mirror of
https://codeberg.org/scip/jaildk.git
synced 2025-12-19 21:51:02 +01:00
Compare commits
20 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| e728efaff5 | |||
| b8fe0d4c11 | |||
|
|
eabec94945 | ||
| b5efc90d29 | |||
| 5cd15ebff6 | |||
| f278760c06 | |||
| fa4b9c08ef | |||
|
|
5ca48c6d5c | ||
|
|
6738e74167 | ||
| 40371fc507 | |||
| b45bb280f9 | |||
| 26cc8b20d2 | |||
| 56a5f51585 | |||
| 5470154a12 | |||
| 10af21a48f | |||
| d76f960e69 | |||
| a00da3ffd4 | |||
| 54fb06fc7d | |||
|
|
aee232054b | ||
|
|
f2dde50ffc |
52
README.md
52
README.md
@@ -1,4 +1,11 @@
|
|||||||
## jaildk - a FreeBSD jail development kit v2.0.0
|
> [!CAUTION]
|
||||||
|
> This software is now being maintained on [Codeberg](https://codeberg.org/scip/leo/).
|
||||||
|
>
|
||||||
|
> However, due to limitations with woodpecker FreeBSD support, CI test workflows are still being executed here.
|
||||||
|
>
|
||||||
|
> Devs: no need to push to codeberg and github, there's a mirror script running somewhere else.
|
||||||
|
|
||||||
|
## jaildk - a FreeBSD jail development kit v2.0.4
|
||||||
|
|
||||||
## Breaking Changes
|
## Breaking Changes
|
||||||
|
|
||||||
@@ -608,6 +615,45 @@ Manipulate a jail specific table:
|
|||||||
|
|
||||||
`pfctl -a /jail/myjail -t blocked -T show`
|
`pfctl -a /jail/myjail -t blocked -T show`
|
||||||
|
|
||||||
|
## Generating pf rule sets
|
||||||
|
|
||||||
|
It is also possible to let jaildk generate the pf rule sets from the
|
||||||
|
jail config. You can generate `map`s and `rule`s. Maps will be used
|
||||||
|
for mapping ipv4 connections and rules primarily for ipv6.
|
||||||
|
|
||||||
|
A map is defined by a name. You can define many maps. Example:
|
||||||
|
|
||||||
|
```toml
|
||||||
|
map_prom_exposed_port="9100"
|
||||||
|
map_prom_exposed_ip="172.16.1.1"
|
||||||
|
map_prom_allow_from="10.2.3.4" # optional, default: any allowed
|
||||||
|
```
|
||||||
|
|
||||||
|
Then you reference the maps like this:
|
||||||
|
|
||||||
|
```toml
|
||||||
|
maps="prom web git"
|
||||||
|
```
|
||||||
|
|
||||||
|
You can also specify the ip address used to connect to the outside:
|
||||||
|
|
||||||
|
```toml
|
||||||
|
masq_ip="172.16.1.1"
|
||||||
|
```
|
||||||
|
|
||||||
|
Rules are being used for incoming ipv6 traffic, which is being routed
|
||||||
|
only. The semtantics are the same:
|
||||||
|
|
||||||
|
```toml
|
||||||
|
rules="web git"
|
||||||
|
|
||||||
|
rule_web_proto="tcp"
|
||||||
|
rule_web_port="{80,443}"
|
||||||
|
|
||||||
|
rule_git_proto="tcp"
|
||||||
|
rule_git_port="22"
|
||||||
|
```
|
||||||
|
|
||||||
## Getting help
|
## Getting help
|
||||||
|
|
||||||
Although I'm happy to hear from jaildk users in private email,
|
Although I'm happy to hear from jaildk users in private email,
|
||||||
@@ -615,7 +661,7 @@ that's the best way for me to forget to do something.
|
|||||||
|
|
||||||
In order to report a bug, unexpected behavior, feature requests
|
In order to report a bug, unexpected behavior, feature requests
|
||||||
or to submit a patch, please open an issue on github:
|
or to submit a patch, please open an issue on github:
|
||||||
https://github.com/TLINDEN/jaildk/issues.
|
https://codeberg.org/scip/jaildk/issues.
|
||||||
|
|
||||||
## Copyright and license
|
## Copyright and license
|
||||||
|
|
||||||
@@ -629,5 +675,5 @@ F.Sass (Culsu)
|
|||||||
|
|
||||||
## Project homepage
|
## Project homepage
|
||||||
|
|
||||||
https://github.com/TLINDEN/jaildk
|
https://codeberg.org/scip/jaildk
|
||||||
|
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
|
|
||||||
version=2.0.3
|
version=2.0.5
|
||||||
|
|
||||||
# this will be completed during build. Don't touch it, just execute
|
# this will be completed during build. Don't touch it, just execute
|
||||||
# make and use the resulting script!
|
# make and use the resulting script!
|
||||||
@@ -1065,6 +1065,10 @@ jaildk_clone() {
|
|||||||
die "new version must be different from source version!"
|
die "new version must be different from source version!"
|
||||||
fi
|
fi
|
||||||
update=1
|
update=1
|
||||||
|
else
|
||||||
|
if test -e "$j/etc/$new/mount.conf" -o -e "$j/etc/$new/jail.conf"; then
|
||||||
|
die "Destination jail $new already exist, cloning would overwrite it!"
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
die_if_not_exist $src "Source jail"
|
die_if_not_exist $src "Source jail"
|
||||||
@@ -1155,7 +1159,7 @@ jaildk_clone() {
|
|||||||
# FIXME: possibly not needed! see comment in jaildk_create()
|
# FIXME: possibly not needed! see comment in jaildk_create()
|
||||||
# jail=$new
|
# jail=$new
|
||||||
bold "To mount the build chroot of the new jail, execute:"
|
bold "To mount the build chroot of the new jail, execute:"
|
||||||
echo "jaildk build $new start -b $base -v $newversion"
|
echo "jaildk build $new -m start -b $base -v $newversion"
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -1286,15 +1290,14 @@ jaildk_jail() {
|
|||||||
jail=$2
|
jail=$2
|
||||||
|
|
||||||
if test "x$mode" = "xstatus"; then
|
if test "x$mode" = "xstatus"; then
|
||||||
(
|
|
||||||
if test -z "$jail" -o "$jail" = "-h"; then
|
if test -z "$jail" -o "$jail" = "-h"; then
|
||||||
bold "Running jails:"
|
bold "Running jails:"
|
||||||
lookup='*'
|
lookup='*'
|
||||||
else
|
else
|
||||||
bold "Status $jail:"
|
bold "Status of $jail:"
|
||||||
lookup=$jail
|
lookup=$jail
|
||||||
fi
|
fi
|
||||||
|
(
|
||||||
echo "Jail IP-Address Path Is-Running RW-mounted Current-Version Base"
|
echo "Jail IP-Address Path Is-Running RW-mounted Current-Version Base"
|
||||||
grep -h "name=" $j/etc/$lookup/jail.conf | cut -d= -f2 | while read jail; do
|
grep -h "name=" $j/etc/$lookup/jail.conf | cut -d= -f2 | while read jail; do
|
||||||
jid=''
|
jid=''
|
||||||
@@ -1317,7 +1320,7 @@ jaildk_jail() {
|
|||||||
|
|
||||||
if jls -j $jail > /dev/null 2>&1; then
|
if jls -j $jail > /dev/null 2>&1; then
|
||||||
# jail is running, get some data about jail
|
# jail is running, get some data about jail
|
||||||
eval $(jls -j v6 -qn ip4.addr ip6.addr jid)
|
eval $(jls -j $jail -qn ip4.addr ip6.addr jid path | sed 's/\.addr/addr/g')
|
||||||
if test -n "$ip4addr"; then
|
if test -n "$ip4addr"; then
|
||||||
ip=$ip4addr
|
ip=$ip4addr
|
||||||
else
|
else
|
||||||
@@ -1529,7 +1532,7 @@ jaildk_login() {
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
jid=""
|
jid=""
|
||||||
jid=`jls | grep "$jail" | awk '{print $1}'`
|
jid=$(jls -j "$jail" jid)
|
||||||
|
|
||||||
if test -z "$jid"; then
|
if test -z "$jid"; then
|
||||||
echo "jail $jail doesn't run!"
|
echo "jail $jail doesn't run!"
|
||||||
@@ -1778,7 +1781,7 @@ jaildk_update() {
|
|||||||
rcscript=update
|
rcscript=update
|
||||||
force=''
|
force=''
|
||||||
|
|
||||||
repo="https://github.com/TLINDEN/jaildk.git"
|
repo="https://codeberg.org/scip/jaildk.git"
|
||||||
mustberoot
|
mustberoot
|
||||||
|
|
||||||
OPTIND=1; while getopts "f" arg; do
|
OPTIND=1; while getopts "f" arg; do
|
||||||
|
|||||||
Reference in New Issue
Block a user