~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

• browse files at revision 1552
• compare with another revision
• download diff
• download tarball
• view history from revision 1552

• reverse the comparison (1552 to 1164.2.16)
• stop comparing with revision 1164.2.16

Show diffs side-by-side

added

removed

bin/ivle-buildjail

18

18

 

19

19

import optparse

20

20

import os

 

21

import stat

21

22

import sys

22

23

import shutil

23

24

 

24

 

import ivle.conf

25

25

import ivle.config

26

26

import ivle.jailbuilder.debian

27

27

 

 

28

class UnsafeJail(Exception):

 

29

    pass

 

30

 

28

31

usage = """usage: %prog [options]

29

32

(requires root)

30

33

Builds or updates the base IVLE jail."""

31

34

 

 

35

# Requires root

 

36

if os.getuid() != 0:

 

37

    print >> sys.stderr, "This script requires root privileges to run"

 

38

    sys.exit(1)

 

39

 

32

40

conf = ivle.config.Config()

33

 

build_path = ivle.conf.jail_system_build

 

41

build_path = conf['paths']['jails']['template_build']

34

42

 

35

43

# Parse arguments

36

44

parser = optparse.OptionParser(usage)

43

51

    help='''Apply any package updates in the jail.''')

44

52

parser.add_option("-m", "--mirror",

45

53

    action="store", dest="apt_mirror",

46

 

    help="Sets the apt mirror.", default="http://archive.ubuntu.com/ubuntu")

 

54

    help="Sets the apt mirror.", default=conf['jail']['mirror'])

47

55

parser.add_option("--python-site-packages",

48

56

    action="store", dest="python_site_packages",

49

57

    help="Path to Python site packages directory inside the jail.",

76

84

              build_path, mirror=options.apt_mirror)

77

85

 

78

86

    ivle.jailbuilder.debian.apt_update_cache(build_path)

 

87

    # Minimal required packages

79

88

    ivle.jailbuilder.debian.apt_install(build_path,

80

 

                        ['python2.5', 'python-cjson', 'python-svn'])

 

89

            ['python2.5', 'python-cjson', 'python-svn', 'python-configobj'])

81

90

 

82

91

    ivle.jailbuilder.debian.apt_clean(build_path)

83

92

 

111

120

 

112

121

if conf['jail']['devmode']:

113

122

    # Copy all console and operating system files into the jail

114

 

    services_path = os.path.join(ivle.conf.share_path, 'services')

 

123

    services_path = os.path.join(conf['paths']['share'], 'services')

115

124

    jail_services_path = os.path.join(build_path, services_path[1:])

116

125

    if os.path.exists(jail_services_path):

117

126

        shutil.rmtree(jail_services_path)

137

146

        shutil.rmtree(jail_site_packages)

138

147

    shutil.copytree(ivle_site_packages, jail_site_packages)

139

148

 

 

149

    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,

 

150

    # so name resolution is less unlikely to work.

 

151

    shutil.copy(

 

152

        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))

 

153

    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))

 

154

    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))

 

155

 

 

156

# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,

 

157

# and /var/{lock,tmp} should die.

 

158

for path in ('tmp', 'var/lock', 'var/tmp'):

 

159

    path = os.path.join(build_path, path)

 

160

    os.chmod(path, os.stat(path).st_mode & ~stat.S_IWOTH)

 

161

 

 

162

# Verify that nothing in the jail is world-writable.

 

163

# We don't want students to write into places that others can see.

 

164

try:

 

165

    for path, dirs, files in os.walk(build_path):

 

166

        for dname in dirs:

 

167

            d = os.path.join(path, dname)

 

168

            if os.path.islink(d):

 

169

                continue

 

170

            if os.stat(d).st_mode & stat.S_IWOTH:

 

171

                raise UnsafeJail(d)

 

172

 

 

173

        for fname in files:

 

174

            f = os.path.join(path, fname)

 

175

            if os.path.islink(f):

 

176

                continue

 

177

            if os.stat(f).st_mode & stat.S_IWOTH:

 

178

                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

 

179

                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

 

180

                                            'random', 'urandom')

 

181

                    ):

 

182

                    continue

 

183

                raise UnsafeJail(f)

 

184

except UnsafeJail, e:

 

185

    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.

 

186

This is a security vulnerability as jail template contents are shared between 

 

187

users. Please either make this path world unwriteable or remove it from the 

 

188

jail."""%str(e)

 

189

    sys.exit(1)

 

190

 

 

191

# Copy jail template build to actual jail template

 

192

template_path = conf['paths']['jails']['template']

140

193

if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',

141

 

              build_path + '/', ivle.conf.jail_system]) != 0:

 

194

              build_path + '/', template_path]) != 0:

142

195

    print >> sys.stderr, "Jail copying failed."

143

196

    sys.exit(1)

144

197

 

 

198

# Now mangle things a bit, so we can bind-mount the user bits in.

 

199

# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home

 

200

 

 

201

os.rename(os.path.join(template_path, 'etc/passwd'),

 

202

          os.path.join(template_path, 'home/.passwd')

 

203

          )

 

204

os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))

 

205

 

 

206

os.makedirs(os.path.join(template_path, "etc/ivle"))

 

207

os.symlink('../../home/.ivle.conf',

 

208

           os.path.join(template_path, "etc/ivle/ivle.conf"))

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1