chrootsetup_linux.sh

   1 # chrootsetup_linux.sh
   2
   3 # This file SHOULD NOT be executable!  It is sourced by jailsetup.sh and
   4 # SHOULD NOT be executed directly!
   5
   6 # On entry the current directory will be set to the top of the chroot
   7 # This script must perform platform-specific chroot setup which includes
   8 # creating any dev device entries, setting up proc (if needed), setting
   9 # up lib64 (if needed) as well as installing a basic set of whatever libraries
  10 # are needed for a chroot to function on this platform.
  11
  12 # This script must also define a pull_in_bin function that may be called to
  13 # install an executable together with any libraries it depends on into the
  14 # chroot.
  15
  16 # Finally this script must install a suitable nc.openbsd compatible version of
  17 # netcat into the chroot jail that's available as nc.openbsd and which supports
  18 # connects to unix sockets.
  19
  20 # We are designed to set up the chroot based on binaries from
  21 # amd64 Debian lenny; some things may need slight modifications if
  22 # being run on a different distribution.
  23
  24 mkdir -p dev proc selinux
  25 chown 0:0 proc selinux
  26 rm -f lib64
  27 ln -s lib lib64
  28
  29 # Seed up /dev:
  30 rm -f dev/null dev/zero dev/random dev/urandom
  31 mknod dev/null c 1 3
  32 mknod dev/zero c 1 5
  33 mknod dev/random c 1 8
  34 mknod dev/urandom c 1 9
  35 chmod a+rw dev/null dev/zero dev/random dev/urandom
  36
  37 # Extra directories
  38 mkdir -p var/run/sshd
  39
  40 # Bring in basic libraries:
  41 rm -f lib/*
  42 # ld.so:
  43 cp -p -t lib /lib/ld-linux.so.2
  44 [ ! -d /lib64 ] || cp -p -t lib /lib64/ld-linux-x86-64.so.2
  45
  46 extract_libs() {
  47         ldd "$1" | grep -v linux-gate | grep -v linux-vdso | grep -v ld-linux | grep '=>' | awk '{print $3}'
  48 }
  49
  50 pull_in_lib() {
  51         [ -f "$1" ] || return
  52         dst="${2%/}/$(basename "$1")"
  53         if [ ! -e "$dst" ] || [ "$1" -nt "$dst" ]; then
  54                 cp -p -t "$2" "$1"
  55                 for llib in $(extract_libs "$1"); do
  56                         (pull_in_lib "$llib" lib)
  57                 done
  58         fi
  59         case "$(basename "$1")" in libc.*)
  60                 # grab libnss_compat.so.2 from libc location
  61                 (pull_in_lib "$(dirname "$1")/libnss_compat.so.2" "$2")
  62         esac
  63 }
  64
  65 # pull_in_bin takes two arguments:
  66 # 1: the full path to a binary to pull in (together with any library dependencies)
  67 # 2: the destination directory relative to the current directory to copy it to
  68 # for example, "pull_in_bin /bin/sh bin" will install the shell into the chroot bin directory
  69 # IMPORTANT: argument 1 must be a machine binary, NOT a shell script or other interpreted text
  70 # IMPORTANT: text scripts can simply be copied in or installed as they don't have libraries to copy
  71 # NOTE: it's expected that calling this function on a running chroot may cause temporary disruption
  72 pull_in_bin() {
  73         bin="$1"; dst="$2"
  74         cp -p -t "$dst" "$bin"
  75         # ...and all the dependencies.
  76         for lib in $(extract_libs "$bin"); do
  77                 pull_in_lib "$lib" lib
  78         done
  79 }
  80
  81 # A catch all that needs to be called after everything's been pulled in
  82 chroot_update_permissions() {
  83         chown -R 0:0 bin dev lib sbin var
  84 }
  85
  86 # nothing special here, the nc.openbsd compatible utility is nc.openbsd
  87 pull_in_bin /bin/nc.openbsd bin