~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

• browse files at revision 1281.1.7
• compare with another revision
• download diff
• download tarball
• view history from revision 1281.1.7

• reverse the comparison (1281.1.7 to 1839)
• stop comparing with revision 1839

Show diffs side-by-side

added

removed

bin/ivle-buildjail

18

18

 

19

19

import optparse

20

20

import os

21

 

import stat

22

21

import sys

23

22

import shutil

24

23

 

 

24

import ivle.conf

25

25

import ivle.config

26

26

import ivle.jailbuilder.debian

27

27

 

28

 

class UnsafeJail(Exception):

29

 

    pass

30

 

 

31

28

usage = """usage: %prog [options]

32

29

(requires root)

33

30

Builds or updates the base IVLE jail."""

34

31

 

35

 

# Requires root

36

 

if os.getuid() != 0:

37

 

    print >> sys.stderr, "This script requires root privileges to run"

38

 

    sys.exit(1)

39

 

 

40

32

conf = ivle.config.Config()

41

 

build_path = conf['paths']['jails']['template_build']

 

33

build_path = ivle.conf.jail_system_build

42

34

 

43

35

# Parse arguments

44

36

parser = optparse.OptionParser(usage)

51

43

    help='''Apply any package updates in the jail.''')

52

44

parser.add_option("-m", "--mirror",

53

45

    action="store", dest="apt_mirror",

54

 

    help="Sets the apt mirror.", default=conf['jail']['mirror'])

 

46

    help="Sets the apt mirror.", default="http://archive.ubuntu.com/ubuntu")

55

47

parser.add_option("--python-site-packages",

56

48

    action="store", dest="python_site_packages",

57

49

    help="Path to Python site packages directory inside the jail.",

79

71

    if options.apt_mirror is not None:

80

72

        os.environ['MIRROR'] = options.apt_mirror

81

73

 

82

 

    # Print a final warning to the user that this is a potentially-expensive

83

 

    # operation

84

 

    recreating = "Re-creating" if os.path.exists(build_path) else "Creating"

85

 

    print_mirror = options.apt_mirror or 'http://archive.ubuntu.com/ubuntu'

86

 

    print """%s jail from %s

87

 

Be warned, this may download hundreds of megabytes!

88

 

If this is the wrong source, please cancel now (note that it is too late to

89

 

save the existing jail; you will have to rebuild the jail from scratch now).\

90

 

""" % (recreating, print_mirror)

91

 

 

92

74

    os.system('rm -rf --one-file-system ' + build_path)

93

75

    ivle.jailbuilder.debian.debootstrap_create_jail(conf['jail']['suite'],

94

76

              build_path, mirror=options.apt_mirror)

95

77

 

96

78

    ivle.jailbuilder.debian.apt_update_cache(build_path)

97

 

    # Minimal required packages

98

79

    ivle.jailbuilder.debian.apt_install(build_path,

99

 

            ['python', 'python-simplejson', 'python-svn', 'python-configobj'])

 

80

                        ['python2.5', 'python-cjson', 'python-svn'])

100

81

 

101

82

    ivle.jailbuilder.debian.apt_clean(build_path)

102

83

 

128

109

 

129

110

    ivle.jailbuilder.debian.apt_clean(build_path)

130

111

 

131

 

    # Configure locales to allow en_US.UTF-8 (which IVLE uses)

132

 

    ivle.jailbuilder.debian._execute_in_chroot(build_path,

133

 

        ['locale-gen', 'en_US.UTF-8'])

134

 

 

135

112

if conf['jail']['devmode']:

136

113

    # Copy all console and operating system files into the jail

137

 

    services_path = os.path.join(conf['paths']['share'], 'services')

 

114

    services_path = os.path.join(ivle.conf.share_path, 'services')

138

115

    jail_services_path = os.path.join(build_path, services_path[1:])

139

116

    if os.path.exists(jail_services_path):

140

117

        shutil.rmtree(jail_services_path)

160

137

        shutil.rmtree(jail_site_packages)

161

138

    shutil.copytree(ivle_site_packages, jail_site_packages)

162

139

 

163

 

    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,

164

 

    # so name resolution is less unlikely to work.

165

 

    shutil.copy(

166

 

        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))

167

 

    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))

168

 

    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))

169

 

 

170

 

# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,

171

 

# and /var/{lock,tmp} should die.

172

 

for path in ('tmp', 'var/lock', 'var/tmp'):

173

 

    path = os.path.join(build_path, path)

174

 

    os.chmod(path, os.stat(path).st_mode & ~stat.S_IWOTH)

175

 

 

176

 

# Verify that nothing in the jail is world-writable.

177

 

# We don't want students to write into places that others can see.

178

 

try:

179

 

    for path, dirs, files in os.walk(build_path):

180

 

        for dname in dirs:

181

 

            d = os.path.join(path, dname)

182

 

            if os.path.islink(d):

183

 

                continue

184

 

            if os.stat(d).st_mode & stat.S_IWOTH:

185

 

                raise UnsafeJail(d)

186

 

 

187

 

        for fname in files:

188

 

            f = os.path.join(path, fname)

189

 

            if os.path.islink(f):

190

 

                continue

191

 

            if os.stat(f).st_mode & stat.S_IWOTH:

192

 

                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

193

 

                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

194

 

                                            'random', 'urandom')

195

 

                    ):

196

 

                    continue

197

 

                raise UnsafeJail(f)

198

 

except UnsafeJail, e:

199

 

    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.

200

 

This is a security vulnerability as jail template contents are shared between 

201

 

users. Please either make this path world unwriteable or remove it from the 

202

 

jail."""%str(e)

203

 

    sys.exit(1)

204

 

 

205

 

# Copy jail template build to actual jail template

206

 

template_path = conf['paths']['jails']['template']

207

140

if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',

208

 

              build_path + '/', template_path]) != 0:

 

141

              build_path + '/', ivle.conf.jail_system]) != 0:

209

142

    print >> sys.stderr, "Jail copying failed."

210

143

    sys.exit(1)

211

144

 

212

145

# Now mangle things a bit, so we can bind-mount the user bits in.

213

146

# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home

214

147

 

215

 

os.rename(os.path.join(template_path, 'etc/passwd'),

216

 

          os.path.join(template_path, 'home/.passwd')

 

148

os.rename(os.path.join(ivle.conf.jail_system, 'etc/passwd'),

 

149

          os.path.join(ivle.conf.jail_system, 'home/.passwd')

217

150

          )

218

 

os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))

 

151

os.symlink('../home/.passwd', os.path.join(ivle.conf.jail_system, 'etc/passwd'))

219

152

 

220

 

os.makedirs(os.path.join(template_path, "etc/ivle"))

 

153

os.makedirs(os.path.join(ivle.conf.jail_system, "etc/ivle"))

221

154

os.symlink('../../home/.ivle.conf',

222

 

           os.path.join(template_path, "etc/ivle/ivle.conf"))

 

155

           os.path.join(ivle.conf.jail_system, "etc/ivle/ivle.conf"))

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1