Mercurial > hgrepos > FreeBSD > ports > sysutils > local-bsdtools
annotate bin/fjail @ 74:247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
| author | Franz Glasner <hg@dom66.de> |
|---|---|
| date | Thu, 15 Aug 2019 15:58:24 +0200 |
| parents | 2e991a00035b |
| children | 2e3ac70bdfc8 |
| rev | line source |
|---|---|
|
72
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
1 #!/bin/sh |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
2 # -*- indent-tabs-mode: nil; -*- |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
3 # @(#)$HGid$ |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
4 |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
5 set -eu |
| 73 | 6 |
| 7 VERSION="@@VERSION@@" | |
| 8 | |
| 9 # Reset to standard umask | |
| 10 umask 0022 | |
| 11 | |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
12 |
| 73 | 13 # |
| 14 # "datasets" -- create the ZFS dataset tree | |
| 15 # | |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
16 # command_datasets [ -u ] parent-dataset child-dataset |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
17 # |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
18 # -u do not automatically mount newly created datasets |
| 73 | 19 # |
| 20 command_datasets() { | |
| 21 # parent ZFS dataset -- child ZFS dataset name | |
| 22 local _pds _cds | |
| 23 # and its mount point | |
| 24 local _pmp _get _dummy | |
| 25 # full name of the dataset | |
| 26 local _ds | |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
27 # dynamic ZFS options |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
28 local _zfsopts |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
29 |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
30 _zfsopts="" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
31 while getopts "u" _opt ; do |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
32 case ${_opt} in |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
33 u) |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
34 # do not mount newly created datasets |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
35 _zfsopts="${_zfsopts} -u" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
36 ;; |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
37 \?|:) |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
38 return 2; |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
39 ;; |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
40 esac |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
41 done |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
42 shift $((OPTIND-1)) |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
43 OPTIND=1 |
| 73 | 44 |
| 45 _pds="$1" | |
| 46 if [ -z "${_pds}" ]; then | |
| 47 echo "ERROR: no parent dataset given" >&2 | |
| 48 return 2 | |
| 49 fi | |
| 50 _get=$(zfs get -H mountpoint "${_pds}" 2>/dev/null) || { echo "ERROR: dataset \`${_pds}' does not exist" >&2; return 1; } | |
| 51 IFS=$'\t' read _dummy _dummy _pmp _dummy <<EOF | |
| 52 ${_get} | |
| 53 EOF | |
| 54 case "${_pmp}" in | |
| 55 none) | |
| 56 echo "ERROR: dataset \`${_pds}' has no mountpoint" >&2 | |
| 57 return 1 | |
| 58 ;; | |
| 59 legacy) | |
| 60 echo "ERROR: dataset \`${_pds}' has a \`${_mp}' mountpoint" >&2 | |
| 61 return 1 | |
| 62 ;; | |
| 63 *) | |
| 64 # VOID | |
| 65 ;; | |
| 66 esac | |
| 67 _cds="$2" | |
| 68 if [ -z "${_cds}" ]; then | |
| 69 echo "ERROR: no child dataset given" >&2 | |
| 70 return 2 | |
| 71 fi | |
| 72 _ds="${_pds}/${_cds}" | |
| 73 echo "Resulting new root dataset is \`${_ds}' at mountpoint \`${_pmp}/${_cds}'" | |
| 74 if zfs get -H mountpoint "${_ds}" >/dev/null 2>/dev/null; then | |
| 75 echo "ERROR: dataset \`${_ds}' does already exist" >&2 | |
| 76 return 1 | |
| 77 fi | |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
78 zfs create ${_zfsopts} -o atime=off "${_ds}" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
79 zfs create ${_zfsopts} -o sync=disabled -o setuid=off "${_ds}/tmp" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
80 zfs create ${_zfsopts} "${_ds}/usr" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
81 zfs create ${_zfsopts} "${_ds}/var" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
82 zfs create ${_zfsopts} -o exec=off -o setuid=off "${_ds}/var/audit" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
83 zfs create ${_zfsopts} -o exec=off -o setuid=off "${_ds}/var/cache" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
84 zfs create ${_zfsopts} -o exec=off -o setuid=off -o compression=off "${_ds}/var/cache/pkg" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
85 zfs create ${_zfsopts} -o exec=off -o setuid=off -o compression=off "${_ds}/var/crash" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
86 zfs create ${_zfsopts} -o exec=off -o setuid=off "${_ds}/var/db" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
87 zfs create ${_zfsopts} -o exec=on -o setuid=off "${_ds}/var/db/pkg" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
88 zfs create ${_zfsopts} -o readonly=on -o exec=off -o setuid=off "${_ds}/var/empty" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
89 zfs create ${_zfsopts} -o exec=off -o setuid=off -o primarycache=metadata "${_ds}/var/log" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
90 zfs create ${_zfsopts} -o exec=off -o setuid=off -o atime=on "${_ds}/var/mail" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
91 zfs create ${_zfsopts} -o sync=disabled -o exec=off -o setuid=off -o compression=off -o primarycache=all "${_ds}/var/run" |
|
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
92 zfs create ${_zfsopts} -o sync=disabled -o setuid=off "${_ds}/var/tmp" |
| 73 | 93 } |
| 94 | |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
95 |
| 73 | 96 # |
| 97 # "privs" -- adjust privileges | |
| 98 # | |
| 99 # To be used when all ZFS datasets are mounted. | |
| 100 # | |
| 101 command_privs() { | |
| 102 # mountpoint | |
| 103 local _mp _d | |
| 104 | |
| 105 _mp="$1" | |
| 106 if [ -z "${_mp}" ]; then | |
| 107 echo "ERROR: no mountpoint given" >&2 | |
| 108 return 2 | |
| 109 fi | |
| 110 if [ ! -d "${_mp}" ]; then | |
| 111 echo "ERROR: directory \`${_mp}' does not exist" >&2 | |
| 112 return 1 | |
| 113 fi | |
| 114 for _d in tmp var/tmp ; do | |
| 115 chmod 01777 "${_mp}/${_d}" | |
| 116 done | |
| 117 chown root:mail "${_mp}/var/mail" | |
| 118 chmod 0775 "${_mp}/var/mail" | |
| 119 } | |
|
72
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
120 |
|
74
247d35f910ca
fjail datasets now recognized a "-u" command option to not automatically mount created datasets
Franz Glasner <hg@dom66.de>
parents:
73
diff
changeset
|
121 |
|
72
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
122 # |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
123 # Global option handling |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
124 # |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
125 while getopts "h" _opt ; do |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
126 case ${_opt} in |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
127 h) |
| 73 | 128 echo "Usage: XXX TBD" |
|
72
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
129 exit 0 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
130 ;; |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
131 \?|:) |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
132 exit 2; |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
133 ;; |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
134 esac |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
135 done |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
136 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
137 # |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
138 # Reset the Shell's option handling system to prepare for handling |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
139 # command-local options. |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
140 # |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
141 shift $((OPTIND-1)) |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
142 OPTIND=1 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
143 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
144 command="$1" |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
145 shift |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
146 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
147 case "${command}" in |
| 73 | 148 datasets) |
| 149 command_datasets "$@" | |
| 150 ;; | |
| 151 privs) | |
| 152 command_privs "$@" | |
| 153 ;; | |
|
72
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
154 *) |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
155 echo "ERROR" >&2 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
156 exit 2 |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
157 ;; |
|
929051be7845
Begin a simple (ZFS-related) jail setup tool
Franz Glasner <fzglas.hg@dom66.de>
parents:
diff
changeset
|
158 esac |
