ref updates: switch from ref-change to ref-changes
[girocco.git] / chrootsetup_linux.sh
blob0af061076a4c4927c58efda658aae059ff66dfb3
1 # chrootsetup_linux.sh
3 # This file SHOULD NOT be executable! It is sourced by jailsetup.sh and
4 # SHOULD NOT be executed directly!
6 # On entry the current directory will be set to the top of the chroot
7 # This script must perform platform-specific chroot setup which includes
8 # creating any dev device entries, setting up proc (if needed), setting
9 # up lib64 (if needed) as well as installing a basic set of whatever libraries
10 # are needed for a chroot to function on this platform.
12 # This script must also define a pull_in_bin function that may be called to
13 # install an executable together with any libraries it depends on into the
14 # chroot.
16 # Finally this script must install a suitable nc.openbsd compatible version of
17 # netcat into the chroot jail that's available as nc.openbsd and which supports
18 # connects to unix sockets.
20 # We are designed to set up the chroot based on binaries from
21 # amd64 Debian lenny; some things may need slight modifications if
22 # being run on a different distribution.
24 mkdir -p dev proc selinux
25 chown 0:0 proc selinux
26 rm -f lib64
27 ln -s lib lib64
29 # Seed up /dev:
30 rm -f dev/null dev/zero dev/random dev/urandom
31 mknod dev/null c 1 3
32 mknod dev/zero c 1 5
33 mknod dev/random c 1 8
34 mknod dev/urandom c 1 9
35 chmod a+rw dev/null dev/zero dev/random dev/urandom
37 # Extra directories
38 mkdir -p var/run/sshd var/tmp
40 # Bring in basic libraries:
41 rm -f lib/*
42 # ld.so:
43 cp -p -t lib /lib/ld-linux*.so*
44 [ ! -d /lib64 ] || cp -p -t lib /lib64/ld-linux*64.so*
46 # Besides '=>' libs, attempt to pick up absolute path libs and create a symlink for upto one level deep
47 extract_libs() {
48 ldd "$1" | grep -v -e linux-gate -e linux-vdso -e ld-linux | awk '{print $1 " " $2 " " $3}' | \
49 while read -r _f1 _f2 _f3; do
50 case "$_f2" in
51 "=>")
52 echo "$_f3"
54 "(0x"*)
55 case "$_f1" in /*.so*)
56 _basedir="$(dirname "$_f1")"
57 _basedir="${_basedir#/}"
58 _basedir="${_basedir#usr/}"
59 case "$_basedir" in
60 lib)
61 echo "$_f1"
63 lib/?*)
64 _basedir="${_basedir#lib/}"
65 case "$_basedir" in */*) :;; *)
66 if [ ! -e "lib/$_basedir" ]; then
67 ln -s . "lib/$_basedir"
69 echo "$_f1"
70 esac
71 esac
72 esac
73 esac
74 done
77 pull_in_lib() {
78 [ -f "$1" ] || return
79 dst="${2%/}/$(basename "$1")"
80 if [ ! -e "$dst" ] || [ "$1" -nt "$dst" ]; then
81 cp -p -t "$2" "$1"
82 for llib in $(extract_libs "$1"); do
83 (pull_in_lib "$llib" lib)
84 done
86 case "$(basename "$1")" in libc.*)
87 # grab libnss_compat.so* from libc location
88 for nlib in "$(dirname "$1")/libnss_compat."so*; do
89 (pull_in_lib "$nlib" "$2")
90 done
91 esac
94 # pull_in_bin takes two arguments:
95 # 1: the full path to a binary to pull in (together with any library dependencies)
96 # 2: the destination directory relative to the current directory to copy it to
97 # 3: optional name of binary that if already in $2 and the same as $1 hard link to instead
98 # for example, "pull_in_bin /bin/sh bin" will install the shell into the chroot bin directory
99 # IMPORTANT: argument 1 must be a machine binary, NOT a shell script or other interpreted text
100 # IMPORTANT: text scripts can simply be copied in or installed as they don't have libraries to copy
101 # NOTE: it's expected that calling this function on a running chroot may cause temporary disruption
102 # In order to avoid a busy error while replacing binaries we first copy the binary to the
103 # var/tmp directory and then force move it into place after the libs have been brought in.
104 pull_in_bin() {
105 bin="$1"; bdst="$2"
106 if [ -n "$3" ] && [ "$3" != "$(basename "$bin")" ] && \
107 [ -r "${bdst%/}/$3" ] && cmp -s "$bin" "${bdst%/}/$3"; then
108 ln -f "${bdst%/}/$3" "${bdst%/}/$(basename "$bin")"
109 return 0
111 cp -p -t var/tmp "$bin"
112 # ...and all the dependencies.
113 for lib in $(extract_libs "$bin"); do
114 pull_in_lib "$lib" lib
115 done
116 mv -f "var/tmp/$(basename "$bin")" "${bdst%/}/"
119 # A catch all that needs to be called after everything's been pulled in
120 chroot_update_permissions() {
121 rm -rf var/tmp
122 chown -R 0:0 bin dev lib sbin var
125 # nothing special here, the nc.openbsd compatible utility is nc.openbsd
126 pull_in_bin /bin/nc.openbsd bin