← Back to branch summary

~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

  • Committer: Matt Giuca
  • Date: 2010-03-22 06:05:32 UTC
  • Revision ID: matt.giuca@gmail.com-20100322060532-5365361xrx9mh32v
https://launchpad.net/bugs/543936
Changed database.py get_svn_url to take a req; include the req.user.login in the Subversion URL. This allows you to check out repositories without separately supplying the IVLE URL (as Subversion won't ask for a username by default). Also removed --username= from the lecturer project view, as it's redundant now. This fixes Launchpad bug #543936.

Show diffs side-by-side

added added

removed removed

Lines of Context:
bin/ivle-buildjail
18
18
 
19
19
import optparse
20
20
import os
 
21
import stat
21
22
import sys
22
23
import shutil
23
24
 
24
 
import ivle.conf
25
25
import ivle.config
26
26
import ivle.jailbuilder.debian
27
27
 
 
28
class UnsafeJail(Exception):
 
29
    pass
 
30
 
28
31
usage = """usage: %prog [options]
29
32
(requires root)
30
33
Builds or updates the base IVLE jail."""
31
34
 
 
35
# Requires root
 
36
if os.getuid() != 0:
 
37
    print >> sys.stderr, "This script requires root privileges to run"
 
38
    sys.exit(1)
 
39
 
32
40
conf = ivle.config.Config()
33
 
build_path = ivle.conf.jail_system_build
 
41
build_path = conf['paths']['jails']['template_build']
34
42
 
35
43
# Parse arguments
36
44
parser = optparse.OptionParser(usage)
76
84
              build_path, mirror=options.apt_mirror)
77
85
 
78
86
    ivle.jailbuilder.debian.apt_update_cache(build_path)
 
87
    # Minimal required packages
79
88
    ivle.jailbuilder.debian.apt_install(build_path,
80
 
                        ['python2.5', 'python-cjson', 'python-svn'])
 
89
            ['python2.5', 'python-cjson', 'python-svn', 'python-configobj'])
81
90
 
82
91
    ivle.jailbuilder.debian.apt_clean(build_path)
83
92
 
109
118
 
110
119
    ivle.jailbuilder.debian.apt_clean(build_path)
111
120
 
 
121
    # Configure locales to allow en_US.UTF-8 (which IVLE uses)
 
122
    ivle.jailbuilder.debian._execute_in_chroot(build_path,
 
123
        ['locale-gen', 'en_US.UTF-8'])
 
124
 
112
125
if conf['jail']['devmode']:
113
126
    # Copy all console and operating system files into the jail
114
 
    services_path = os.path.join(ivle.conf.share_path, 'services')
 
127
    services_path = os.path.join(conf['paths']['share'], 'services')
115
128
    jail_services_path = os.path.join(build_path, services_path[1:])
116
129
    if os.path.exists(jail_services_path):
117
130
        shutil.rmtree(jail_services_path)
137
150
        shutil.rmtree(jail_site_packages)
138
151
    shutil.copytree(ivle_site_packages, jail_site_packages)
139
152
 
 
153
    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,
 
154
    # so name resolution is less unlikely to work.
 
155
    shutil.copy(
 
156
        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))
 
157
    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))
 
158
    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))
 
159
 
 
160
# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,
 
161
# and /var/{lock,tmp} should die.
 
162
for path in ('tmp', 'var/lock', 'var/tmp'):
 
163
    path = os.path.join(build_path, path)
 
164
    os.chmod(path, os.stat(path).st_mode & ~stat.S_IWOTH)
 
165
 
 
166
# Verify that nothing in the jail is world-writable.
 
167
# We don't want students to write into places that others can see.
 
168
try:
 
169
    for path, dirs, files in os.walk(build_path):
 
170
        for dname in dirs:
 
171
            d = os.path.join(path, dname)
 
172
            if os.path.islink(d):
 
173
                continue
 
174
            if os.stat(d).st_mode & stat.S_IWOTH:
 
175
                raise UnsafeJail(d)
 
176
 
 
177
        for fname in files:
 
178
            f = os.path.join(path, fname)
 
179
            if os.path.islink(f):
 
180
                continue
 
181
            if os.stat(f).st_mode & stat.S_IWOTH:
 
182
                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and
 
183
                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',
 
184
                                            'random', 'urandom')
 
185
                    ):
 
186
                    continue
 
187
                raise UnsafeJail(f)
 
188
except UnsafeJail, e:
 
189
    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.
 
190
This is a security vulnerability as jail template contents are shared between 
 
191
users. Please either make this path world unwriteable or remove it from the 
 
192
jail."""%str(e)
 
193
    sys.exit(1)
 
194
 
 
195
# Copy jail template build to actual jail template
 
196
template_path = conf['paths']['jails']['template']
140
197
if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',
141
 
              build_path + '/', ivle.conf.jail_system]) != 0:
 
198
              build_path + '/', template_path]) != 0:
142
199
    print >> sys.stderr, "Jail copying failed."
143
200
    sys.exit(1)
144
201
 
 
202
# Now mangle things a bit, so we can bind-mount the user bits in.
 
203
# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home
 
204
 
 
205
os.rename(os.path.join(template_path, 'etc/passwd'),
 
206
          os.path.join(template_path, 'home/.passwd')
 
207
          )
 
208
os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))
 
209
 
 
210
os.makedirs(os.path.join(template_path, "etc/ivle"))
 
211
os.symlink('../../home/.ivle.conf',
 
212
           os.path.join(template_path, "etc/ivle/ivle.conf"))