mirror of
https://codeberg.org/scip/jaildk.git
synced 2025-12-16 12:11:05 +01:00
Compare commits
17 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| b5efc90d29 | |||
| 5cd15ebff6 | |||
| f278760c06 | |||
| fa4b9c08ef | |||
|
|
5ca48c6d5c | ||
|
|
6738e74167 | ||
| 40371fc507 | |||
| b45bb280f9 | |||
| 26cc8b20d2 | |||
| 56a5f51585 | |||
| 5470154a12 | |||
| 10af21a48f | |||
| d76f960e69 | |||
| a00da3ffd4 | |||
| 54fb06fc7d | |||
|
|
aee232054b | ||
|
|
f2dde50ffc |
16
.github/assets/jail.conf
vendored
Normal file
16
.github/assets/jail.conf
vendored
Normal file
@@ -0,0 +1,16 @@
|
||||
* {
|
||||
exec.start = "/bin/sh /etc/rc";
|
||||
exec.stop = "/bin/sh /etc/rc.shutdown";
|
||||
allow.raw_sockets = "false";
|
||||
sysvmsg = "new";
|
||||
sysvsem = "new";
|
||||
sysvshm = "new";
|
||||
host.hostname = $name;
|
||||
path = "/jail/run/$name";
|
||||
exec.prestart = "/jail/bin/jaildk install $name start";
|
||||
exec.clean = "true";
|
||||
}
|
||||
|
||||
test {
|
||||
ip4.addr = "172.16.0.1";
|
||||
}
|
||||
52
.github/workflows/ci.yaml
vendored
Normal file
52
.github/workflows/ci.yaml
vendored
Normal file
@@ -0,0 +1,52 @@
|
||||
name: Test-Jaildk
|
||||
|
||||
on: [push]
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
name: Test jaildk on FreeBSD
|
||||
steps:
|
||||
- name: checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Test in FreeBSD
|
||||
uses: vmactions/freebsd-vm@v1
|
||||
id: testjaildk
|
||||
with:
|
||||
release: "14.1"
|
||||
usesh: true
|
||||
prepare: |
|
||||
pkg install -y curl cpdup
|
||||
|
||||
run: |
|
||||
freebsd-version
|
||||
sysctl hw.model
|
||||
sysctl hw.ncpu
|
||||
sysctl hw.physmem
|
||||
sysctl hw.usermem
|
||||
ls -la
|
||||
ifconfig em0 172.16.0.1/32 alias
|
||||
ifconfig -a
|
||||
set -x -e
|
||||
sysrc jail_enable="YES"
|
||||
cp .github/assets/jail.conf /etc/
|
||||
|
||||
cp src/jaildk.sh jaildk
|
||||
sh jaildk setup /jail
|
||||
|
||||
fetch https://download.freebsd.org/ftp/releases/amd64/amd64/14.1-RELEASE/base.txz -o /jail/base/14.1-RELEASE-base.txz
|
||||
mkdir -p /jail/base/14.1-RELEASE
|
||||
tar -xf /jail/base/14.1-RELEASE-base.txz -C /jail/base/14.1-RELEASE --unlink
|
||||
|
||||
/jail/bin/jaildk create test
|
||||
ls -l /jail/etc/test
|
||||
/jail/bin/jaildk build test -m start
|
||||
df -h /jail/build/test/etc
|
||||
|
||||
echo 'sshd_enable="Yes"' > /jail/build/test/usr/local/etc/rc.conf
|
||||
chroot /jail/build/test /etc/rc.d/sshd keygen
|
||||
|
||||
/jail/bin/jaildk start test
|
||||
/jail/bin/jaildk status | grep -E "test|Jail"
|
||||
|
||||
|
||||
43
README.md
43
README.md
@@ -1,4 +1,6 @@
|
||||
## jaildk - a FreeBSD jail development kit v2.0.0
|
||||
[](https://github.com/tlinden/jaildk/actions)
|
||||
|
||||
## jaildk - a FreeBSD jail development kit v2.0.4
|
||||
|
||||
## Breaking Changes
|
||||
|
||||
@@ -608,6 +610,45 @@ Manipulate a jail specific table:
|
||||
|
||||
`pfctl -a /jail/myjail -t blocked -T show`
|
||||
|
||||
## Generating pf rule sets
|
||||
|
||||
It is also possible to let jaildk generate the pf rule sets from the
|
||||
jail config. You can generate `map`s and `rule`s. Maps will be used
|
||||
for mapping ipv4 connections and rules primarily for ipv6.
|
||||
|
||||
A map is defined by a name. You can define many maps. Example:
|
||||
|
||||
```toml
|
||||
map_prom_exposed_port="9100"
|
||||
map_prom_exposed_ip="172.16.1.1"
|
||||
map_prom_allow_from="10.2.3.4" # optional, default: any allowed
|
||||
```
|
||||
|
||||
Then you reference the maps like this:
|
||||
|
||||
```toml
|
||||
maps="prom web git"
|
||||
```
|
||||
|
||||
You can also specify the ip address used to connect to the outside:
|
||||
|
||||
```toml
|
||||
masq_ip="172.16.1.1"
|
||||
```
|
||||
|
||||
Rules are being used for incoming ipv6 traffic, which is being routed
|
||||
only. The semtantics are the same:
|
||||
|
||||
```toml
|
||||
rules="web git"
|
||||
|
||||
rule_web_proto="tcp"
|
||||
rule_web_port="{80,443}"
|
||||
|
||||
rule_git_proto="tcp"
|
||||
rule_git_port="22"
|
||||
```
|
||||
|
||||
## Getting help
|
||||
|
||||
Although I'm happy to hear from jaildk users in private email,
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
|
||||
version=2.0.3
|
||||
version=2.0.5
|
||||
|
||||
# this will be completed during build. Don't touch it, just execute
|
||||
# make and use the resulting script!
|
||||
@@ -1065,6 +1065,10 @@ jaildk_clone() {
|
||||
die "new version must be different from source version!"
|
||||
fi
|
||||
update=1
|
||||
else
|
||||
if test -e "$j/etc/$new/mount.conf" -o -e "$j/etc/$new/jail.conf"; then
|
||||
die "Destination jail $new already exist, cloning would overwrite it!"
|
||||
fi
|
||||
fi
|
||||
|
||||
die_if_not_exist $src "Source jail"
|
||||
@@ -1155,7 +1159,7 @@ jaildk_clone() {
|
||||
# FIXME: possibly not needed! see comment in jaildk_create()
|
||||
# jail=$new
|
||||
bold "To mount the build chroot of the new jail, execute:"
|
||||
echo "jaildk build $new start -b $base -v $newversion"
|
||||
echo "jaildk build $new -m start -b $base -v $newversion"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -1286,15 +1290,14 @@ jaildk_jail() {
|
||||
jail=$2
|
||||
|
||||
if test "x$mode" = "xstatus"; then
|
||||
if test -z "$jail" -o "$jail" = "-h"; then
|
||||
bold "Running jails:"
|
||||
lookup='*'
|
||||
else
|
||||
bold "Status of $jail:"
|
||||
lookup=$jail
|
||||
fi
|
||||
(
|
||||
if test -z "$jail" -o "$jail" = "-h"; then
|
||||
bold "Running jails:"
|
||||
lookup='*'
|
||||
else
|
||||
bold "Status $jail:"
|
||||
lookup=$jail
|
||||
fi
|
||||
|
||||
echo "Jail IP-Address Path Is-Running RW-mounted Current-Version Base"
|
||||
grep -h "name=" $j/etc/$lookup/jail.conf | cut -d= -f2 | while read jail; do
|
||||
jid=''
|
||||
@@ -1317,7 +1320,7 @@ jaildk_jail() {
|
||||
|
||||
if jls -j $jail > /dev/null 2>&1; then
|
||||
# jail is running, get some data about jail
|
||||
eval $(jls -j v6 -qn ip4.addr ip6.addr jid)
|
||||
eval $(jls -j $jail -qn ip4.addr ip6.addr jid path | sed 's/\.addr/addr/g')
|
||||
if test -n "$ip4addr"; then
|
||||
ip=$ip4addr
|
||||
else
|
||||
@@ -1529,7 +1532,7 @@ jaildk_login() {
|
||||
fi
|
||||
|
||||
jid=""
|
||||
jid=`jls | grep "$jail" | awk '{print $1}'`
|
||||
jid=$(jls -j "$jail" jid)
|
||||
|
||||
if test -z "$jid"; then
|
||||
echo "jail $jail doesn't run!"
|
||||
@@ -2483,7 +2486,7 @@ sanitycheck() {
|
||||
for program in cpdup; do
|
||||
if ! command -v $program 2>&1 >/dev/null; then
|
||||
echo "$program must be installed!" >&2
|
||||
exit1
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user