Merge pull request #420 from JRGTH/master
Extra validation for Linux jails, small changes
This commit is contained in:
Christer Edwards
GitHub
@@ -302,6 +302,106 @@ bootstrap_release() {
|
||||
echo
|
||||
}
|
||||
|
||||
debootstrap_release() {
|
||||
|
||||
#check and install OS dependencies @hackacad
|
||||
#ToDo: add function 'linux_pre' for sysrc etc.
|
||||
|
||||
required_mods="fdescfs linprocfs linsysfs tmpfs"
|
||||
linuxarc_mods="linux linux64"
|
||||
for _req_kmod in ${required_mods}; do
|
||||
if [ ! "$(sysrc -f /boot/loader.conf -qn ${_req_kmod}_load)" = "YES" ]; then
|
||||
warn "${_req_kmod} not enabled in /boot/loader.conf, Should I do that for you? (N|y)"
|
||||
read answer
|
||||
case "${answer}" in
|
||||
[Nn][Oo]|[Nn]|"")
|
||||
error_exit "Exiting."
|
||||
;;
|
||||
[Yy][Ee][Ss]|[Yy])
|
||||
# Skip already loaded known modules.
|
||||
if ! kldstat -m ${_req_kmod} >/dev/null 2>&1; then
|
||||
info "Loading kernel module: ${_req_kmod}"
|
||||
kldload -v ${_req_kmod}
|
||||
fi
|
||||
info "Persisting module: ${_req_kmod}"
|
||||
sysrc -f /boot/loader.conf ${_req_kmod}_load=YES
|
||||
;;
|
||||
esac
|
||||
else
|
||||
# If already set in /boot/loader.conf, check and try to load the module.
|
||||
if ! kldstat -m ${_req_kmod} >/dev/null 2>&1; then
|
||||
info "Loading kernel module: ${_req_kmod}"
|
||||
kldload -v ${_req_kmod}
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
# Mandatory Linux modules/rc.
|
||||
for _lin_kmod in ${linuxarc_mods}; do
|
||||
if ! kldstat -n ${_lin_kmod} >/dev/null 2>&1; then
|
||||
info "Loading kernel module: ${_lin_kmod}"
|
||||
kldload -v ${_lin_kmod}
|
||||
fi
|
||||
done
|
||||
if [ ! "$(sysrc -qn linux_enable)" = "YES" ]; then
|
||||
sysrc linux_enable=YES
|
||||
fi
|
||||
|
||||
if ! which -s debootstrap; then
|
||||
warn "Debootstrap not found. Should it be installed? (N|y)"
|
||||
read answer
|
||||
case $answer in
|
||||
[Nn][Oo]|[Nn]|"")
|
||||
error_exit "Exiting. You need to install debootstap before boostrapping a Linux jail."
|
||||
;;
|
||||
[Yy][Ee][Ss]|[Yy])
|
||||
pkg install -y debootstrap
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Create subsequent Linux releases datasets
|
||||
if [ ! -d "${bastille_releasesdir}/${DIR_BOOTSTRAP}" ]; then
|
||||
if [ "${bastille_zfs_enable}" = "YES" ]; then
|
||||
if [ -n "${bastille_zfs_zpool}" ]; then
|
||||
zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${DIR_BOOTSTRAP}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${DIR_BOOTSTRAP}"
|
||||
fi
|
||||
else
|
||||
mkdir -p "${bastille_releasesdir}/${DIR_BOOTSTRAP}"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Fetch the Linux flavor
|
||||
info "Bootstrapping ${PLATFORM_OS} distfiles..."
|
||||
if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${LINUX_FLAVOR} "${bastille_releasesdir}"/${DIR_BOOTSTRAP}; then
|
||||
## perform cleanup only for stale/empty directories on failure
|
||||
if [ "${bastille_zfs_enable}" = "YES" ]; then
|
||||
if [ -n "${bastille_zfs_zpool}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then
|
||||
zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${DIR_BOOTSTRAP}"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
if [ -d "${bastille_releasesdir}/${DIR_BOOTSTRAP}" ]; then
|
||||
if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then
|
||||
rm -rf "${bastille_releasesdir:?}/${DIR_BOOTSTRAP}"
|
||||
fi
|
||||
fi
|
||||
error_exit "Bootstrap failed."
|
||||
fi
|
||||
|
||||
case "${LINUX_FLAVOR}" in
|
||||
bionic|stretch|buster)
|
||||
info "Increasing APT::Cache-Start"
|
||||
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${DIR_BOOTSTRAP}/etc/apt/apt.conf.d/00aptitude
|
||||
;;
|
||||
esac
|
||||
|
||||
info "Bootstrap successful."
|
||||
info "See 'bastille --help' for available commands."
|
||||
echo
|
||||
}
|
||||
|
||||
bootstrap_template() {
|
||||
|
||||
## ${bastille_templatesdir}
|
||||
@@ -339,43 +439,6 @@ bootstrap_template() {
|
||||
bastille verify "${_user}/${_repo}"
|
||||
}
|
||||
|
||||
check_linux_prerequisites() {
|
||||
#check and install OS dependencies @hackacad
|
||||
if [ ! "$(sysrc -f /boot/loader.conf -n linprocfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n linsysfs_load)" = "YES" ] && [ ! "$(sysrc -f /boot/loader.conf -n tmpfs_load)" = "YES" ]; then
|
||||
warn "linprocfs_load, linsysfs_load, tmpfs_load not enabled in /boot/loader.conf or linux_enable not active. Should I do that for you? (N|y)"
|
||||
read answer
|
||||
case $answer in
|
||||
[Nn][Oo]|[Nn]|"")
|
||||
error_exit "Exiting."
|
||||
;;
|
||||
[Yy][Ee][Ss]|[Yy])
|
||||
info "Loading modules"
|
||||
kldload linux linux64 linprocfs linsysfs tmpfs
|
||||
info "Persisting modules"
|
||||
sysrc linux_enable=YES
|
||||
sysrc -f /boot/loader.conf linprocfs_load=YES
|
||||
sysrc -f /boot/loader.conf linsysfs_load=YES
|
||||
sysrc -f /boot/loader.conf tmpfs_load=YES
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
ensure_debootstrap() {
|
||||
if ! which -s debootstrap; then
|
||||
warn "Debootstrap not found. Should it be installed? (N|y)"
|
||||
read answer
|
||||
case $answer in
|
||||
[Nn][Oo]|[Nn]|"")
|
||||
error_exit "Exiting. You need to install debootstap before boostrapping a Linux jail."
|
||||
;;
|
||||
[Yy][Ee][Ss]|[Yy])
|
||||
pkg install -y debootstrap
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
HW_MACHINE=$(sysctl hw.machine | awk '{ print $2 }')
|
||||
HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }')
|
||||
RELEASE="${1}"
|
||||
@@ -466,37 +529,38 @@ http?://*/*/*)
|
||||
;;
|
||||
#adding Ubuntu Bionic as valid "RELEASE" for POC @hackacad
|
||||
ubuntu_bionic|bionic|ubuntu-bionic)
|
||||
check_linux_prerequisites
|
||||
ensure_debootstrap
|
||||
debootstrap --foreign --arch=amd64 --no-check-gpg bionic "${bastille_releasesdir}"/Ubuntu_1804
|
||||
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/Ubuntu_1804/etc/apt/apt.conf.d/00aptitude
|
||||
PLATFORM_OS="Ubuntu/Linux"
|
||||
LINUX_FLAVOR="bionic"
|
||||
DIR_BOOTSTRAP="Ubuntu_1804"
|
||||
ARCH_BOOTSTRAP="amd64"
|
||||
debootstrap_release
|
||||
;;
|
||||
ubuntu_focal|focal|ubuntu-focal)
|
||||
check_linux_prerequisites
|
||||
ensure_debootstrap
|
||||
debootstrap --foreign --arch=amd64 --no-check-gpg focal "${bastille_releasesdir}"/Ubuntu_2004
|
||||
PLATFORM_OS="Ubuntu/Linux"
|
||||
LINUX_FLAVOR="focal"
|
||||
DIR_BOOTSTRAP="Ubuntu_2004"
|
||||
ARCH_BOOTSTRAP="amd64"
|
||||
debootstrap_release
|
||||
;;
|
||||
debian_stretch|stretch|debian-stretch)
|
||||
check_linux_prerequisites
|
||||
ensure_debootstrap
|
||||
debootstrap --foreign --arch=amd64 --no-check-gpg stretch "${bastille_releasesdir}"/Debian9
|
||||
echo "Increasing APT::Cache-Start"
|
||||
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/Debian9/etc/apt/apt.conf.d/00aptitude
|
||||
PLATFORM_OS="Debian/Linux"
|
||||
LINUX_FLAVOR="stretch"
|
||||
DIR_BOOTSTRAP="Debian9"
|
||||
ARCH_BOOTSTRAP="amd64"
|
||||
debootstrap_release
|
||||
;;
|
||||
debian_buster|buster|debian-buster)
|
||||
check_linux_prerequisites
|
||||
ensure_debootstrap
|
||||
debootstrap --foreign --arch=amd64 --no-check-gpg buster "${bastille_releasesdir}"/Debian10
|
||||
echo "Increasing APT::Cache-Start"
|
||||
echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/Debian10/etc/apt/apt.conf.d/00aptitude
|
||||
PLATFORM_OS="Debian/Linux"
|
||||
LINUX_FLAVOR="buster"
|
||||
DIR_BOOTSTRAP="Debian10"
|
||||
ARCH_BOOTSTRAP="amd64"
|
||||
debootstrap_release
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
|
||||
|
||||
|
||||
case "${OPTION}" in
|
||||
update)
|
||||
bastille update "${RELEASE}"
|
||||
|
||||
Reference in New Issue
Block a user