~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

• browse files at revision 1300
• compare with another revision
• download diff
• download tarball
• view history from revision 1300

• reverse the comparison (1300 to 1833)
• stop comparing with revision 1833

Show diffs side-by-side

added

removed

bin/ivle-buildjail

22

22

import sys

23

23

import shutil

24

24

 

 

25

import ivle.conf

25

26

import ivle.config

26

27

import ivle.jailbuilder.debian

27

28

 

32

33

(requires root)

33

34

Builds or updates the base IVLE jail."""

34

35

 

35

 

# Requires root

36

 

if os.getuid() != 0:

37

 

    print >> sys.stderr, "This script requires root privileges to run"

38

 

    sys.exit(1)

39

 

 

40

36

conf = ivle.config.Config()

41

 

build_path = conf['paths']['jails']['template_build']

 

37

build_path = ivle.conf.jail_system_build

42

38

 

43

39

# Parse arguments

44

40

parser = optparse.OptionParser(usage)

79

75

    if options.apt_mirror is not None:

80

76

        os.environ['MIRROR'] = options.apt_mirror

81

77

 

82

 

    # Print a final warning to the user that this is a potentially-expensive

83

 

    # operation

84

 

    recreating = "Re-creating" if os.path.exists(build_path) else "Creating"

85

 

    print_mirror = options.apt_mirror or 'http://archive.ubuntu.com/ubuntu'

86

 

    print """%s jail from %s

87

 

Be warned, this may download hundreds of megabytes!

88

 

If this is the wrong source, please cancel now (note that it is too late to

89

 

save the existing jail; you will have to rebuild the jail from scratch now).\

90

 

""" % (recreating, print_mirror)

91

 

 

92

78

    os.system('rm -rf --one-file-system ' + build_path)

93

79

    ivle.jailbuilder.debian.debootstrap_create_jail(conf['jail']['suite'],

94

80

              build_path, mirror=options.apt_mirror)

95

81

 

96

82

    ivle.jailbuilder.debian.apt_update_cache(build_path)

97

 

    # Minimal required packages

98

83

    ivle.jailbuilder.debian.apt_install(build_path,

99

 

            ['python', 'python-simplejson', 'python-svn', 'python-configobj'])

 

84

                        ['python2.5', 'python-cjson', 'python-svn'])

100

85

 

101

86

    ivle.jailbuilder.debian.apt_clean(build_path)

102

87

 

128

113

 

129

114

    ivle.jailbuilder.debian.apt_clean(build_path)

130

115

 

131

 

    # Configure locales to allow en_US.UTF-8 (which IVLE uses)

132

 

    ivle.jailbuilder.debian._execute_in_chroot(build_path,

133

 

        ['locale-gen', 'en_US.UTF-8'])

134

 

 

135

116

if conf['jail']['devmode']:

136

117

    # Copy all console and operating system files into the jail

137

 

    services_path = os.path.join(conf['paths']['share'], 'services')

 

118

    services_path = os.path.join(ivle.conf.share_path, 'services')

138

119

    jail_services_path = os.path.join(build_path, services_path[1:])

139

120

    if os.path.exists(jail_services_path):

140

121

        shutil.rmtree(jail_services_path)

160

141

        shutil.rmtree(jail_site_packages)

161

142

    shutil.copytree(ivle_site_packages, jail_site_packages)

162

143

 

163

 

    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,

164

 

    # so name resolution is less unlikely to work.

165

 

    shutil.copy(

166

 

        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))

167

 

    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))

168

 

    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))

169

 

 

170

144

# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,

171

145

# and /var/{lock,tmp} should die.

172

146

for path in ('tmp', 'var/lock', 'var/tmp'):

175

149

 

176

150

# Verify that nothing in the jail is world-writable.

177

151

# We don't want students to write into places that others can see.

178

 

try:

179

 

    for path, dirs, files in os.walk(build_path):

180

 

        for dname in dirs:

181

 

            d = os.path.join(path, dname)

182

 

            if os.path.islink(d):

183

 

                continue

184

 

            if os.stat(d).st_mode & stat.S_IWOTH:

185

 

                raise UnsafeJail(d)

186

 

 

187

 

        for fname in files:

188

 

            f = os.path.join(path, fname)

189

 

            if os.path.islink(f):

190

 

                continue

191

 

            if os.stat(f).st_mode & stat.S_IWOTH:

192

 

                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

193

 

                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

194

 

                                            'random', 'urandom')

195

 

                    ):

196

 

                    continue

197

 

                raise UnsafeJail(f)

198

 

except UnsafeJail, e:

199

 

    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.

200

 

This is a security vulnerability as jail template contents are shared between 

201

 

users. Please either make this path world unwriteable or remove it from the 

202

 

jail."""%str(e)

203

 

    sys.exit(1)

204

 

 

205

 

# Copy jail template build to actual jail template

206

 

template_path = conf['paths']['jails']['template']

 

152

for path, dirs, files in os.walk(build_path):

 

153

    for dname in dirs:

 

154

        d = os.path.join(path, dname)

 

155

        if os.path.islink(d):

 

156

            continue

 

157

        if os.stat(d).st_mode & stat.S_IWOTH:

 

158

            raise UnsafeJail(d)

 

159

 

 

160

    for fname in files:

 

161

        f = os.path.join(path, fname)

 

162

        if os.path.islink(f):

 

163

            continue

 

164

        if os.stat(f).st_mode & stat.S_IWOTH:

 

165

            if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

 

166

                os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

 

167

                                        'random', 'urandom')

 

168

                ):

 

169

                continue

 

170

            raise UnsafeJail(f)

 

171

    

 

172

 

207

173

if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',

208

 

              build_path + '/', template_path]) != 0:

 

174

              build_path + '/', ivle.conf.jail_system]) != 0:

209

175

    print >> sys.stderr, "Jail copying failed."

210

176

    sys.exit(1)

211

177

 

212

178

# Now mangle things a bit, so we can bind-mount the user bits in.

213

179

# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home

214

180

 

215

 

os.rename(os.path.join(template_path, 'etc/passwd'),

216

 

          os.path.join(template_path, 'home/.passwd')

 

181

os.rename(os.path.join(ivle.conf.jail_system, 'etc/passwd'),

 

182

          os.path.join(ivle.conf.jail_system, 'home/.passwd')

217

183

          )

218

 

os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))

 

184

os.symlink('../home/.passwd', os.path.join(ivle.conf.jail_system, 'etc/passwd'))

219

185

 

220

 

os.makedirs(os.path.join(template_path, "etc/ivle"))

 

186

os.makedirs(os.path.join(ivle.conf.jail_system, "etc/ivle"))

221

187

os.symlink('../../home/.ivle.conf',

222

 

           os.path.join(template_path, "etc/ivle/ivle.conf"))

 

188

           os.path.join(ivle.conf.jail_system, "etc/ivle/ivle.conf"))

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1