From 3dc2db84b00ce7301514216eca33177d314f1c4d Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Sat, 21 Nov 2020 00:33:06 -0400
Subject: [PATCH 1/3] Upgrade thick jails from bastille

---
 usr/local/share/bastille/upgrade.sh | 81 ++++++++++++++++++++++++++---
 1 file changed, 73 insertions(+), 8 deletions(-)

diff --git a/usr/local/share/bastille/upgrade.sh b/usr/local/share/bastille/upgrade.sh
index 7583b247..3febd58f 100644
--- a/usr/local/share/bastille/upgrade.sh
+++ b/usr/local/share/bastille/upgrade.sh
@@ -32,7 +32,7 @@
 . /usr/local/etc/bastille/bastille.conf
 
 usage() {
-    error_exit "Usage: bastille upgrade release newrelease"
+    error_exit "Usage: bastille upgrade release newrelease | target newrelease | target install | [option]"
 }
 
 # Handle special-case commands first.
@@ -42,20 +42,85 @@ help|-h|--help)
     ;;
 esac
 
-if [ $# -gt 2 ] || [ $# -lt 2 ]; then
+if [ $# -gt 3 ] || [ $# -lt 2 ]; then
     usage
 fi
 
-RELEASE="$1"
-shift
-NEWRELEASE="$1"
+TARGET="$1"
+NEWRELEASE="$2"
+OPTION="$3"
+
+# Check for unsupported actions
+if [ "${TARGET}" = "ALL" ]; then
+    error_exit "Batch upgrade is unsupported."
+fi
 
 if freebsd-version | grep -qi HBSD; then
     error_exit "Not yet supported on HardenedBSD."
 fi
 
-if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
-    freebsd-update -b "${bastille_releasesdir}/${RELEASE}" -r "${NEWRELEASE}" upgrade
+# Handle options
+case "${OPTION}" in
+    -f|--force)
+        OPTION="-F"
+        ;;
+    *)
+        OPTION=
+        ;;
+esac
+
+jail_check() {
+    # Check if the jail is thick and is running
+    if [ ! "$(jls name | awk "/^${TARGET}$/")" ]; then
+        error_exit "[${TARGET}]: Not started. See 'bastille start ${TARGET}'."
+    else
+        if cat "${bastille_jailsdir}/${TARGET}/fstab" 2>/dev/null | grep -w "${TARGET}" | grep -qw "/.*/.bastille"; then
+            error_exit "${TARGET} is not a thick container."
+        fi
+    fi
+}
+
+release_upgrade() {
+    # Upgrade a release
+    if [ -d "${bastille_releasesdir}/${TARGET}" ]; then
+        if echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
+            freebsd-update ${OPTION} -b "${bastille_releasesdir}/${TARGET}" -r "${NEWRELEASE}" upgrade
+        else
+            error_exit "${NEWRELEASE} is not a valid release."
+        fi
+    else
+        error_exit "${TARGET} not found. See 'bastille bootstrap'."
+    fi
+}
+
+jail_upgrade() {
+    # Upgrade a thick container
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        jail_check
+        CURRENT_VERSION=$(jexec -l ${TARGET} freebsd-version)
+        env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_jailsdir}/${TARGET}/root" --currently-running "${CURRENT_VERSION}" -r ${NEWRELEASE} upgrade
+        echo
+        echo -e "${COLOR_YELLOW}Please run 'bastille upgrade ${TARGET} install' to finish installing updates.${COLOR_RESET}"
+    else
+        error_exit "${TARGET} not found. See 'bastille bootstrap'."
+    fi
+}
+
+jail_updates_install() {
+    # Finish installing upgrade on a thick container
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then 
+        jail_check
+        env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_jailsdir}/${TARGET}/root" install
+    else
+        error_exit "${TARGET} not found. See 'bastille bootstrap'."
+    fi
+}
+
+# Check what we should upgrade
+if echo "${TARGET}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
+    release_upgrade
+elif [ "${NEWRELEASE}" = "install" ]; then
+    jail_updates_install
 else
-    error_exit "${RELEASE} not found. See 'bastille bootstrap'."
+    jail_upgrade
 fi

From 52643c7e07fd31f57fa71a4eebd49508623b53fb Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Sun, 22 Nov 2020 20:01:14 -0400
Subject: [PATCH 2/3] Add upgrade release validation

---
 usr/local/share/bastille/upgrade.sh | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/usr/local/share/bastille/upgrade.sh b/usr/local/share/bastille/upgrade.sh
index 3febd58f..56b32a01 100644
--- a/usr/local/share/bastille/upgrade.sh
+++ b/usr/local/share/bastille/upgrade.sh
@@ -80,14 +80,18 @@ jail_check() {
     fi
 }
 
+release_check() {
+    # Validate the release
+    if ! echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
+        error_exit "${NEWRELEASE} is not a valid release."
+    fi
+}
+
 release_upgrade() {
     # Upgrade a release
     if [ -d "${bastille_releasesdir}/${TARGET}" ]; then
-        if echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
-            freebsd-update ${OPTION} -b "${bastille_releasesdir}/${TARGET}" -r "${NEWRELEASE}" upgrade
-        else
-            error_exit "${NEWRELEASE} is not a valid release."
-        fi
+        release_check
+        freebsd-update ${OPTION} -b "${bastille_releasesdir}/${TARGET}" -r "${NEWRELEASE}" upgrade
     else
         error_exit "${TARGET} not found. See 'bastille bootstrap'."
     fi
@@ -97,6 +101,7 @@ jail_upgrade() {
     # Upgrade a thick container
     if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
         jail_check
+        release_check
         CURRENT_VERSION=$(jexec -l ${TARGET} freebsd-version)
         env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_jailsdir}/${TARGET}/root" --currently-running "${CURRENT_VERSION}" -r ${NEWRELEASE} upgrade
         echo

From dd9e55bb9b403193181b105813a3008ddf8275fe Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Tue, 24 Nov 2020 08:38:49 -0400
Subject: [PATCH 3/3] Update command enhancement and code improvements

---
 usr/local/share/bastille/update.sh  | 73 ++++++++++++++++++++---------
 usr/local/share/bastille/upgrade.sh |  2 +-
 2 files changed, 53 insertions(+), 22 deletions(-)

diff --git a/usr/local/share/bastille/update.sh b/usr/local/share/bastille/update.sh
index 34e3c641..d6a00ac3 100644
--- a/usr/local/share/bastille/update.sh
+++ b/usr/local/share/bastille/update.sh
@@ -42,41 +42,72 @@ help|-h|--help)
     ;;
 esac
 
-if [ $# -gt 1 ] || [ $# -lt 1 ]; then
+if [ $# -gt 2 ] || [ $# -lt 1 ]; then
     usage
 fi
 
 TARGET="${1}"
-shift
+OPTION="${2}"
+
+# Handle options
+case "${OPTION}" in
+    -f|--force)
+        OPTION="-F"
+        ;;
+    *)
+        OPTION=
+        ;;
+esac
+
+# Check for unsupported actions
+if [ "${TARGET}" = "ALL" ]; then
+    error_exit "Batch upgrade is unsupported."
+fi
 
 if freebsd-version | grep -qi HBSD; then
     error_exit "Not yet supported on HardenedBSD."
 fi
 
-if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
-    if ! grep -qw ".bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
-            if [ "$(jls name | awk "/^${TARGET}$/")" ]; then
-                # Update a thick container.
-                CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
-                if [ -z "${CURRENT_VERSION}" ]; then
-                    error_exit "Can't determine '${TARGET}' version."
-                else
-                    env PAGER="/bin/cat" freebsd-update --not-running-from-cron -b "${bastille_jailsdir}/${TARGET}/root" \
-                    fetch install --currently-running "${CURRENT_VERSION}"
-                fi
-            else
-                error_notify "${TARGET} is not running."
-                error_exit "See 'bastille start ${TARGET}'."
-            fi
+jail_check() {
+    # Check if the jail is thick and is running
+    if [ ! "$(jls name | awk "/^${TARGET}$/")" ]; then
+        error_exit "[${TARGET}]: Not started. See 'bastille start ${TARGET}'."
     else
-        error_exit "${TARGET} is not a thick container."
+        if grep -qw "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
+            error_exit "${TARGET} is not a thick container."
+        fi
     fi
-else
+}
+
+jail_update() {
+    # Update a thick container
+    if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
+        jail_check    
+        CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
+        if [ -z "${CURRENT_VERSION}" ]; then
+            error_exit "Can't determine '${TARGET}' version."
+        else
+            env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_jailsdir}/${TARGET}/root" \
+            fetch install --currently-running "${CURRENT_VERSION}"
+        fi
+    else
+        error_exit "${TARGET} not found. See 'bastille bootstrap'."
+    fi
+}
+
+release_update() {
+    # Update a release base(affects child containers)
     if [ -d "${bastille_releasesdir}/${TARGET}" ]; then
-        # Update container base(affects child containers).
-        env PAGER="/bin/cat" freebsd-update --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
+        env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
         fetch install --currently-running "${TARGET}"
     else
         error_exit "${TARGET} not found. See 'bastille bootstrap'."
     fi
+}
+
+# Check what we should update
+if echo "${TARGET}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
+    release_update
+else
+    jail_update
 fi
diff --git a/usr/local/share/bastille/upgrade.sh b/usr/local/share/bastille/upgrade.sh
index 56b32a01..dbd0ee9b 100644
--- a/usr/local/share/bastille/upgrade.sh
+++ b/usr/local/share/bastille/upgrade.sh
@@ -74,7 +74,7 @@ jail_check() {
     if [ ! "$(jls name | awk "/^${TARGET}$/")" ]; then
         error_exit "[${TARGET}]: Not started. See 'bastille start ${TARGET}'."
     else
-        if cat "${bastille_jailsdir}/${TARGET}/fstab" 2>/dev/null | grep -w "${TARGET}" | grep -qw "/.*/.bastille"; then
+        if grep -qw "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
             error_exit "${TARGET} is not a thick container."
         fi
     fi