diff --git a/README.md b/README.md index 605025e2..7e945c9a 100644 --- a/README.md +++ b/README.md @@ -292,6 +292,37 @@ bootstrapping templates from GitHub or GitLab. See `bastille update` to ensure your bootstrapped releases include the latest patches. +**Ubuntu Linux [new since 0.9]** + +The bootstrap process for Linux containers is very different from the *BSD process. +You will need the package debootstrap and some kernel modules for that. +But don't worry, Bastille will do that for that for you. + +```shell +ishmael ~ # bastille bootstrap focal +sysrc: unknown variable 'linprocfs_load' +sysrc: unknown variable 'linsysfs_load' +sysrc: unknown variable 'tmpfs_load' +linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you? (N|y) +#y +Loading modules +Persisting modules +linux_enable: -> YES +linprocfs_load: -> YES +linsysfs_load: -> YES +tmpfs_load: -> YES +Debootstrap not found. Should it be installed? (N|y) +#y +FreeBSD repository is up to date. +All repositories are up to date. +Checking integrity... done (0 conflicting) +The following 1 package(s) will be affected (of 0 checked): + +New packages to be INSTALLED: + debootstrap: 1.0.123_4 +[...] +``` +As of 0.9.20210714 Bastille supports Ubuntu 18.04 (bionic) and Ubuntu 20.04 (focal). bastille create --------------- @@ -381,6 +412,15 @@ shared base container is a "thin"). ishmael ~ # bastille create -T folsom 12.0-RELEASE 10.17.89.10 ``` +**Linux** +```shell +ishmael ~ # bastille create folsom focal 10.17.89.10 +``` + +Systemd is not supported due to the missing boot process. + + + I recommend using private (rfc1918) ip address ranges for your containers. These ranges include: diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh index 1a908758..503a8c83 100644 --- a/usr/local/share/bastille/bootstrap.sh +++ b/usr/local/share/bastille/bootstrap.sh @@ -429,11 +429,88 @@ http?://*/*/*) BASTILLE_TEMPLATE_REPO=$(echo "${1}" | awk -F / '{ print $5 }') bootstrap_template ;; +#adding Ubuntu Bionic as valid "RELEASE" for POC @hackacad +ubuntu_bionic|bionic|ubuntu-bionic) + #check and install OS dependencies @hackacad + if [ ! "$(sysrc -f /boot/loader.conf -n linprocfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n linsysfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n tmpfs_load)" = "YES" ]; then + warn "linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you? (N|y)" + read answer + case $answer in + no|No|n|N|"") + error_exit "Exiting." + ;; + yes|Yes|y|Y) + info "Loading modules" + kldload linux linux64 linprocfs linsysfs tmpfs + info "Persisting modules" + sysrc linux_enable=YES + sysrc -f /boot/loader.conf linprocfs_load=YES + sysrc -f /boot/loader.conf linsysfs_load=YES + sysrc -f /boot/loader.conf tmpfs_load=YES + ;; + esac + fi + if which -s debootstrap; then + debootstrap --foreign --arch=amd64 --no-check-gpg bionic "${bastille_releasesdir}"/Ubuntu_1804 + else + warn "Debootstrap not found. Should it be installed? (N|y)" + read answer + case $answer in + no|No|n|N|"") + error_exit "Exiting. You need to install debootstap before boostrapping a Linux jail." + ;; + yes|Yes|y|Y) + pkg install -y debootstrap + debootstrap --foreign --arch=amd64 --no-check-gpg bionic "${bastille_releasesdir}"/Ubuntu_1804 + ;; + esac + fi + echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/Ubuntu_1804/etc/apt/apt.conf.d/00aptitude + ;; +ubuntu_focal|focal|ubuntu-focal) + #check and install OS dependencies @hackacad + #ToDo: add function 'linux_pre' for sysrc etc. + if [ ! "$(sysrc -f /boot/loader.conf -n linprocfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n linsysfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n tmpfs_load)" = "YES" ]; then + warn "linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you? (N|y)" + read answer + case $answer in + no|No|n|N|"") + error_exit "Exiting." + ;; + yes|Yes|y|Y) + info "Loading modules" + kldload linux linux64 linprocfs linsysfs tmpfs + info "Persisting modules" + sysrc linux_enable=YES + sysrc -f /boot/loader.conf linprocfs_load=YES + sysrc -f /boot/loader.conf linsysfs_load=YES + sysrc -f /boot/loader.conf tmpfs_load=YES + ;; + esac + fi + if which -s debootstrap; then + debootstrap --foreign --arch=amd64 --no-check-gpg focal "${bastille_releasesdir}"/Ubuntu_2004 + else + warn "Debootstrap not found. Should it be installed? (N|y)" + read answer + case $answer in + no|No|n|N|"") + error_exit "Exiting. You need to install debootstap before boostrapping a Linux jail." + ;; + yes|Yes|y|Y) + pkg install -y debootstrap + debootstrap --foreign --arch=amd64 --no-check-gpg focal "${bastille_releasesdir}"/Ubuntu_2004 + ;; + esac + fi + ;; *) usage ;; esac + + case "${OPTION}" in update) bastille update "${RELEASE}" diff --git a/usr/local/share/bastille/console.sh b/usr/local/share/bastille/console.sh index afe66c2f..3363c9ab 100644 --- a/usr/local/share/bastille/console.sh +++ b/usr/local/share/bastille/console.sh @@ -53,7 +53,7 @@ validate_user() { USER_SHELL="$(jexec -l "${_jail}" getent passwd "${USER}" | cut -d: -f7)" if [ -n "${USER_SHELL}" ]; then if jexec -l "${_jail}" grep -qwF "${USER_SHELL}" /etc/shells; then - jexec -l "${_jail}" /usr/bin/login -f "${USER}" + jexec -l "${_jail}" $LOGIN -f "${USER}" else echo "Invalid shell for user ${USER}" fi @@ -76,11 +76,12 @@ check_fib() { for _jail in ${JAILS}; do info "[${_jail}]:" + LOGIN="$(jexec -l "${_jail}" which login)" if [ -n "${USER}" ]; then validate_user else - check_fib - ${_setfib} jexec -l "${_jail}" /usr/bin/login -f root + LOGIN="$(jexec -l "${_jail}" which login)" + ${_setfib} jexec -l "${_jail}" $LOGIN -f root fi echo done diff --git a/usr/local/share/bastille/create.sh b/usr/local/share/bastille/create.sh index e46109e0..4c62bef9 100644 --- a/usr/local/share/bastille/create.sh +++ b/usr/local/share/bastille/create.sh @@ -141,6 +141,30 @@ ${NAME} { EOF } +generate_linux_jail_conf() { + cat << EOF > "${bastille_jail_conf}" +${NAME} { + host.hostname = ${NAME}; + mount.fstab = ${bastille_jail_fstab}; + path = ${bastille_jail_path}; + devfs_ruleset = 4; + + exec.start = '/bin/true'; + exec.stop = '/bin/true'; + persist; + + mount.devfs; + + allow.mount; + allow.mount.devfs; + + interface = ${bastille_jail_conf_interface}; + ${IPX_ADDR} = ${IP}; + ip6 = ${IP6_MODE}; +} +EOF +} + generate_vnet_jail_conf() { ## determine number of containers + 1 ## iterate num and grep all jail configs @@ -205,8 +229,51 @@ create_jail() { mkdir -p "${bastille_jailsdir}/${NAME}/root" fi fi + ## PoC for Linux jails @hackacad + if [ -n "${LINUX_JAIL}" ]; then + if [ ! -d "${bastille_jail_base}" ]; then + mkdir -p "${bastille_jail_base}" + fi + mkdir -p "${bastille_jail_path}/dev" + mkdir -p "${bastille_jail_path}/proc" + mkdir -p "${bastille_jail_path}/sys" + mkdir -p "${bastille_jail_path}/home" + mkdir -p "${bastille_jail_path}/tmp" + touch "${bastille_jail_path}/dev/shm" + touch "${bastille_jail_path}/dev/fd" + cp -RPf ${bastille_releasesdir}/${RELEASE}/* ${bastille_jail_path}/ + echo ${NAME} ${bastille_jail_path}/etc/hostname - if [ -z "${EMPTY_JAIL}" ]; then + if [ ! -d "${bastille_jail_template}" ]; then + mkdir -p "${bastille_jail_template}" + fi + + if [ ! -f "${bastille_jail_fstab}" ]; then + touch "${bastille_jail_fstab}" + fi + echo -e "devfs ${bastille_jail_path}/dev devfs rw 0 0" > "${bastille_jail_fstab}" + echo -e "tmpfs ${bastille_jail_path}/dev/shm tmpfs rw,size=1g,mode=1777 0 0" > "${bastille_jail_fstab}" + echo -e "fdescfs ${bastille_jail_path}/dev/fd fdescfs rw,linrdlnk 0 0" > "${bastille_jail_fstab}" + echo -e "linprocfs ${bastille_jail_path}/proc linprocfs rw 0 0" > "${bastille_jail_fstab}" + echo -e "linsysfs ${bastille_jail_path}/sys linsysfs rw 0 0" > "${bastille_jail_fstab}" + echo -e "/tmp ${bastille_jail_path}/tmp nullfs rw 0 0" > "${bastille_jail_fstab}" +## removed temporarely / only for X11 jails? @hackacad +# echo -e "/home ${bastille_jail_path}/home nullfs rw 0 0" > "${bastille_jail_fstab}" + + if [ ! -f "${bastille_jail_conf}" ]; then + if [ -z "${bastille_network_loopback}" ] && [ -n "${bastille_network_shared}" ]; then + local bastille_jail_conf_interface=${bastille_network_shared} + fi + if [ -n "${bastille_network_loopback}" ] && [ -z "${bastille_network_shared}" ]; then + local bastille_jail_conf_interface=${bastille_network_loopback} + fi + if [ -n "${INTERFACE}" ]; then + local bastille_jail_conf_interface=${INTERFACE} + fi + fi + fi + + if [ -z "${EMPTY_JAIL}" ] && [ -z "${LINUX_JAIL}" ]; then if [ ! -d "${bastille_jail_base}" ]; then mkdir -p "${bastille_jail_base}" fi @@ -237,13 +304,7 @@ create_jail() { if [ -n "${INTERFACE}" ]; then local bastille_jail_conf_interface=${INTERFACE} fi - - ## generate the jail configuration file - if [ -n "${VNET_JAIL}" ]; then - generate_vnet_jail_conf - else - generate_jail_conf - fi + generate_jail_conf fi ## using relative paths here @@ -325,25 +386,25 @@ create_jail() { fi fi fi - - ## create home directory if missing - if [ ! -d "${bastille_jail_path}/usr/home" ]; then - mkdir -p "${bastille_jail_path}/usr/home" + if [ -n "${VNET_JAIL}" ]; then + ## create home directory if missing + if [ ! -d "${bastille_jail_path}/usr/home" ]; then + mkdir -p "${bastille_jail_path}/usr/home" + fi + ## link home properly + if [ ! -L "home" ]; then + ln -s usr/home home + fi + + ## TZ: configurable (default: Etc/UTC) + ln -s "/usr/share/zoneinfo/${bastille_tzdata}" etc/localtime + + # Post-creation jail misc configuration + # Create a dummy fstab file + touch "etc/fstab" + # Disables adjkerntz, avoids spurious error messages + sed -i '' 's|[0-9],[0-9]\{2\}.*[0-9]-[0-9].*root.*kerntz -a|#& # Disabled by bastille|' "etc/crontab" fi - ## link home properly - if [ ! -L "home" ]; then - ln -s usr/home home - fi - - ## TZ: configurable (default: Etc/UTC) - ln -s "/usr/share/zoneinfo/${bastille_tzdata}" etc/localtime - - # Post-creation jail misc configuration - # Create a dummy fstab file - touch "etc/fstab" - # Disables adjkerntz, avoids spurious error messages - sed -i '' 's|[0-9],[0-9]\{2\}.*[0-9]-[0-9].*root.*kerntz -a|#& # Disabled by bastille|' "etc/crontab" - ## VNET specific if [ -n "${VNET_JAIL}" ]; then ## VNET requires jib script @@ -353,6 +414,8 @@ create_jail() { fi fi fi + elif [ -n "${LINUX_JAIL}" ]; then + generate_linux_jail_conf else ## Generate minimal configuration for empty jail generate_minimal_conf @@ -370,7 +433,6 @@ create_jail() { bastille start "${NAME}" fi fi - if [ -n "${VNET_JAIL}" ]; then if [ -n "${bastille_template_vnet}" ]; then ## rename interface to generic vnet0 @@ -404,6 +466,14 @@ create_jail() { if [ -n "${bastille_template_empty}" ]; then bastille template "${NAME}" ${bastille_template_empty} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}" fi + ## Using templating function to fetch necessary packges @hackacad + elif [ -n "${LINUX_JAIL}" ]; then + info "Fetching packages..." + jexec -l "${NAME}" /bin/bash -c "DEBIAN_FRONTEND=noninteractive rm /var/cache/apt/archives/rsyslog*.deb" + jexec -l "${NAME}" /bin/bash -c "DEBIAN_FRONTEND=noninteractive dpkg --force-depends --force-confdef --force-confold -i /var/cache/apt/archives/*.deb" + jexec -l "${NAME}" /bin/bash -c "DEBIAN_FRONTEND=noninteractive dpkg --force-depends --force-confdef --force-confold -i /var/cache/apt/archives/*.deb" + jexec -l "${NAME}" /bin/bash -c "chmod 777 /tmp" + jexec -l "${NAME}" /bin/bash -c "apt update" else # Thin jail. if [ -n "${bastille_template_thin}" ]; then bastille template "${NAME}" ${bastille_template_thin} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}" @@ -411,7 +481,7 @@ create_jail() { fi # Apply values changed by the template. -- cwells - if [ -z "${EMPTY_JAIL}" ]; then + if [ -z "${EMPTY_JAIL}" ] && [ -z "${LINUX_JAIL}" ]; then bastille restart "${NAME}" elif [ -n "${EMPTY_JAIL}" ]; then # Don't restart empty jails unless a template defined. @@ -451,6 +521,10 @@ else shift EMPTY_JAIL="1" ;; + -L|--linux|linux) + shift + LINUX_JAIL="1" + ;; -T|--thick|thick) shift THICK_JAIL="1" @@ -486,6 +560,24 @@ if [ -n "${NAME}" ]; then validate_name fi + +if [ -n "${LINUX_JAIL}" ]; then + case "${RELEASE}" in + bionic|ubuntu_bionic|ubuntu|ubuntu-bionic) + ## check for FreeBSD releases name + NAME_VERIFY=ubuntu_bionic + ;; + focal|ubuntu_focal|ubuntu-focal) + ## check for FreeBSD releases name + NAME_VERIFY=ubuntu_focal + ;; + *) + error_notify "Unknown Linux." + usage + ;; + esac +fi + if [ -z "${EMPTY_JAIL}" ]; then ## verify release case "${RELEASE}" in @@ -529,6 +621,14 @@ if [ -z "${EMPTY_JAIL}" ]; then NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') validate_release ;; + ubuntu_bionic|bionic|ubuntu-bionic) + NAME_VERIFY=Ubuntu_1804 + validate_release + ;; + ubuntu_focal|focal|ubuntu-focal) + NAME_VERIFY=Ubuntu_2004 + validate_release + ;; *) error_notify "Unknown Release." usage @@ -590,6 +690,9 @@ fi if [ -z ${bastille_template_empty+x} ]; then bastille_template_empty='default/empty' fi +if [ -z ${bastille_template_linux+x} ]; then + bastille_template_empty='default/linux' +fi if [ -z ${bastille_template_thick+x} ]; then bastille_template_thick='default/thick' fi diff --git a/usr/local/share/bastille/templates/default/linux/Bastillefile b/usr/local/share/bastille/templates/default/linux/Bastillefile new file mode 100644 index 00000000..5fd46696 --- /dev/null +++ b/usr/local/share/bastille/templates/default/linux/Bastillefile @@ -0,0 +1,14 @@ +PRE mkdir -p home +PRE mkdir -p tmp + + +FSTAB devfs root/dev devfs rw 0 0 +FSTAB tmpfs dev/shm tmpfs rw,size=1g,mode=1777 0 0 +FSTAB fdescfs dev/fd fdescfs rw,linrdlnk 0 0 +FSTAB linprocfs proc linprocfs rw 0 0 +FSTAB linsysfs sys linsysfs rw 0 0 +FSTAB /tmp tmp nullfs rw 0 0 +FSTAB /home home nullfs rw 0 0 + +CMD mkdir etc/apt/apt.conf.d/00aptitude +CMD echo "APT::Cache-Start 251658240;" > etc/apt/apt.conf.d/00aptitude \ No newline at end of file