Mirrors/BastilleBSD_bastille
1
0
Fork 1
mirror of https://github.com/BastilleBSD/bastille.git synced 2025-12-11 17:39:52 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
2813cd6ac61a4e04f58077ad2530ed6e21bb3ba6
BastilleBSD_bastille/usr/local/share/bastille/template.sh
tschettervictor 2813cd6ac6 deprecate legacy templates
2025-12-07 18:50:46 -07:00

415 lines
14 KiB
Bash
Raw Blame History

#!/bin/sh
#
# SPDX-License-Identifier: BSD-3-Clause
#
# Copyright (c) 2018-2025, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this
# list of conditions and the following disclaimer.
#
# * Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# * Neither the name of the copyright holder nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
. /usr/local/share/bastille/common.sh
usage() {
error_notify "Usage: bastille template [option(s)] TARGET|convert TEMPLATE"
cat << EOF
Options:
-a | --auto Auto mode. Start/stop jail(s) if required.
-x | --debug Enable debug mode.
EOF
exit 1
}
post_command_hook() {
local jail=$1
local cmd=$2
local args=$3
case $cmd in
rdr)
echo -e ${args}
esac
}
get_arg_name() {
local name_value_pair="${1}"
echo "${name_value_pair}" | sed -E 's/=.*//'
}
parse_arg_value() {
local arg="${1}"
# Parses the value after = and then escapes back/forward slashes and single quotes in it. -- cwells
echo "${arg}" | sed -E 's/[^=]+=?//' | sed -e 's/\\/\\\\/g' -e 's/\//\\\//g' -e 's/'\''/'\''\\'\'\''/g' -e 's/&/\\&/g' -e 's/"//g'
}
get_arg_value() {
local name_value_pair="${1}"
shift
arg_name="$(get_arg_name "${name_value_pair}")"
# Remaining arguments in $@ are the script arguments, which take precedence. -- cwells
for script_arg in "$@"; do
case ${script_arg} in
--arg)
# Parse whatever is next. -- cwells
next_arg='true' ;;
*)
if [ "${next_arg}" = 'true' ]; then # This is the parameter after --arg. -- cwells
next_arg=''
if [ "$(get_arg_name "${script_arg}")" = "${arg_name}" ]; then
parse_arg_value "${script_arg}"
return
fi
fi
;;
esac
done
# Check the ARG_FILE if one was provided. --cwells
if [ -n "${ARG_FILE}" ]; then
# To prevent a false empty value, only parse the value if this argument exists in the file. -- cwells
if grep "^${arg_name}=" "${ARG_FILE}" > /dev/null 2>&1; then
parse_arg_value "$(grep "^${arg_name}=" "${ARG_FILE}")"
return
fi
fi
# Return the default value, which may be empty, from the name=value pair. -- cwells
parse_arg_value "${name_value_pair}"
}
render() {
local file_path="${1}/${2}"
if [ -d "${file_path}" ]; then # Recursively render every file in this directory. -- cwells
echo "Rendering Directory: ${file_path}"
find "${file_path}" \( -type d -name .git -prune \) -o -type f
find "${file_path}" \( -type d -name .git -prune \) -o -type f -print0 | eval "xargs -0 sed -i '' ${ARG_REPLACEMENTS}"
elif [ -f "${file_path}" ]; then
echo "Rendering File: ${file_path}"
eval "sed -i '' ${ARG_REPLACEMENTS} '${file_path}'"
else
warn "[WARNING]: Path not found for render: ${2}"
fi
}
line_in_file() {
local jail_path="${1}"
eval set -- "${2}"
local line="${1}"
local file_path="${2}"
if [ -f "${jail_path}/${file_path}" ]; then
if ! grep -qxF "${line}" "${jail_path}/${file_path}"; then
echo "${line}" >> "${jail_path}/${file_path}"
fi
else
warn "[WARNING]: Path not found for line_in_file: ${file_path}"
fi
}
# Handle options.
AUTO=0
while [ "$#" -gt 0 ]; do
case "${1}" in
-h|--help|help)
usage
;;
-a|--auto)
AUTO=1
shift
;;
-x|--debug)
enable_debug
shift
;;
-*)
for opt in $(echo ${1} | sed 's/-//g' | fold -w1); do
case ${opt} in
a) AUTO=1 ;;
x) enable_debug ;;
*) error_exit "[ERROR]: Unknown Option: \"${1}\"" ;;
esac
done
shift
;;
*)
break
;;
esac
done
if [ "$#" -lt 2 ]; then
usage
fi
TARGET="${1}"
TEMPLATE="${2}"
bastille_template=${bastille_templatesdir}/${TEMPLATE}
bastille_root_check
# We set the target only if it is not --convert
# Special case conversion of hook-style template files into a Bastillefile. -- cwells
if [ "${TARGET}" = "convert" ]; then
if [ -d "${TEMPLATE}" ]; then # A relative path was provided. -- cwells
cd "${TEMPLATE}" || error_exit "[ERROR]: Failed to change to directory: ${TEMPLATE}"
elif [ -d "${bastille_template}" ]; then
cd "${bastille_template}" || error_exit "[ERROR]: Failed to change to directory: ${TEMPLATE}"
else
error_exit "[ERROR]: Template not found: ${TEMPLATE}"
fi
echo "Converting template: ${TEMPLATE}"
# Convert legacy template to Bastillefile
HOOKS='ARG LIMITS INCLUDE PRE FSTAB PF PKG OVERLAY CONFIG SYSRC SERVICE CMD RENDER'
for hook in ${HOOKS}; do
if [ -s "${hook}" ]; then
# Default command is the hook name and default args are the line from the file. -- cwells
cmd="${hook}"
args_template='${line}'
# Replace old hook names with Bastille command names. -- cwells
case ${hook} in
CONFIG|OVERLAY)
cmd='CP'
args_template='${line} /'
;;
FSTAB)
cmd='MOUNT' ;;
PF)
cmd='RDR' ;;
PRE)
cmd='CMD' ;;
esac
while read line; do
if [ -z "${line}" ]; then
continue
fi
eval "args=\"${args_template}\""
echo "${cmd} ${args}" >> Bastillefile
done < "${hook}"
echo '' >> Bastillefile
rm "${hook}"
fi
done
info "\nTemplate converted: ${TEMPLATE}"
exit 0
else
set_target "${TARGET}"
fi
case ${TEMPLATE} in
http?://*/*/*)
TEMPLATE_DIR=$(echo "${TEMPLATE}" | awk -F / '{ print $4 "/" $5 }')
if [ ! -d "${bastille_templatesdir}/${TEMPLATE_DIR}" ]; then
info "Bootstrapping ${TEMPLATE}..."
if ! bastille bootstrap "${TEMPLATE}"; then
error_exit "[ERROR]: Failed to bootstrap template: ${TEMPLATE}"
fi
fi
TEMPLATE="${TEMPLATE_DIR}"
bastille_template=${bastille_templatesdir}/${TEMPLATE}
;;
*/*)
if [ ! -d "${bastille_templatesdir}/${TEMPLATE}" ]; then
if [ ! -d ${TEMPLATE} ]; then
error_exit "[ERROR]: ${TEMPLATE} not found."
else
bastille_template=${TEMPLATE}
fi
fi
;;
*)
error_exit "[ERROR]: Template name/URL not recognized."
esac
# Check for an --arg-file parameter. -- cwells
for script_arg in "$@"; do
case ${script_arg} in
--arg-file)
# Parse whatever is next. -- cwells
next_arg='true' ;;
*)
if [ "${next_arg}" = 'true' ]; then # This is the parameter after --arg-file. -- cwells
next_arg=''
ARG_FILE="${script_arg}"
break
fi
;;
esac
done
# Check if ARG_FILE exists
if [ -n "${ARG_FILE}" ] && [ ! -f "${ARG_FILE}" ]; then
error_exit "[ERROR]: File not found: ${ARG_FILE}"
fi
for jail in ${JAILS}; do
check_target_is_running "${jail}" || if [ "${AUTO}" -eq 1 ]; then
bastille start "${jail}"
else
info "\n[${jail}]:"
error_notify "Jail is not running."
error_continue "Use [-a|--auto] to auto-start the jail."
fi
info "\n[${jail}]:"
echo "Applying template: ${TEMPLATE}..."
## get jail ip4 and ip6 values
bastille_jail_path=$(/usr/sbin/jls -j "${jail}" path)
if [ "$(bastille config ${jail} get vnet)" != 'enabled' ]; then
jail_ip4="$(bastille config ${jail} get ip4.addr | sed 's/,/ /g' | awk '{print $1}')"
jail_ip6="$(bastille config ${jail} get ip6.addr | sed 's/,/ /g' | awk '{print $1}')"
fi
## remove value if ip4 was not set or disabled, otherwise get value
if [ "${jail_ip4}" = "not set" ] || [ "${jail_ip4}" = "disable" ]; then
jail_ip4='' # In case it was -. -- cwells
elif echo "${jail_ip4}" | grep -q "|"; then
jail_ip4="$(echo ${jail_ip4} | awk -F"|" '{print $2}' | sed -E 's#/[0-9]+$##g')"
else
jail_ip4="$(echo ${jail_ip4} | sed -E 's#/[0-9]+$##g')"
fi
## remove value if ip6 was not set or disabled, otherwise get value
if [ "${jail_ip6}" = "not set" ] || [ "${jail_ip6}" = "disable" ]; then
jail_ip6='' # In case it was -. -- cwells
elif echo "${jail_ip6}" | grep -q "|"; then
jail_ip6="$(echo ${jail_ip6} | awk -F"|" '{print $2}' | sed -E 's#/[0-9]+$##g')"
else
jail_ip6="$(echo ${jail_ip6} | sed -E 's#/[0-9]+$##g')"
fi
# print error when both ip4 and ip6 are not set
if { [ "${jail_ip4}" = "not set" ] || [ "${jail_ip4}" = "disable" ]; } && \
{ [ "${jail_ip6}" = "not set" ] || [ "${jail_ip6}" = "disable" ]; } then
error_notify "Jail IP not found for jail: ${jail}"
fi
# Build a list of sed commands like this: -e 's/${username}/root/g' -e 's/${domain}/example.com/g'
# Values provided by default (without being defined by the user) are listed here. -- cwells
ARG_REPLACEMENTS="-e 's/\${JAIL_IP}/${jail_ip4}/g' -e 's/\${JAIL_IP6}/${jail_ip6}/g' -e 's/\${JAIL_NAME}/${jail}/g'"
### Bastillefile ###
if [ -s "${bastille_template}/Bastillefile" ]; then
# Ignore blank lines and comments. -- cwells
SCRIPT=$(awk '{ if (substr($0, length, 1) == "\\") { printf "%s", substr($0, 1, length-1); } else { print $0; } }' "${bastille_template}/Bastillefile" | grep -v '^[[:blank:]]*$' | grep -v '^[[:blank:]]*#')
# Use a newline as the separator. -- cwells
IFS='
'
set -f
for line in ${SCRIPT}; do
# First word converted to lowercase is the Bastille command. -- cwells
cmd=$(echo "${line}" | awk '{print tolower($1);}')
# Rest of the line with "arg" variables replaced will be the arguments. -- cwells
args=$(echo "${line}" | awk -F '[ ]' '{$1=""; sub(/^ */, ""); print;}' | eval "sed ${ARG_REPLACEMENTS}")
# Apply overrides for commands/aliases and arguments. -- cwells
case $cmd in
arg) # This is a template argument definition. -- cwells
arg_name=$(get_arg_name "${args}")
arg_value=$(get_arg_value "${args}" "$@")
if [ -z "${arg_value}" ]; then
warn "[WARNING]: No value provided for arg: ${arg_name}"
fi
# Build a list of sed commands like this: -e 's/${username}/root/g' -e 's/${domain}/example.com/g'
ARG_REPLACEMENTS="${ARG_REPLACEMENTS} -e 's/\${${arg_name}}/${arg_value}/g'"
continue
;;
cmd)
# Escape single-quotes in the command being executed. -- cwells
args=$(echo "${args}" | sed "s/'/'\\\\''/g")
# Allow redirection within the jail. -- cwells
args="sh -c '${args}'"
;;
cp|copy)
cmd='cp'
# Convert relative "from" path into absolute path inside the template directory. -- cwells
if [ "${args%"${args#?}"}" != '/' ] && [ "${args%"${args#??}"}" != '"/' ]; then
args="${bastille_template}/${args}"
fi
;;
fstab|mount)
cmd='mount' ;;
include)
cmd='template' ;;
overlay)
cmd='cp'
args="${bastille_template}/${args} /"
;;
pkg)
args="install -y ${args}"
;;
tag|tags)
cmd='tags'
args="add $(echo ${args} | tr ' ' ,)"
;;
render) # This is a path to one or more files needing arguments replaced by values. -- cwells
render "${bastille_jail_path}" "${args}"
continue
;;
lif|lineinfile|line_in_file)
line_in_file "${bastille_jail_path}" "${args}"
continue
;;
esac
if ! eval "bastille ${cmd} ${jail} ${args}"; then
set +f
unset IFS
error_exit "[ERROR]: Failed to execute command: ${cmd}"
fi
post_command_hook "${jail}" "${cmd}" "${args}"
done
set +f
unset IFS
fi
info "\nTemplate applied: ${TEMPLATE}"
done
Reference in New Issue View Git Blame Copy Permalink