~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

• browse files at revision 1348
• compare with another revision
• download diff
• download tarball
• view history from revision 1348

• reverse the comparison (1348 to 1724)
• stop comparing with revision 1724

Show diffs side-by-side

added

removed

bin/ivle-buildjail

22

22

import sys

23

23

import shutil

24

24

 

 

25

import ivle.conf

25

26

import ivle.config

26

27

import ivle.jailbuilder.debian

27

28

 

32

33

(requires root)

33

34

Builds or updates the base IVLE jail."""

34

35

 

35

 

# Requires root

36

 

if os.getuid() != 0:

37

 

    print >> sys.stderr, "This script requires root privileges to run"

38

 

    sys.exit(1)

39

 

 

40

36

conf = ivle.config.Config()

41

 

build_path = conf['paths']['jails']['template_build']

 

37

build_path = ivle.conf.jail_system_build

42

38

 

43

39

# Parse arguments

44

40

parser = optparse.OptionParser(usage)

84

80

              build_path, mirror=options.apt_mirror)

85

81

 

86

82

    ivle.jailbuilder.debian.apt_update_cache(build_path)

87

 

    # Minimal required packages

88

83

    ivle.jailbuilder.debian.apt_install(build_path,

89

 

            ['python2.5', 'python-cjson', 'python-svn', 'python-configobj'])

 

84

                        ['python2.5', 'python-cjson', 'python-svn'])

90

85

 

91

86

    ivle.jailbuilder.debian.apt_clean(build_path)

92

87

 

118

113

 

119

114

    ivle.jailbuilder.debian.apt_clean(build_path)

120

115

 

121

 

    # Configure locales to allow en_US.UTF-8 (which IVLE uses)

122

 

    ivle.jailbuilder.debian._execute_in_chroot(build_path,

123

 

        ['locale-gen', 'en_US.UTF-8'])

124

 

 

125

116

if conf['jail']['devmode']:

126

117

    # Copy all console and operating system files into the jail

127

 

    services_path = os.path.join(conf['paths']['share'], 'services')

 

118

    services_path = os.path.join(ivle.conf.share_path, 'services')

128

119

    jail_services_path = os.path.join(build_path, services_path[1:])

129

120

    if os.path.exists(jail_services_path):

130

121

        shutil.rmtree(jail_services_path)

150

141

        shutil.rmtree(jail_site_packages)

151

142

    shutil.copytree(ivle_site_packages, jail_site_packages)

152

143

 

153

 

    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,

154

 

    # so name resolution is less unlikely to work.

155

 

    shutil.copy(

156

 

        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))

157

 

    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))

158

 

    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))

159

 

 

160

144

# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,

161

145

# and /var/{lock,tmp} should die.

162

146

for path in ('tmp', 'var/lock', 'var/tmp'):

165

149

 

166

150

# Verify that nothing in the jail is world-writable.

167

151

# We don't want students to write into places that others can see.

168

 

try:

169

 

    for path, dirs, files in os.walk(build_path):

170

 

        for dname in dirs:

171

 

            d = os.path.join(path, dname)

172

 

            if os.path.islink(d):

173

 

                continue

174

 

            if os.stat(d).st_mode & stat.S_IWOTH:

175

 

                raise UnsafeJail(d)

176

 

 

177

 

        for fname in files:

178

 

            f = os.path.join(path, fname)

179

 

            if os.path.islink(f):

180

 

                continue

181

 

            if os.stat(f).st_mode & stat.S_IWOTH:

182

 

                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

183

 

                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

184

 

                                            'random', 'urandom')

185

 

                    ):

186

 

                    continue

187

 

                raise UnsafeJail(f)

188

 

except UnsafeJail, e:

189

 

    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.

190

 

This is a security vulnerability as jail template contents are shared between 

191

 

users. Please either make this path world unwriteable or remove it from the 

192

 

jail."""%str(e)

193

 

    sys.exit(1)

194

 

 

195

 

# Copy jail template build to actual jail template

196

 

template_path = conf['paths']['jails']['template']

 

152

for path, dirs, files in os.walk(build_path):

 

153

    for dname in dirs:

 

154

        d = os.path.join(path, dname)

 

155

        if os.path.islink(d):

 

156

            continue

 

157

        if os.stat(d).st_mode & stat.S_IWOTH:

 

158

            raise UnsafeJail(d)

 

159

 

 

160

    for fname in files:

 

161

        f = os.path.join(path, fname)

 

162

        if os.path.islink(f):

 

163

            continue

 

164

        if os.stat(f).st_mode & stat.S_IWOTH:

 

165

            if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

 

166

                os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

 

167

                                        'random', 'urandom')

 

168

                ):

 

169

                continue

 

170

            raise UnsafeJail(f)

 

171

    

 

172

 

197

173

if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',

198

 

              build_path + '/', template_path]) != 0:

 

174

              build_path + '/', ivle.conf.jail_system]) != 0:

199

175

    print >> sys.stderr, "Jail copying failed."

200

176

    sys.exit(1)

201

177

 

202

178

# Now mangle things a bit, so we can bind-mount the user bits in.

203

179

# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home

204

180

 

205

 

os.rename(os.path.join(template_path, 'etc/passwd'),

206

 

          os.path.join(template_path, 'home/.passwd')

 

181

os.rename(os.path.join(ivle.conf.jail_system, 'etc/passwd'),

 

182

          os.path.join(ivle.conf.jail_system, 'home/.passwd')

207

183

          )

208

 

os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))

 

184

os.symlink('../home/.passwd', os.path.join(ivle.conf.jail_system, 'etc/passwd'))

209

185

 

210

 

os.makedirs(os.path.join(template_path, "etc/ivle"))

 

186

os.makedirs(os.path.join(ivle.conf.jail_system, "etc/ivle"))

211

187

os.symlink('../../home/.ivle.conf',

212

 

           os.path.join(template_path, "etc/ivle/ivle.conf"))

 

188

           os.path.join(ivle.conf.jail_system, "etc/ivle/ivle.conf"))

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1