Merge pull request #340 from hackacad/linux_compat

Linux compat RC1

README.md

@@ -292,6 +292,37 @@ bootstrapping templates from GitHub or GitLab.
 See `bastille update` to ensure your bootstrapped releases include the latest
 patches.
 
+**Ubuntu Linux [new since 0.9]**
+
+The bootstrap process for Linux containers is very different from the *BSD process.
+You will need the package debootstrap and some kernel modules for that.
+But don't worry, Bastille will do that for that for you.
+
+```shell
+ishmael ~ # bastille bootstrap focal
+sysrc: unknown variable 'linprocfs_load'
+sysrc: unknown variable 'linsysfs_load'
+sysrc: unknown variable 'tmpfs_load'
+linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you?  (N|y)
+#y
+Loading modules
+Persisting modules
+linux_enable:  -> YES
+linprocfs_load:  -> YES
+linsysfs_load:  -> YES
+tmpfs_load:  -> YES
+Debootstrap not found. Should it be installed? (N|y)
+#y
+FreeBSD repository is up to date.
+All repositories are up to date.
+Checking integrity... done (0 conflicting)
+The following 1 package(s) will be affected (of 0 checked):
+
+New packages to be INSTALLED:
+        debootstrap: 1.0.123_4
+[...]
+```
+As of 0.9.20210714 Bastille supports Ubuntu 18.04 (bionic) and Ubuntu 20.04 (focal).
 
 bastille create
 ---------------
@@ -381,6 +412,15 @@ shared base container is a "thin").
 ishmael ~ # bastille create -T folsom 12.0-RELEASE 10.17.89.10
 ```
 
+**Linux**
+```shell
+ishmael ~ # bastille create folsom focal 10.17.89.10
+```
+
+Systemd is not supported due to the missing boot process.
+
+
+
 I recommend using private (rfc1918) ip address ranges for your containers.
 These ranges include:
 

usr/local/share/bastille/bootstrap.sh

@@ -429,11 +429,88 @@ http?://*/*/*)
     BASTILLE_TEMPLATE_REPO=$(echo "${1}" | awk -F / '{ print $5 }')
     bootstrap_template
     ;;
+#adding Ubuntu Bionic as valid "RELEASE" for POC @hackacad
+ubuntu_bionic|bionic|ubuntu-bionic)
+    #check and install OS dependencies @hackacad
+    if [ ! "$(sysrc -f /boot/loader.conf -n linprocfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n linsysfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n tmpfs_load)" = "YES" ]; then
+        warn "linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you?  (N|y)"
+        read  answer
+        case $answer in
+            no|No|n|N|"")
+                error_exit "Exiting."
+                ;;
+            yes|Yes|y|Y)
+                info "Loading modules"
+                kldload linux linux64 linprocfs linsysfs tmpfs
+                info "Persisting modules"
+                sysrc linux_enable=YES
+                sysrc -f /boot/loader.conf linprocfs_load=YES
+                sysrc -f /boot/loader.conf linsysfs_load=YES
+                sysrc -f /boot/loader.conf tmpfs_load=YES
+                ;;
+        esac
+    fi
+    if which -s debootstrap; then
+        debootstrap --foreign --arch=amd64 --no-check-gpg bionic "${bastille_releasesdir}"/Ubuntu_1804
+    else
+        warn "Debootstrap not found. Should it be installed? (N|y)"
+        read  answer
+        case $answer in
+            no|No|n|N|"")
+                error_exit "Exiting. You need to install debootstap before boostrapping a Linux jail."
+                ;;
+            yes|Yes|y|Y)
+                pkg install -y debootstrap
+                debootstrap --foreign --arch=amd64 --no-check-gpg bionic "${bastille_releasesdir}"/Ubuntu_1804
+                ;;
+        esac
+    fi
+    echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/Ubuntu_1804/etc/apt/apt.conf.d/00aptitude
+    ;;
+ubuntu_focal|focal|ubuntu-focal)
+    #check and install OS dependencies @hackacad
+    #ToDo: add function 'linux_pre' for sysrc etc.
+    if [ ! "$(sysrc -f /boot/loader.conf -n linprocfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n linsysfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n tmpfs_load)" = "YES" ]; then
+        warn "linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you?  (N|y)"
+        read  answer
+        case $answer in
+            no|No|n|N|"")
+                error_exit "Exiting."
+                ;;
+            yes|Yes|y|Y)
+                info "Loading modules"
+                kldload linux linux64 linprocfs linsysfs tmpfs
+                info "Persisting modules"
+                sysrc linux_enable=YES
+                sysrc -f /boot/loader.conf linprocfs_load=YES
+                sysrc -f /boot/loader.conf linsysfs_load=YES
+                sysrc -f /boot/loader.conf tmpfs_load=YES
+                ;;
+        esac
+    fi
+    if which -s debootstrap; then
+        debootstrap --foreign --arch=amd64 --no-check-gpg focal "${bastille_releasesdir}"/Ubuntu_2004
+    else
+        warn "Debootstrap not found. Should it be installed? (N|y)"
+        read  answer
+        case $answer in
+            no|No|n|N|"")
+                error_exit "Exiting. You need to install debootstap before boostrapping a Linux jail."
+                ;;
+            yes|Yes|y|Y)
+                pkg install -y debootstrap
+                debootstrap --foreign --arch=amd64 --no-check-gpg focal "${bastille_releasesdir}"/Ubuntu_2004
+                ;;
+        esac
+    fi
+    ;;
 *)
     usage
     ;;
 esac
 
+
+
 case "${OPTION}" in
 update)
     bastille update "${RELEASE}"

usr/local/share/bastille/console.sh

@@ -53,7 +53,7 @@ validate_user() {
         USER_SHELL="$(jexec -l "${_jail}" getent passwd "${USER}" | cut -d: -f7)"
         if [ -n "${USER_SHELL}" ]; then
             if jexec -l "${_jail}" grep -qwF "${USER_SHELL}" /etc/shells; then
-                jexec -l "${_jail}" /usr/bin/login -f "${USER}"
+                jexec -l "${_jail}" $LOGIN -f "${USER}"
             else
                 echo "Invalid shell for user ${USER}"
             fi
@@ -76,11 +76,12 @@ check_fib() {
 
 for _jail in ${JAILS}; do
     info "[${_jail}]:"
+    LOGIN="$(jexec -l "${_jail}" which login)"
     if [ -n "${USER}" ]; then
         validate_user
     else
-        check_fib
+        LOGIN="$(jexec -l "${_jail}" which login)"
-        ${_setfib} jexec -l "${_jail}" /usr/bin/login -f root
+        ${_setfib} jexec -l "${_jail}" $LOGIN -f root
     fi
     echo
 done

usr/local/share/bastille/create.sh

@@ -141,6 +141,30 @@ ${NAME} {
 EOF
 }
 
+generate_linux_jail_conf() {
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  host.hostname = ${NAME};
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+  devfs_ruleset = 4;
+  
+  exec.start = '/bin/true';
+  exec.stop = '/bin/true';
+  persist;
+  
+  mount.devfs;
+  
+  allow.mount;
+  allow.mount.devfs;
+  
+  interface = ${bastille_jail_conf_interface};
+  ${IPX_ADDR} = ${IP};
+  ip6 = ${IP6_MODE};
+}
+EOF
+}
+
 generate_vnet_jail_conf() {
     ## determine number of containers + 1
     ## iterate num and grep all jail configs
@@ -205,8 +229,51 @@ create_jail() {
             mkdir -p "${bastille_jailsdir}/${NAME}/root"
         fi
     fi
+    ## PoC for Linux jails @hackacad
+    if [ -n "${LINUX_JAIL}" ]; then
+        if [ ! -d "${bastille_jail_base}" ]; then
+            mkdir -p "${bastille_jail_base}"
+        fi
+        mkdir -p "${bastille_jail_path}/dev"
+        mkdir -p "${bastille_jail_path}/proc"
+        mkdir -p "${bastille_jail_path}/sys"
+        mkdir -p "${bastille_jail_path}/home"
+        mkdir -p "${bastille_jail_path}/tmp"        
+        touch "${bastille_jail_path}/dev/shm"
+        touch "${bastille_jail_path}/dev/fd"
+        cp -RPf ${bastille_releasesdir}/${RELEASE}/* ${bastille_jail_path}/
+        echo ${NAME} ${bastille_jail_path}/etc/hostname
 
-    if [ -z "${EMPTY_JAIL}" ]; then
+        if [ ! -d "${bastille_jail_template}" ]; then
+            mkdir -p "${bastille_jail_template}"
+        fi
+
+        if [ ! -f "${bastille_jail_fstab}" ]; then
+            touch "${bastille_jail_fstab}"
+        fi
+        echo -e "devfs           ${bastille_jail_path}/dev      devfs           rw                      0       0" > "${bastille_jail_fstab}"
+        echo -e "tmpfs           ${bastille_jail_path}/dev/shm  tmpfs           rw,size=1g,mode=1777    0       0" > "${bastille_jail_fstab}"
+        echo -e "fdescfs         ${bastille_jail_path}/dev/fd   fdescfs         rw,linrdlnk             0       0" > "${bastille_jail_fstab}"
+        echo -e "linprocfs       ${bastille_jail_path}/proc     linprocfs       rw                      0       0" > "${bastille_jail_fstab}"
+        echo -e "linsysfs        ${bastille_jail_path}/sys      linsysfs        rw                      0       0" > "${bastille_jail_fstab}"
+        echo -e "/tmp            ${bastille_jail_path}/tmp      nullfs          rw                      0       0" > "${bastille_jail_fstab}"
+## removed temporarely / only for X11 jails? @hackacad
+#        echo -e "/home           ${bastille_jail_path}/home     nullfs          rw                      0       0" > "${bastille_jail_fstab}"
+
+        if [ ! -f "${bastille_jail_conf}" ]; then
+            if [ -z "${bastille_network_loopback}" ] && [ -n "${bastille_network_shared}" ]; then
+                local bastille_jail_conf_interface=${bastille_network_shared}
+            fi
+            if [ -n "${bastille_network_loopback}" ] && [ -z "${bastille_network_shared}" ]; then
+                local bastille_jail_conf_interface=${bastille_network_loopback}
+            fi
+            if [ -n "${INTERFACE}" ]; then
+                local bastille_jail_conf_interface=${INTERFACE}
+            fi
+        fi
+    fi
+
+    if [ -z "${EMPTY_JAIL}" ] && [ -z "${LINUX_JAIL}" ]; then
         if [ ! -d "${bastille_jail_base}" ]; then
             mkdir -p "${bastille_jail_base}"
         fi
@@ -237,13 +304,7 @@ create_jail() {
             if [ -n "${INTERFACE}" ]; then
                 local bastille_jail_conf_interface=${INTERFACE}
             fi
-
+            generate_jail_conf
-            ## generate the jail configuration file
-            if [ -n "${VNET_JAIL}" ]; then
-                generate_vnet_jail_conf
-            else
-                generate_jail_conf
-            fi
         fi
 
         ## using relative paths here
@@ -325,25 +386,25 @@ create_jail() {
                 fi
             fi
         fi
-
+        if [ -n "${VNET_JAIL}" ]; then
-        ## create home directory if missing
+            ## create home directory if missing
-        if [ ! -d "${bastille_jail_path}/usr/home" ]; then
+            if [ ! -d "${bastille_jail_path}/usr/home" ]; then
-            mkdir -p "${bastille_jail_path}/usr/home"
+                mkdir -p "${bastille_jail_path}/usr/home"
+            fi
+            ## link home properly
+            if [ ! -L "home" ]; then
+                ln -s usr/home home
+            fi
+    
+            ## TZ: configurable (default: Etc/UTC)
+            ln -s "/usr/share/zoneinfo/${bastille_tzdata}" etc/localtime
+    
+            # Post-creation jail misc configuration
+            # Create a dummy fstab file
+            touch "etc/fstab"
+            # Disables adjkerntz, avoids spurious error messages
+            sed -i '' 's|[0-9],[0-9]\{2\}.*[0-9]-[0-9].*root.*kerntz -a|#& # Disabled by bastille|' "etc/crontab"
         fi
-        ## link home properly
-        if [ ! -L "home" ]; then
-            ln -s usr/home home
-        fi
-
-        ## TZ: configurable (default: Etc/UTC)
-        ln -s "/usr/share/zoneinfo/${bastille_tzdata}" etc/localtime
-
-        # Post-creation jail misc configuration
-        # Create a dummy fstab file
-        touch "etc/fstab"
-        # Disables adjkerntz, avoids spurious error messages
-        sed -i '' 's|[0-9],[0-9]\{2\}.*[0-9]-[0-9].*root.*kerntz -a|#& # Disabled by bastille|' "etc/crontab"
-
         ## VNET specific
         if [ -n "${VNET_JAIL}" ]; then
             ## VNET requires jib script
@@ -353,6 +414,8 @@ create_jail() {
                 fi
             fi
         fi
+    elif [ -n "${LINUX_JAIL}" ]; then
+        generate_linux_jail_conf
     else
         ## Generate minimal configuration for empty jail
         generate_minimal_conf
@@ -370,7 +433,6 @@ create_jail() {
             bastille start "${NAME}"
         fi
     fi
-
     if [ -n "${VNET_JAIL}" ]; then
         if [ -n "${bastille_template_vnet}" ]; then
             ## rename interface to generic vnet0
@@ -404,6 +466,14 @@ create_jail() {
         if [ -n "${bastille_template_empty}" ]; then
             bastille template "${NAME}" ${bastille_template_empty} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}"
         fi
+    ## Using templating function to fetch necessary packges @hackacad
+    elif [ -n "${LINUX_JAIL}" ]; then
+        info "Fetching packages..."
+        jexec -l "${NAME}" /bin/bash -c "DEBIAN_FRONTEND=noninteractive rm /var/cache/apt/archives/rsyslog*.deb"
+        jexec -l "${NAME}" /bin/bash -c "DEBIAN_FRONTEND=noninteractive dpkg --force-depends --force-confdef --force-confold -i /var/cache/apt/archives/*.deb"
+        jexec -l "${NAME}" /bin/bash -c "DEBIAN_FRONTEND=noninteractive dpkg --force-depends --force-confdef --force-confold -i /var/cache/apt/archives/*.deb"
+        jexec -l "${NAME}" /bin/bash -c "chmod 777 /tmp"
+        jexec -l "${NAME}" /bin/bash -c "apt update"
     else # Thin jail.
         if [ -n "${bastille_template_thin}" ]; then
             bastille template "${NAME}" ${bastille_template_thin} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}"
@@ -411,7 +481,7 @@ create_jail() {
     fi
 
     # Apply values changed by the template. -- cwells
-    if [ -z "${EMPTY_JAIL}" ]; then
+    if [ -z "${EMPTY_JAIL}" ] && [ -z "${LINUX_JAIL}" ]; then
         bastille restart "${NAME}"
     elif [ -n "${EMPTY_JAIL}" ]; then
         # Don't restart empty jails unless a template defined.
@@ -451,6 +521,10 @@ else
             shift
             EMPTY_JAIL="1"
             ;;
+        -L|--linux|linux)
+            shift
+            LINUX_JAIL="1"
+            ;;
         -T|--thick|thick)
             shift
             THICK_JAIL="1"
@@ -486,6 +560,24 @@ if [ -n "${NAME}" ]; then
     validate_name
 fi
 
+
+if [ -n "${LINUX_JAIL}" ]; then
+    case "${RELEASE}" in
+    bionic|ubuntu_bionic|ubuntu|ubuntu-bionic)
+        ## check for FreeBSD releases name
+        NAME_VERIFY=ubuntu_bionic
+        ;;
+    focal|ubuntu_focal|ubuntu-focal)
+        ## check for FreeBSD releases name
+        NAME_VERIFY=ubuntu_focal
+        ;;
+    *)
+        error_notify "Unknown Linux."
+        usage
+        ;;
+    esac
+fi
+
 if [ -z "${EMPTY_JAIL}" ]; then
     ## verify release
     case "${RELEASE}" in
@@ -529,6 +621,14 @@ if [ -z "${EMPTY_JAIL}" ]; then
         NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
         validate_release
         ;;
+    ubuntu_bionic|bionic|ubuntu-bionic)
+        NAME_VERIFY=Ubuntu_1804
+        validate_release
+        ;;
+    ubuntu_focal|focal|ubuntu-focal)
+        NAME_VERIFY=Ubuntu_2004
+        validate_release
+        ;;
     *)
         error_notify "Unknown Release."
         usage
@@ -590,6 +690,9 @@ fi
 if [ -z ${bastille_template_empty+x} ]; then
     bastille_template_empty='default/empty'
 fi
+if [ -z ${bastille_template_linux+x} ]; then
+    bastille_template_empty='default/linux'
+fi
 if [ -z ${bastille_template_thick+x} ]; then
     bastille_template_thick='default/thick'
 fi

usr/local/share/bastille/templates/default/linux/Bastillefile

@@ -0,0 +1,14 @@
+PRE mkdir -p home
+PRE mkdir -p tmp
+
+
+FSTAB devfs           root/dev      devfs           rw                      0       0
+FSTAB tmpfs           dev/shm  tmpfs           rw,size=1g,mode=1777    0       0
+FSTAB fdescfs         dev/fd   fdescfs         rw,linrdlnk             0       0
+FSTAB linprocfs       proc     linprocfs       rw                      0       0
+FSTAB linsysfs        sys      linsysfs        rw                      0       0
+FSTAB /tmp            tmp      nullfs          rw                      0       0
+FSTAB /home           home     nullfs          rw                      0       0
+
+CMD mkdir etc/apt/apt.conf.d/00aptitude
+CMD echo "APT::Cache-Start 251658240;" > etc/apt/apt.conf.d/00aptitude