2 # The Girocco jail setup script
4 # We are designed to set up the chroot based on binaries from
5 # amd64 Debian lenny; some things may need slight modifications if
6 # being run on a different distribution.
12 # Verify we have all we neeed.
13 if ! getent group
$cfg_owning_group >/dev
/null
; then
14 echo "*** Error: You do not have $cfg_owning_group in system yet." >&2
19 mkdir
-p "$cfg_chroot"
21 chown root
"$cfg_chroot"
22 chmod 755 "$cfg_chroot"
24 # First, setup basic directory structure
25 mkdir
-p bin dev etc lib sbin srv
/git var
/run proc
30 # Set up basic user/group configuration; if there is any already,
31 # we hope it's the same numbers and users.
33 if [ ! -s etc
/passwd
]; then
35 sshd:x:101:65534:priviledge separation:/var/run/sshd:/bin/false
36 $cfg_cgi_user:x:$(getent passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
37 $cfg_mirror_user:x:$(getent passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
38 mob::65538:65534:the mob:/:/bin/git-shell
42 if [ ! -s etc
/group
]; then
44 _repo:x:$(getent group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
49 rm -f dev
/null dev
/zero dev
/random dev
/urandom
52 mknod dev
/random c
1 8
53 mknod dev
/urandom c
1 9
54 chmod a
+rw dev
/null dev
/zero dev
/random dev
/urandom
58 chown
65538 var
/run
/mob
61 # Set up sshd configuration:
64 chown
$cfg_cgi_user:$cfg_owning_group etc
/sshkeys
65 chmod g
+ws etc
/sshkeys
67 if [ ! -s etc
/ssh
/sshd_config
]; then
68 cat >etc
/ssh
/sshd_config
<<EOT
74 UsePrivilegeSeparation yes
76 AuthorizedKeysFile /etc/sshkeys/%u
80 PermitEmptyPasswords yes
81 ChallengeResponseAuthentication no
82 PasswordAuthentication yes
85 if [ ! -s etc
/ssh
/ssh_host_dsa_key
]; then
86 yes | ssh-keygen
-N "" -C Girocco
-t dsa
-f etc
/ssh
/ssh_host_dsa_key
88 if [ ! -s etc
/ssh
/ssh_host_rsa_key
]; then
89 yes | ssh-keygen
-N "" -C Girocco
-t rsa
-f etc
/ssh
/ssh_host_rsa_key
92 # Bring in basic libraries:
95 cp -t lib
/lib
/ld-linux.so
.2
96 [ ! -d /lib64
] ||
cp -t lib
/lib64
/ld-linux-x86-64.so
.2
98 cp -t lib
/lib
/libc.so
.6 /lib
/libcrypt.so
.1 /lib
/libutil.so
.1 /lib
/libnsl.so
.1 /lib
/libnss_compat.so
.2 /lib
/libresolv.so
.2 /lib
/libdl.so
.2 /lib
/libgcc_s.so
.1
100 # Now, bring in sshd and sh.
105 # ...and all the dependencies.
106 ldd
"$bin" |
grep -v linux-gate |
grep -v linux-vdso |
grep -v ld-linux |
grep '=>' |
awk '{print $3}' |
xargs -r -- cp -u -t lib
109 pull_in_bin
/bin
/sh bin
110 pull_in_bin
/bin
/nc.openbsd bin
111 # If /sbin/sshd is already running within the chroot, we get Text file busy.
112 pull_in_bin
/usr
/sbin
/sshd sbin ||
:
114 # ...and the bits of git we need.
115 for i
in git git-index-pack git-receive-pack git-shell git-update-server-info git-upload-archive git-upload-pack git-unpack-objects
; do
116 if [ -e /usr
/lib
/git-core
/$i ]; then
117 pull_in_bin
/usr
/lib
/git-core
/$i bin
119 pull_in_bin
/usr
/bin
/$i bin
123 echo "--- Add to your boot scripts: mount --bind $cfg_reporoot $cfg_chroot/srv/git"
124 echo "--- Add to your boot scripts: mount --bind /proc $cfg_chroot/proc"
125 echo "--- Add to your syslog configuration: listening on socket $cfg_chroot/dev/log"