2 # The Girocco jail setup script
4 # If the first parameter is "dbonly", setup the database only
6 # We are designed to set up the chroot based on the output of
7 # `uname -s` by sourcing a suitable system-specific script.
8 # Unrecognized systems will generate an error. When using
9 # "dbonly" the setup of the chroot binaries is skipped so the
10 # output of `uname -s` does not matter in that case.
16 getent
="$srcdir/getent"
19 # find_std_utility should always come up with the full path to the standard
20 # version of the utility whose name is passed as "$1"
21 getconf
="/usr/bin/getconf"
22 [ -x "$getconf" ] || getconf
="/bin/getconf"
23 [ -x "$getconf" ] || getconf
="getconf"
24 stdpath
="$("unset" -f command; "command" "$getconf" "PATH
" 2>/dev/null)" ||
:
25 ":" "${stdpath:=/bin:/usr/bin}"
26 stdpath
="$stdpath:/sbin:/usr/sbin"
28 "unset" -f unalias command "$1" >/dev
/null
2>&1 ||
:
29 "unalias" -a >/dev
/null
2>&1 ||
:
30 PATH
="$stdpath" && "export" PATH ||
:
35 [ "$1" != "dbonly" ] || dbonly
=1
37 reserved_users
="root sshd _sshd mob git lock bundle nobody everyone $cfg_cgi_user $cfg_mirror_user"
39 # Require either sshd or _sshd user unless "dbonly"
41 if ! "$getent" passwd sshd
>/dev
/null
&& ! "$getent" passwd _sshd
>/dev
/null
; then
42 if [ -n "$dbonly" ]; then
43 if ! [ -s etc
/passwd
]; then
44 # Only complain on initial etc/passwd creation
45 echo "WARNING: no sshd or _sshd user, omitting entries from chroot etc/passwd"
49 echo "*** Error: You do not have required sshd or _sshd user in system." >&2
53 "$getent" passwd sshd
>/dev
/null || sshd_user
=_sshd
56 # Verify we have all we need
57 if ! "$getent" passwd
"$cfg_mirror_user" >/dev
/null
; then
58 echo "*** Error: You do not have \"$cfg_mirror_user\" user in system yet." >&2
61 if ! "$getent" passwd
"$cfg_cgi_user" >/dev
/null
; then
62 echo "*** Error: You do not have \"$cfg_cgi_user\" user in system yet." >&2
65 if [ -n "$dbonly" ] && [ -z "$cfg_owning_group" ]; then
66 cfg_owning_group
="$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 4)"
67 elif ! "$getent" group
"$cfg_owning_group" >/dev
/null
; then
68 echo "*** Error: You do not have \"$cfg_owning_group\" group in system yet." >&2
72 # One last paranoid check before we go writing all over everything
73 if [ -z "$cfg_chroot" ] ||
[ "$cfg_chroot" = "/" ]; then
74 echo "*** Error: chroot location is not set or is invalid." >&2
75 echo "*** Error: perhaps you have an incorrect Config.pm?" >&2
80 mkdir
-p "$cfg_chroot"
82 chmod 755 "$cfg_chroot" ||
83 echo "WARNING: Cannot chmod $cfg_chroot"
86 chmod 0555 var
/empty ||
87 echo "WARNING: Cannot chmod a=rx $cfg_chroot/var/empty"
89 # Set up basic user/group configuration; if there isn't any already
91 [ -n "$cfg_mob" ] || mobpass
='x'
93 if ! [ -s etc
/passwd
]; then
95 root:x:0:0:system administrator:/var/empty:/bin/false
96 nobody:x:$("$getent" passwd nobody | cut -d : -f 3-4):unprivileged user:/var/empty:/bin/false
98 [ -z "$sshd_user" ] ||
cat >>etc
/passwd
<<EOT
99 sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
100 _sshd:x:$("$getent" passwd $sshd_user | cut -d : -f 3-4):privilege separation:/var/empty:/bin/false
102 [ "$cfg_cgi_user" = "$cfg_mirror_user" ] ||
cat >>etc
/passwd
<<EOT
103 $cfg_cgi_user:x:$("$getent" passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
105 cat >>etc
/passwd
<<EOT
106 $cfg_mirror_user:x:$("$getent" passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
107 everyone:x:65537:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):every user:/:/bin/false
108 mob:$mobpass:65538:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):the mob:/:/bin/git-shell-verify
109 git::65539:$("$getent" passwd nobody | cut -d : -f 4):read-only access:/:/bin/git-shell-verify
111 elif [ -z "$dbonly" ]; then
112 # Make sure an sshd entry is present
113 if ! grep -q '^sshd:' etc
/passwd
; then
114 echo "*** Error: chroot etc/passwd exists but lacks sshd entry." >&2
119 if ! [ -s etc
/group
]; then
121 _repo:x:$("$getent" group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
125 # Set up basic default Git configuration
126 # Initialize one if none exists or update critical variables for an existing one
129 if [ -e etc
/girocco
/.gitconfig
] && ! [ -f etc
/girocco
/.gitconfig
]; then
130 echo "*** Error: chroot etc/girocco/.gitconfig exists but is not a file." >&2
133 if [ -f etc
/girocco
/.gitconfig
]; then
135 x
="$(git config --file etc/girocco/.gitconfig --get "no--such--section.no such subsection.no--such--key
")" || gcerr
=$?
136 if [ $gcerr -gt 1 ]; then
137 echo "*** Error: chroot etc/girocco/.gitconfig exists but is corrupt." >&2
138 echo "*** Error: either remove it or edit it to correct the problem." >&2
142 if ! [ -s etc
/girocco
/.gitconfig
]; then
143 chmod u
+w etc
/girocco
145 cat >etc
/girocco
/.gitconfig
<<EOT
146 # Any values set here will take effect whenever Girocco runs a git command
150 # $1 => name, $2 => value, $3 => overwrite_flag
151 # if $3 is "2" and $2 is "" value will be unset
152 update_config_item
() {
155 _oldval
="$(git config --file etc/girocco/.gitconfig --get "$1")" || _existsnot
=1
156 if [ -n "$_existsnot" ]; then
157 [ -n "$2" ] ||
[ "$3" != "2" ] ||
return 0
159 [ -n "$3" ] ||
return 0
160 [ "$_oldval" != "$2" ] ||
{ [ "$3" = "2" ] && [ -z "$2" ]; } ||
return 0
162 [ -n "$didchmod" ] ||
{ chmod u
+w etc
/girocco
; didchmod
=1; }
163 if [ "$3" = "2" ] && [ -z "$2" ]; then
164 git config
--file etc
/girocco
/.gitconfig
--unset "$1"
166 git config
--file etc
/girocco
/.gitconfig
"$1" "$2"
168 if [ -n "$_existsnot" ]; then
169 echo "chroot: etc/girocco/.gitconfig: config $1: (created) \"$2\""
170 elif [ "$3" = "2" ] && [ -z "$2" ]; then
171 echo "chroot: etc/girocco/.gitconfig: config $1: (removed)"
173 echo "chroot: etc/girocco/.gitconfig: config $1: \"$_oldval\" -> \"$2\""
176 if [ -n "$cfg_git_no_mmap" ]; then
177 update_config_item core.packedGitWindowSize
1m
1
179 update_config_item core.packedGitWindowSize
32m
1
181 if [ -n "$var_window_memory" ]; then
182 update_config_item pack.windowMemory
"$var_window_memory" 1
184 if [ -n "$cfg_jgit_compatible_bitmaps" ]; then
185 update_config_item pack.writeBitmapHashCache false
1
187 update_config_item pack.writeBitmapHashCache true
1
189 update_config_item core.pager
"cat" 1
190 update_config_item core.compression
5
191 update_config_item transfer.unpackLimit
1 1
192 update_config_item http.lowSpeedLimit
1
193 update_config_item http.lowSpeedTime
600
194 update_config_item receive.advertisePushOptions false
1
195 update_config_item receive.maxInputSize
"${cfg_max_receive_size:-0}" 1
196 update_config_item girocco.notifyHook
"${cfg_default_notifyhook}" 2
198 # set up some default ssh client config just in case (e.g. git-svn)
199 if [ -e etc
/girocco
/.
ssh ] && ! [ -d etc
/girocco
/.
ssh ]; then
200 echo "*** Error: chroot etc/girocco/.ssh exists but is not a directory." >&2
203 if [ -e etc
/girocco
/.ssh
/config
] && ! [ -f etc
/girocco
/.ssh
/config
]; then
204 echo "*** Error: chroot etc/girocco/.ssh/config exists but is not a file." >&2
207 if ! [ -s etc
/girocco
/.ssh
/config
]; then
208 chmod u
+w etc
/girocco
210 [ -d etc
/girocco
/.
ssh ] || mkdir etc
/girocco
/.
ssh
211 cat >etc
/girocco
/.ssh
/config
<<EOT
212 # Any values set here will take effect whenever Girocco svn runs an ssh client command
214 StrictHostKeyChecking no
216 UserKnownHostsFile /dev/null
220 [ -z "$didchmod" ] ||
chmod a-w etc
/girocco
222 mkdir
-p etc
/sshkeys etc
/sshcerts etc
/sshactive
223 for ruser
in $reserved_users; do
224 touch etc
/sshkeys
/$ruser
226 chgrp
$cfg_owning_group etc etc
/sshkeys etc
/sshcerts etc
/sshactive ||
227 echo "WARNING: Cannot chgrp $cfg_owning_group the etc directories"
228 chgrp
$cfg_owning_group etc
/passwd ||
229 echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/passwd"
230 chgrp
$cfg_owning_group etc
/group ||
231 echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/group"
232 chgrp
$cfg_owning_group etc
/girocco etc
/girocco
/.gitconfig ||
233 echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/girocco"
234 chgrp
$cfg_owning_group etc
/girocco
/.
ssh etc
/girocco
/.ssh
/config ||
235 echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_chroot/etc/.ssh"
236 chmod g
+s etc etc
/sshkeys etc
/sshcerts etc
/sshactive ||
237 echo "WARNING: Cannot chmod g+s the etc directories"
238 chmod g
+w etc etc
/sshkeys etc
/sshcerts etc
/sshactive ||
239 echo "WARNING: Cannot chmod g+w the etc directories"
240 chmod g
+w etc
/passwd etc
/group ||
241 echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
242 chmod go-w etc
/passwd etc
/girocco etc
/girocco
/.gitconfig ||
243 echo "WARNING: Cannot chmod go-w etc/girocco and/or etc/girocco/.gitconfig"
244 chmod go-w etc
/girocco
/.
ssh etc
/girocco
/.ssh
/config ||
245 echo "WARNING: Cannot chmod go-w etc/girocco/.ssh and/or etc/girocco/.ssh/config"
246 chmod go-rwx etc
/girocco
/.ssh
/config ||
247 echo "WARNING: Cannot chmod go-rwx etc/girocco/.ssh/config"
248 chmod a-w etc
/girocco
/.
ssh ||
249 echo "WARNING: Cannot chmod a-w etc/girocco/.ssh"
250 chmod a-w etc
/girocco ||
251 echo "WARNING: Cannot chmod a-w etc/girocco"
252 chmod -R g
+w etc
/sshkeys etc
/sshcerts etc
/sshactive
2>/dev
/null ||
253 echo "WARNING: Cannot chmod g+w the sshkeys, sshcerts and/or sshactive files"
255 # Note time of last install
256 >etc
/sshactive
/_install
258 [ -z "$dbonly" ] ||
exit 0
260 # Make sure the system type is supported for chroot
261 sysname
="$(uname -s | tr A-Z a-z)" ||
:
264 # These equivalents may need to be expanded at some point
278 chrootsetup
="$curdir/chrootsetup_$sysname.sh"
279 if ! [ -f "$chrootsetup" ] ||
! [ -r "$chrootsetup" ] ||
! [ -s "$chrootsetup" ]; then
280 echo "*** Error: $chrootsetup not found" >&2
281 echo "*** Error: creating a chroot for a $(uname -s) system is not supported" >&2
285 # validate reporoot, chroot, jailreporoot and sshd_bin before doing anything more
287 # validates the passed in dir if a second argument is not empty dir must NOT
288 # start with / otherwise it must. A trailing '/' is removed and any duplicated
289 # // are removed and a sole / or empty is disallowed.
291 _check
="$(echo "$1" | tr -s /)"
293 [ -n "$_check" ] && [ "$_check" != "/" ] ||
return 1
295 # must start with '/'
296 case "$_check" in /*) :;; *) return 1; esac
298 # must NOT start with '/'
299 case "$_check" in /*) return 1; esac
304 if ! reporoot
="$(make_valid_dir "$cfg_reporoot")"; then
305 echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
306 echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
309 if ! chroot
="$(make_valid_dir "$cfg_chroot")"; then
310 echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
311 echo "*** Error: MUST start with '/' and MUST NOT be '/'" >&2
314 if ! jailreporoot
="$(make_valid_dir "$cfg_jailreporoot" 1)"; then
315 echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
316 echo "*** Error: MUST NOT start with '/' and MUST NOT be ''" >&2
320 # chroot MUST NOT be reporoot
321 if [ "$chroot" = "$reporoot" ]; then
322 echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
323 echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
324 echo "*** Error: reporoot and chroot MUST NOT be the same" >&2
328 # chroot MUST NOT be a subdirectory of reporoot
329 case "$chroot" in "$reporoot"/*)
330 echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
331 echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
332 echo "*** Error: chroot MUST NOT be a subdirectory of reporoot" >&2
336 # chroot/jailreporoot MUST NOT be a subdirectory of reporoot
337 case "$chroot/$jailreporoot" in "$reporoot"/*)
338 echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
339 echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
340 echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
341 echo "*** Error: chroot/jailreporoot MUST NOT be a subdirectory of reporoot" >&2
345 # reporoot MUST NOT be a subdirectory of chroot/jailreporoot
346 case "$reporoot" in "$chroot/$jailreporoot"/*)
347 echo "*** Error: invalid Config::reporoot: $cfg_reporoot" >&2
348 echo "*** Error: invalid Config::chroot: $cfg_chroot" >&2
349 echo "*** Error: invalid Config::jailreporoot: $cfg_jailreporoot" >&2
350 echo "*** Error: reporoot MUST NOT be a subdirectory of chroot/jailreporoot" >&2
354 # sshd_bin MUST be undef (or empty) or a full absolute path
356 case "$cfg_sshd_bin" in *"/../"*) sshd_bin_bad
=1;; ""|
/?
*) :;; *) sshd_bin_bad
=1;; esac
357 [ -z "$sshd_bin_bad" ] ||
{
358 echo "*** Error: invalid Config::sshd_bin $cfg_sshd_bin" >&2
359 echo "*** Error: if set, sshd_bin must be an absolute path" >&2
362 sshd_bin
="$cfg_sshd_bin"
363 [ -n "$sshd_bin" ] || sshd_bin
="$(find_std_utility "sshd
")" ||
{
364 echo "*** Error: Config::sshd_bin is not set and no sshd could be found" >&2
365 echo "*** Error: please set Config::sshd_bin to an absolute path to sshd" >&2
368 [ -x "$sshd_bin" ] && [ -r "$sshd_bin" ] && [ -f "$sshd_bin" ] ||
{
369 echo "*** Error: the selected sshd ('$sshd_bin') was not found, not readable or not executable" >&2
373 # Set the user and group on the top of the chroot before creating anything else
376 # When we create a fork, the alternates always have an absolute path.
377 # If reporoot is not --bind mounted at the same location in chroot we must
378 # create a suitable symlink so the absolute path alternates continue to work
379 # in the ssh chroot or else forks will be broken in there.
380 if [ "$reporoot" != "/$jailreporoot" ]; then
381 mkdirp
="$(dirname "${reporoot#/}")"
382 [ "$mkdirp" = "." ] && mkdirp
=
384 [ -z "$mkdirp" ] || lnback
="$(echo "$mkdirp/" | sed -e 's,[^/]*/,../,g')"
385 [ -z "$mkdirp" ] || mkdir
-p "$chroot/$mkdirp"
386 (umask 0; ln -s -f -n "$lnback$jailreporoot" "$chroot$reporoot")
387 [ $?
-eq 0 ] ||
exit 1
390 # First, setup basic platform-independent directory structure
391 mkdir
-p bin dev etc lib sbin var
/empty var
/run
"$jailreporoot"
397 # Now source the platform-specific script that is responsible for dev device
398 # setup, proc setup (if needed), lib64 setup (if needed) and basic library
399 # installation to make a chroot operational. Additionally it will define a
400 # pull_in_bin function that can be used to add executables and their library
401 # dependencies to the chroot and finally will install a suitable nc.openbsd
402 # compatible version of netcat that supports connections to unix sockets.
405 # Now, bring in sshd, sh etc.
406 # The $chrootsetup script should have already provided a suitable nc.openbsd
407 install -p "$cfg_basedir/bin/git-shell-verify" bin
/git-shell-verify.new
408 install -p "$cfg_basedir/bin/git-askpass-password" bin
/git-askpass-password.new
410 -e 's|^#!.*|#!/bin/sh| if $. == 1;' \
411 -e 'close ARGV if eof;' \
412 bin
/git-shell-verify.new bin
/git-askpass-password.new
413 mv -f bin
/git-askpass-password.new bin
/git-askpass-password
414 mv -f bin
/git-shell-verify.new bin
/git-shell-verify
415 pull_in_bin
"$cfg_basedir/bin/can_user_push" bin
416 pull_in_bin
"$cfg_basedir/bin/list_packs" bin
417 pull_in_bin
"$cfg_basedir/bin/strftime" bin
418 pull_in_bin
"$var_sh_bin" bin
/sh
419 # be paranoid since these are going into the chroot and make sure
420 # that we get the "standard" versions of them (they are all standard "POSIX"
421 # utilities) not some wayward version picked up by a haphazard PATH
422 pull_in_bin
"$(find_std_utility cat )" bin
423 pull_in_bin
"$(find_std_utility chmod )" bin
424 pull_in_bin
"$(find_std_utility date )" bin
425 pull_in_bin
"$(find_std_utility find )" bin
426 pull_in_bin
"$(find_std_utility mkdir )" bin
427 pull_in_bin
"$(find_std_utility mv )" bin
428 pull_in_bin
"$(find_std_utility rm )" bin
429 pull_in_bin
"$(find_std_utility sleep )" bin
430 pull_in_bin
"$(find_std_utility sort )" bin
431 pull_in_bin
"$(find_std_utility touch )" bin
432 pull_in_bin
"$(find_std_utility tr )" bin
433 pull_in_bin
"$(find_std_utility wc )" bin
434 # this one's already been validated and might be in a non-standard location
435 pull_in_bin
"$sshd_bin" sbin
437 # ...and the bits of git we need,
438 # being sure to use the configured git and its --exec-path to find the pieces
439 for i
in git git-index-pack git-receive-pack git-shell git-update-server-info \
440 git-upload-archive git-upload-pack git-unpack-objects git-config \
441 git-for-each-ref git-rev-list git-rev-parse git-symbolic-ref
; do
442 pull_in_bin
"$var_git_exec_path/$i" bin git
445 # ...and any extras identified by install.sh
446 # these are also all standard "POSIX" utilities
447 # ones that a decent sh implementation would have built-in already...
448 if [ -n "$GIROCCO_CHROOT_EXTRA_INSTALLS" ]; then
449 for i
in $GIROCCO_CHROOT_EXTRA_INSTALLS; do
450 pull_in_bin
"$(find_std_utility "$
(basename "$i")")" bin
454 # Note time of last jailsetup
455 >etc
/sshactive
/_jailsetup
457 # Update permissions on the database files
458 chown
$cfg_cgi_user:$cfg_owning_group etc
/passwd etc
/group
459 chown
-R $cfg_cgi_user:$cfg_owning_group etc
/sshkeys etc
/sshcerts etc
/sshactive
460 chown
$cfg_mirror_user:$cfg_owning_group etc etc
/girocco etc
/girocco
/.gitconfig
462 # Set up basic sshd configuration:
463 if [ -n "$nosshdir" ]; then
466 ! [ -f /etc
/moduli
] ||
{ cp -p /etc
/moduli etc
/; chown
0:0 etc
/moduli
; }
468 ! [ -e etc
/ssh ] ||
[ -d etc
/ssh ] ||
rm -rf etc
/ssh
470 ! [ -f /etc
/ssh
/moduli
] ||
{ cp -p /etc
/ssh
/moduli etc
/ssh
/; chown
0:0 etc
/ssh
/moduli
; }
472 mkdir
-p var
/run
/sshd
473 if ! [ -s etc
/ssh
/sshd_config
]; then
474 cat >etc
/ssh
/sshd_config
<<EOT
476 Port $cfg_sshd_jail_port
479 AllowAgentForwarding no
480 AllowTcpForwarding no
482 IgnoreUserKnownHosts yes
487 UsePrivilegeSeparation yes
489 HostKey /etc/ssh/ssh_host_rsa_key
491 if [ -z "$cfg_disable_dsa" ]; then
492 cat >>etc
/ssh
/sshd_config
<<EOT
493 HostKey /etc/ssh/ssh_host_dsa_key
496 cat >>etc
/ssh
/sshd_config
<<EOT
497 AuthorizedKeysFile /etc/sshkeys/%u
501 PermitEmptyPasswords yes
502 ChallengeResponseAuthentication no
503 PasswordAuthentication yes
506 if ! [ -s etc
/ssh
/ssh_host_rsa_key
]; then
508 if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev
/null
; then
509 bits
="$cfg_rsakeylength"
511 yes | ssh-keygen
-b "$bits" -t rsa
-N "" -C Girocco
-f etc
/ssh
/ssh_host_rsa_key
513 if [ -z "$cfg_disable_dsa" ] && ! [ -s etc
/ssh
/ssh_host_dsa_key
]; then
514 # ssh-keygen can only create 1024 bit DSA keys
515 yes | ssh-keygen
-b 1024 -t dsa
-N "" -C Girocco
-f etc
/ssh
/ssh_host_dsa_key
518 # Set the final permissions on the binaries and perform any final twiddling
519 chroot_update_permissions
521 # Change the owner of the sshd-related files
522 chown
0:0 etc
/ssh
/ssh_
* etc
/ssh
/sshd_
*
524 echo "--- Add to your boot scripts: mount --bind $reporoot $chroot/$jailreporoot"
525 echo "--- Add to your boot scripts: mount --bind /proc $chroot/proc"
526 echo "--- Add to your syslog configuration: listening on socket $chroot/dev/log"
527 echo "--- To restart a running jail's sshd: sudo kill -HUP \$(cat $chroot/var/run/sshd.pid)"