Mirrors/hackacad
2
0
Fork 0
mirror of https://github.com/hackacad/bastille.git synced 2025-12-22 10:10:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

limits: Retain support for no action (will default to add)

Browse Source
This commit is contained in:
tschettervictor
2025-03-23 06:00:09 -06:00
committed by GitHub
parent 27beac434e
commit f5cdff4fc1
1 changed files with 21 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
usr/local/share/bastille/limits.sh
View File

@@ -86,6 +86,11 @@ TARGET="${1}"
ACTION="${2}" ACTION="${2}"
shift 2 shift 2
# Retain support for no action (will default to add)
if [ "${ACTION}" != "remove" ] && [ "${ACTION}" != "clear" ] && [ "${ACTION}" != "list" ] && [ "${ACTION}" != "show" ] && [ "${ACTION}" != "reset" ] && [ "${ACTION}" != "stats" ]; then
ACTION="add"
fi
RACCT_ENABLE="$(sysctl -n kern.racct.enable)" RACCT_ENABLE="$(sysctl -n kern.racct.enable)"
if [ "${RACCT_ENABLE}" != '1' ]; then if [ "${RACCT_ENABLE}" != '1' ]; then
error_exit "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot" error_exit "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
@@ -109,7 +114,7 @@ for _jail in ${JAILS}; do
add) add)
OPTION="${1}" OPTION="${1}"
VALUE="${2}" VALUE="${2}"
# Add rctl rule to rctl.conf # Add rctl rule to rctl.conf
_rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail" _rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail"
_rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail" _rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail"
@@ -118,7 +123,7 @@ for _jail in ${JAILS}; do
_escaped_option=$(echo "${OPTION}" | sed 's/\//\\\//g') _escaped_option=$(echo "${OPTION}" | sed 's/\//\\\//g')
_escaped_rctl_rule=$(echo "${_rctl_rule}" | sed 's/\//\\\//g') _escaped_rctl_rule=$(echo "${_rctl_rule}" | sed 's/\//\\\//g')
_escaped_rctl_rule_log=$(echo "${_rctl_rule_log}" | sed 's/\//\\\//g') _escaped_rctl_rule_log=$(echo "${_rctl_rule_log}" | sed 's/\//\\\//g')
sed -i '' -E "s/jail:${_jail}:${_escaped_option}:deny.+/${_escaped_rctl_rule}/" "${bastille_jailsdir}/${_jail}/rctl.conf" sed -i '' -E "s/jail:${_jail}:${_escaped_option}:deny.+/${_escaped_rctl_rule}/" "${bastille_jailsdir}/${_jail}/rctl.conf"
sed -i '' -E "s/jail:${_jail}:${_escaped_option}:log.+/${_escaped_rctl_rule_log}/" "${bastille_jailsdir}/${_jail}/rctl.conf" sed -i '' -E "s/jail:${_jail}:${_escaped_option}:log.+/${_escaped_rctl_rule_log}/" "${bastille_jailsdir}/${_jail}/rctl.conf"
else # Just append the entry. -- cwells else # Just append the entry. -- cwells
echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf" echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
@@ -127,7 +132,7 @@ for _jail in ${JAILS}; do
echo -e "${OPTION} ${VALUE}" echo -e "${OPTION} ${VALUE}"
rctl -a "${_rctl_rule}" "${_rctl_rule_log}" rctl -a "${_rctl_rule}" "${_rctl_rule_log}"
;; ;;
remove) remove)
OPTION="${1}" OPTION="${1}"
# Remove rule from rctl.conf # Remove rule from rctl.conf
@@ -141,16 +146,16 @@ for _jail in ${JAILS}; do
fi fi
;; ;;
clear) clear)
# Remove limits # Remove limits
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
while read _limits; do while read _limits; do
rctl -r "${_limits}" 2>/dev/null rctl -r "${_limits}" 2>/dev/null
done < "${bastille_jailsdir}/${_jail}/rctl.conf" done < "${bastille_jailsdir}/${_jail}/rctl.conf"
info "[${_jail}]: RCTL limits cleared." info "[${_jail}]: RCTL limits cleared."
fi fi
;; ;;
list|show) list|show)
# Show limits # Show limits
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
if [ "${1}" = "active" ]; then if [ "${1}" = "active" ]; then
rctl jail:${_jail} 2>/dev/null rctl jail:${_jail} 2>/dev/null
@@ -158,28 +163,27 @@ for _jail in ${JAILS}; do
cat "${bastille_jailsdir}/${_jail}/rctl.conf" cat "${bastille_jailsdir}/${_jail}/rctl.conf"
fi fi
fi fi
;; ;;
stats) stats)
# Show statistics # Show statistics
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
rctl -hu jail:${_jail} 2>/dev/null rctl -hu jail:${_jail} 2>/dev/null
fi fi
;; ;;
reset) reset)
# Remove limits and delete rctl.conf # Remove limits and delete rctl.conf
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
while read _limits; do while read _limits; do
rctl -r "${_limits}" 2>/dev/null rctl -r "${_limits}" 2>/dev/null
done < "${bastille_jailsdir}/${_jail}/rctl.conf" done < "${bastille_jailsdir}/${_jail}/rctl.conf"
info "[${TARGET}]: RCTL limits cleared." info "[${TARGET}]: RCTL limits cleared."
fi fi
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
rm -f "${bastille_jailsdir}/${_jail}/rctl.conf" rm -f "${bastille_jailsdir}/${_jail}/rctl.conf"
info "[${TARGET}]: rctl.conf removed." info "[${TARGET}]: rctl.conf removed."
else else
error_continue "[${TARGET}]: rctl.conf not found." error_continue "[${TARGET}]: rctl.conf not found."
fi fi
;; ;;
esac esac
done done