Skip to content

Commit 9f2b2cb

Browse files
author
olevole
committed
jail: improved environment variables control (WIP)
1 parent d20bbb8 commit 9f2b2cb

File tree

33 files changed

+589
-154
lines changed

33 files changed

+589
-154
lines changed

‎Makefile

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,14 @@ distclean:
4949
${RM} -f bin/cbsd
5050
${RM} -f misc/efivar
5151
${RM} -f sbin/netmask
52-
${RM} -f misc/exec_jail
52+
${RM} -f misc/jexec_env
53+
${RM} -f misc/jail_env
5354
${RM} -f misc/sqlcli
5455
${RM} -f misc/pwcrypt
5556
${RM} -f misc/cbsdlogtail
5657
${RM} -f misc/elf_tables
5758
${RM} -f misc/fmagic
59+
${RM} -f misc/getshell
5860
${RM} -f misc/conv2human
5961
${RM} -f misc/cbsd_fwatch
6062
# x86_64 for DFLY
@@ -110,14 +112,16 @@ cbsd: pkg-config-check
110112
${CC} sbin/src/netmask.c -o sbin/netmask && ${STRIP} sbin/netmask
111113
${CC} bin/src/cfetch.c -o bin/cfetch -lcurl -L/usr/local/lib -I/usr/local/include && ${STRIP} bin/cfetch
112114
${CC} misc/src/efivar.c -o misc/efivar && ${STRIP} misc/efivar
113-
${CC} misc/src/exec_jail.c misc/exec_jail && ${STRIP} misc/exec_jail
115+
${CC} misc/src/jexec_env.c misc/jexec_env && ${STRIP} misc/jexec_env
116+
${CC} misc/src/jail_env.c misc/jail_env && ${STRIP} misc/jail_env
114117
${CC} misc/src/sqlcli.c `pkg-config sqlite3 --cflags --libs` -lm -o misc/sqlcli && ${STRIP} misc/sqlcli
115118
${CC} misc/src/cbsdlogtail.c -o misc/cbsdlogtail && ${STRIP} misc/cbsdlogtail
116119
${CC} misc/src/pwcrypt.c -lcrypt -o misc/pwcrypt && ${STRIP} misc/pwcrypt
117120
${CC} misc/src/chk_arp_byip.c -o misc/chk_arp_byip && ${STRIP} misc/chk_arp_byip
118121
${CC} misc/src/cbsdtee.c -o misc/cbsdtee && ${STRIP} misc/cbsdtee
119122
${CC} misc/src/elf_tables.c -I/usr/local/include -I/usr/local/include/libelf -L/usr/local/lib -lelf -o misc/elf_tables && ${STRIP} misc/elf_tables
120123
${CC} misc/src/fmagic.c -lmagic -o misc/fmagic && ${STRIP} misc/fmagic
124+
${CC} misc/src/getshell.c -o misc/getshell && ${STRIP} misc/getshell
121125
${CC} misc/src/conv2human.c -I/usr/local/include -I/usr/local/include/libelf -L/usr/local/lib -lelf -o misc/conv2human -lutil && ${STRIP} misc/conv2human
122126
${CC} misc/src/cbsd_fwatch.c -o misc/cbsd_fwatch && ${STRIP} misc/cbsd_fwatch
123127
${CC} misc/src/daemonize/daemonize.c misc/src/daemonize/getopt.c -Imisc/src/daemonize -O2 -o misc/daemonize && ${STRIP} misc/daemonize

‎bin/cbsdsh/mknodes.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -418,6 +418,7 @@ readline(FILE *infp)
418418

419419
if (fgets(line, 1024, infp) == NULL)
420420
return 0;
421+
421422
for (p = line; *p != '#' && *p != '\n' && *p != '\0'; p++)
422423
;
423424
while (p > line && (p[-1] == ' ' || p[-1] == '\t'))

‎etc/defaults/vm-freebsd-FreeBSD-x64-14.3.conf

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# don't remove this line:
2+
vm_profile="FreeBSD-x64-14.3"
3+
vm_os_type="freebsd"
4+
# this is one-string additional info strings in dialogue menu
5+
long_description="FreeBSD: 14.3-RELEASE"
6+
7+
# custom settings:
8+
fetch=1
9+
10+
# Official resources to fetch ISO's
11+
# /usr/libexec/bsdinstall/mirrorselect
12+
iso_site="https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/14.3/ \
13+
ftp://ftp1.fr.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/14.3/ \
14+
ftp://ftp.de.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/14.3/ \
15+
ftp://ftp.hk.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/14.3/ \
16+
ftp://ftp2.ru.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/14.3/ \
17+
ftp://ftp1.us.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/14.3/ \
18+
"
19+
20+
# Official CBSD project mirrors ( info: https://github.com/cbsd/mirrors )
21+
cbsd_iso_mirrors="https://mirror.convectix.com/iso/ https://raw.githubusercontent.com/cbsd/mirrors/refs/heads/main/cbsd-iso.txt"
22+
23+
iso_img="FreeBSD-14.3-RELEASE-amd64-disc1.iso"
24+
iso_img_dist="FreeBSD-14.3-RELEASE-amd64-disc1.iso.xz"
25+
26+
iso_extract="nice -n 19 ${IDLE_IONICE} ${XZ_CMD} -d ${iso_img_dist}"
27+
28+
# register_iso as:
29+
register_iso_name="cbsd-iso-${iso_img}"
30+
register_iso_as="iso-FreeBSD-x64-14.3-RELEASE-amd64-disc1"
31+
32+
default_jailname="freebsd"
33+
34+
# disable profile?
35+
xen_active=1
36+
bhyve_active=1
37+
qemu_active=1
38+
39+
# Available in ClonOS?
40+
clonos_active=1
41+
42+
# VNC
43+
vm_vnc_port="0"
44+
vm_efi="uefi"
45+
46+
vm_package="small1"
47+
48+
# VirtualBox Area
49+
virtualbox_ostype="FreeBSD_64"
50+
51+
sha256sum="ff02d4d90429dba7e09287b0d1c95463c583437213a7c98244cadc774b2642ea"
52+
iso_img_dist_size="857126648"
53+
54+
# enable birtio RNG interface?
55+
virtio_rnd="1"
56+
57+
# default boot firmware
58+
cd_boot_firmware="bhyve"
59+
hdd_boot_firmware="bhyve"

‎etc/defaults/vm-linux-OviOS-5.conf

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# don't remove this line:
2+
vm_profile="OviOS-5"
3+
vm_os_type="linux"
4+
# this is one-string additional info strings in dialogue menu
5+
long_description="OviOS: 5.0"
6+
7+
# custom settings:
8+
fetch=1
9+
10+
# Official resources to fetch ISO's
11+
iso_site="\
12+
https://phoenixnap.dl.sourceforge.net/project/ovios/ovios/ \
13+
https://www.OviOS.org/releases/ \
14+
"
15+
16+
# Official CBSD project mirrors ( info: https://github.com/cbsd/mirrors )
17+
cbsd_iso_mirrors="https://mirror.convectix.com/iso/ https://raw.githubusercontent.com/cbsd/mirrors/refs/heads/main/cbsd-iso.txt"
18+
19+
iso_img="OviOS_Linux_v5.0_DRACO_Edition.iso"
20+
21+
# register_iso as:
22+
register_iso_name="cbsd-iso-${iso_img}"
23+
register_iso_as="iso-${vm_profile}"
24+
25+
default_jailname="ovi"
26+
imgsize="64g"
27+
imgsize_min="64g"
28+
vm_ram="8g"
29+
30+
# VNC
31+
vm_vnc_port="0"
32+
vm_efi="uefi"
33+
34+
# disable profile?
35+
xen_active=1
36+
bhyve_active=1
37+
qemu_active=1
38+
39+
# Available in ClonOS?
40+
clonos_active=1
41+
sha256sum="86e89d77ac9da784fd437bfcff595b9529ce8764d1517909f76296b2d00bc534"
42+
iso_img_dist_size="1265106944"
43+
44+
virtio_type="ahci-hd"
45+
46+
# enable birtio RNG interface?
47+
virtio_rnd="1"
48+
49+
# firmware settings
50+
cd_boot_firmware="bhyve"
51+
hdd_boot_firmware="refind"
52+
53+
# vm_post_message in single line
54+
vm_post_message=" You need to add at least one additional disk, e.g: \n\n % cbsd bhyve-dsk mode=attach jname=${jname} dsk_controller=ahci-hd dsk_size=64g\n\n Default console credential:\n\n User:root\n Password: OviOS\n\n Deployment Wizard URL: https://${ip4_addr}:5001\n\nDefault Cluster UI credential (https://${ip4_addr}): admin/password\n\n"

‎misc/src/getshell.c

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <string.h>
4+
5+
#define MAX_LINE 1024
6+
7+
int main(int argc, char *argv[])
8+
{
9+
if (argc != 3) {
10+
fprintf(stderr, "Usage: %s <passwd_file> <username>\n", argv[0]);
11+
return 1;
12+
}
13+
14+
const char *passwd_path = argv[1];
15+
const char *username = argv[2];
16+
FILE *fp = fopen(passwd_path, "r");
17+
if (!fp) {
18+
printf("/bin/sh\n");
19+
return 1;
20+
}
21+
22+
char line[MAX_LINE];
23+
int found = 0;
24+
while (fgets(line, sizeof(line), fp)) {
25+
// Remove newline
26+
line[strcspn(line, "\n")] = 0;
27+
28+
// Format: user:passwd:uid:gid:gecos:home:shell
29+
char *saveptr;
30+
char *user = strtok_r(line, ":", &saveptr);
31+
if (!user) continue;
32+
if (strcmp(user, username) == 0) {
33+
// Skip to shell field
34+
char *field = NULL;
35+
for (int i = 0; i < 5; ++i) field = strtok_r(NULL, ":", &saveptr);
36+
char *shell = strtok_r(NULL, ":", &saveptr);
37+
printf("%s\n", shell ? shell : "/bin/sh");
38+
found = 1;
39+
break;
40+
}
41+
}
42+
fclose(fp);
43+
44+
if (!found) {
45+
printf("/bin/sh\n");
46+
return 1;
47+
}
48+
return 0;
49+
}

‎misc/src/exec_jail.c renamed to ‎misc/src/jail_env.c

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
// Part of the CBSD Project
2-
// Exec cmd via jexec
2+
// Similar to jexec_env but execute command in hoster, but call /usr/sbin/jail instead of jexec
3+
// In the long term, this could be used to run unprivileged containers (as a user other than root)
4+
// /usr/local/cbsd/misc/daemonize -e /usr/jails/ftmp/jstart.test.err -p /usr/jails/ftmp/jstart.test.88952 /usr/bin/nice -n 1 /usr/sbin/jail -f /usr/jails/ftmp/test.conf -c test
5+
// -> ${NICE_CMD} -n ${nice} ${SETFIB} ${CPUSET} ${miscdir}/exec_envjail /usr/jails/ftmp/test.conf
36
#include <stdio.h>
47
#include <stdlib.h>
58
#include <string.h>
@@ -39,6 +42,10 @@ int execute_cmd(char *jname, char **argv)
3942
{
4043
char *workdir = getenv("workdir");
4144
const char *term;
45+
const char *blocksize;
46+
int home_set=0, jexec_index=0, freebsd_ver=0;
47+
FILE *fp;
48+
char buffer[128];
4249

4350
if (!workdir) {
4451
fprintf(stderr, "Environment variable 'workdir' is not set.\n");
@@ -49,6 +56,10 @@ int execute_cmd(char *jname, char **argv)
4956
exit(1);
5057
}
5158

59+
// inherit TERM/BLOCKSIZE by default
60+
term = getenv("TERM");
61+
blocksize = getenv("BLOCKSIZE");
62+
5263
pid_t pid = fork();
5364

5465
if (pid == 0) {
@@ -59,10 +70,12 @@ int execute_cmd(char *jname, char **argv)
5970
cleanenv[0] = NULL;
6071

6172
// inherit TERM by default
62-
term = getenv("TERM");
6373
if (term != NULL)
6474
setenv("TERM", term, 1);
6575

76+
if (blocksize != NULL)
77+
setenv("BLOCKSIZE", blocksize, 1);
78+
6679
char env_path[512];
6780
snprintf(env_path, sizeof(env_path), "%s/jails-system/%s/environment", workdir, jname);
6881
jname_putenv(env_path);
@@ -72,29 +85,16 @@ int execute_cmd(char *jname, char **argv)
7285
// Build argv for jexec: {"jexec", jname, "/bin/sh", "-c", argv[2], NULL}
7386
#define MAX_JEXEC_ARGS 10
7487
char *jexec_argv[MAX_JEXEC_ARGS];
75-
jexec_argv[0] = "jexec";
76-
jexec_argv[1] = "-U";
77-
jexec_argv[2] = argv[2]; // user
78-
jexec_argv[3] = "-d";
79-
jexec_argv[4] = argv[3]; // Homedir
80-
jexec_argv[5] = jname;
81-
jexec_argv[6] = argv[4]; // Shell
82-
if ( argv[5] != NULL ) {
83-
jexec_argv[7] = "-c";
84-
jexec_argv[8] = argv[5]; // The quoted command string
85-
jexec_argv[9] = NULL;
86-
} else {
87-
jexec_argv[7] = NULL;
88-
}
89-
// if (argv[2] == NULL) {
90-
// fprintf(stderr, "No command specified.\n");
91-
// exit(1);
92-
// }
88+
jexec_argv[jexec_index++] = "jail";
9389

94-
// printf("/usr/sbin/jexec %s %s %s %s %s %s\n",jexec_argv[1],jexec_argv[2],jexec_argv[3],jexec_argv[4],jexec_argv[5],jexec_argv[6]);
90+
jexec_argv[jexec_index++] = "-f";
91+
jexec_argv[jexec_index++] = argv[2]; // config
92+
jexec_argv[jexec_index++] = "-c";
93+
jexec_argv[jexec_index++] = jname;
94+
jexec_argv[jexec_index++] = NULL;
9595

9696
// Execute the command with the new environment
97-
execv("/usr/sbin/jexec", jexec_argv);
97+
execv("/usr/sbin/jail", jexec_argv);
9898
// If execv returns, it failed
9999
perror("execv failed");
100100
exit(1);

0 commit comments

Comments
 (0)