esac
done
shift
;;
*)
break
;;
esac
done
if [ $# -lt 1 ]; then if [ $# -lt 2 ]; then
usage usage
fi fi
TARGET="${1}"
shift
bastille_root_check bastille_root_check
set_target "${TARGET}"
errors=0 errors=0
for _jail in ${JAILS}; do for _jail in ${JAILS}; do
info "[${_jail}]:" info "[${_jail}]:"
bastille_jail_path=$(/usr/sbin/jls -j "${_jail}" path)
check_target_is_running "${_jail}" || if [ "${AUTO}" -eq 1 ]; then
bastille start "${_jail}"
else
error_notify "Jail is not running."
error_continue "Use [-a|--auto] to auto-start the jail."
fi
bastille_jail_path="${bastille_jailsdir}/${_jail}/root"
if [ -f "/usr/sbin/mport" ]; then if [ -f "/usr/sbin/mport" ]; then
if ! jexec -l -U root "${_jail}" /usr/sbin/mport "$@"; then if ! jexec -l -U root "${_jail}" /usr/sbin/mport "$@"; then
errors=1 errors=1
@@ -71,10 +124,8 @@ for _jail in ${JAILS}; do
errors=1 errors=1
fi fi
fi fi
echo
done done
if [ $errors -ne 0 ]; then if [ $errors -ne 0 ]; then
error_exit "Failed to apply on some jails, please check logs" error_exit "Failed to apply on some jails, please check logs"
exit 1
fi fi

53
usr/local/share/bastille/umount.sh
View File

@@ -34,15 +34,47 @@
. /usr/local/etc/bastille/bastille.conf . /usr/local/etc/bastille/bastille.conf
usage() { usage() {
error_exit "Usage: bastille umount TARGET JAIL_PATH" error_notify "Usage: bastille umount [option(s)] TARGET JAIL_PATH"
cat << EOF
Options:
-a | --auto Auto mode. Start/stop jail(s) if required.
-x | --debug Enable debug mode.
EOF
exit 1
} }
# Handle special-case commands first. # Handle options.
case "${1}" in AUTO=0
help|-h|--help) while [ "$#" -gt 0 ]; do
usage case "${1}" in
;; -h|--help|help)
esac usage
;;
-a|--auto)
AUTO=1
shift
;;
-x|--debug)
enable_debug
shift
;;
-*)
for _opt in $(echo ${1} | sed 's/-//g' | fold -w1); do
case ${_opt} in
a) AUTO=1 ;;
x) enable_debug ;;
*) error_exit "Unknown Option: \"${1}\""
esac
done
shift
;;
*)
break
;;
esac
done
if [ "$#" -ne 2 ]; then if [ "$#" -ne 2 ]; then
usage usage
@@ -58,6 +90,13 @@ for _jail in ${JAILS}; do
info "[${_jail}]:" info "[${_jail}]:"
check_target_is_running "${_jail}" || if [ "${AUTO}" -eq 1 ]; then
bastille start "${_jail}"
else
error_notify "Jail is not running."
error_exit "Use [-a|--auto] to auto-start the jail."
fi
_jailpath="$( echo "${bastille_jailsdir}/${_jail}/root/${MOUNT_PATH}" 2>/dev/null | sed 's#//#/#' | sed 's#\\##g')" _jailpath="$( echo "${bastille_jailsdir}/${_jail}/root/${MOUNT_PATH}" 2>/dev/null | sed 's#//#/#' | sed 's#\\##g')"
_mount="$( mount | grep -Eo "[[:blank:]]${_jailpath}[[:blank:]]" )" _mount="$( mount | grep -Eo "[[:blank:]]${_jailpath}[[:blank:]]" )"
_jailpath_fstab="$(echo "${bastille_jailsdir}/${_jail}/root/${MOUNT_PATH}" | sed 's#//#/#g' | sed 's# #\\#g' | sed 's#\\#\\\\040#g')" _jailpath_fstab="$(echo "${bastille_jailsdir}/${_jail}/root/${MOUNT_PATH}" | sed 's#//#/#g' | sed 's# #\\#g' | sed 's#\\#\\\\040#g')"