mirror of
https://github.com/hackacad/bastille.git
synced 2026-03-25 10:14:59 +01:00
imporve hbsd support
This commit is contained in:
tschettervictor
@@ -33,7 +33,8 @@
|
||||
. /usr/local/share/bastille/common.sh
|
||||
|
||||
usage() {
|
||||
error_notify "Usage: bastille bootstrap [option(s)] RELEASE|TEMPLATE [update|arch]"
|
||||
error_notify "Usage: bastille bootstrap [option(s)] RELEASE [update|arch]"
|
||||
error_notify " TEMPLATE"
|
||||
cat << EOF
|
||||
|
||||
Options:
|
||||
@@ -45,50 +46,6 @@ EOF
|
||||
exit 1
|
||||
}
|
||||
|
||||
validate_release() {
|
||||
|
||||
MAJOR_VERSION=$(echo ${RELEASE} | grep -Eo '^[0-9]+')
|
||||
MINOR_VERSION=$(echo ${RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
|
||||
if [ "${PKGBASE}" -eq 1 ] && [ "${MAJOR_VERSION}" -le 14 ]; then
|
||||
error_exit "[ERROR]: Pkgbase is not supported for release: ${RELEASE}"
|
||||
fi
|
||||
|
||||
if [ "${MAJOR_VERSION}" -ge 16 ]; then
|
||||
PKGBASE=1
|
||||
fi
|
||||
|
||||
if [ "${PLATFORM_OS}" != "FreeBSD" ] && [ "${PKGBASE}" -eq 1 ]; then
|
||||
error_exit "[ERROR]: Pkgbase can only be used with FreeBSD releases."
|
||||
fi
|
||||
|
||||
info "\nBootstrapping release: ${RELEASE}..."
|
||||
|
||||
## check upstream url, else warn user
|
||||
if [ -n "${NAME_VERIFY}" ]; then
|
||||
# Alternate RELEASE/ARCH fetch support
|
||||
if [ "${OPTION}" = "--i386" ] || [ "${OPTION}" = "--32bit" ]; then
|
||||
ARCH="i386"
|
||||
RELEASE="${RELEASE}-${ARCH}"
|
||||
fi
|
||||
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
info "\nUsing PkgBase..."
|
||||
bootstrap_directories
|
||||
bootstrap_pkgbase_release
|
||||
elif [ "${PKGBASE}" -eq 0 ]; then
|
||||
info "\nFetching ${PLATFORM_OS} distfiles..."
|
||||
if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then
|
||||
error_exit "Unable to fetch MANIFEST. See 'bootstrap urls'."
|
||||
fi
|
||||
bootstrap_directories
|
||||
bootstrap_release
|
||||
fi
|
||||
else
|
||||
usage
|
||||
fi
|
||||
}
|
||||
|
||||
bootstrap_directories() {
|
||||
|
||||
# Ensure required directories are in place
|
||||
@@ -210,254 +167,264 @@ bootstrap_directories() {
|
||||
fi
|
||||
}
|
||||
|
||||
bootstrap_pkgbase_release() {
|
||||
cleanup_directories() {
|
||||
|
||||
local abi="${PLATFORM_OS}:${MAJOR_VERSION}:${HW_MACHINE_ARCH}"
|
||||
local fingerprints="${bastille_releasesdir}/${RELEASE}/usr/share/keys/pkg"
|
||||
local host_fingerprintsdir="/usr/share/keys/pkg"
|
||||
local release_fingerprintsdir="${bastille_releasesdir}/${RELEASE}/usr/share/keys"
|
||||
if [ "${FREEBSD_BRANCH}" = "release" ]; then
|
||||
local repo_name="FreeBSD-base-release-${MINOR_VERSION}"
|
||||
elif [ "${FREEBSD_BRANCH}" = "current" ]; then
|
||||
local repo_name="FreeBSD-base-latest"
|
||||
fi
|
||||
local repo_dir="${bastille_sharedir}/pkgbase"
|
||||
|
||||
## If release exists quit, else bootstrap additional packages
|
||||
if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
|
||||
|
||||
## check pkgbase package list and skip existing sets
|
||||
bastille_pkgbase_packages=$(echo "${bastille_pkgbase_packages}" | sed "s/base-jail//")
|
||||
|
||||
## check if release already bootstrapped, else continue bootstrapping
|
||||
if [ -z "${bastille_pkgbase_packages}" ]; then
|
||||
info "\nBootstrap appears complete!"
|
||||
exit 0
|
||||
else
|
||||
info "\nFetching additional packages..."
|
||||
fi
|
||||
fi
|
||||
|
||||
# Copy fingerprints into releasedir
|
||||
if ! mkdir -p "${release_fingerprintsdir}"; then
|
||||
error_exit "[ERROR]: Faild to create fingerprints directory."
|
||||
fi
|
||||
if ! cp -a "${host_fingerprintsdir}" "${release_fingerprintsdir}"; then
|
||||
error_exit "[ERROR]: Failed to copy fingerprints directory."
|
||||
fi
|
||||
|
||||
# Ensure repo is up to date
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \
|
||||
--repo-conf-dir="${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
update -r "${repo_name}"; then
|
||||
error_notify "[ERROR]: Failed to update repository: ${repo_name}"
|
||||
fi
|
||||
|
||||
# Reset ERROR_COUNT
|
||||
ERROR_COUNT="0"
|
||||
|
||||
for package in ${bastille_pkgbase_packages}; do
|
||||
|
||||
# Check if package set is already installed
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" info "FreeBSD-set-${package}" 2>/dev/null; then
|
||||
# Install package set
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \
|
||||
--repo-conf-dir="${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
install -r "${repo_name}" \
|
||||
FreeBSD-set-"${package}"; then
|
||||
|
||||
ERROR_COUNT=$((ERROR_COUNT + 1))
|
||||
# Cleanup on failed bootstrap
|
||||
if checkyesno bastille_zfs_enable; then
|
||||
if [ -n "${bastille_zfs_zpool}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool:?}/${bastille_zfs_prefix:?}/cache/${RELEASE}"
|
||||
fi
|
||||
else
|
||||
error_continue "[ERROR]: Package set already installed: ${package}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Cleanup if failed
|
||||
if [ "${ERROR_COUNT}" -ne "0" ]; then
|
||||
## perform cleanup only for stale/empty directories on failure
|
||||
if checkyesno bastille_zfs_enable; then
|
||||
if [ -n "${bastille_zfs_zpool}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
|
||||
fi
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool:?}/${bastille_zfs_prefix:?}/releases/${RELEASE}"
|
||||
fi
|
||||
elif [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
fi
|
||||
elif [ -d "${bastille_cachedir}/${RELEASE}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
|
||||
rm -rf "${bastille_cachedir:?}/${RELEASE}"
|
||||
fi
|
||||
if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
|
||||
rm -rf "${bastille_releasesdir:?}/${RELEASE}"
|
||||
fi
|
||||
fi
|
||||
error_exit "[ERROR]: Bootstrap failed."
|
||||
else
|
||||
|
||||
# Silence motd at login
|
||||
touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
|
||||
touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
|
||||
|
||||
# Success
|
||||
info "\nBootstrap successful."
|
||||
echo "See 'bastille --help' for available commands."
|
||||
|
||||
fi
|
||||
}
|
||||
|
||||
bootstrap_release() {
|
||||
validate_release() {
|
||||
|
||||
## if release exists quit, else bootstrap additional distfiles
|
||||
info "\nAttempting to bootstrap ${PLATFORM_OS} release: ${RELEASE}"
|
||||
|
||||
# Set release name to sane release
|
||||
RELEASE="${NAME_VERIFY}"
|
||||
|
||||
### FreeBSD ###
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
MAJOR_VERSION=$(echo ${RELEASE} | grep -Eo '^[0-9]+')
|
||||
MINOR_VERSION=$(echo ${RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
if [ "${MAJOR_VERSION}" -ge 16 ]; then
|
||||
PKGBASE=1
|
||||
elif [ "${MAJOR_VERSION}" -le 14 ] && [ "${PKGBASE}" -eq 1 ]; then
|
||||
error_exit "[ERROR]: Pkgbase is not supported for release: ${RELEASE}"
|
||||
fi
|
||||
### Linux ###
|
||||
elif [ "${PLATFORM_OS}" = "Linux/Debian" ] || [ "${PLATFORM_OS}" = "Linux/Ubuntu" ]; then
|
||||
info "\nEnsuring Linux compatability..."
|
||||
if ! bastille setup -y linux >/dev/null 2>/dev/null; then
|
||||
error_notify "[ERROR]: Failed to configure linux."
|
||||
error_exit "See 'bastille setup linux' for more details."
|
||||
fi
|
||||
fi
|
||||
|
||||
# Validate OPTION
|
||||
if [ -n "${OPTION}" ]; then
|
||||
# Alternate RELEASE/ARCH fetch support
|
||||
if [ "${OPTION}" = "--i386" ] || [ "${OPTION}" = "--32bit" ]; then
|
||||
ARCH="i386"
|
||||
RELEASE="${RELEASE}-${ARCH}"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
bootstrap_release_legacy() {
|
||||
|
||||
errors=0
|
||||
|
||||
# Verify release URL
|
||||
if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then
|
||||
errors=$((errors + 1))
|
||||
error_return 1 "Unable to fetch MANIFEST. See 'bootstrap urls'."
|
||||
fi
|
||||
|
||||
# Validate already installed archives
|
||||
if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
|
||||
## check distfiles list and skip existing cached files
|
||||
bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/base//")
|
||||
# TODO check how to handle this
|
||||
# shellcheck disable=SC2010
|
||||
bastille_cached_files=$(ls "${bastille_cachedir}/${RELEASE}" | grep -v "MANIFEST" | tr -d ".txz")
|
||||
for distfile in ${bastille_cached_files}; do
|
||||
bastille_bootstrap_archives=$(echo "${bastille_bootstrap_archives}" | sed "s/${distfile}//")
|
||||
done
|
||||
|
||||
## check if release already bootstrapped, else continue bootstrapping
|
||||
if [ -z "${bastille_bootstrap_archives}" ]; then
|
||||
info "\nBootstrap appears complete!\n"
|
||||
exit 0
|
||||
else
|
||||
info "\nFetching additional distfiles..."
|
||||
fi
|
||||
fi
|
||||
|
||||
for _archive in ${bastille_bootstrap_archives}; do
|
||||
## check if the dist files already exists then extract
|
||||
FETCH_VALIDATION="0"
|
||||
if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
|
||||
info "\nExtracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz..."
|
||||
if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
|
||||
## silence motd at container login
|
||||
touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
|
||||
touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
|
||||
else
|
||||
error_exit "[ERROR]: Failed to extract ${_archive}.txz."
|
||||
# Bootstrap archives
|
||||
for archive in ${bastille_bootstrap_archives}; do
|
||||
if [ -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then
|
||||
info "\nExtracting ${PLATFORM_OS} archive: ${archive}.txz"
|
||||
if ! /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${archive}.txz"; then
|
||||
errors=$((errors + 1))
|
||||
error_continue "[ERROR]: Failed to extract archive: ${archive}.txz."
|
||||
fi
|
||||
else
|
||||
## get the manifest for dist files checksum validation
|
||||
# Fetch MANIFEST
|
||||
if [ ! -f "${bastille_cachedir}/${RELEASE}/MANIFEST" ]; then
|
||||
fetch "${UPSTREAM_URL}/MANIFEST" -o "${bastille_cachedir}/${RELEASE}/MANIFEST" || FETCH_VALIDATION="1"
|
||||
info "\nFetching MANIFEST..."
|
||||
if ! fetch "${UPSTREAM_URL}/MANIFEST" -o "${bastille_cachedir}/${RELEASE}/MANIFEST"; then
|
||||
errors=$((errors + 1))
|
||||
error_continue "[ERROR]: Failed to fetch MANIFEST."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "${FETCH_VALIDATION}" -ne "0" ]; then
|
||||
## perform cleanup only for stale/empty directories on failure
|
||||
if checkyesno bastille_zfs_enable; then
|
||||
if [ -n "${bastille_zfs_zpool}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
|
||||
fi
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
if [ -d "${bastille_cachedir}/${RELEASE}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
|
||||
rm -rf "${bastille_cachedir:?}/${RELEASE}"
|
||||
fi
|
||||
fi
|
||||
if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${RELEASE}")" ]; then
|
||||
rm -rf "${bastille_releasesdir:?}/${RELEASE}"
|
||||
fi
|
||||
fi
|
||||
error_exit "[ERROR]: Bootstrap failed."
|
||||
# Fetch distfile
|
||||
if [ ! -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then
|
||||
info "\nFetching distfile: ${archive}.txz"
|
||||
if ! fetch "${UPSTREAM_URL}/${archive}.txz" -o "${bastille_cachedir}/${RELEASE}/${archive}.txz"; then
|
||||
errors=$((errors + 1))
|
||||
error_continue "[ERROR]: Failed to fetch archive: ${archive}.txz"
|
||||
fi
|
||||
fi
|
||||
|
||||
## fetch for missing dist files
|
||||
if [ ! -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
|
||||
if ! fetch "${UPSTREAM_URL}/${_archive}.txz" -o "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
|
||||
## alert only if unable to fetch additional dist files
|
||||
error_exit "[ERROR]: Failed to fetch ${_archive}.txz"
|
||||
fi
|
||||
# Validate checksums
|
||||
info "\nValidating checksum for archive: ${archive}.txz"
|
||||
if [ -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then
|
||||
SHA256_DIST=$(grep -w "${archive}.txz" "${bastille_cachedir}/${RELEASE}/MANIFEST" | awk '{print $2}')
|
||||
SHA256_FILE=$(sha256 -q "${bastille_cachedir}/${RELEASE}/${archive}.txz")
|
||||
if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
|
||||
errors=$((errors + 1))
|
||||
error_continue "[ERROR]: Failed to validate archive: ${archive}.txz"
|
||||
else
|
||||
info "\nChecksum validated."
|
||||
echo "MANIFEST: ${SHA256_DIST}"
|
||||
echo "DOWNLOAD: ${SHA256_FILE}"
|
||||
fi
|
||||
fi
|
||||
|
||||
## compare checksums on the fetched dist files
|
||||
if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
|
||||
SHA256_DIST=$(grep -w "${_archive}.txz" "${bastille_cachedir}/${RELEASE}/MANIFEST" | awk '{print $2}')
|
||||
SHA256_FILE=$(sha256 -q "${bastille_cachedir}/${RELEASE}/${_archive}.txz")
|
||||
if [ "${SHA256_FILE}" != "${SHA256_DIST}" ]; then
|
||||
rm "${bastille_cachedir}/${RELEASE}/${_archive}.txz"
|
||||
error_exit "[ERROR]: Failed validation for ${_archive}.txz. Please retry bootstrap!"
|
||||
else
|
||||
info "\nValidated checksum for ${RELEASE}: ${_archive}.txz"
|
||||
echo "MANIFEST: ${SHA256_DIST}"
|
||||
echo "DOWNLOAD: ${SHA256_FILE}"
|
||||
fi
|
||||
fi
|
||||
|
||||
## extract the fetched dist files
|
||||
if [ -f "${bastille_cachedir}/${RELEASE}/${_archive}.txz" ]; then
|
||||
info "\nExtracting ${PLATFORM_OS} ${RELEASE} ${_archive}.txz..."
|
||||
if /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${_archive}.txz"; then
|
||||
## silence motd at container login
|
||||
touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
|
||||
touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
|
||||
else
|
||||
error_exit "[ERROR]: Failed to extract ${_archive}.txz."
|
||||
fi
|
||||
# Extract distfile
|
||||
info "\nExtracting archive: ${archive}.txz..."
|
||||
if [ -f "${bastille_cachedir}/${RELEASE}/${archive}.txz" ]; then
|
||||
if ! /usr/bin/tar -C "${bastille_releasesdir}/${RELEASE}" -xf "${bastille_cachedir}/${RELEASE}/${archive}.txz"; then
|
||||
errors=$((errors + 1))
|
||||
error_continue "[ERROR]: Failed to extract archive: ${archive}.txz."
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
info "\nBootstrap successful."
|
||||
echo "See 'bastille --help' for available commands."
|
||||
# Cleanup on error
|
||||
if [ "${errors}" -ne 0 ]; then
|
||||
return "${errors}"
|
||||
fi
|
||||
|
||||
# Silence motd at container login
|
||||
touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
|
||||
touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
|
||||
}
|
||||
|
||||
debootstrap_release() {
|
||||
bootstrap_release_pkgbase() {
|
||||
|
||||
info "\nEnsuring Linux compatability..."
|
||||
if ! bastille setup -y linux >/dev/null 2>/dev/null; then
|
||||
error_notify "[ERROR]: Failed to configure linux."
|
||||
error_exit "See 'bastille setup linux' for more details."
|
||||
fi
|
||||
errors=0
|
||||
|
||||
# Make sure to check/bootstrap directories first.
|
||||
NOCACHEDIR=1
|
||||
RELEASE="${DIR_BOOTSTRAP}"
|
||||
bootstrap_directories
|
||||
info "\nUsing PkgBase..."
|
||||
|
||||
# Fetch the Linux flavor
|
||||
info "\nFetching ${PLATFORM_OS} distfiles..."
|
||||
if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${LINUX_FLAVOR} "${bastille_releasesdir}"/${DIR_BOOTSTRAP}; then
|
||||
### FreeBSD ###
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
## perform cleanup only for stale/empty directories on failure
|
||||
if checkyesno bastille_zfs_enable; then
|
||||
if [ -n "${bastille_zfs_zpool}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${DIR_BOOTSTRAP}"
|
||||
local abi="${PLATFORM_OS}:${MAJOR_VERSION}:${HW_MACHINE_ARCH}"
|
||||
local fingerprints="${bastille_releasesdir}/${RELEASE}/usr/share/keys/pkg"
|
||||
local host_fingerprintsdir="/usr/share/keys/pkg"
|
||||
local release_fingerprintsdir="${bastille_releasesdir}/${RELEASE}/usr/share/keys"
|
||||
if [ "${FREEBSD_BRANCH}" = "release" ]; then
|
||||
local repo_name="FreeBSD-base-release-${MINOR_VERSION}"
|
||||
elif [ "${FREEBSD_BRANCH}" = "current" ]; then
|
||||
local repo_name="FreeBSD-base-latest"
|
||||
fi
|
||||
local repo_dir="${bastille_sharedir}/pkgbase"
|
||||
|
||||
# Validate COPYRIGHT existence
|
||||
if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
|
||||
# Verify package sets
|
||||
bastille_pkgbase_packages=$(echo "${bastille_pkgbase_packages}" | sed "s/base-jail//")
|
||||
if [ -z "${bastille_pkgbase_packages}" ]; then
|
||||
info "\nBootstrap appears complete!"
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
info "\nInstalling packages..."
|
||||
|
||||
# Copy fingerprints into releasedir
|
||||
if ! mkdir -p "${release_fingerprintsdir}"; then
|
||||
errors=$((errors + 1))
|
||||
error_return 1 "[ERROR]: Faild to create fingerprints directory."
|
||||
fi
|
||||
if ! cp -a "${host_fingerprintsdir}" "${release_fingerprintsdir}"; then
|
||||
errors=$((errors + 1))
|
||||
error_return 1 "[ERROR]: Failed to copy fingerprints directory."
|
||||
fi
|
||||
|
||||
# Update PkgBase repo
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \
|
||||
--repo-conf-dir="${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
update -r "${repo_name}"; then
|
||||
|
||||
errors=$((errors + 1))
|
||||
error_return 1 "[ERROR]: Failed to update repository: ${repo_name}"
|
||||
fi
|
||||
|
||||
for package in ${bastille_pkgbase_packages}; do
|
||||
|
||||
# Check if package set is already installed
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" info "FreeBSD-set-${package}" 2>/dev/null; then
|
||||
# Install package set
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \
|
||||
--repo-conf-dir="${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
install -r "${repo_name}" \
|
||||
FreeBSD-set-"${package}"; then
|
||||
|
||||
errors=$((errors + 1))
|
||||
error_continue "[ERROR]: Failed to install package set: ${package}"
|
||||
fi
|
||||
else
|
||||
info "\nPackage set already installed: ${package}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Cleanup on error
|
||||
if [ "${errors}" -ne 0 ]; then
|
||||
return "${errors}"
|
||||
fi
|
||||
|
||||
if [ -d "${bastille_releasesdir}/${DIR_BOOTSTRAP}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then
|
||||
rm -rf "${bastille_releasesdir:?}/${DIR_BOOTSTRAP}"
|
||||
fi
|
||||
fi
|
||||
error_exit "[ERROR]: Bootstrap failed."
|
||||
# Silence motd at login
|
||||
touch "${bastille_releasesdir}/${RELEASE}/root/.hushlogin"
|
||||
touch "${bastille_releasesdir}/${RELEASE}/usr/share/skel/dot.hushlogin"
|
||||
fi
|
||||
}
|
||||
|
||||
case "${LINUX_FLAVOR}" in
|
||||
bionic|focal|jammy|buster|bullseye|bookworm|noble)
|
||||
info "Increasing APT::Cache-Start"
|
||||
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${DIR_BOOTSTRAP}/etc/apt/apt.conf.d/00aptitude
|
||||
;;
|
||||
esac
|
||||
bootstrap_release_linux() {
|
||||
|
||||
info "\nBootstrap successful."
|
||||
info "\nSee 'bastille --help' for available commands."
|
||||
errors=0
|
||||
|
||||
if [ "${PLATFORM_OS}" = "Linux/Debian" ] || [ "${PLATFORM_OS}" = "Linux/Ubuntu" ]; then
|
||||
# Fetch the Linux flavor
|
||||
if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${LINUX_FLAVOR} "${bastille_releasesdir}"/${DIR_BOOTSTRAP}; then
|
||||
errors=$((errors +1))
|
||||
error_return 1 "[ERROR]: Failed to fetch Linux release: ${LINUX_FLAVOR}"
|
||||
fi
|
||||
|
||||
# Cleanup on error
|
||||
if [ "${errors}" -ne 0 ]; then
|
||||
return "${errors}"
|
||||
fi
|
||||
|
||||
# Set necessary settings
|
||||
case "${LINUX_FLAVOR}" in
|
||||
bionic|focal|jammy|buster|bullseye|bookworm|noble)
|
||||
info "Increasing APT::Cache-Start"
|
||||
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${DIR_BOOTSTRAP}/etc/apt/apt.conf.d/00aptitude
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
bootstrap_template() {
|
||||
@@ -550,13 +517,13 @@ done
|
||||
|
||||
RELEASE="${1}"
|
||||
OPTION="${2}"
|
||||
NOCACHEDIR=
|
||||
NOCACHEDIR=""
|
||||
HW_MACHINE=$(sysctl hw.machine | awk '{ print $2 }')
|
||||
HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }')
|
||||
|
||||
bastille_root_check
|
||||
|
||||
#Validate if ZFS is enabled in rc.conf and bastille.conf.
|
||||
# Validate if ZFS is enabled in rc.conf and bastille.conf.
|
||||
if [ "$(sysrc -n zfs_enable)" = "YES" ] && ! checkyesno bastille_zfs_enable; then
|
||||
warn "ZFS is enabled in rc.conf but not bastille.conf. Do you want to continue? (N|y)"
|
||||
read answer
|
||||
@@ -614,70 +581,43 @@ fi
|
||||
## Filter sane release names
|
||||
case "${RELEASE}" in
|
||||
[2-4].[0-9]*)
|
||||
## check for MidnightBSD releases name
|
||||
### MidnightBSD ###
|
||||
PLATFORM_OS="MidnightBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}")
|
||||
UPSTREAM_URL="${bastille_url_midnightbsd}${HW_MACHINE_ARCH}/${NAME_VERIFY}"
|
||||
PLATFORM_OS="MidnightBSD"
|
||||
validate_release
|
||||
;;
|
||||
*-CURRENT|*-current)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]')
|
||||
UPSTREAM_URL=$(echo "${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" | sed 's/releases/snapshots/')
|
||||
*-current|*-CURRENT)
|
||||
### FreeBSD ###
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]')
|
||||
UPSTREAM_URL=$(echo "${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" | sed 's/releases/snapshots/')
|
||||
FREEBSD_BRANCH="current"
|
||||
;;
|
||||
*\.*-stable|*\.*-STABLE)
|
||||
### FreeBSD ###
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]')
|
||||
UPSTREAM_URL=$(echo "${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}" | sed 's/releases/snapshots/')
|
||||
FREEBSD_BRANCH="current"
|
||||
validate_release
|
||||
;;
|
||||
*-RELEASE|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([0-9]{1,2})\.[0-9](-RELEASE|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]')
|
||||
UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}"
|
||||
### FreeBSD ###
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([0-9]+)\.[0-9](-RELEASE|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]')
|
||||
UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}"
|
||||
FREEBSD_BRANCH="release"
|
||||
validate_release
|
||||
;;
|
||||
*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
|
||||
## check for HardenedBSD releases name(previous infrastructure, keep for reference)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-${NAME_VERIFY}"
|
||||
current|CURRENT)
|
||||
### HardenedBSD ###
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
validate_release
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | sed 's/CURRENT/current/g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_VERIFY}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/LATEST"
|
||||
;;
|
||||
*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
|
||||
## check for HardenedBSD(specific stable build releases)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
|
||||
NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-build-[0-9]\{1,3\}//g')
|
||||
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
|
||||
[1-9]*-stable|[1-9]*-STABLE)
|
||||
### HardenedBSD ###
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
validate_release
|
||||
;;
|
||||
*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
|
||||
## check for HardenedBSD(latest stable build release)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
|
||||
NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-BUILD-LATEST//g')
|
||||
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-BUILD-//g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}"
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
validate_release
|
||||
;;
|
||||
current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
|
||||
## check for HardenedBSD(specific current build releases)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
|
||||
NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
|
||||
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
validate_release
|
||||
;;
|
||||
current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
|
||||
## check for HardenedBSD(latest current build release)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
|
||||
NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
|
||||
NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-BUILD-//g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}"
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
validate_release
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)(-stable)$' | sed 's/STABLE/stable/g')
|
||||
UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_VERIFY}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/LATEST"
|
||||
;;
|
||||
http?://*/*/*)
|
||||
BASTILLE_TEMPLATE_URL=${1}
|
||||
@@ -692,65 +632,94 @@ case "${RELEASE}" in
|
||||
BASTILLE_TEMPLATE_REPO=$(echo "${git_repository}" | awk -F / '{ print $2 }')
|
||||
bootstrap_template
|
||||
;;
|
||||
#adding Ubuntu Bionic as valid "RELEASE" for POC @hackacad
|
||||
ubuntu_bionic|bionic|ubuntu-bionic)
|
||||
PLATFORM_OS="Ubuntu/Linux"
|
||||
LINUX_FLAVOR="bionic"
|
||||
DIR_BOOTSTRAP="Ubuntu_1804"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
ubuntu_focal|focal|ubuntu-focal)
|
||||
PLATFORM_OS="Ubuntu/Linux"
|
||||
LINUX_FLAVOR="focal"
|
||||
DIR_BOOTSTRAP="Ubuntu_2004"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
ubuntu_jammy|jammy|ubuntu-jammy)
|
||||
PLATFORM_OS="Ubuntu/Linux"
|
||||
LINUX_FLAVOR="jammy"
|
||||
DIR_BOOTSTRAP="Ubuntu_2204"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
ubuntu_noble|noble|ubuntu-noble)
|
||||
PLATFORM_OS="Ubuntu/Linux"
|
||||
LINUX_FLAVOR="noble"
|
||||
DIR_BOOTSTRAP="Ubuntu_2404"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
debian_buster|buster|debian-buster)
|
||||
PLATFORM_OS="Debian/Linux"
|
||||
LINUX_FLAVOR="buster"
|
||||
DIR_BOOTSTRAP="Debian10"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
debian_bullseye|bullseye|debian-bullseye)
|
||||
PLATFORM_OS="Debian/Linux"
|
||||
LINUX_FLAVOR="bullseye"
|
||||
DIR_BOOTSTRAP="Debian11"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
debian_bookworm|bookworm|debian-bookworm)
|
||||
PLATFORM_OS="Debian/Linux"
|
||||
LINUX_FLAVOR="bookworm"
|
||||
DIR_BOOTSTRAP="Debian12"
|
||||
ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
|
||||
debootstrap_release
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "${PKGBASE}" -eq 0 ]; then
|
||||
case "${OPTION}" in
|
||||
update)
|
||||
bastille update "${RELEASE}"
|
||||
;;
|
||||
esac
|
||||
# Verify PLATFORM_OS and bootstrap
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
validate_release
|
||||
bootstrap_directories
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
bootstrap_release_pkgbase || cleanup_directories
|
||||
else
|
||||
bootstrap_release_legacy || cleanup_directories
|
||||
fi
|
||||
elif [ "${PLATFORM_OS}" = "HardenedBSD" ]; then
|
||||
validate_release
|
||||
bootstrap_directories
|
||||
bootstrap_release_legacy || cleanup_directories
|
||||
elif [ "${PLATFORM_OS}" = "MidnightBSD" ]; then
|
||||
validate_release
|
||||
bootstrap_directories
|
||||
bootstrap_release_legacy || cleanup_directories
|
||||
elif [ "${PLATFORM_OS}" = "Ubuntu/Linux" ] || [ "${PLATFORM_OS}" = "Debian/Linux" ]; then
|
||||
NOCACHEDIR=1
|
||||
RELEASE="${DIR_BOOTSTRAP}"
|
||||
bootstrap_directories
|
||||
bootstrap_release_linux || cleanup_directories
|
||||
else
|
||||
error_exit "[ERROR]: Unsupported platform."
|
||||
fi
|
||||
|
||||
# Check for errors
|
||||
if [ "${errors}" -eq 0 ]; then
|
||||
# Check for OPTION=update
|
||||
if [ "${PKGBASE}" -eq 0 ]; then
|
||||
case "${OPTION}" in
|
||||
update)
|
||||
bastille update "${RELEASE}"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Success
|
||||
info "\nBootstrap successful."
|
||||
echo "See 'bastille --help' for available commands."
|
||||
echo
|
||||
else
|
||||
error_exit "[ERROR]: Bootstrap failed!"
|
||||
fi
|
||||
@@ -67,6 +67,10 @@ validate_name() {
|
||||
local NAME_VERIFY=${NAME}
|
||||
local NAME_SANITY="$(echo "${NAME_VERIFY}" | tr -c -d 'a-zA-Z0-9-_')"
|
||||
|
||||
if check_target_exists "${NAME}"; then
|
||||
error_exit "[ERROR]: Jail already exists: ${NAME}"
|
||||
fi
|
||||
|
||||
# Make sure NAME has only allowed characters
|
||||
if [ -n "$(echo "${NAME_SANITY}" | awk "/^[-_].*$/" )" ]; then
|
||||
error_exit "[ERROR]: Jail names may not begin with (-|_) characters!"
|
||||
@@ -79,32 +83,60 @@ validate_name() {
|
||||
fi
|
||||
}
|
||||
|
||||
validate_release() {
|
||||
|
||||
# Validate sane release name
|
||||
if [ -n "${NAME_VERIFY}" ]; then
|
||||
RELEASE="${NAME_VERIFY}"
|
||||
else
|
||||
usage
|
||||
fi
|
||||
|
||||
# Validate Linux releases
|
||||
if [ "${PLATFORM_OS}" = "Ubuntu" ] || [ "${PLATFORM_OS}" = "Debian" ]; then
|
||||
if [ "${LINUX_JAIL}" -eq 0 ]; then
|
||||
error_exit "[ERROR]: Linux releases can only be used with [-l|--linux]"
|
||||
fi
|
||||
elif [ "${PLATFORM_OS}" = "FreeBSD" ] || [ "${PLATFORM_OS}" = "HardenedBSD" ] || [ "${PLATFORM_OS}" = "MidnightBSD" ]; then
|
||||
# Validate release existence
|
||||
if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Release must be bootstrapped first."
|
||||
error_exit "See 'bastille bootstrap'."
|
||||
fi
|
||||
else
|
||||
error_exit "[ERROR]: Unable to validate Platform OS."
|
||||
fi
|
||||
|
||||
# Set OS_RELEASE
|
||||
OS_RELEASE="$( ${bastille_releasesdir}/${RELEASE}/bin/freebsd-version )"
|
||||
}
|
||||
|
||||
validate_ip() {
|
||||
|
||||
local _ip="${1}"
|
||||
local _ip6="$(echo ${_ip} | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$)|SLAAC)')"
|
||||
local ip="${1}"
|
||||
local ip6="$(echo ${ip} | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$)|SLAAC)')"
|
||||
|
||||
if [ -n "${_ip6}" ]; then
|
||||
info "\nValid: (${_ip6})."
|
||||
# This is only used in this function to set IPX_DEFINITION
|
||||
if [ -n "${ip6}" ]; then
|
||||
info "\nValid: (${ip6})."
|
||||
# This is only used in this function to set IPX_DEFINITION
|
||||
local ipx_addr="ip6.addr"
|
||||
else
|
||||
if [ "${_ip}" = "inherit" ] || [ "${_ip}" = "ip_hostname" ]; then
|
||||
if [ "${ip}" = "inherit" ] || [ "${ip}" = "ip_hostname" ]; then
|
||||
if [ "${VNET_JAIL}" -eq 1 ]; then
|
||||
error_exit "[ERROR]: Unsupported IP option for VNET jail: (${_ip})."
|
||||
error_exit "[ERROR]: Unsupported IP option for VNET jail: (${ip})."
|
||||
else
|
||||
info "\nValid: (${_ip})."
|
||||
info "\nValid: (${ip})."
|
||||
fi
|
||||
elif [ "${_ip}" = "DHCP" ] || [ "${_ip}" = "SYNCDHCP" ] || [ "${_ip}" = "0.0.0.0" ]; then
|
||||
elif [ "${ip}" = "DHCP" ] || [ "${ip}" = "SYNCDHCP" ] || [ "${ip}" = "0.0.0.0" ]; then
|
||||
if [ "${VNET_JAIL}" -eq 0 ]; then
|
||||
error_exit "[ERROR]: Unsupported IP option for non-VNET jail: (${_ip})."
|
||||
error_exit "[ERROR]: Unsupported IP option for non-VNET jail: (${ip})."
|
||||
else
|
||||
info "\nValid: (${_ip})."
|
||||
info "\nValid: (${ip})."
|
||||
fi
|
||||
else
|
||||
local IFS
|
||||
if echo "${_ip}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
|
||||
TEST_IP=$(echo "${_ip}" | cut -d / -f1)
|
||||
if echo "${ip}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
|
||||
TEST_IP=$(echo "${ip}" | cut -d / -f1)
|
||||
IFS=.
|
||||
set ${TEST_IP}
|
||||
for quad in 1 2 3 4; do
|
||||
@@ -113,9 +145,9 @@ validate_ip() {
|
||||
fi
|
||||
done
|
||||
ipx_addr="ip4.addr"
|
||||
info "\nValid: (${_ip})."
|
||||
info "\nValid: (${ip})."
|
||||
else
|
||||
error_continue "Invalid: (${_ip})."
|
||||
error_continue "Invalid: (${ip})."
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@@ -139,45 +171,45 @@ validate_ip() {
|
||||
fi
|
||||
|
||||
# Determine IP/Interface mode
|
||||
if [ "${_ip}" = "inherit" ]; then
|
||||
if [ "${ip}" = "inherit" ]; then
|
||||
if [ "${DUAL_STACK}" -eq 1 ]; then
|
||||
IP4_DEFINITION="ip4 = ${_ip};"
|
||||
IP6_DEFINITION="ip6 = ${_ip};"
|
||||
IP4_DEFINITION="ip4 = ${ip};"
|
||||
IP6_DEFINITION="ip6 = ${ip};"
|
||||
IP6_MODE="new"
|
||||
else
|
||||
IP4_DEFINITION="ip4 = ${_ip};"
|
||||
IP4_DEFINITION="ip4 = ${ip};"
|
||||
IP6_DEFINITION=""
|
||||
IP6_MODE="disable"
|
||||
fi
|
||||
elif [ "${_ip}" = "ip_hostname" ]; then
|
||||
elif [ "${ip}" = "ip_hostname" ]; then
|
||||
if [ "${DUAL_STACK}" -eq 1 ]; then
|
||||
IP_HOSTNAME="${_ip}"
|
||||
IP_HOSTNAME="${ip}"
|
||||
IP4_DEFINITION="${IP_HOSTNAME};"
|
||||
IP6_DEFINITION="${IP_HOSTNAME};"
|
||||
IP6_MODE="new"
|
||||
else
|
||||
IP_HOSTNAME="${_ip}"
|
||||
IP_HOSTNAME="${ip}"
|
||||
IP4_DEFINITION="${IP_HOSTNAME};"
|
||||
IP6_DEFINITION=""
|
||||
IP6_MODE="disable"
|
||||
fi
|
||||
elif [ "${_ip}" = "DHCP" ] || [ "${_ip}" = "SLAAC" ] || [ "${_ip}" = "0.0.0.0" ]; then
|
||||
elif [ "${ip}" = "DHCP" ] || [ "${ip}" = "SLAAC" ] || [ "${ip}" = "0.0.0.0" ]; then
|
||||
if [ "${VNET_JAIL}" -eq 1 ]; then
|
||||
if [ "${ipx_addr}" = "ip4.addr" ]; then
|
||||
IP4_ADDR="${_ip}"
|
||||
IP4_ADDR="${ip}"
|
||||
elif [ "${ipx_addr}" = "ip6.addr" ]; then
|
||||
IP6_ADDR="${_ip}"
|
||||
IP6_ADDR="${ip}"
|
||||
fi
|
||||
else
|
||||
error_exit "[ERROR]: Unsupported IP option for standard jail: (${_ip})."
|
||||
error_exit "[ERROR]: Unsupported IP option for standard jail: (${ip})."
|
||||
fi
|
||||
else
|
||||
if [ "${ipx_addr}" = "ip4.addr" ]; then
|
||||
IP4_ADDR="${_ip}"
|
||||
IP4_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${_ip};"
|
||||
IP4_ADDR="${ip}"
|
||||
IP4_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${ip};"
|
||||
elif [ "${ipx_addr}" = "ip6.addr" ]; then
|
||||
IP6_ADDR="${_ip}"
|
||||
IP6_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${_ip};"
|
||||
IP6_ADDR="${ip}"
|
||||
IP6_DEFINITION="${ipx_addr} = ${bastille_jail_conf_interface}|${ip};"
|
||||
IP6_MODE="new"
|
||||
fi
|
||||
fi
|
||||
@@ -221,23 +253,6 @@ validate_netif() {
|
||||
fi
|
||||
}
|
||||
|
||||
validate_release() {
|
||||
|
||||
## ensure the user set the Linux(experimental) option explicitly
|
||||
if [ -n "${UBUNTU}" ]; then
|
||||
if [ "${LINUX_JAIL}" -eq 0 ]; then
|
||||
usage
|
||||
fi
|
||||
fi
|
||||
|
||||
## check release name match, else show usage
|
||||
if [ -n "${NAME_VERIFY}" ]; then
|
||||
RELEASE="${NAME_VERIFY}"
|
||||
else
|
||||
usage
|
||||
fi
|
||||
}
|
||||
|
||||
generate_minimal_conf() {
|
||||
|
||||
cat << EOF > "${bastille_jail_conf}"
|
||||
@@ -270,7 +285,7 @@ ${NAME} {
|
||||
mount.fstab = ${bastille_jail_fstab};
|
||||
path = ${bastille_jail_path};
|
||||
securelevel = 2;
|
||||
osrelease = ${RELEASE};
|
||||
osrelease = ${OS_RELEASE};
|
||||
|
||||
${IP4_DEFINITION}
|
||||
${IP6_DEFINITION}
|
||||
@@ -326,7 +341,7 @@ ${NAME} {
|
||||
mount.fstab = ${bastille_jail_fstab};
|
||||
path = ${bastille_jail_path};
|
||||
securelevel = 2;
|
||||
osrelease = ${RELEASE};
|
||||
osrelease = ${OS_RELEASE};
|
||||
|
||||
${NETBLOCK}
|
||||
}
|
||||
@@ -651,77 +666,77 @@ create_jail() {
|
||||
|
||||
# Retrieve epair name from jail.conf
|
||||
uniq_epair=$(grep vnet.interface "${bastille_jailsdir}/${NAME}/jail.conf" | awk '{print $3}' | sed 's/;//; s/-/_/g')
|
||||
_gateway=''
|
||||
_gateway6=''
|
||||
_ifconfig_inet=''
|
||||
_ifconfig_inet6=''
|
||||
gateway=''
|
||||
gateway6=''
|
||||
ifconfig_inet=''
|
||||
ifconfig_inet6=''
|
||||
|
||||
# Check for DHCP
|
||||
if echo "${IP}" | grep -qE '(0[.]0[.]0[.]0|DHCP|SYNCDHCP)'; then
|
||||
_ifconfig_inet="SYNCDHCP"
|
||||
ifconfig_inet="SYNCDHCP"
|
||||
else
|
||||
# Set Gateway
|
||||
if [ -n "${OPT_GATEWAY}" ]; then
|
||||
_gateway="${OPT_GATEWAY}"
|
||||
elif [ -n "${bastille_network_gateway}" ]; then
|
||||
_gateway="${bastille_network_gateway}"
|
||||
gateway="${bastille_network_gateway}"
|
||||
else
|
||||
_gateway="$(netstat -4rn | awk '/default/ {print $2}')"
|
||||
gateway="$(netstat -4rn | awk '/default/ {print $2}')"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add IPv4 address (this is empty if DHCP is used)
|
||||
if [ -n "${IP4_ADDR}" ]; then
|
||||
_ifconfig_inet="inet ${IP4_ADDR}"
|
||||
ifconfig_inet="inet ${IP4_ADDR}"
|
||||
fi
|
||||
|
||||
# Enable IPv6 if used
|
||||
if [ -n "${IP6_ADDR}" ]; then
|
||||
_ifconfig_inet6='inet6 -ifdisabled'
|
||||
ifconfig_inet6='inet6 -ifdisabled'
|
||||
if echo "${IP}" | grep -qE 'SLAAC'; then
|
||||
# Enable SLAAC if requested
|
||||
_ifconfig_inet6="${_ifconfig_inet6} accept_rtadv"
|
||||
ifconfig_inet6="${ifconfig_inet6} accept_rtadv"
|
||||
else
|
||||
# Set Gateway
|
||||
if [ -n "${bastille_network_gateway6}" ]; then
|
||||
_gateway6="${bastille_network_gateway6}"
|
||||
gateway6="${bastille_network_gateway6}"
|
||||
else
|
||||
_gateway6="$(netstat -6rn | awk '/default/ {print $2}')"
|
||||
gateway6="$(netstat -6rn | awk '/default/ {print $2}')"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add IPv6 address (this is empty if SLAAC is used)
|
||||
if [ -n "${IP6_ADDR}" ]; then
|
||||
_ifconfig_inet6="${_ifconfig_inet6} ${IP6_ADDR}"
|
||||
ifconfig_inet6="${_ifconfig_inet6} ${IP6_ADDR}"
|
||||
fi
|
||||
|
||||
# We need to pass IP4 and IP6 separately
|
||||
_ifconfig="${_ifconfig_inet}"
|
||||
_ifconfig6="${_ifconfig_inet6}"
|
||||
ifconfig="${_ifconfig_inet}"
|
||||
ifconfig6="${_ifconfig_inet6}"
|
||||
|
||||
# Set jail interface description if "if_bridge"
|
||||
if [ "${bastille_network_vnet_type}" = "if_bridge" ]; then
|
||||
# Use interface name as INTERFACE+VNET when PASSTHROUGH is selected
|
||||
# Use default "vnet0" otherwise
|
||||
if [ "${VNET_JAIL_PASSTHROUGH}" -eq 1 ]; then
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}"
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}"
|
||||
else
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg EXT_INTERFACE="${INTERFACE}" --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}"
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg EXT_INTERFACE="${INTERFACE}" --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}"
|
||||
fi
|
||||
elif [ "${bastille_network_vnet_type}" = "netgraph" ]; then
|
||||
# Use interface name as INTERFACE+VNET when PASSTHROUGH is selected
|
||||
# Use default "vnet0" otherwise
|
||||
if [ "${VNET_JAIL_PASSTHROUGH}" -eq 1 ]; then
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}"
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="${INTERFACE}" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}"
|
||||
else
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}" --arg IFCONFIG6="${_ifconfig6}"
|
||||
bastille template "${NAME}" ${bastille_template_vnet} --arg INTERFACE="${uniq_epair}" --arg VNET="vnet0" --arg GATEWAY="${gateway}" --arg GATEWAY6="${gateway6}" --arg IFCONFIG="${ifconfig}" --arg IFCONFIG6="${ifconfig6}"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add VLAN ID if it was given
|
||||
if [ -n "${VLAN_ID}" ]; then
|
||||
bastille template "${NAME}" ${bastille_template_vlan} --arg VLANID="${VLAN_ID}" --arg IFCONFIG="${_ifconfig}"
|
||||
bastille template "${NAME}" ${bastille_template_vlan} --arg VLANID="${VLAN_ID}" --arg IFCONFIG="${ifconfig}"
|
||||
fi
|
||||
|
||||
fi
|
||||
@@ -758,8 +773,8 @@ create_jail() {
|
||||
# Apply nameserver (if set)
|
||||
if [ -n "${OPT_NAMESERVER}" ]; then
|
||||
sed -i '' "/^nameserver.*/d" "${bastille_jail_resolv_conf}"
|
||||
for _ns in $(echo ${OPT_NAMESERVER} | sed 's/,/ /g'); do
|
||||
echo "nameserver ${_ns}" >> "${bastille_jail_resolv_conf}"
|
||||
for ns in $(echo ${OPT_NAMESERVER} | sed 's/,/ /g'); do
|
||||
echo "nameserver ${ns}" >> "${bastille_jail_resolv_conf}"
|
||||
done
|
||||
fi
|
||||
|
||||
@@ -776,13 +791,6 @@ create_jail() {
|
||||
|
||||
bastille_root_check
|
||||
|
||||
if echo "${3}" | grep '@'; then
|
||||
# shellcheck disable=SC2034
|
||||
BASTILLE_JAIL_IP=$(echo "$3" | awk -F@ '{print $2}')
|
||||
# shellcheck disable=SC2034
|
||||
BASTILLE_JAIL_INTERFACES=$( echo "$3" | awk -F@ '{print $1}')
|
||||
fi
|
||||
|
||||
# Handle options.
|
||||
BOOT="on"
|
||||
EMPTY_JAIL=0
|
||||
@@ -1001,128 +1009,89 @@ if { [ "${bastille_network_vnet_type}" = "netgraph" ] && [ "${VNET_INTERFACE_TYP
|
||||
error_exit "[ERROR]: Netgraph does not support the [-B|--bridge] or [-P|--passthrough] option."
|
||||
fi
|
||||
|
||||
if [ "${LINUX_JAIL}" -eq 1 ] && [ "${VALIDATE_RELEASE}" -eq 1 ]; then
|
||||
case "${RELEASE}" in
|
||||
bionic|ubuntu_bionic|ubuntu|ubuntu-bionic)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=ubuntu_bionic
|
||||
;;
|
||||
focal|ubuntu_focal|ubuntu-focal)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=ubuntu_focal
|
||||
;;
|
||||
jammy|ubuntu_jammy|ubuntu-jammy)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=ubuntu_jammy
|
||||
;;
|
||||
debian_buster|buster|debian-buster)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=buster
|
||||
;;
|
||||
debian_bullseye|bullseye|debian-bullseye)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=bullseye
|
||||
;;
|
||||
debian_bookworm|bookworm|debian-bookworm)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=bookworm
|
||||
;;
|
||||
*)
|
||||
error_notify "[ERROR]: Unknown linux release."
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Filter sane release names
|
||||
if [ "${EMPTY_JAIL}" -eq 0 ]; then
|
||||
if [ "${VALIDATE_RELEASE}" -eq 1 ]; then
|
||||
## verify release
|
||||
# Verify release
|
||||
case "${RELEASE}" in
|
||||
[2-4].[0-9]*)
|
||||
## check for MidnightBSD releases name
|
||||
NAME_VERIFY=$(echo "${RELEASE}")
|
||||
validate_release
|
||||
;;
|
||||
*-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current)
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
|
||||
validate_release
|
||||
;;
|
||||
*-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
|
||||
## check for FreeBSD releases name
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
|
||||
validate_release
|
||||
;;
|
||||
*-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
|
||||
## check for HardenedBSD releases name(previous infrastructure)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-last)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
|
||||
validate_release
|
||||
;;
|
||||
*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*)
|
||||
## check for HardenedBSD(specific stable build releases)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
|
||||
validate_release
|
||||
;;
|
||||
*-stable-build-latest|*-stable-BUILD-LATEST|*-STABLE-BUILD-LATEST)
|
||||
## check for HardenedBSD(latest stable build release)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
|
||||
validate_release
|
||||
;;
|
||||
current-build-[0-9]*|CURRENT-BUILD-[0-9]*)
|
||||
## check for HardenedBSD(specific current build releases)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build)-([0-9]{1,3})' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g')
|
||||
validate_release
|
||||
;;
|
||||
current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
|
||||
## check for HardenedBSD(latest current build release)
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_bionic|bionic|ubuntu-bionic)
|
||||
UBUNTU="1"
|
||||
NAME_VERIFY=Ubuntu_1804
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_focal|focal|ubuntu-focal)
|
||||
UBUNTU="1"
|
||||
NAME_VERIFY=Ubuntu_2004
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_jammy|jammy|ubuntu-jammy)
|
||||
UBUNTU="1"
|
||||
NAME_VERIFY=Ubuntu_2204
|
||||
validate_release
|
||||
;;
|
||||
debian_buster|buster|debian-buster)
|
||||
NAME_VERIFY=Debian10
|
||||
validate_release
|
||||
;;
|
||||
debian_bullseye|bullseye|debian-bullseye)
|
||||
NAME_VERIFY=Debian11
|
||||
validate_release
|
||||
;;
|
||||
debian_bookworm|bookworm|debian-bookworm)
|
||||
NAME_VERIFY=Debian12
|
||||
validate_release
|
||||
;;
|
||||
*)
|
||||
error_notify "Unknown Release."
|
||||
usage
|
||||
;;
|
||||
[2-4].[0-9]*)
|
||||
### MidnightBSD ##
|
||||
PLATFORM_OS="MidnightBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}")
|
||||
validate_release
|
||||
;;
|
||||
*-current|*-CURRENT|*-current-I386|*-CURRENT-i386)
|
||||
### FreeBSD ###
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
|
||||
validate_release
|
||||
;;
|
||||
*-release|*-RELEASE|*-release-I386|*-RELEASE-i386|*-rc[1-9]|*-RC[1-9]|*-beta[1-9]|*-BETA[1-9])
|
||||
### FreeBSD ###
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
|
||||
validate_release
|
||||
;;
|
||||
*\.*-stable|*\.*-STABLE)
|
||||
### FreeBSD ###
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]')
|
||||
validate_release
|
||||
;;
|
||||
current|CURRENT)
|
||||
### HardenedBSD ###
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | sed 's/CURRENT/current/g')
|
||||
validate_release
|
||||
;;
|
||||
[1-9]*-stable|[1-9]*-STABLE)
|
||||
### HardenedBSD ###
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | sed 's/STABLE/stable/g')
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_bionic|bionic|ubuntu-bionic)
|
||||
PLATFORM_OS="Ubuntu"
|
||||
NAME_VERIFY=Ubuntu_1804
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_focal|focal|ubuntu-focal)
|
||||
PLATFORM_OS="Ubuntu"
|
||||
NAME_VERIFY=Ubuntu_2004
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_jammy|jammy|ubuntu-jammy)
|
||||
PLATFORM_OS="Ubuntu"
|
||||
NAME_VERIFY=Ubuntu_2204
|
||||
validate_release
|
||||
;;
|
||||
ubuntu_noble|noble|ubuntu-noble)
|
||||
PLATFORM_OS="Ubuntu"
|
||||
NAME_VERIFY=Ubuntu_2404
|
||||
validate_release
|
||||
;;
|
||||
debian_buster|buster|debian-buster)
|
||||
PLATFORM_OS="Debian"
|
||||
NAME_VERIFY=Debian10
|
||||
validate_release
|
||||
;;
|
||||
debian_bullseye|bullseye|debian-bullseye)
|
||||
PLATFORM_OS="Debian"
|
||||
NAME_VERIFY=Debian11
|
||||
validate_release
|
||||
;;
|
||||
debian_bookworm|bookworm|debian-bookworm)
|
||||
PLATFORM_OS="Debian"
|
||||
NAME_VERIFY=Debian12
|
||||
validate_release
|
||||
;;
|
||||
*)
|
||||
error_notify "Unknown release: ${RELEASE}"
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Check for name/root/.bastille
|
||||
if [ -d "${bastille_jailsdir}/${NAME}/root/.bastille" ]; then
|
||||
error_exit "[ERROR]: ${NAME} already exists. ${NAME}/root/.bastille exists."
|
||||
fi
|
||||
|
||||
# Check for required release
|
||||
if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Release must be bootstrapped first."
|
||||
error_exit "See 'bastille bootstrap'."
|
||||
fi
|
||||
|
||||
# Validate IP address
|
||||
if [ -n "${IP}" ]; then
|
||||
validate_ips
|
||||
@@ -1131,14 +1100,14 @@ if [ "${EMPTY_JAIL}" -eq 0 ]; then
|
||||
fi
|
||||
|
||||
# Validate interface
|
||||
# Interface must be set with vnet jails
|
||||
if [ -n "${INTERFACE}" ]; then
|
||||
validate_netif
|
||||
validate_netconf
|
||||
elif [ "${VNET_JAIL}" -eq 1 ]; then
|
||||
if [ -z "${INTERFACE}" ]; then
|
||||
if [ -z "${bastille_network_shared}" ]; then
|
||||
# User must specify interface on vnet jails.
|
||||
error_exit "[ERROR]: Network interface not defined."
|
||||
error_exit "[ERROR]: Network interface not set."
|
||||
else
|
||||
validate_netconf
|
||||
fi
|
||||
@@ -1178,9 +1147,8 @@ fi
|
||||
if [ -z ${bastille_template_vnet+x} ]; then
|
||||
bastille_template_vnet='default/vnet'
|
||||
fi
|
||||
|
||||
if check_target_exists "${NAME}"; then
|
||||
error_exit "[ERROR]: Jail already exists: ${NAME}"
|
||||
if [ -z ${bastille_template_vlan+x} ]; then
|
||||
bastille_template_vnet='default/vlan'
|
||||
fi
|
||||
|
||||
create_jail "${NAME}" "${RELEASE}" "${IP}" "${INTERFACE}"
|
||||
|
||||
@@ -95,9 +95,6 @@ if [ -f "/bin/midnightbsd-version" ]; then
|
||||
error_exit "[ERROR]: Not yet supported on MidnightBSD."
|
||||
fi
|
||||
|
||||
if freebsd-version | grep -qi HBSD; then
|
||||
error_exit "[ERROR]: Not yet supported on HardenedBSD."
|
||||
fi
|
||||
|
||||
jail_check() {
|
||||
|
||||
@@ -119,21 +116,88 @@ jail_check() {
|
||||
error_exit "See 'bastille update RELEASE' to update thin jails."
|
||||
fi
|
||||
|
||||
# Validate update method
|
||||
CURRENT_VERSION="$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)"
|
||||
MINOR_VERSION=$(echo ${CURRENT_VERSION} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
MAJOR_VERSION=$(echo ${CURRENT_VERSION} | grep -Eo '^[0-9]+')
|
||||
if echo "${CURRENT_VERSION}" | grep -oq "\-CURRENT"; then
|
||||
FREEBSD_BRANCH="current"
|
||||
PLATFORM_OS="$( ${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version )"
|
||||
if echo "${PLATFORM_OS}" | grep -q "HBSD"; then
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
else
|
||||
FREEBSD_BRANCH="release"
|
||||
PLATFORM_OS="FreeBSD"
|
||||
fi
|
||||
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
# Validate update method
|
||||
CURRENT_VERSION="$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)"
|
||||
MINOR_VERSION=$(echo ${CURRENT_VERSION} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
MAJOR_VERSION=$(echo ${CURRENT_VERSION} | grep -Eo '^[0-9]+')
|
||||
if echo "${CURRENT_VERSION}" | grep -oq "\-CURRENT"; then
|
||||
FREEBSD_BRANCH="current"
|
||||
else
|
||||
FREEBSD_BRANCH="release"
|
||||
fi
|
||||
if [ -z "${CURRENT_VERSION}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
fi
|
||||
if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_jailsdir}/${TARGET}/root" which /usr/bin/uname > /dev/null 2>&1; then
|
||||
PKGBASE=1
|
||||
fi
|
||||
fi
|
||||
if [ -z "${CURRENT_VERSION}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
fi
|
||||
if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_jailsdir}/${TARGET}/root" which /usr/bin/uname > /dev/null 2>&1; then
|
||||
PKGBASE=1
|
||||
}
|
||||
|
||||
jail_update() {
|
||||
|
||||
# Update a thick container
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
local jailname="${TARGET}"
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf"
|
||||
local work_dir="${jailpath}/var/db/freebsd-update"
|
||||
|
||||
CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
if [ -z "${CURRENT_VERSION}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
else
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} \
|
||||
--not-running-from-cron \
|
||||
-j "${jailname}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
fetch
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} \
|
||||
--not-running-from-cron \
|
||||
-j "${jailname}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
install
|
||||
fi
|
||||
|
||||
# Update release version (including patch level)
|
||||
NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
if [ "${CURRENT_VERSION}" != "${NEW_VERSION}" ]; then
|
||||
bastille config ${TARGET} set osrelease ${NEW_VERSION} >/dev/null
|
||||
fi
|
||||
|
||||
elif [ "${PLATFORM_OS}" = "HardenedBSD" ]; then
|
||||
|
||||
local jailname="${TARGET}"
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local hbsd_update_conf="${jailpath}/etc/hbsd-update.conf"
|
||||
|
||||
CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
if [ -z "${CURRENT_VERSION}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
else
|
||||
hbsd-update \
|
||||
-j "${jailname}" \
|
||||
-c "${hbsd_update_conf}"
|
||||
fi
|
||||
|
||||
# Update release version (including patch level)
|
||||
NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
if [ "${CURRENT_VERSION}" != "${NEW_VERSION}" ]; then
|
||||
bastille config ${TARGET} set osrelease ${NEW_VERSION} >/dev/null
|
||||
fi
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
jail_update_pkgbase() {
|
||||
@@ -178,54 +242,32 @@ jail_update_pkgbase() {
|
||||
fi
|
||||
}
|
||||
|
||||
jail_update() {
|
||||
|
||||
local jailname="${TARGET}"
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf"
|
||||
local work_dir="${jailpath}/var/db/freebsd-update"
|
||||
|
||||
# Update a thick container
|
||||
if [ -d "${bastille_jailsdir}/${TARGET}" ]; then
|
||||
CURRENT_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
if [ -z "${CURRENT_VERSION}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
else
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} \
|
||||
--not-running-from-cron \
|
||||
-j "${jailname}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
fetch
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} \
|
||||
--not-running-from-cron \
|
||||
-j "${jailname}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
install
|
||||
fi
|
||||
# Update release version (including patch level)
|
||||
NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
bastille config ${TARGET} set osrelease ${NEW_VERSION}
|
||||
fi
|
||||
}
|
||||
|
||||
release_check() {
|
||||
|
||||
if echo "${TARGET}" | grep -w "[0-9]\{1,2\}\.[0-9]\-RELEASE\-i386"; then
|
||||
ARCH_I386="1"
|
||||
RELEASE="${NAME_VERIFY}"
|
||||
|
||||
# Validate release existence
|
||||
if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
error_exit "[ERROR]: Release not found: ${RELEASE}"
|
||||
fi
|
||||
|
||||
# Validate update method
|
||||
MINOR_VERSION=$(echo ${TARGET} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
MAJOR_VERSION=$(echo ${TARGET} | grep -Eo '^[0-9]+')
|
||||
if echo "${TARGET}" | grep -oq "\-CURRENT"; then
|
||||
FREEBSD_BRANCH="current"
|
||||
else
|
||||
FREEBSD_BRANCH="release"
|
||||
fi
|
||||
if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_releasesdir}/${TARGET}" which /usr/bin/uname > /dev/null 2>&1; then
|
||||
PKGBASE=1
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
if echo "${TARGET}" | grep -w "[0-9]\{1,2\}\.[0-9]\-RELEASE\-i386"; then
|
||||
ARCH_I386="1"
|
||||
fi
|
||||
|
||||
# Validate update method
|
||||
MINOR_VERSION=$(echo ${TARGET} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
MAJOR_VERSION=$(echo ${TARGET} | grep -Eo '^[0-9]+')
|
||||
if echo "${TARGET}" | grep -oq "\-CURRENT"; then
|
||||
FREEBSD_BRANCH="current"
|
||||
else
|
||||
FREEBSD_BRANCH="release"
|
||||
fi
|
||||
if [ "${MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_releasesdir}/${TARGET}" which /usr/bin/uname > /dev/null 2>&1; then
|
||||
PKGBASE=1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -271,12 +313,12 @@ release_update_pkgbase() {
|
||||
|
||||
release_update() {
|
||||
|
||||
local release_dir="${bastille_releasesdir}/${TARGET}"
|
||||
local freebsd_update_conf="${release_dir}/etc/freebsd-update.conf"
|
||||
local work_dir="${release_dir}/var/db/freebsd-update"
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
local release_dir="${bastille_releasesdir}/${TARGET}"
|
||||
local freebsd_update_conf="${release_dir}/etc/freebsd-update.conf"
|
||||
local work_dir="${release_dir}/var/db/freebsd-update"
|
||||
|
||||
# Update a release base(affects child containers)
|
||||
if [ -d "${release_dir}" ]; then
|
||||
# Update a release base (affects child containers)
|
||||
TARGET_TRIM="${TARGET}"
|
||||
if [ -n "${ARCH_I386}" ]; then
|
||||
TARGET_TRIM=$(echo "${TARGET}" | sed 's/-i386//')
|
||||
@@ -293,8 +335,20 @@ release_update() {
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
install --currently-running "${TARGET_TRIM}"
|
||||
else
|
||||
error_exit "[ERROR]: ${TARGET} not found. See 'bastille bootstrap RELEASE'."
|
||||
|
||||
elif [ "${PLATFORM_OS}" = "HardenedBSD" ]; then
|
||||
|
||||
local release_dir="${bastille_releasesdir}/${TARGET}"
|
||||
local hbsd_update_conf="${release_dir}/etc/hbsd-update.conf"
|
||||
|
||||
# Update a release base (affects child containers)
|
||||
TARGET_TRIM="${TARGET}"
|
||||
if [ -n "${ARCH_I386}" ]; then
|
||||
TARGET_TRIM=$(echo "${TARGET}" | sed 's/-i386//')
|
||||
fi
|
||||
hbsd-update \
|
||||
-r "${release_dir}" \
|
||||
-c "${hbsd_update_conf}"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -341,24 +395,62 @@ templates_update() {
|
||||
# Set needed variables for pkgbase
|
||||
HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }')
|
||||
|
||||
# Check what we should update
|
||||
if [ "${TARGET}" = 'TEMPLATES' ]; then
|
||||
templates_update
|
||||
elif echo "${TARGET}" | grep -Eq '^[A-Za-z0-9_-]+/[A-Za-z0-9_-]+$'; then
|
||||
BASTILLE_TEMPLATE="${TARGET}"
|
||||
template_update
|
||||
elif echo "${TARGET}" | grep -q "[0-9]\{2\}.[0-9]-\(RELEASE\|CURRENT\)"; then
|
||||
release_check
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
release_update_pkgbase
|
||||
else
|
||||
case "${TARGET}" in
|
||||
templates|TEMPLATES)
|
||||
templates_update
|
||||
;;
|
||||
*/*)
|
||||
BASTILLE_TEMPLATE="${TARGET}"
|
||||
template_update
|
||||
;;
|
||||
*-current|*-CURRENT)
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]')
|
||||
release_check
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
release_update_pkgbase
|
||||
else
|
||||
release_update
|
||||
fi
|
||||
;;
|
||||
*\.*-stable|*\.*-STABLE)
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]')
|
||||
release_check
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
release_update_pkgbase
|
||||
else
|
||||
release_update
|
||||
fi
|
||||
;;
|
||||
*-release|*-RELEASE)
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([0-9]+)\.[0-9](-RELEASE)$' | tr '[:lower:]' '[:upper:]')
|
||||
release_check
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
release_update_pkgbase
|
||||
else
|
||||
release_update
|
||||
fi
|
||||
;;
|
||||
current|CURRENT)
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | sed 's/CURRENT/current/g')
|
||||
release_check
|
||||
release_update
|
||||
fi
|
||||
else
|
||||
jail_check
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
jail_update_pkgbase
|
||||
else
|
||||
jail_update
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
[1-9]*-stable|[1-9]*-STABLE)
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]+)(-stable)$' | sed 's/STABLE/stable/g')
|
||||
release_check
|
||||
release_update
|
||||
;;
|
||||
*)
|
||||
jail_check
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
jail_update_pkgbase
|
||||
else
|
||||
jail_update
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue
Block a user