← Back to branch summary

~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

  • Committer: William Grant
  • Date: 2010-02-15 05:37:50 UTC
  • Revision ID: grantw@unimelb.edu.au-20100215053750-hihmegnp8e7dshc2
Ignore test coverage files.

Show diffs side-by-side

added added

removed removed

Lines of Context:
bin/ivle-buildjail
18
18
 
19
19
import optparse
20
20
import os
 
21
import stat
21
22
import sys
22
23
import shutil
23
24
 
24
 
import ivle.conf
25
25
import ivle.config
26
26
import ivle.jailbuilder.debian
27
27
 
 
28
class UnsafeJail(Exception):
 
29
    pass
 
30
 
28
31
usage = """usage: %prog [options]
29
32
(requires root)
30
33
Builds or updates the base IVLE jail."""
31
34
 
 
35
# Requires root
 
36
if os.getuid() != 0:
 
37
    print >> sys.stderr, "This script requires root privileges to run"
 
38
    sys.exit(1)
 
39
 
32
40
conf = ivle.config.Config()
33
 
build_path = ivle.conf.jail_system_build
 
41
build_path = conf['paths']['jails']['template_build']
34
42
 
35
43
# Parse arguments
36
44
parser = optparse.OptionParser(usage)
43
51
    help='''Apply any package updates in the jail.''')
44
52
parser.add_option("-m", "--mirror",
45
53
    action="store", dest="apt_mirror",
46
 
    help="Sets the apt mirror.", default="http://archive.ubuntu.com/ubuntu")
 
54
    help="Sets the apt mirror.", default=conf['jail']['mirror'])
47
55
parser.add_option("--python-site-packages",
48
56
    action="store", dest="python_site_packages",
49
57
    help="Path to Python site packages directory inside the jail.",
76
84
              build_path, mirror=options.apt_mirror)
77
85
 
78
86
    ivle.jailbuilder.debian.apt_update_cache(build_path)
 
87
    # Minimal required packages
79
88
    ivle.jailbuilder.debian.apt_install(build_path,
80
 
                        ['python2.5', 'python-cjson', 'python-svn'])
 
89
            ['python2.5', 'python-cjson', 'python-svn', 'python-configobj'])
81
90
 
82
91
    ivle.jailbuilder.debian.apt_clean(build_path)
83
92
 
111
120
 
112
121
if conf['jail']['devmode']:
113
122
    # Copy all console and operating system files into the jail
114
 
    services_path = os.path.join(ivle.conf.share_path, 'services')
 
123
    services_path = os.path.join(conf['paths']['share'], 'services')
115
124
    jail_services_path = os.path.join(build_path, services_path[1:])
116
125
    if os.path.exists(jail_services_path):
117
126
        shutil.rmtree(jail_services_path)
137
146
        shutil.rmtree(jail_site_packages)
138
147
    shutil.copytree(ivle_site_packages, jail_site_packages)
139
148
 
 
149
    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,
 
150
    # so name resolution is less unlikely to work.
 
151
    shutil.copy(
 
152
        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))
 
153
    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))
 
154
    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))
 
155
 
 
156
# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,
 
157
# and /var/{lock,tmp} should die.
 
158
for path in ('tmp', 'var/lock', 'var/tmp'):
 
159
    path = os.path.join(build_path, path)
 
160
    os.chmod(path, os.stat(path).st_mode & ~stat.S_IWOTH)
 
161
 
 
162
# Verify that nothing in the jail is world-writable.
 
163
# We don't want students to write into places that others can see.
 
164
try:
 
165
    for path, dirs, files in os.walk(build_path):
 
166
        for dname in dirs:
 
167
            d = os.path.join(path, dname)
 
168
            if os.path.islink(d):
 
169
                continue
 
170
            if os.stat(d).st_mode & stat.S_IWOTH:
 
171
                raise UnsafeJail(d)
 
172
 
 
173
        for fname in files:
 
174
            f = os.path.join(path, fname)
 
175
            if os.path.islink(f):
 
176
                continue
 
177
            if os.stat(f).st_mode & stat.S_IWOTH:
 
178
                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and
 
179
                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',
 
180
                                            'random', 'urandom')
 
181
                    ):
 
182
                    continue
 
183
                raise UnsafeJail(f)
 
184
except UnsafeJail, e:
 
185
    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.
 
186
This is a security vulnerability as jail template contents are shared between 
 
187
users. Please either make this path world unwriteable or remove it from the 
 
188
jail."""%str(e)
 
189
    sys.exit(1)
 
190
 
 
191
# Copy jail template build to actual jail template
 
192
template_path = conf['paths']['jails']['template']
140
193
if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',
141
 
              build_path + '/', ivle.conf.jail_system]) != 0:
 
194
              build_path + '/', template_path]) != 0:
142
195
    print >> sys.stderr, "Jail copying failed."
143
196
    sys.exit(1)
144
197
 
 
198
# Now mangle things a bit, so we can bind-mount the user bits in.
 
199
# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home
 
200
 
 
201
os.rename(os.path.join(template_path, 'etc/passwd'),
 
202
          os.path.join(template_path, 'home/.passwd')
 
203
          )
 
204
os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))
 
205
 
 
206
os.makedirs(os.path.join(template_path, "etc/ivle"))
 
207
os.symlink('../../home/.ivle.conf',
 
208
           os.path.join(template_path, "etc/ivle/ivle.conf"))