jailsetup.sh

   1 #!/bin/sh
   2 # The Girocco jail setup script
   3 #
   4 # We are designed to set up the chroot based on binaries from
   5 # amd64 Debian lenny; some things may need slight modifications if
   6 # being run on a different distribution.
   7
   8 set -e
   9
  10 . ./shlib.sh
  11
  12 reserved_users="root sshd mob $cfg_cgi_user $cfg_mirror_user"
  13
  14 # Verify we have all we neeed.
  15 if ! getent group $cfg_owning_group >/dev/null; then
  16         echo "*** Error: You do not have $cfg_owning_group in system yet." >&2
  17         exit 1
  18 fi
  19
  20 umask 022
  21 mkdir -p "$cfg_chroot"
  22 cd "$cfg_chroot"
  23 chown root "$cfg_chroot"
  24 chmod 755 "$cfg_chroot"
  25
  26 # First, setup basic directory structure
  27 mkdir -p bin dev etc lib sbin srv/git var/run proc
  28 rm -f usr lib64
  29 ln -s . usr
  30 ln -s lib lib64
  31
  32 # Set up basic user/group configuration; if there is any already,
  33 # we hope it's the same numbers and users.
  34
  35 if [ ! -s etc/passwd ]; then
  36         cat >etc/passwd <<EOT
  37 sshd:x:101:65534:priviledge separation:/var/run/sshd:/bin/false
  38 $cfg_cgi_user:x:$(getent passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
  39 $cfg_mirror_user:x:$(getent passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
  40 mob::65538:65534:the mob:/:/bin/git-shell
  41 EOT
  42 fi
  43
  44 if [ ! -s etc/group ]; then
  45         cat >etc/group <<EOT
  46 _repo:x:$(getent group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
  47 EOT
  48 fi
  49
  50 # Seed up /dev:
  51 rm -f dev/null dev/zero dev/random dev/urandom
  52 mknod dev/null c 1 3
  53 mknod dev/zero c 1 5
  54 mknod dev/random c 1 8
  55 mknod dev/urandom c 1 9
  56 chmod a+rw dev/null dev/zero dev/random dev/urandom
  57
  58 # Set up mob user:
  59 touch var/run/mob
  60 chown 65538 var/run/mob
  61 chmod 0 var/run/mob
  62
  63 # Set up sshd configuration:
  64 mkdir -p var/run/sshd
  65 mkdir -p etc/sshkeys
  66 for ruser in $reserved_users; do
  67   touch etc/sshkeys/$ruser
  68 done
  69 chown -R $cfg_cgi_user:$cfg_owning_group etc/sshkeys
  70 chmod g+s etc/sshkeys
  71 chmod -R g+w etc/sshkeys
  72
  73 mkdir -p etc/ssh
  74 if [ ! -s etc/ssh/sshd_config ]; then
  75         cat >etc/ssh/sshd_config <<EOT
  76 Protocol        2
  77 Port            22
  78 UsePAM          no
  79 X11Forwarding   no
  80 PermitRootLogin no
  81 UsePrivilegeSeparation yes
  82
  83 AuthorizedKeysFile      /etc/sshkeys/%u
  84 StrictModes     no
  85
  86 # mob user:
  87 PermitEmptyPasswords    yes
  88 ChallengeResponseAuthentication no
  89 PasswordAuthentication  yes
  90 EOT
  91 fi
  92 if [ ! -s etc/ssh/ssh_host_dsa_key ]; then
  93         yes | ssh-keygen -N "" -C Girocco -t dsa -f etc/ssh/ssh_host_dsa_key
  94 fi
  95 if [ ! -s etc/ssh/ssh_host_rsa_key ]; then
  96         yes | ssh-keygen -N "" -C Girocco -t rsa -f etc/ssh/ssh_host_rsa_key
  97 fi
  98
  99 # Bring in basic libraries:
 100 rm -f lib/*
 101 # ld.so:
 102 cp -t lib /lib/ld-linux.so.2
 103 [ ! -d /lib64 ] || cp -t lib /lib64/ld-linux-x86-64.so.2
 104 # libc:
 105 cp -t lib /lib/libc.so.6 /lib/libcrypt.so.1 /lib/libutil.so.1 /lib/libnsl.so.1 /lib/libnss_compat.so.2 /lib/libresolv.so.2 /lib/libdl.so.2 /lib/libgcc_s.so.1
 106
 107 # Now, bring in sshd and sh.
 108
 109 pull_in_bin() {
 110         bin="$1"; dst="$2"
 111         cp -t "$dst" "$bin"
 112         # ...and all the dependencies.
 113         ldd "$bin" | grep -v linux-gate | grep -v linux-vdso | grep -v ld-linux | grep '=>' | awk '{print $3}' | xargs -r -- cp -u -t lib
 114 }
 115
 116 pull_in_bin /bin/sh bin
 117 pull_in_bin /bin/nc.openbsd bin
 118 # If /sbin/sshd is already running within the chroot, we get Text file busy.
 119 pull_in_bin /usr/sbin/sshd sbin || :
 120
 121 # ...and the bits of git we need.
 122 for i in git git-index-pack git-receive-pack git-shell git-update-server-info git-upload-archive git-upload-pack git-unpack-objects; do
 123         if [ -e /usr/lib/git-core/$i ]; then
 124                 pull_in_bin /usr/lib/git-core/$i bin
 125         else
 126                 pull_in_bin /usr/bin/$i bin
 127         fi
 128 done
 129
 130 echo "--- Add to your boot scripts: mount --bind $cfg_reporoot $cfg_chroot/srv/git"
 131 echo "--- Add to your boot scripts: mount --bind /proc $cfg_chroot/proc"
 132 echo "--- Add to your syslog configuration: listening on socket $cfg_chroot/dev/log"