diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh index 89d4d024..00f6d3df 100644 --- a/usr/local/share/bastille/bootstrap.sh +++ b/usr/local/share/bastille/bootstrap.sh @@ -33,7 +33,8 @@ . /usr/local/share/bastille/common.sh usage() { - error_notify "Usage: bastille bootstrap [option(s)] RELEASE|TEMPLATE [update|arch]" + error_notify "Usage: bastille bootstrap [option(s)] RELEASE [update|arch]" + error_notify " TEMPLATE" cat << EOF Options: @@ -45,54 +46,8 @@ EOF exit 1 } -validate_release() { - - MAJOR_VERSION=$(echo ${RELEASE} | grep -Eo '^[0-9]+') - MINOR_VERSION=$(echo ${RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/') - - if [ "${PKGBASE}" -eq 1 ] && [ "${MAJOR_VERSION}" -le 14 ]; then - error_exit "[ERROR]: Pkgbase is not supported for release: ${RELEASE}" - fi - - if [ "${MAJOR_VERSION}" -ge 16 ]; then - PKGBASE=1 - fi - - if [ "${PLATFORM_OS}" != "FreeBSD" ] && [ "${PKGBASE}" -eq 1 ]; then - error_exit "[ERROR]: Pkgbase can only be used with FreeBSD releases." - fi - - info "\nBootstrapping release: ${RELEASE}..." - - ## check upstream url, else warn user - if [ -n "${NAME_VERIFY}" ]; then - # Alternate RELEASE/ARCH fetch support - if [ "${OPTION}" = "--i386" ] || [ "${OPTION}" = "--32bit" ]; then - ARCH="i386" - RELEASE="${RELEASE}-${ARCH}" - fi - - if [ "${PKGBASE}" -eq 1 ]; then - info "\nUsing PkgBase..." - bootstrap_directories - bootstrap_pkgbase_release - elif [ "${PKGBASE}" -eq 0 ]; then - info "\nFetching ${PLATFORM_OS} distfiles..." - if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then - error_exit "Unable to fetch MANIFEST. See 'bootstrap urls'." - fi - bootstrap_directories - bootstrap_release - fi - else - usage - fi -} - bootstrap_directories() { - # Ensure required directories are in place - ## ${bastille_prefix} if [ ! -d "${bastille_prefix}" ]; then if checkyesno bastille_zfs_enable; then @@ -210,254 +165,259 @@ bootstrap_directories() { fi } -bootstrap_pkgbase_release() { +cleanup_directories() { - local abi="${PLATFORM_OS}:${MAJOR_VERSION}:${HW_MACHINE_ARCH}" - local fingerprints="${bastille_releasesdir}/${RELEASE}/usr/share/keys/pkg" - local host_fingerprintsdir="/usr/share/keys/pkg" - local release_fingerprintsdir="${bastille_releasesdir}/${RELEASE}/usr/share/keys" - if [ "${FREEBSD_BRANCH}" = "release" ]; then - local repo_name="FreeBSD-base-release-${MINOR_VERSION}" - elif [ "${FREEBSD_BRANCH}" = "current" ]; then - local repo_name="FreeBSD-base-latest" - fi - local repo_dir="${bastille_sharedir}/pkgbase" - - ## If release exists quit, else bootstrap additional packages - if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then - - ## check pkgbase package list and skip existing sets - bastille_pkgbase_packages=$(echo "${bastille_pkgbase_packages}" | sed "s/base-jail//") - - ## check if release already bootstrapped, else continue bootstrapping - if [ -z "${bastille_pkgbase_packages}" ]; then - info "\nBootstrap appears complete!" - exit 0 - else - info "\nFetching additional packages..." - fi - fi - - # Copy fingerprints into releasedir - if ! mkdir -p "${release_fingerprintsdir}"; then - error_exit "[ERROR]: Faild to create fingerprints directory." - fi - if ! cp -a "${host_fingerprintsdir}" "${release_fingerprintsdir}"; then - error_exit "[ERROR]: Failed to copy fingerprints directory." - fi - - # Ensure repo is up to date - if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \ - --repo-conf-dir="${repo_dir}" \ - -o IGNORE_OSVERSION="yes" \ - -o ABI="${abi}" \ - -o ASSUME_ALWAYS_YES="yes" \ - -o FINGERPRINTS="${fingerprints}" \ - update -r "${repo_name}"; then - error_notify "[ERROR]: Failed to update repository: ${repo_name}" - fi - - # Reset ERROR_COUNT - ERROR_COUNT="0" - - for package in ${bastille_pkgbase_packages}; do - - # Check if package set is already installed - if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" info "FreeBSD-set-${package}" 2>/dev/null; then - # Install package set - if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \ - --repo-conf-dir="${repo_dir}" \ - -o IGNORE_OSVERSION="yes" \ - -o ABI="${abi}" \ - -o ASSUME_ALWAYS_YES="yes" \ - -o FINGERPRINTS="${fingerprints}" \ - install -r "${repo_name}" \ - FreeBSD-set-"${package}"; then - - ERROR_COUNT=$((ERROR_COUNT + 1)) + # Cleanup on failed bootstrap + if checkyesno bastille_zfs_enable; then + if [ -n "${bastille_zfs_zpool}" ]; then + if zfs list "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}" >/dev/null 2>/dev/null; then + zfs destroy "${bastille_zfs_zpool:?}/${bastille_zfs_prefix:?}/cache/${RELEASE}" fi - else - error_continue "[ERROR]: Package set already installed: ${package}" - fi - done - - # Cleanup if failed - if [ "${ERROR_COUNT}" -ne "0" ]; then - ## perform cleanup only for stale/empty directories on failure - if checkyesno bastille_zfs_enable; then - if [ -n "${bastille_zfs_zpool}" ]; then - if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then - zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}" - fi - fi - elif [ -d "${bastille_releasesdir}/${RELEASE}" ]; then - if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then - rm -rf "${bastille_releasesdir:?}/${RELEASE}" + if zfs list "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}" >/dev/null 2>/dev/null; then + zfs destroy "${bastille_zfs_zpool:?}/${bastille_zfs_prefix:?}/releases/${RELEASE}" fi fi - error_exit "[ERROR]: Bootstrap failed." - else - - # Silence motd at login - touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin" - touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin" - - # Success - info "\nBootstrap successful." - echo "See 'bastille --help' for available commands." - + elif [ -d "${bastille_cachedir}/${RELEASE}" ]; then + if [ -d "${bastille_cachedir}/${RELEASE}" ]; then + rm -rf "${bastille_cachedir:?}/${RELEASE}" + fi + if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then + rm -rf "${bastille_releasesdir:?}/${RELEASE}" + fi fi } -bootstrap_release() { +validate_release() { - ## if release exists quit, else bootstrap additional distfiles + info "\nAttempting to bootstrap ${PLATFORM_OS} release: ${RELEASE}" + + # Set release name to sane release + RELEASE="${NAME_VERIFY}" + + ### FreeBSD ### + if [ "${PLATFORM_OS}" = "FreeBSD" ]; then + MAJOR_VERSION=$(echo ${RELEASE} | grep -Eo '^[0-9]+') + MINOR_VERSION=$(echo ${RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/') + if [ "${MAJOR_VERSION}" -ge 16 ]; then + PKGBASE=1 + elif [ "${MAJOR_VERSION}" -le 14 ] && [ "${PKGBASE}" -eq 1 ]; then + error_exit "[ERROR]: Pkgbase is not supported for release: ${RELEASE}" + fi + ### Linux ### + elif [ "${PLATFORM_OS}" = "Linux/Debian" ] || [ "${PLATFORM_OS}" = "Linux/Ubuntu" ]; then + info "\nEnsuring Linux compatability..." + if ! bastille setup -y linux >/dev/null 2>/dev/null; then + error_notify "[ERROR]: Failed to configure linux." + error_exit "See 'bastille setup linux' for more details." + fi + elif [ "${PLATFORM_OS}" != "FreeBSD" ] && [ "${PKGBASE}" -eq 1 ]; then + error_exit "[ERROR]: Pkgbase is not supported for platform: ${PLATFORM_OS}" + fi + + + # Validate OPTION + if [ -n "${OPTION}" ]; then + # Alternate RELEASE/ARCH fetch support + if [ "${OPTION}" = "--i386" ] || [ "${OPTION}" = "--32bit" ]; then + ARCH="i386" + RELEASE="${RELEASE}-${ARCH}" + fi + fi +} + +bootstrap_release_legacy() { + + # Verify release URL + if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then + ERRORS=$((ERRORS + 1)) + error_return 1 "Unable to fetch MANIFEST. See 'bootstrap urls'." + fi + + # Validate already installed archives if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then - ## check distfiles list and skip existing cached files bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/base//") - # TODO check how to handle this # shellcheck disable=SC2010 bastille_cached_files=$(ls "${bastille_cachedir}/${RELEASE}" | grep -v "MANIFEST" | tr -d ".txz") for distfile in ${bastille_cached_files}; do bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/${distfile}//") done - - ## check if release already bootstrapped, else continue bootstrapping if [ -z "${bastille_bootstrap_archives}" ]; then info "\nBootstrap appears complete!\n" exit 0 - else - info "\nFetching additional distfiles..." fi fi - for _archive in ${bastille_bootstrap_archives}; do - ## check if the dist files already exists then extract - FETCH_VALIDATION="0" - if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then - info "\nExtracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz..." - if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then - ## silence motd at container login - touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin" - touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin" - else - error_exit "[ERROR]: Failed to extract ${_archive}.txz." + # Bootstrap archives + for archive in ${bastille_bootstrap_archives}; do + if [ -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then + info "\nExtracting ${PLATFORM_OS} archive: ${archive}.txz" + if ! /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${archive}.txz"; then + ERRORS=$((ERRORS + 1)) + error_continue "[ERROR]: Failed to extract archive: ${archive}.txz." fi else - ## get the manifest for dist files checksum validation + # Fetch MANIFEST if [ ! -f "${bastille_cachedir}/${RELEASE}/MANIFEST" ]; then - fetch "${UPSTREAM_URL}/MANIFEST" -o "${bastille_cachedir}/${RELEASE}/MANIFEST" || FETCH_VALIDATION="1" + info "\nFetching MANIFEST..." + if ! fetch "${UPSTREAM_URL}/MANIFEST" -o "${bastille_cachedir}/${RELEASE}/MANIFEST"; then + ERRORS=$((ERRORS + 1)) + error_continue "[ERROR]: Failed to fetch MANIFEST." + fi fi - if [ "${FETCH_VALIDATION}" -ne "0" ]; then - ## perform cleanup only for stale/empty directories on failure - if checkyesno bastille_zfs_enable; then - if [ -n "${bastille_zfs_zpool}" ]; then - if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then - zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}" - fi - if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then - zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}" - fi - fi - fi - if [ -d "${bastille_cachedir}/${RELEASE}" ]; then - if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then - rm -rf "${bastille_cachedir:?}/${RELEASE}" - fi - fi - if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then - if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then - rm -rf "${bastille_releasesdir:?}/${RELEASE}" - fi - fi - error_exit "[ERROR]: Bootstrap failed." + # Fetch distfile + if [ ! -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then + info "\nFetching distfile: ${archive}.txz" + if ! fetch "${UPSTREAM_URL}/${archive}.txz" -o "${bastille_cachedir}/${RELEASE}/${archive}.txz"; then + ERRORS=$((ERRORS + 1)) + error_continue "[ERROR]: Failed to fetch archive: ${archive}.txz" fi + fi - ## fetch for missing dist files - if [ ! -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then - if ! fetch "${UPSTREAM_URL}/${_archive}.txz" -o "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then - ## alert only if unable to fetch additional dist files - error_exit "[ERROR]: Failed to fetch ${_archive}.txz" - fi + # Validate checksums + info "\nValidating checksum for archive: ${archive}.txz" + if [ -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then + SHA256_DIST=$(grep -w "${archive}.txz" "${bastille_cachedir}/${RELEASE}/MANIFEST" | awk '{print $2}') + SHA256_FILE=$(sha256 -q "${bastille_cachedir}/${RELEASE}/${archive}.txz") + if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then + ERRORS=$((ERRORS + 1)) + error_continue "[ERROR]: Failed to validate checksum for archive: ${archive}.txz" + else + echo "MANIFEST: ${SHA256_DIST}" + echo "DOWNLOAD: ${SHA256_FILE}" + info "\nChecksum validated." fi + fi - ## compare checksums on the fetched dist files - if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then - SHA256_DIST=$(grep -w "${_archive}.txz" "${bastille_cachedir}/${RELEASE}/MANIFEST" | awk '{print $2}') - SHA256_FILE=$(sha256 -q "${bastille_cachedir}/${RELEASE}/${_archive}.txz") - if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then - rm "${bastille_cachedir}/${RELEASE}/${_archive}.txz" - error_exit "[ERROR]: Failed validation for ${_archive}.txz. Please retry bootstrap!" - else - info "\nValidated checksum for ${RELEASE}: ${_archive}.txz" - echo "MANIFEST: ${SHA256_DIST}" - echo "DOWNLOAD: ${SHA256_FILE}" - fi - fi - - ## extract the fetched dist files - if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then - info "\nExtracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz..." - if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then - ## silence motd at container login - touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin" - touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin" - else - error_exit "[ERROR]: Failed to extract ${_archive}.txz." - fi + # Extract distfile + info "\nExtracting archive: ${archive}.txz" + if [ -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then + if ! /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${archive}.txz"; then + ERRORS=$((ERRORS + 1)) + error_continue "[ERROR]: Failed to extract archive: ${archive}.txz." fi + fi fi done - info "\nBootstrap successful." - echo "See 'bastille --help' for available commands." + # Cleanup on error + if [ "${ERRORS}" -ne 0 ]; then + return "${ERRORS}" + fi + # Silence motd at container login + touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin" + touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin" } -debootstrap_release() { +bootstrap_release_pkgbase() { - info "\nEnsuring Linux compatability..." - if ! bastille setup -y linux >/dev/null 2>/dev/null; then - error_notify "[ERROR]: Failed to configure linux." - error_exit "See 'bastille setup linux' for more details." - fi + info "\nUsing PkgBase..." - # Make sure to check/bootstrap directories first. - NOCACHEDIR=1 - RELEASE="${DIR_BOOTSTRAP}" - bootstrap_directories + ### FreeBSD ### + if [ "${PLATFORM_OS}" = "FreeBSD" ]; then - # Fetch the Linux flavor - info "\nFetching ${PLATFORM_OS} distfiles..." - if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${LINUX_FLAVOR} "${bastille_releasesdir}"/${DIR_BOOTSTRAP}; then + local abi="${PLATFORM_OS}:${MAJOR_VERSION}:${HW_MACHINE_ARCH}" + local fingerprints="${bastille_releasesdir}/${RELEASE}/usr/share/keys/pkg" + local host_fingerprintsdir="/usr/share/keys/pkg" + local release_fingerprintsdir="${bastille_releasesdir}/${RELEASE}/usr/share/keys" + if [ "${FREEBSD_BRANCH}" = "release" ]; then + local repo_name="FreeBSD-base-release-${MINOR_VERSION}" + elif [ "${FREEBSD_BRANCH}" = "current" ]; then + local repo_name="FreeBSD-base-latest" + fi + local repo_dir="${bastille_sharedir}/pkgbase" - ## perform cleanup only for stale/empty directories on failure - if checkyesno bastille_zfs_enable; then - if [ -n "${bastille_zfs_zpool}" ]; then - if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then - zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${DIR_BOOTSTRAP}" + # Validate COPYRIGHT existence + if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then + # Verify package sets + bastille_pkgbase_packages=$(echo "${bastille_pkgbase_packages}" | sed "s/base-jail//") + if [ -z "${bastille_pkgbase_packages}" ]; then + info "\nBootstrap appears complete!" + exit 0 + fi + fi + + info "\nInstalling packages..." + + # Copy fingerprints into releasedir + if ! mkdir -p "${release_fingerprintsdir}"; then + ERRORS=$((ERRORS + 1)) + error_return 1 "[ERROR]: Faild to create fingerprints directory." + fi + if ! cp -a "${host_fingerprintsdir}" "${release_fingerprintsdir}"; then + ERRORS=$((ERRORS + 1)) + error_return 1 "[ERROR]: Failed to copy fingerprints directory." + fi + + # Update PkgBase repo + if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \ + --repo-conf-dir="${repo_dir}" \ + -o IGNORE_OSVERSION="yes" \ + -o ABI="${abi}" \ + -o ASSUME_ALWAYS_YES="yes" \ + -o FINGERPRINTS="${fingerprints}" \ + update -r "${repo_name}"; then + + ERRORS=$((ERRORS + 1)) + error_return 1 "[ERROR]: Failed to update repository: ${repo_name}" + fi + + for package in ${bastille_pkgbase_packages}; do + + # Check if package set is already installed + if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" info "FreeBSD-set-${package}" 2>/dev/null; then + # Install package set + if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \ + --repo-conf-dir="${repo_dir}" \ + -o IGNORE_OSVERSION="yes" \ + -o ABI="${abi}" \ + -o ASSUME_ALWAYS_YES="yes" \ + -o FINGERPRINTS="${fingerprints}" \ + install -r "${repo_name}" \ + FreeBSD-set-"${package}"; then + + ERRORS=$((ERRORS + 1)) + error_continue "[ERROR]: Failed to install package set: ${package}" fi + else + info "\nPackage set already installed: ${package}" fi + done + + # Cleanup on error + if [ "${ERRORS}" -ne 0 ]; then + return "${ERRORS}" fi - if [ -d "${bastille_releasesdir}/${DIR_BOOTSTRAP}" ]; then - if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then - rm -rf "${bastille_releasesdir:?}/${DIR_BOOTSTRAP}" - fi - fi - error_exit "[ERROR]: Bootstrap failed." + # Silence motd at login + touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin" + touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin" fi +} - case "${LINUX_FLAVOR}" in - bionic|focal|jammy|buster|bullseye|bookworm|noble) - info "Increasing APT::Cache-Start" - echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${DIR_BOOTSTRAP}/etc/apt/apt.conf.d/00aptitude - ;; - esac +bootstrap_release_linux() { - info "\nBootstrap successful." - info "\nSee 'bastille --help' for available commands." + if [ "${PLATFORM_OS}" = "Linux/Debian" ] || [ "${PLATFORM_OS}" = "Linux/Ubuntu" ]; then + # Fetch the Linux flavor + if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${RELEASE} "${bastille_releasesdir}"/${RELEASE}; then + ERRORS=$((ERRORS + 1)) + error_return 1 "[ERROR]: Failed to fetch Linux release: ${RELEASE}" + fi + + # Cleanup on error + if [ "${ERRORS}" -ne 0 ]; then + return "${ERRORS}" + fi + + # Set necessary settings + case "${LINUX_FLAVOR}" in + bionic|focal|jammy|buster|bullseye|bookworm|noble) + info "Increasing APT::Cache-Start" + echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${RELEASE}/etc/apt/apt.conf.d/00aptitude + ;; + esac + fi } bootstrap_template() { @@ -475,50 +435,51 @@ bootstrap_template() { fi ## define basic variables - _url=${BASTILLE_TEMPLATE_URL} - _user=${BASTILLE_TEMPLATE_USER} - _repo=${BASTILLE_TEMPLATE_REPO%.*} # Remove the trailing ".git" - _raw_template_dir=${bastille_templatesdir}/${_user}/${_repo} + url=${BASTILLE_TEMPLATE_URL} + user=${BASTILLE_TEMPLATE_USER} + repo=${BASTILLE_TEMPLATE_REPO%.*} # Remove the trailing ".git" + raw_template_dir=${bastille_templatesdir}/${user}/${repo} ## support for non-git if ! which -s git; then error_notify "Git not found." error_exit "Not yet implemented." else - if [ ! -d "${_raw_template_dir}/.git" ]; then - git clone "${_url}" "${_raw_template_dir}" ||\ + if [ ! -d "${raw_template_dir}/.git" ]; then + git clone "${url}" "${raw_template_dir}" ||\ error_notify "Clone unsuccessful." - elif [ -d "${_raw_template_dir}/.git" ]; then - git -C "${_raw_template_dir}" pull ||\ + elif [ -d "${raw_template_dir}/.git" ]; then + git -C "${raw_template_dir}" pull ||\ error_notify "Template update unsuccessful." fi fi - if [ ! -f ${_raw_template_dir}/Bastillefile ]; then + if [ ! -f ${raw_template_dir}/Bastillefile ]; then # Extract template in project/template format - find "${_raw_template_dir}" -type f -name Bastillefile | while read -r _file; do - _template_dir="$(dirname ${_file})" - _project_dir="$(dirname ${_template_dir})" - _template_name="$(basename ${_template_dir})" - _project_name="$(basename ${_project_dir})" - _complete_template="${_project_name}/${_template_name}" - cp -fR "${_project_dir}" "${bastille_templatesdir}" - bastille verify "${_complete_template}" + find "${raw_template_dir}" -type f -name Bastillefile | while read -r _file; do + template_dir="$(dirname ${file})" + project_dir="$(dirname ${template_dir})" + template_name="$(basename ${template_dir})" + project_name="$(basename ${project_dir})" + complete_template="${project_name}/${template_name}" + cp -fR "${project_dir}" "${bastille_templatesdir}" + bastille verify "${complete_template}" done # Remove the cloned repo - if [ -n "${_user}" ]; then - rm -r "${bastille_templatesdir:?}/${_user:?}" + if [ -n "${user}" ]; then + rm -r "${bastille_templatesdir:?}/${user:?}" fi else # Verify a single template - bastille verify "${_user}/${_repo}" + bastille verify "${user}/${repo}" fi } # Handle options. PKGBASE=0 +ERRORS=0 while [ "$#" -gt 0 ]; do case "${1}" in -h|--help|help) @@ -550,13 +511,13 @@ done RELEASE="${1}" OPTION="${2}" -NOCACHEDIR= +NOCACHEDIR="" HW_MACHINE=$(sysctl hw.machine | awk '{ print $2 }') HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }') bastille_root_check -#Validate if ZFS is enabled in rc.conf and bastille.conf. +# Validate if ZFS is enabled in rc.conf and bastille.conf. if [ "$(sysrc -n zfs_enable)" = "YES" ] && ! checkyesno bastille_zfs_enable; then warn "ZFS is enabled in rc.conf but not bastille.conf. Do you want to continue? (N|y)" read answer @@ -588,7 +549,6 @@ if checkyesno bastille_zfs_enable; then fi # bootstrapping from aarch64/arm64 Debian or Ubuntu require a different value for ARCH -# create a new variable if [ "${HW_MACHINE_ARCH}" = "aarch64" ]; then HW_MACHINE_ARCH_LINUX="arm64" else @@ -614,70 +574,43 @@ fi ## Filter sane release names case "${RELEASE}" in [2-4].[0-9]*) - ## check for MidnightBSD releases name + ### MidnightBSD ### + PLATFORM_OS="MidnightBSD" NAME_VERIFY=$(echo "${RELEASE}") UPSTREAM_URL="${bastille_url_midnightbsd}${HW_MACHINE_ARCH}/${NAME_VERIFY}" - PLATFORM_OS="MidnightBSD" - validate_release ;; - *-CURRENT|*-current) - ## check for FreeBSD releases name - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]') - UPSTREAM_URL=$(echo "${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" | sed 's/releases/snapshots/') + *-current|*-CURRENT) + ### FreeBSD ### PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]') + UPSTREAM_URL=$(echo "${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" | sed 's/releases/snapshots/') + FREEBSD_BRANCH="current" + ;; + *\.*-stable|*\.*-STABLE) + ### FreeBSD ### + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]') + UPSTREAM_URL=$(echo "${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" | sed 's/releases/snapshots/') FREEBSD_BRANCH="current" - validate_release ;; *-RELEASE|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9]) - ## check for FreeBSD releases name - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([0-9]{1,2})\.[0-9](-RELEASE|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]') - UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" + ### FreeBSD ### PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([0-9]+)\.[0-9](-RELEASE|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]') + UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" FREEBSD_BRANCH="release" - validate_release ;; - *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) - ## check for HardenedBSD releases name(previous infrastructure, keep for reference) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') - UPSTREAM_URL="${bastille_url_hardenedbsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-${NAME_VERIFY}" + current|CURRENT) + ### HardenedBSD ### PLATFORM_OS="HardenedBSD" - validate_release + NAME_VERIFY=$(echo "${RELEASE}" | sed 's/CURRENT/current/g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_VERIFY}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/LATEST" ;; - *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) - ## check for HardenedBSD(specific stable build releases) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') - NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-build-[0-9]\{1,3\}//g') - NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g') - UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + [1-9]*-stable|[1-9]*-STABLE) + ### HardenedBSD ### PLATFORM_OS="HardenedBSD" - validate_release - ;; - *-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST) - ## check for HardenedBSD(latest stable build release) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') - NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-BUILD-LATEST//g') - NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-BUILD-//g') - UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}" - PLATFORM_OS="HardenedBSD" - validate_release - ;; - current-build-[0-9]*|CURRENT-BUILD-[0-9]*) - ## check for HardenedBSD(specific current build releases) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g') - NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g') - NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g') - UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" - PLATFORM_OS="HardenedBSD" - validate_release - ;; - current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST) - ## check for HardenedBSD(latest current build release) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') - NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g') - NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-BUILD-//g') - UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}" - PLATFORM_OS="HardenedBSD" - validate_release + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)(-stable)$' | sed 's/STABLE/stable/g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_VERIFY}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/LATEST" ;; http?://*/*/*) BASTILLE_TEMPLATE_URL=${1} @@ -692,65 +625,89 @@ case "${RELEASE}" in BASTILLE_TEMPLATE_REPO=$(echo "${git_repository}" | awk -F / '{ print $2 }') bootstrap_template ;; - #adding Ubuntu Bionic as valid "RELEASE" for POC @hackacad ubuntu_bionic|bionic|ubuntu-bionic) - PLATFORM_OS="Ubuntu/Linux" + PLATFORM_OS="Linux/Ubuntu" LINUX_FLAVOR="bionic" - DIR_BOOTSTRAP="Ubuntu_1804" + NAME_VERIFY="Ubuntu_1804" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; ubuntu_focal|focal|ubuntu-focal) - PLATFORM_OS="Ubuntu/Linux" + PLATFORM_OS="Linux/Ubuntu" LINUX_FLAVOR="focal" - DIR_BOOTSTRAP="Ubuntu_2004" + NAME_VERIFY="Ubuntu_2004" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; ubuntu_jammy|jammy|ubuntu-jammy) - PLATFORM_OS="Ubuntu/Linux" + PLATFORM_OS="Linux/Ubuntu" LINUX_FLAVOR="jammy" - DIR_BOOTSTRAP="Ubuntu_2204" + NAME_VERIFY="Ubuntu_2204" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; ubuntu_noble|noble|ubuntu-noble) - PLATFORM_OS="Ubuntu/Linux" + PLATFORM_OS="Linux/Ubuntu" LINUX_FLAVOR="noble" - DIR_BOOTSTRAP="Ubuntu_2404" + NAME_VERIFY="Ubuntu_2404" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; - debian_buster|buster|debian-buster) - PLATFORM_OS="Debian/Linux" + debian_buster|buster|debian-buster|debian10|Debian10) + PLATFORM_OS="Linux/Debian" LINUX_FLAVOR="buster" - DIR_BOOTSTRAP="Debian10" + NAME_VERIFY="Debian10" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; - debian_bullseye|bullseye|debian-bullseye) - PLATFORM_OS="Debian/Linux" + debian_bullseye|bullseye|debian-bullseye|debian11|Debian11) + PLATFORM_OS="Linux/Debian" LINUX_FLAVOR="bullseye" - DIR_BOOTSTRAP="Debian11" + NAME_VERIFY="Debian11" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; - debian_bookworm|bookworm|debian-bookworm) - PLATFORM_OS="Debian/Linux" + debian_bookworm|bookworm|debian-bookworm|debian12|Debian12) + PLATFORM_OS="Linux/Debian" LINUX_FLAVOR="bookworm" - DIR_BOOTSTRAP="Debian12" + NAME_VERIFY="Debian12" ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX} - debootstrap_release ;; *) usage ;; esac -if [ "${PKGBASE}" -eq 0 ]; then - case "${OPTION}" in - update) - bastille update "${RELEASE}" - ;; - esac -fi +# Bootstrap +case ${PLATFORM_OS} in + FreeBSD|HardenedBSD|MidnightBSD) + validate_release + bootstrap_directories + if [ "${PKGBASE}" -eq 1 ]; then + bootstrap_release_pkgbase || cleanup_directories + else + bootstrap_release_legacy || cleanup_directories + fi + ;; + Linux/Ubuntu|Linux/Debian) + validate_release + bootstrap_directories + bootstrap_release_linux || cleanup_directories + ;; + *) + error_exit "[ERROR]: Unsupported platform." + ;; +esac + +# Check for errors +if [ "${ERRORS}" -eq 0 ]; then + # Check for OPTION=update + if [ "${PKGBASE}" -eq 0 ]; then + case "${OPTION}" in + update) + bastille update "${RELEASE}" + ;; + esac + fi + + # Success + info "\nBootstrap successful." + echo "See 'bastille --help' for available commands." + echo +else + error_exit "[ERROR]: Bootstrap failed!" +fi \ No newline at end of file diff --git a/usr/local/share/bastille/common.sh b/usr/local/share/bastille/common.sh index 2e7b6364..c4d450e8 100644 --- a/usr/local/share/bastille/common.sh +++ b/usr/local/share/bastille/common.sh @@ -64,21 +64,24 @@ if [ -z "${NO_COLOR}" ] && [ -t 1 ]; then enable_color fi -# Notify message on error -# Do not echo blank line +# Error messages/functions +error_notify() { + echo -e "${COLOR_RED}$*${COLOR_RESET}" 1>&2 +} + error_continue() { error_notify "$@" # shellcheck disable=SC2104 continue } -# Notify message on error, but do not exit -error_notify() { - echo -e "${COLOR_RED}$*${COLOR_RESET}" 1>&2 +error_return() { + local return="${1}" + shift 1 + error_notify "$@" + return "${return}" } -# Notify message on error and exit -# Echo blank line when exiting error_exit() { error_notify "$@" echo diff --git a/usr/local/share/bastille/create.sh b/usr/local/share/bastille/create.sh index 18e35bf4..109ed91e 100644 --- a/usr/local/share/bastille/create.sh +++ b/usr/local/share/bastille/create.sh @@ -67,6 +67,10 @@ validate_name() { local NAME_VERIFY=${NAME} local NAME_SANITY="$(echo "${NAME_VERIFY}" | tr -c -d 'a-zA-Z0-9-_')" + if check_target_exists "${NAME}"; then + error_exit "[ERROR]: Jail already exists: ${NAME}" + fi + # Make sure NAME has only allowed characters if [ -n "$(echo "${NAME_SANITY}" | awk "/^[-_].*$/" )" ]; then error_exit "[ERROR]: Jail names may not begin with (-|_) characters!" @@ -79,32 +83,60 @@ validate_name() { fi } +validate_release() { + + # Validate sane release name + if [ -n "${NAME_VERIFY}" ]; then + RELEASE="${NAME_VERIFY}" + else + usage + fi + + # Validate Linux releases + if [ "${PLATFORM_OS}" = "Ubuntu" ] || [ "${PLATFORM_OS}" = "Debian" ]; then + if [ "${LINUX_JAIL}" -eq 0 ]; then + error_exit "[ERROR]: Linux releases can only be used with [-l|--linux]" + fi + elif [ "${PLATFORM_OS}" = "FreeBSD" ] || [ "${PLATFORM_OS}" = "HardenedBSD" ] || [ "${PLATFORM_OS}" = "MidnightBSD" ]; then + # Validate release existence + if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then + error_notify "[ERROR]: Release must be bootstrapped first." + error_exit "See 'bastille bootstrap'." + fi + else + error_exit "[ERROR]: Unable to validate Platform OS." + fi + + # Set OS_RELEASE + OS_RELEASE="$( ${bastille_releasesdir}/${RELEASE}/bin/freebsd-version )" +} + validate_ip() { - local _ip="${1}" - local _ip6="$(echo ${_ip} | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$)|SLAAC)')" + local ip="${1}" + local ip6="$(echo ${ip} | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$)|SLAAC)')" - if [ -n "${_ip6}" ]; then - info "\nValid: (${_ip6})." - # This is only used in this function to set IPX_DEFINITION + if [ -n "${ip6}" ]; then + info "\nValid: (${ip6})." + # This is only used in this function to set IPX_DEFINITION local ipx_addr="ip6.addr" else - if [ "${_ip}" = "inherit" ] || [ "${_ip}" = "ip_hostname" ]; then + if [ "${ip}" = "inherit" ] || [ "${ip}" = "ip_hostname" ]; then if [ "${VNET_JAIL}" -eq 1 ]; then - error_exit "[ERROR]: Unsupported IP option for VNET jail: (${_ip})." + error_exit "[ERROR]: Unsupported IP option for VNET jail: (${ip})." else - info "\nValid: (${_ip})." + info "\nValid: (${ip})." fi - elif [ "${_ip}" = "DHCP" ] || [ "${_ip}" = "SYNCDHCP" ] || [ "${_ip}" = "0.0.0.0" ]; then + elif [ "${ip}" = "DHCP" ] || [ "${ip}" = "SYNCDHCP" ] || [ "${ip}" = "0.0.0.0" ]; then if [ "${VNET_JAIL}" -eq 0 ]; then - error_exit "[ERROR]: Unsupported IP option for non-VNET jail: (${_ip})." + error_exit "[ERROR]: Unsupported IP option for non-VNET jail: (${ip})." else - info "\nValid: (${_ip})." + info "\nValid: (${ip})." fi else local IFS - if echo "${_ip}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then - TEST_IP=$(echo "${_ip}" | cut -d / -f1) + if echo "${ip}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then + TEST_IP=$(echo "${ip}" | cut -d / -f1) IFS=. set ${TEST_IP} for quad in 1 2 3 4; do @@ -113,9 +145,9 @@ validate_ip() { fi done ipx_addr="ip4.addr" - info "\nValid: (${_ip})." + info "\nValid: (${ip})." else - error_continue "Invalid: (${_ip})." + error_continue "Invalid: (${ip})." fi fi fi @@ -139,45 +171,45 @@ validate_ip() { fi # Determine IP/Interface mode - if [ "${_ip}" = "inherit" ]; then + if [ "${ip}" = "inherit" ]; then if [ "${DUAL_STACK}" -eq 1 ]; then - IP4_DEFINITION="ip4 = ${_ip};" - IP6_DEFINITION="ip6 = ${_ip};" + IP4_DEFINITION="ip4 = ${ip};" + IP6_DEFINITION="ip6 = ${ip};" IP6_MODE="new" else - IP4_DEFINITION="ip4 = ${_ip};" + IP4_DEFINITION="ip4 = ${ip};" IP6_DEFINITION="" IP6_MODE="disable" fi - elif [ "${_ip}" = "ip_hostname" ]; then + elif [ "${ip}" = "ip_hostname" ]; then if [ "${DUAL_STACK}" -eq 1 ]; then - IP_HOSTNAME="${_ip}" + IP_HOSTNAME="${ip}" IP4_DEFINITION="${IP_HOSTNAME};" IP6_DEFINITION="${IP_HOSTNAME};" IP6_MODE="new" else - IP_HOSTNAME="${_ip}" + IP_HOSTNAME="${ip}" IP4_DEFINITION="${IP_HOSTNAME};" IP6_DEFINITION="" IP6_MODE="disable" fi - elif [ "${_ip}" = "DHCP" ] || [ "${_ip}" = "SLAAC" ] || [ "${_ip}" = "0.0.0.0" ]; then + elif [ "${ip}" = "DHCP" ] || [ "${ip}" = "SLAAC" ] || [ "${ip}" = "0.0.0.0" ]; then if [ "${VNET_JAIL}" -eq 1 ]; then if [ "${ipx_addr}" = "ip4.addr" ]; then - IP4_ADDR="${_ip}" + IP4_ADDR="${ip}" elif [ "${ipx_addr}" = "ip6.addr" ]; then - IP6_ADDR="${_ip}" + IP6_ADDR="${ip}" fi else - error_exit "[ERROR]: Unsupported IP option for standard jail: (${_ip})." + error_exit "[ERROR]: Unsupported IP option for standard jail: (${ip})." fi else if [ "${ipx_addr}" = "ip4.addr" ]; then - IP4_ADDR="${_ip}" - IP4_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${_ip};" + IP4_ADDR="${ip}" + IP4_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${ip};" elif [ "${ipx_addr}" = "ip6.addr" ]; then - IP6_ADDR="${_ip}" - IP6_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${_ip};" + IP6_ADDR="${ip}" + IP6_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${ip};" IP6_MODE="new" fi fi @@ -221,23 +253,6 @@ validate_netif() { fi } -validate_release() { - - ## ensure the user set the Linux(experimental) option explicitly - if [ -n "${UBUNTU}" ]; then - if [ "${LINUX_JAIL}" -eq 0 ]; then - usage - fi - fi - - ## check release name match, else show usage - if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" - else - usage - fi -} - generate_minimal_conf() { cat << EOF > "${bastille_jail_conf}" @@ -270,7 +285,7 @@ ${NAME} { mount.fstab = ${bastille_jail_fstab}; path = ${bastille_jail_path}; securelevel = 2; - osrelease = ${RELEASE}; + osrelease = ${OS_RELEASE}; ${IP4_DEFINITION} ${IP6_DEFINITION} @@ -326,7 +341,7 @@ ${NAME} { mount.fstab = ${bastille_jail_fstab}; path = ${bastille_jail_path}; securelevel = 2; - osrelease = ${RELEASE}; + osrelease = ${OS_RELEASE}; ${NETBLOCK} } @@ -651,77 +666,77 @@ create_jail() { # Retrieve epair name from jail.conf uniq_epair=$(grep vnet.interface "${bastille_jailsdir}/${NAME}/jail.conf" | awk '{print $3}' | sed 's/;//; s/-/_/g') - _gateway='' - _gateway6='' - _ifconfig_inet='' - _ifconfig_inet6='' + gateway='' + gateway6='' + ifconfig_inet='' + ifconfig_inet6='' # Check for DHCP if echo "${IP}" | grep -qE '(0[.]0[.]0[.]0|DHCP|SYNCDHCP)'; then - _ifconfig_inet="SYNCDHCP" + ifconfig_inet="SYNCDHCP" else # Set Gateway if [ -n "${OPT_GATEWAY}" ]; then - _gateway="${OPT_GATEWAY}" + gateway="${OPT_GATEWAY}" elif [ -n "${bastille_network_gateway}" ]; then - _gateway="${bastille_network_gateway}" + gateway="${bastille_network_gateway}" else - _gateway="$(netstat -4rn | awk '/default/ {print $2}')" + gateway="$(netstat -4rn | awk '/default/ {print $2}')" fi fi # Add IPv4 address (this is empty if DHCP is used) if [ -n "${IP4_ADDR}" ]; then - _ifconfig_inet="inet ${IP4_ADDR}" + ifconfig_inet="inet ${IP4_ADDR}" fi # Enable IPv6 if used if [ -n "${IP6_ADDR}" ]; then - _ifconfig_inet6='inet6 -ifdisabled' + ifconfig_inet6='inet6 -ifdisabled' if echo "${IP}" | grep -qE 'SLAAC'; then # Enable SLAAC if requested - _ifconfig_inet6="${_ifconfig_inet6} accept_rtadv" + ifconfig_inet6="${ifconfig_inet6} accept_rtadv" else # Set Gateway if [ -n "${bastille_network_gateway6}" ]; then - _gateway6="${bastille_network_gateway6}" + gateway6="${bastille_network_gateway6}" else - _gateway6="$(netstat -6rn | awk '/default/ {print $2}')" + gateway6="$(netstat -6rn | awk '/default/ {print $2}')" fi fi fi # Add IPv6 address (this is empty if SLAAC is used) if [ -n "${IP6_ADDR}" ]; then - _ifconfig_inet6="${_ifconfig_inet6} ${IP6_ADDR}" + ifconfig_inet6="${ifconfig_inet6} ${IP6_ADDR}" fi # We need to pass IP4 and IP6 separately - _ifconfig="${_ifconfig_inet}" - _ifconfig6="${_ifconfig_inet6}" + ifconfig="${ifconfig_inet}" + ifconfig6="${ifconfig_inet6}" # Set jail interface description if "if_bridge" if [ "${bastille_network_vnet_type}" = "if_bridge" ]; then # Use interface name as INTERFACE+VNET when PASSTHROUGH is selected # Use default "vnet0" otherwise if [ "${VNET_JAIL_PASSTHROUGH}" -eq 1 ]; then - bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}" + bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}" else - bastille template "${NAME}" ${bastille_template_vnet} --arg EXT_INTERFACE="${INTERFACE}" --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}" + bastille template "${NAME}" ${bastille_template_vnet} --arg EXT_INTERFACE="${INTERFACE}" --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}" fi elif [ "${bastille_network_vnet_type}" = "netgraph" ]; then # Use interface name as INTERFACE+VNET when PASSTHROUGH is selected # Use default "vnet0" otherwise if [ "${VNET_JAIL_PASSTHROUGH}" -eq 1 ]; then - bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}" + bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}" else - bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}" + bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}" fi fi # Add VLAN ID if it was given if [ -n "${VLAN_ID}" ]; then - bastille template "${NAME}" ${bastille_template_vlan} --arg VLANID="${VLAN_ID}" --arg IFCONFIG="${_ifconfig}" + bastille template "${NAME}" ${bastille_template_vlan} --arg VLANID="${VLAN_ID}" --arg IFCONFIG="${ifconfig}" fi fi @@ -758,8 +773,8 @@ create_jail() { # Apply nameserver (if set) if [ -n "${OPT_NAMESERVER}" ]; then sed -i '' "/^nameserver.*/d" "${bastille_jail_resolv_conf}" - for _ns in $(echo ${OPT_NAMESERVER} | sed 's/,/ /g'); do - echo "nameserver ${_ns}" >> "${bastille_jail_resolv_conf}" + for ns in $(echo ${OPT_NAMESERVER} | sed 's/,/ /g'); do + echo "nameserver ${ns}" >> "${bastille_jail_resolv_conf}" done fi @@ -776,13 +791,6 @@ create_jail() { bastille_root_check -if echo "${3}" | grep '@'; then - # shellcheck disable=SC2034 - BASTILLE_JAIL_IP=$(echo "$3" | awk -F@ '{print $2}') - # shellcheck disable=SC2034 - BASTILLE_JAIL_INTERFACES=$( echo "$3" | awk -F@ '{print $1}') -fi - # Handle options. BOOT="on" EMPTY_JAIL=0 @@ -1001,128 +1009,89 @@ if { [ "${bastille_network_vnet_type}" = "netgraph" ] && [ "${VNET_INTERFACE_TYP error_exit "[ERROR]: Netgraph does not support the [-B|--bridge] or [-P|--passthrough] option." fi -if [ "${LINUX_JAIL}" -eq 1 ] && [ "${VALIDATE_RELEASE}" -eq 1 ]; then - case "${RELEASE}" in - bionic|ubuntu_bionic|ubuntu|ubuntu-bionic) - ## check for FreeBSD releases name - NAME_VERIFY=ubuntu_bionic - ;; - focal|ubuntu_focal|ubuntu-focal) - ## check for FreeBSD releases name - NAME_VERIFY=ubuntu_focal - ;; - jammy|ubuntu_jammy|ubuntu-jammy) - ## check for FreeBSD releases name - NAME_VERIFY=ubuntu_jammy - ;; - debian_buster|buster|debian-buster) - ## check for FreeBSD releases name - NAME_VERIFY=buster - ;; - debian_bullseye|bullseye|debian-bullseye) - ## check for FreeBSD releases name - NAME_VERIFY=bullseye - ;; - debian_bookworm|bookworm|debian-bookworm) - ## check for FreeBSD releases name - NAME_VERIFY=bookworm - ;; - *) - error_notify "[ERROR]: Unknown linux release." - usage - ;; - esac -fi - +# Filter sane release names if [ "${EMPTY_JAIL}" -eq 0 ]; then if [ "${VALIDATE_RELEASE}" -eq 1 ]; then - ## verify release + # Verify release case "${RELEASE}" in - [2-4].[0-9]*) - ## check for MidnightBSD releases name - NAME_VERIFY=$(echo "${RELEASE}") - validate_release - ;; - *-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current) - ## check for FreeBSD releases name - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') - validate_release - ;; - *-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9]) - ## check for FreeBSD releases name - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') - validate_release - ;; - *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) - ## check for HardenedBSD releases name(previous infrastructure) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') - validate_release - ;; - *-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) - ## check for HardenedBSD(specific stable build releases) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') - validate_release - ;; - *-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST) - ## check for HardenedBSD(latest stable build release) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') - validate_release - ;; - current-build-[0-9]*|CURRENT-BUILD-[0-9]*) - ## check for HardenedBSD(specific current build releases) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g') - validate_release - ;; - current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST) - ## check for HardenedBSD(latest current build release) - NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') - validate_release - ;; - ubuntu_bionic|bionic|ubuntu-bionic) - UBUNTU="1" - NAME_VERIFY=Ubuntu_1804 - validate_release - ;; - ubuntu_focal|focal|ubuntu-focal) - UBUNTU="1" - NAME_VERIFY=Ubuntu_2004 - validate_release - ;; - ubuntu_jammy|jammy|ubuntu-jammy) - UBUNTU="1" - NAME_VERIFY=Ubuntu_2204 - validate_release - ;; - debian_buster|buster|debian-buster) - NAME_VERIFY=Debian10 - validate_release - ;; - debian_bullseye|bullseye|debian-bullseye) - NAME_VERIFY=Debian11 - validate_release - ;; - debian_bookworm|bookworm|debian-bookworm) - NAME_VERIFY=Debian12 - validate_release - ;; - *) - error_notify "Unknown Release." - usage - ;; + [2-4].[0-9]*) + ### MidnightBSD ## + PLATFORM_OS="MidnightBSD" + NAME_VERIFY=$(echo "${RELEASE}") + validate_release + ;; + *-current|*-CURRENT|*-current-I386|*-CURRENT-i386) + ### FreeBSD ### + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') + validate_release + ;; + *-release|*-RELEASE|*-release-I386|*-RELEASE-i386|*-rc[1-9]|*-RC[1-9]|*-beta[1-9]|*-BETA[1-9]) + ### FreeBSD ### + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g') + validate_release + ;; + *\.*-stable|*\.*-STABLE) + ### FreeBSD ### + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]') + validate_release + ;; + current|CURRENT) + ### HardenedBSD ### + PLATFORM_OS="HardenedBSD" + NAME_VERIFY=$(echo "${RELEASE}" | sed 's/CURRENT/current/g') + validate_release + ;; + [1-9]*-stable|[1-9]*-STABLE) + ### HardenedBSD ### + PLATFORM_OS="HardenedBSD" + NAME_VERIFY=$(echo "${RELEASE}" | sed 's/STABLE/stable/g') + validate_release + ;; + ubuntu_bionic|bionic|ubuntu-bionic) + PLATFORM_OS="Ubuntu" + NAME_VERIFY=Ubuntu_1804 + validate_release + ;; + ubuntu_focal|focal|ubuntu-focal) + PLATFORM_OS="Ubuntu" + NAME_VERIFY=Ubuntu_2004 + validate_release + ;; + ubuntu_jammy|jammy|ubuntu-jammy) + PLATFORM_OS="Ubuntu" + NAME_VERIFY=Ubuntu_2204 + validate_release + ;; + ubuntu_noble|noble|ubuntu-noble) + PLATFORM_OS="Ubuntu" + NAME_VERIFY=Ubuntu_2404 + validate_release + ;; + debian_buster|buster|debian-buster) + PLATFORM_OS="Debian" + NAME_VERIFY=Debian10 + validate_release + ;; + debian_bullseye|bullseye|debian-bullseye) + PLATFORM_OS="Debian" + NAME_VERIFY=Debian11 + validate_release + ;; + debian_bookworm|bookworm|debian-bookworm) + PLATFORM_OS="Debian" + NAME_VERIFY=Debian12 + validate_release + ;; + *) + error_notify "Unknown release: ${RELEASE}" + usage + ;; esac fi - # Check for name/root/.bastille - if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then - error_exit "[ERROR]: ${NAME} already exists. ${NAME}/root/.bastille exists." - fi - - # Check for required release - if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then - error_notify "[ERROR]: Release must be bootstrapped first." - error_exit "See 'bastille bootstrap'." - fi - # Validate IP address if [ -n "${IP}" ]; then validate_ips @@ -1131,14 +1100,14 @@ if [ "${EMPTY_JAIL}" -eq 0 ]; then fi # Validate interface + # Interface must be set with vnet jails if [ -n "${INTERFACE}" ]; then validate_netif validate_netconf elif [ "${VNET_JAIL}" -eq 1 ]; then if [ -z "${INTERFACE}" ]; then if [ -z "${bastille_network_shared}" ]; then - # User must specify interface on vnet jails. - error_exit "[ERROR]: Network interface not defined." + error_exit "[ERROR]: Network interface not set." else validate_netconf fi @@ -1178,9 +1147,8 @@ fi if [ -z ${bastille_template_vnet+x} ]; then bastille_template_vnet='default/vnet' fi - -if check_target_exists "${NAME}"; then - error_exit "[ERROR]: Jail already exists: ${NAME}" +if [ -z ${bastille_template_vlan+x} ]; then + bastille_template_vnet='default/vlan' fi create_jail "${NAME}" "${RELEASE}" "${IP}" "${INTERFACE}" diff --git a/usr/local/share/bastille/list.sh b/usr/local/share/bastille/list.sh index c5bf43d2..c9024df6 100644 --- a/usr/local/share/bastille/list.sh +++ b/usr/local/share/bastille/list.sh @@ -582,19 +582,20 @@ list_type() { # TODO: Check the correct usage or arguments here. See SC2120. # shellcheck disable=SC2120 -list_release(){ +list_release() { + if [ -d "${bastille_releasesdir}" ]; then # TODO: Check if this can be changed to `find` as SC2012 suggests. # shellcheck disable=SC2012 - REL_LIST="$(ls -v --color=never "${bastille_releasesdir}" | sed "s/\n//g")" - for _REL in ${REL_LIST}; do - if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" ] || [ -d "${bastille_releasesdir}/${_REL}/debootstrap" ]; then - if [ "${1}" = "-p" ] && [ -f "${bastille_releasesdir}/${_REL}/bin/freebsd-version" ]; then - REL_PATCH_LEVEL=$(sed -n "s/^USERLAND_VERSION=\"\(.*\)\"$/\1/p" "${bastille_releasesdir}/${_REL}/bin/freebsd-version" 2> /dev/null) - REL_PATCH_LEVEL=${REL_PATCH_LEVEL:-${_REL}} - echo "${REL_PATCH_LEVEL}" + release_list="$(ls -v --color=never "${bastille_releasesdir}" | sed "s/\n//g")" + for release in ${release_list}; do + if [ -f "${bastille_releasesdir}/${release}/root/.profile" ] || [ -d "${bastille_releasesdir}/${release}/debootstrap" ]; then + if [ "${1}" = "-p" ] && [ -f "${bastille_releasesdir}/${release}/bin/freebsd-version" ]; then + release_patch=$(sed -n "s/^USERLAND_VERSION=\"\(.*\)\"$/\1/p" "${bastille_releasesdir}/${release}/bin/freebsd-version" 2> /dev/null) + release_patch=${release_patch:-${release}} + echo "${release_patch}" else - echo "${_REL}" + echo "${release}" fi fi done diff --git a/usr/local/share/bastille/update.sh b/usr/local/share/bastille/update.sh index 59490f53..24f2d0fe 100644 --- a/usr/local/share/bastille/update.sh +++ b/usr/local/share/bastille/update.sh @@ -52,6 +52,10 @@ fi # Handle options. OPTION="" AUTO=0 +PKGBASE=0 +PLATFORM_OS="FreeBSD" +JAIL_PLATFORM_OS="FreeBSD" +RELEASE_PLATFORM_OS="FreeBSD" while [ "$#" -gt 0 ]; do case "${1}" in -h|--help|help) @@ -87,18 +91,9 @@ while [ "$#" -gt 0 ]; do done TARGET="${1}" -PKGBASE=0 bastille_root_check -if [ -f "/bin/midnightbsd-version" ]; then - error_exit "[ERROR]: Not yet supported on MidnightBSD." -fi - -if freebsd-version | grep -qi HBSD; then - error_exit "[ERROR]: Not yet supported on HardenedBSD." -fi - jail_check() { # Check if the jail is thick and is running @@ -114,52 +109,113 @@ jail_check() { info "\n[${TARGET}]:" + # Check for thin jail if grep -qw "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then error_notify "[ERROR]: ${TARGET} is not a thick container." error_exit "See 'bastille update RELEASE' to update thin jails." fi - # Validate update method - CURRENT_VERSION="$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)" - MINOR_VERSION=$(echo ${CURRENT_VERSION} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/') - MAJOR_VERSION=$(echo ${CURRENT_VERSION} | grep -Eo '^[0-9]+') - if echo "${CURRENT_VERSION}" | grep -oq "\-CURRENT"; then - FREEBSD_BRANCH="current" + # Verify PLATFORM_OS inside jail + JAIL_PLATFORM_OS="$( ${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version )" + if echo "${JAIL_PLATFORM_OS}" | grep -q "HBSD"; then + JAIL_PLATFORM_OS="HardenedBSD" else - FREEBSD_BRANCH="release" + JAIL_PLATFORM_OS="FreeBSD" fi + + # Set CURRENT_VERSION + CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null) if [ -z "${CURRENT_VERSION}" ]; then error_exit "[ERROR]: Can't determine '${TARGET}' version." fi - if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_jailsdir}/${TARGET}/root" which /usr/bin/uname > /dev/null 2>&1; then - PKGBASE=1 + + # Validate method (Legacy/PkgBase) + if [ "${JAIL_PLATFORM_OS}" = "FreeBSD" ]; then + # Validate update method + MINOR_VERSION=$(echo ${CURRENT_VERSION} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/') + MAJOR_VERSION=$(echo ${CURRENT_VERSION} | grep -Eo '^[0-9]+') + if echo "${CURRENT_VERSION}" | grep -oq "\-CURRENT"; then + FREEBSD_BRANCH="current" + else + FREEBSD_BRANCH="release" + fi + if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_jailsdir}/${TARGET}/root" which /usr/bin/uname > /dev/null 2>&1; then + PKGBASE=1 + fi + fi +} + +jail_update() { + + # Update a thick container + if [ "${JAIL_PLATFORM_OS}" = "FreeBSD" ]; then + + local jailname="${TARGET}" + local jailpath="${bastille_jailsdir}/${TARGET}/root" + local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf" + local work_dir="${jailpath}/var/db/freebsd-update" + + env PAGER="/bin/cat" freebsd-update ${OPTION} \ + --not-running-from-cron \ + -j "${jailname}" \ + -d "${work_dir}" \ + -f "${freebsd_update_conf}" \ + fetch + + env PAGER="/bin/cat" freebsd-update ${OPTION} \ + --not-running-from-cron \ + -j "${jailname}" \ + -d "${work_dir}" \ + -f "${freebsd_update_conf}" \ + install + + elif [ "${JAIL_PLATFORM_OS}" = "HardenedBSD" ]; then + + local jailname="${TARGET}" + local jailpath="${bastille_jailsdir}/${TARGET}/root" + local hbsd_update_conf="${jailpath}/etc/hbsd-update.conf" + + hbsd-update \ + -j "${jailname}" \ + -c "${hbsd_update_conf}" + fi + + # Update release version (including patch level) + NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null) + if [ "${CURRENT_VERSION}" != "${NEW_VERSION}" ]; then + bastille config ${TARGET} set osrelease ${NEW_VERSION} >/dev/null + info "\nUpgrade complete: ${CURRENT_VERSION} > ${NEW_VERSION}\n" + else + info "\nNo updates available.\n" fi } jail_update_pkgbase() { - local jailpath="${bastille_jailsdir}/${TARGET}/root" - local abi="FreeBSD:${MAJOR_VERSION}:${HW_MACHINE_ARCH}" - local fingerprints="${jailpath}/usr/share/keys/pkg" - if [ "${FREEBSD_BRANCH}" = "release" ]; then - local repo_name="FreeBSD-base-release-${MINOR_VERSION}" - elif [ "${FREEBSD_BRANCH}" = "current" ]; then - local repo_name="FreeBSD-base-latest" - fi - local repo_dir="${bastille_sharedir}/pkgbase" + if [ "${JAIL_PLATFORM_OS}" = "FreeBSD" ]; then + + local jailpath="${bastille_jailsdir}/${TARGET}/root" + local abi="FreeBSD:${MAJOR_VERSION}:${HW_MACHINE_ARCH}" + local fingerprints="${jailpath}/usr/share/keys/pkg" + if [ "${FREEBSD_BRANCH}" = "release" ]; then + local repo_name="FreeBSD-base-release-${MINOR_VERSION}" + elif [ "${FREEBSD_BRANCH}" = "current" ]; then + local repo_name="FreeBSD-base-latest" + fi + local repo_dir="${bastille_sharedir}/pkgbase" - # Update jail - if [ -d "${jailpath}" ]; then # Update repo (pkgbase) if ! pkg --rootdir "${jailpath}" \ --repo-conf-dir "${repo_dir}" \ - -o IGNORE_OSVERSION="yes" \ - -o ABI="${abi}" \ - -o ASSUME_ALWAYS_YES="yes" \ - -o FINGERPRINTS="${fingerprints}" \ - update -r "${repo_name}"; then + -o IGNORE_OSVERSION="yes" \ + -o ABI="${abi}" \ + -o ASSUME_ALWAYS_YES="yes" \ + -o FINGERPRINTS="${fingerprints}" \ + update -r "${repo_name}"; then + error_exit "[ERROR]: Failed to update pkg repo: ${repo_name}" fi + # Update jail if ! pkg --rootdir "${jailpath}" \ --repo-conf-dir "${repo_dir}" \ @@ -168,81 +224,119 @@ jail_update_pkgbase() { -o ASSUME_ALWAYS_YES="yes" \ -o FINGERPRINTS="${fingerprints}" \ upgrade -r "${repo_name}"; then - error_exit "[ERROR]: Failed to upgrade jail: ${TARGET}" + + error_exit "[ERROR]: Failed to update jail: ${TARGET}" fi + # Update release version (including patch level) NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null) - bastille config ${TARGET} set osrelease ${NEW_VERSION} + if [ "${CURRENT_VERSION}" != "${NEW_VERSION}" ]; then + bastille config ${TARGET} set osrelease ${NEW_VERSION} >/dev/null + info "\nUpgrade complete: ${CURRENT_VERSION} > ${NEW_VERSION}\n" + else + info "\nNo updates available.\n" + fi else error_exit "[ERROR]: Jail not found: ${TARGET}" fi } -jail_update() { +release_check() { - local jailname="${TARGET}" - local jailpath="${bastille_jailsdir}/${TARGET}/root" - local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf" - local work_dir="${jailpath}/var/db/freebsd-update" + TARGET="${NAME_VERIFY}" - # Update a thick container - if [ -d "${bastille_jailsdir}/${TARGET}" ]; then - CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null) - if [ -z "${CURRENT_VERSION}" ]; then - error_exit "[ERROR]: Can't determine '${TARGET}' version." - else - env PAGER="/bin/cat" freebsd-update ${OPTION} \ - --not-running-from-cron \ - -j "${jailname}" \ - -d "${work_dir}" \ - -f "${freebsd_update_conf}" \ - fetch - env PAGER="/bin/cat" freebsd-update ${OPTION} \ - --not-running-from-cron \ - -j "${jailname}" \ - -d "${work_dir}" \ - -f "${freebsd_update_conf}" \ - install + # Validate release existence + if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then + error_exit "[ERROR]: Release not found: ${RELEASE}" + fi + + # Verify PLATFORM_OS inside release + RELEASE_PLATFORM_OS="$( ${bastille_releasesdir}/${TARGET}/bin/freebsd-version )" + if echo "${RELEASE_PLATFORM_OS}" | grep -q "HBSD"; then + RELEASE_PLATFORM_OS="HardenedBSD" + else + RELEASE_PLATFORM_OS="FreeBSD" + fi + + if [ "${RELEASE_PLATFORM_OS}" = "FreeBSD" ]; then + + if echo "${TARGET}" | grep -w "[0-9]\{1,2\}\.[0-9]\-RELEASE\-i386"; then + ARCH_I386="1" + fi + + # Validate update method + MINOR_VERSION=$(echo ${TARGET} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/') + MAJOR_VERSION=$(echo ${TARGET} | grep -Eo '^[0-9]+') + if echo "${TARGET}" | grep -oq "\-CURRENT"; then + FREEBSD_BRANCH="current" + else + FREEBSD_BRANCH="release" + fi + if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_releasesdir}/${TARGET}" which /usr/bin/uname > /dev/null 2>&1; then + PKGBASE=1 fi - # Update release version (including patch level) - NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null) - bastille config ${TARGET} set osrelease ${NEW_VERSION} fi } -release_check() { +release_update() { - if echo "${TARGET}" | grep -w "[0-9]\{1,2\}\.[0-9]\-RELEASE\-i386"; then - ARCH_I386="1" - fi + if [ "${RELEASE_PLATFORM_OS}" = "FreeBSD" ]; then - # Validate update method - MINOR_VERSION=$(echo ${TARGET} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/') - MAJOR_VERSION=$(echo ${TARGET} | grep -Eo '^[0-9]+') - if echo "${TARGET}" | grep -oq "\-CURRENT"; then - FREEBSD_BRANCH="current" - else - FREEBSD_BRANCH="release" - fi - if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_releasesdir}/${TARGET}" which /usr/bin/uname > /dev/null 2>&1; then - PKGBASE=1 + local release_dir="${bastille_releasesdir}/${TARGET}" + local freebsd_update_conf="${release_dir}/etc/freebsd-update.conf" + local work_dir="${release_dir}/var/db/freebsd-update" + + # Update a release base (affects child containers) + TARGET_TRIM="${TARGET}" + if [ -n "${ARCH_I386}" ]; then + TARGET_TRIM=$(echo "${TARGET}" | sed 's/-i386//') + fi + + env PAGER="/bin/cat" freebsd-update ${OPTION} \ + --not-running-from-cron \ + -b "${release_dir}" \ + -d "${work_dir}" \ + -f "${freebsd_update_conf}" \ + fetch --currently-running "${TARGET_TRIM}" + + env PAGER="/bin/cat" freebsd-update ${OPTION} \ + --not-running-from-cron \ + -b "${release_dir}" \ + -d "${work_dir}" \ + -f "${freebsd_update_conf}" \ + install --currently-running "${TARGET_TRIM}" + + elif [ "${RELEASE_PLATFORM_OS}" = "HardenedBSD" ]; then + + local release_dir="${bastille_releasesdir}/${TARGET}" + local hbsd_update_conf="${release_dir}/etc/hbsd-update.conf" + + # Update a release base (affects child containers) + TARGET_TRIM="${TARGET}" + if [ -n "${ARCH_I386}" ]; then + TARGET_TRIM=$(echo "${TARGET}" | sed 's/-i386//') + fi + + hbsd-update \ + -r "${release_dir}" \ + -c "${hbsd_update_conf}" fi } release_update_pkgbase() { - local release_dir="${bastille_releasesdir}/${TARGET}" - local abi="FreeBSD:${MAJOR_VERSION}:${HW_MACHINE_ARCH}" - local fingerprints="${release_dir}/usr/share/keys/pkg" - if [ "${FREEBSD_BRANCH}" = "release" ]; then - local repo_name="FreeBSD-base-release-${MINOR_VERSION}" - elif [ "${FREEBSD_BRANCH}" = "current" ]; then - local repo_name="FreeBSD-base-latest" - fi - local repo_dir="${bastille_sharedir}/pkgbase" + if [ "${RELEASE_PLATFORM_OS}" = "FreeBSD" ]; then + + local release_dir="${bastille_releasesdir}/${TARGET}" + local abi="FreeBSD:${MAJOR_VERSION}:${HW_MACHINE_ARCH}" + local fingerprints="${release_dir}/usr/share/keys/pkg" + if [ "${FREEBSD_BRANCH}" = "release" ]; then + local repo_name="FreeBSD-base-release-${MINOR_VERSION}" + elif [ "${FREEBSD_BRANCH}" = "current" ]; then + local repo_name="FreeBSD-base-latest" + fi + local repo_dir="${bastille_sharedir}/pkgbase" - # Update a release base (affects child containers) - if [ -d "${release_dir}" ]; then # Update repo (pkgbase) if ! pkg --rootdir "${release_dir}" \ --repo-conf-dir "${repo_dir}" \ @@ -251,8 +345,10 @@ release_update_pkgbase() { -o ASSUME_ALWAYS_YES="yes" \ -o FINGERPRINTS="${fingerprints}" \ update -r "${repo_name}"; then + error_exit "[ERROR]: Failed to update pkg repo: ${repo_name}" fi + # Update release (pkgbase) if ! pkg --rootdir "${release_dir}" \ --repo-conf-dir "${repo_dir}" \ @@ -261,40 +357,9 @@ release_update_pkgbase() { -o ASSUME_ALWAYS_YES="yes" \ -o FINGERPRINTS="${fingerprints}" \ upgrade -r "${repo_name}"; then - error_exit "[ERROR]: Failed to upgrade release: ${TARGET}" + + error_exit "[ERROR]: Failed to update release: ${TARGET}" fi - else - error_notify "[ERROR]: Release not found: ${TARGET}" - error_exit "See 'bastille bootstrap RELEASE'" - fi -} - -release_update() { - - local release_dir="${bastille_releasesdir}/${TARGET}" - local freebsd_update_conf="${release_dir}/etc/freebsd-update.conf" - local work_dir="${release_dir}/var/db/freebsd-update" - - # Update a release base(affects child containers) - if [ -d "${release_dir}" ]; then - TARGET_TRIM="${TARGET}" - if [ -n "${ARCH_I386}" ]; then - TARGET_TRIM=$(echo "${TARGET}" | sed 's/-i386//') - fi - env PAGER="/bin/cat" freebsd-update ${OPTION} \ - --not-running-from-cron \ - -b "${release_dir}" \ - -d "${work_dir}" \ - -f "${freebsd_update_conf}" \ - fetch --currently-running "${TARGET_TRIM}" - env PAGER="/bin/cat" freebsd-update ${OPTION} \ - --not-running-from-cron \ - -b "${release_dir}" \ - -d "${work_dir}" \ - -f "${freebsd_update_conf}" \ - install --currently-running "${TARGET_TRIM}" - else - error_exit "[ERROR]: ${TARGET} not found. See 'bastille bootstrap RELEASE'." fi } @@ -341,24 +406,83 @@ templates_update() { # Set needed variables for pkgbase HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }') -# Check what we should update -if [ "${TARGET}" = 'TEMPLATES' ]; then - templates_update -elif echo "${TARGET}" | grep -Eq '^[A-Za-z0-9_-]+/[A-Za-z0-9_-]+$'; then - BASTILLE_TEMPLATE="${TARGET}" - template_update -elif echo "${TARGET}" | grep -q "[0-9]\{2\}.[0-9]-\(RELEASE\|CURRENT\)"; then - release_check - if [ "${PKGBASE}" -eq 1 ]; then - release_update_pkgbase - else - release_update - fi -else - jail_check - if [ "${PKGBASE}" -eq 1 ]; then - jail_update_pkgbase - else - jail_update - fi -fi \ No newline at end of file +# Check what we need to update +# JAIL or RELEASE +UPDATE_TARGET="" +case "${TARGET}" in + templates|TEMPLATES) + UPDATE_TARGET="TEMPLATES" + ;; + */*) + BASTILLE_TEMPLATE="${TARGET}" + UPDATE_TARGET="TEMPLATE" + ;; + [2-4].[0-9]*) + PLATFORM_OS="MidnightBSD" + NAME_VERIFY=$(echo "${TARGET}") + UPDATE_TARGET="RELEASE" + ;; + *-current|*-CURRENT) + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]') + UPDATE_TARGET="RELEASE" + ;; + *\.*-stable|*\.*-STABLE) + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]') + UPDATE_TARGET="RELEASE" + ;; + *-release|*-RELEASE) + PLATFORM_OS="FreeBSD" + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([0-9]+)\.[0-9](-RELEASE)$' | tr '[:lower:]' '[:upper:]') + UPDATE_TARGET="RELEASE" + ;; + current|CURRENT) + PLATFORM_OS="HardenedBSD" + NAME_VERIFY=$(echo "${TARGET}" | sed 's/CURRENT/current/g') + UPDATE_TARGET="RELEASE" + ;; + [1-9]*-stable|[1-9]*-STABLE) + PLATFORM_OS="HardenedBSD" + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]+)(-stable)$' | sed 's/STABLE/stable/g') + UPDATE_TARGET="RELEASE" + ;; + *) + UPDATE_TARGET="JAIL" + ;; +esac + +# Unsupported platforms +if [ "${PLATFORM_OS}" = "MidnightBSD" ] || [ -f "/bin/midnightbsd-version" ]; then + error_exit "[ERROR]: Not yet supported on MidnightBSD." +fi + +# Update +case ${UPDATE_TARGET} in + TEMPLATE) + template_update + ;; + TEMPLATES) + templates_update + ;; + RELEASE) + release_check + info "\nAttempting to update release: ${TARGET}" + if [ "${PKGBASE}" -eq 1 ]; then + release_update_pkgbase + else + release_update + fi + ;; + JAIL) + jail_check + if [ "${PKGBASE}" -eq 1 ]; then + jail_update_pkgbase + else + jail_update + fi + ;; + *) + error_exit "[ERROR]: Unknown update target." + ;; +esac \ No newline at end of file