hackacad/usr/local/bin/bastille

#!/bin/sh
#
# Copyright (c) 2018-2019, Christer Edwards <christer.edwards@gmail.com>
# All rights reserved.
# 
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
# 
# * Redistributions of source code must retain the above copyright notice, this
#   list of conditions and the following disclaimer.
# 
# * Redistributions in binary form must reproduce the above copyright notice,
#   this list of conditions and the following disclaimer in the documentation
#   and/or other materials provided with the distribution.
# 
# * Neither the name of the copyright holder nor the names of its
#   contributors may be used to endorse or promote products derived from
#   this software without specific prior written permission.
# 
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

## root check first.
bastille_root_check() {
    if [ $(id -u) -ne 0 ]; then
        ## so we can make it colorful
        . /usr/local/share/bastille/colors.pre.sh

        ## permission denied
        echo -e "${COLOR_RED}Bastille: Permission Denied${COLOR_RESET}" 1>&2
        echo -e "${COLOR_RED}root / sudo / doas required${COLOR_RESET}" 1>&2
        exit 1
    fi
}

bastille_root_check

## we only load the config if root_check passes
. /usr/local/etc/bastille/bastille.conf
. /usr/local/share/bastille/colors.pre.sh

## bastille_prefix should be 0750
## this restricts file system access to privileged users
bastille_perms_check() {
    if [ -d "${bastille_prefix}" ]; then
        BASTILLE_PREFIX_PERMS=$(stat -f "%Op" "${bastille_prefix}")
        if [ "${BASTILLE_PREFIX_PERMS}" != 40750 ]; then
            echo -e "${COLOR_RED}Insecure permissions on ${bastille_prefix}${COLOR_RESET}" 1>&2
            echo -e "${COLOR_RED}Try: chmod 0750 ${bastille_prefix}${COLOR_RESET}" 1>&2
            echo
            exit 1
        fi
    fi
}

bastille_perms_check

## we only load the config if root_check passes
. /usr/local/etc/bastille/bastille.conf

## version
BASTILLE_VERSION="0.4.20191025"

usage() {
    cat << EOF
Bastille is a jail automation framework that allows you to quickly create and
manage FreeBSD jails.

Usage:
  bastille command [ALL|glob] [args]

Available Commands:
  bootstrap   Bootstrap a FreeBSD release for container base.
  cmd         Execute arbitrary command on targeted container(s).
  console     Console into a running container.
  cp          cp(1) files from host to targeted container(s).
  create      Create a new thin container or a thick container if -T|--thick option specified.
  destroy     Destroy a stopped container or a FreeBSD release.
  help        Help about any command
  htop        Interactive process viewer (requires htop).
  list        List containers (running and stopped).
  pkg         Manipulate binary packages within targeted container(s). See pkg(8).
  restart     Restart a running container.
  service     Manage services within targeted jail(s).
  start       Start a stopped container.
  stop        Stop a running container.
  sysrc       Safely edit rc files within targeted container(s).
  template    Apply file templates to targeted jail(s).
  top         Display and update information about the top(1) cpu processes.
  update      Update container base -pX release.
  upgrade     Upgrade container release to X.Y-RELEASE.
  verify      Compare release against a "known good" index.
  zfs         Manage (get|set) zfs attributes on targeted jail(s).

Use "bastille -v|--version" for version information.
Use "bastille command -h|--help" for more information about a command.

EOF
    exit 1
}

[ $# -lt 1 ] && usage

CMD=$1
shift

# Handle special-case commands first.
case "${CMD}" in
version|-v|--version)
    echo -e "${COLOR_GREEN}${BASTILLE_VERSION}${COLOR_RESET}"
    exit 0
    ;;
help|-h|--help)
    usage
    ;;
esac

# Filter out all non-commands
case "${CMD}" in
cmd|cp|create|destroy|list|pkg|restart|start|stop|sysrc|template|verify)
    ;;
update|upgrade)
    ;;
service|console|bootstrap|htop|top)
    ;;
bootstrap|update|upgrade|zfs)
    ;;
*)
usage
    ;;
esac

SCRIPTPATH="${bastille_sharedir}/${CMD}.sh"
if [ -f "${SCRIPTPATH}" ]; then
    : ${UMASK:=022}
    umask ${UMASK}

    : ${SH:=sh}

    exec ${SH} "${SCRIPTPATH}" "$@"
else
    echo -e "${COLOR_RED}${SCRIPTPATH} not found.${COLOR_RESET}" 1>&2
fi