17 Commits
v2.0.3 ... main

Author SHA1 Message Date
b5efc90d29 fix #37: match jail name to id correctly 2025-04-06 15:16:50 +02:00
5cd15ebff6 fix #34: add documentation for pf rule generation 2025-04-01 12:55:25 +02:00
f278760c06 fix #36: forbid cloning to existing jail if name differs 2025-04-01 09:25:38 +02:00
fa4b9c08ef fix documentation issue #35: do not recommend invalid command line 2025-04-01 09:20:24 +02:00
T.v.Dein
5ca48c6d5c Add ci badge 2024-10-15 20:40:40 +02:00
T.v.Dein
6738e74167 Add -xe to CI run to see commands and exit immediately 2024-10-15 20:28:41 +02:00
40371fc507 fix base src tarball 2024-10-15 19:14:48 +02:00
b45bb280f9 manually build base, next try 2024-10-15 19:09:46 +02:00
26cc8b20d2 add sysrc call to enable jail 2024-10-15 18:48:48 +02:00
56a5f51585 install cpdup during prep 2024-10-15 18:45:56 +02:00
5470154a12 do really exit 1 2024-10-15 18:45:42 +02:00
10af21a48f another try, this time w/o make 2024-10-15 18:40:43 +02:00
d76f960e69 not using PATH 2024-10-15 18:32:40 +02:00
a00da3ffd4 fix yaml 2024-10-15 18:30:32 +02:00
54fb06fc7d added ci test runner 2024-10-15 18:22:47 +02:00
T.v.Dein
aee232054b Merge pull request #28 from Culsu/main
Fix for issue  #27
2024-10-15 08:26:28 +02:00
Culsu
f2dde50ffc fixed an error where jaildk status was trying to find a jail called v6, also fixed some column alignment when printing the status 2024-10-14 23:42:08 +02:00
4 changed files with 126 additions and 14 deletions

16
.github/assets/jail.conf vendored Normal file
View File

@@ -0,0 +1,16 @@
* {
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
allow.raw_sockets = "false";
sysvmsg = "new";
sysvsem = "new";
sysvshm = "new";
host.hostname = $name;
path = "/jail/run/$name";
exec.prestart = "/jail/bin/jaildk install $name start";
exec.clean = "true";
}
test {
ip4.addr = "172.16.0.1";
}

52
.github/workflows/ci.yaml vendored Normal file
View File

@@ -0,0 +1,52 @@
name: Test-Jaildk
on: [push]
jobs:
test:
runs-on: ubuntu-latest
name: Test jaildk on FreeBSD
steps:
- name: checkout
uses: actions/checkout@v4
- name: Test in FreeBSD
uses: vmactions/freebsd-vm@v1
id: testjaildk
with:
release: "14.1"
usesh: true
prepare: |
pkg install -y curl cpdup
run: |
freebsd-version
sysctl hw.model
sysctl hw.ncpu
sysctl hw.physmem
sysctl hw.usermem
ls -la
ifconfig em0 172.16.0.1/32 alias
ifconfig -a
set -x -e
sysrc jail_enable="YES"
cp .github/assets/jail.conf /etc/
cp src/jaildk.sh jaildk
sh jaildk setup /jail
fetch https://download.freebsd.org/ftp/releases/amd64/amd64/14.1-RELEASE/base.txz -o /jail/base/14.1-RELEASE-base.txz
mkdir -p /jail/base/14.1-RELEASE
tar -xf /jail/base/14.1-RELEASE-base.txz -C /jail/base/14.1-RELEASE --unlink
/jail/bin/jaildk create test
ls -l /jail/etc/test
/jail/bin/jaildk build test -m start
df -h /jail/build/test/etc
echo 'sshd_enable="Yes"' > /jail/build/test/usr/local/etc/rc.conf
chroot /jail/build/test /etc/rc.d/sshd keygen
/jail/bin/jaildk start test
/jail/bin/jaildk status | grep -E "test|Jail"

View File

@@ -1,4 +1,6 @@
## jaildk - a FreeBSD jail development kit v2.0.0
[![Actions](https://github.com/tlinden/jaildk/actions/workflows/ci.yaml/badge.svg)](https://github.com/tlinden/jaildk/actions)
## jaildk - a FreeBSD jail development kit v2.0.4
## Breaking Changes
@@ -608,6 +610,45 @@ Manipulate a jail specific table:
`pfctl -a /jail/myjail -t blocked -T show`
## Generating pf rule sets
It is also possible to let jaildk generate the pf rule sets from the
jail config. You can generate `map`s and `rule`s. Maps will be used
for mapping ipv4 connections and rules primarily for ipv6.
A map is defined by a name. You can define many maps. Example:
```toml
map_prom_exposed_port="9100"
map_prom_exposed_ip="172.16.1.1"
map_prom_allow_from="10.2.3.4" # optional, default: any allowed
```
Then you reference the maps like this:
```toml
maps="prom web git"
```
You can also specify the ip address used to connect to the outside:
```toml
masq_ip="172.16.1.1"
```
Rules are being used for incoming ipv6 traffic, which is being routed
only. The semtantics are the same:
```toml
rules="web git"
rule_web_proto="tcp"
rule_web_port="{80,443}"
rule_git_proto="tcp"
rule_git_port="22"
```
## Getting help
Although I'm happy to hear from jaildk users in private email,

View File

@@ -1,6 +1,6 @@
#!/bin/sh
version=2.0.3
version=2.0.5
# this will be completed during build. Don't touch it, just execute
# make and use the resulting script!
@@ -1065,6 +1065,10 @@ jaildk_clone() {
die "new version must be different from source version!"
fi
update=1
else
if test -e "$j/etc/$new/mount.conf" -o -e "$j/etc/$new/jail.conf"; then
die "Destination jail $new already exist, cloning would overwrite it!"
fi
fi
die_if_not_exist $src "Source jail"
@@ -1155,7 +1159,7 @@ jaildk_clone() {
# FIXME: possibly not needed! see comment in jaildk_create()
# jail=$new
bold "To mount the build chroot of the new jail, execute:"
echo "jaildk build $new start -b $base -v $newversion"
echo "jaildk build $new -m start -b $base -v $newversion"
fi
}
@@ -1286,15 +1290,14 @@ jaildk_jail() {
jail=$2
if test "x$mode" = "xstatus"; then
if test -z "$jail" -o "$jail" = "-h"; then
bold "Running jails:"
lookup='*'
else
bold "Status of $jail:"
lookup=$jail
fi
(
if test -z "$jail" -o "$jail" = "-h"; then
bold "Running jails:"
lookup='*'
else
bold "Status $jail:"
lookup=$jail
fi
echo "Jail IP-Address Path Is-Running RW-mounted Current-Version Base"
grep -h "name=" $j/etc/$lookup/jail.conf | cut -d= -f2 | while read jail; do
jid=''
@@ -1317,7 +1320,7 @@ jaildk_jail() {
if jls -j $jail > /dev/null 2>&1; then
# jail is running, get some data about jail
eval $(jls -j v6 -qn ip4.addr ip6.addr jid)
eval $(jls -j $jail -qn ip4.addr ip6.addr jid path | sed 's/\.addr/addr/g')
if test -n "$ip4addr"; then
ip=$ip4addr
else
@@ -1529,7 +1532,7 @@ jaildk_login() {
fi
jid=""
jid=`jls | grep "$jail" | awk '{print $1}'`
jid=$(jls -j "$jail" jid)
if test -z "$jid"; then
echo "jail $jail doesn't run!"
@@ -2483,7 +2486,7 @@ sanitycheck() {
for program in cpdup; do
if ! command -v $program 2>&1 >/dev/null; then
echo "$program must be installed!" >&2
exit1
exit 1
fi
done
}