~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

• browse files at revision 1839
• compare with another revision
• download diff
• download tarball
• view history from revision 1839

• reverse the comparison (1839 to 1255)
• stop comparing with revision 1255

Show diffs side-by-side

added

removed

bin/ivle-buildjail

18

18

 

19

19

import optparse

20

20

import os

 

21

import stat

21

22

import sys

22

23

import shutil

23

24

 

24

 

import ivle.conf

25

25

import ivle.config

26

26

import ivle.jailbuilder.debian

27

27

 

 

28

class UnsafeJail(Exception):

 

29

    pass

 

30

 

28

31

usage = """usage: %prog [options]

29

32

(requires root)

30

33

Builds or updates the base IVLE jail."""

31

34

 

 

35

# Requires root

 

36

if os.getuid() != 0:

 

37

    print >> sys.stderr, "This script requires root privileges to run"

 

38

    sys.exit(1)

 

39

 

32

40

conf = ivle.config.Config()

33

 

build_path = ivle.conf.jail_system_build

 

41

build_path = conf['paths']['jails']['template_build']

34

42

 

35

43

# Parse arguments

36

44

parser = optparse.OptionParser(usage)

43

51

    help='''Apply any package updates in the jail.''')

44

52

parser.add_option("-m", "--mirror",

45

53

    action="store", dest="apt_mirror",

46

 

    help="Sets the apt mirror.", default="http://archive.ubuntu.com/ubuntu")

 

54

    help="Sets the apt mirror.", default=conf['jail']['mirror'])

47

55

parser.add_option("--python-site-packages",

48

56

    action="store", dest="python_site_packages",

49

57

    help="Path to Python site packages directory inside the jail.",

71

79

    if options.apt_mirror is not None:

72

80

        os.environ['MIRROR'] = options.apt_mirror

73

81

 

 

82

    # Print a final warning to the user that this is a potentially-expensive

 

83

    # operation

 

84

    recreating = "Re-creating" if os.path.exists(build_path) else "Creating"

 

85

    print_mirror = options.apt_mirror or 'http://archive.ubuntu.com/ubuntu'

 

86

    print """%s jail from %s

 

87

Be warned, this may download hundreds of megabytes!

 

88

If this is the wrong source, please cancel now (note that it is too late to

 

89

save the existing jail; you will have to rebuild the jail from scratch now).\

 

90

""" % (recreating, print_mirror)

 

91

 

74

92

    os.system('rm -rf --one-file-system ' + build_path)

75

93

    ivle.jailbuilder.debian.debootstrap_create_jail(conf['jail']['suite'],

76

94

              build_path, mirror=options.apt_mirror)

77

95

 

78

96

    ivle.jailbuilder.debian.apt_update_cache(build_path)

 

97

    # Minimal required packages

79

98

    ivle.jailbuilder.debian.apt_install(build_path,

80

 

                        ['python2.5', 'python-cjson', 'python-svn'])

 

99

            ['python', 'python-simplejson', 'python-svn', 'python-configobj'])

81

100

 

82

101

    ivle.jailbuilder.debian.apt_clean(build_path)

83

102

 

109

128

 

110

129

    ivle.jailbuilder.debian.apt_clean(build_path)

111

130

 

 

131

    # Configure locales to allow en_US.UTF-8 (which IVLE uses)

 

132

    ivle.jailbuilder.debian._execute_in_chroot(build_path,

 

133

        ['locale-gen', 'en_US.UTF-8'])

 

134

 

112

135

if conf['jail']['devmode']:

113

136

    # Copy all console and operating system files into the jail

114

 

    services_path = os.path.join(ivle.conf.share_path, 'services')

 

137

    services_path = os.path.join(conf['paths']['share'], 'services')

115

138

    jail_services_path = os.path.join(build_path, services_path[1:])

116

139

    if os.path.exists(jail_services_path):

117

140

        shutil.rmtree(jail_services_path)

137

160

        shutil.rmtree(jail_site_packages)

138

161

    shutil.copytree(ivle_site_packages, jail_site_packages)

139

162

 

 

163

    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,

 

164

    # so name resolution is less unlikely to work.

 

165

    shutil.copy(

 

166

        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))

 

167

    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))

 

168

    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))

 

169

 

 

170

# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,

 

171

# and /var/{lock,tmp} should die.

 

172

for path in ('tmp', 'var/lock', 'var/tmp'):

 

173

    path = os.path.join(build_path, path)

 

174

    os.chmod(path, os.stat(path).st_mode & ~stat.S_IWOTH)

 

175

 

 

176

# Verify that nothing in the jail is world-writable.

 

177

# We don't want students to write into places that others can see.

 

178

try:

 

179

    for path, dirs, files in os.walk(build_path):

 

180

        for dname in dirs:

 

181

            d = os.path.join(path, dname)

 

182

            if os.path.islink(d):

 

183

                continue

 

184

            if os.stat(d).st_mode & stat.S_IWOTH:

 

185

                raise UnsafeJail(d)

 

186

 

 

187

        for fname in files:

 

188

            f = os.path.join(path, fname)

 

189

            if os.path.islink(f):

 

190

                continue

 

191

            if os.stat(f).st_mode & stat.S_IWOTH:

 

192

                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and

 

193

                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',

 

194

                                            'random', 'urandom')

 

195

                    ):

 

196

                    continue

 

197

                raise UnsafeJail(f)

 

198

except UnsafeJail, e:

 

199

    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.

 

200

This is a security vulnerability as jail template contents are shared between 

 

201

users. Please either make this path world unwriteable or remove it from the 

 

202

jail."""%str(e)

 

203

    sys.exit(1)

 

204

 

 

205

# Copy jail template build to actual jail template

 

206

template_path = conf['paths']['jails']['template']

140

207

if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',

141

 

              build_path + '/', ivle.conf.jail_system]) != 0:

 

208

              build_path + '/', template_path]) != 0:

142

209

    print >> sys.stderr, "Jail copying failed."

143

210

    sys.exit(1)

144

211

 

 

212

# Now mangle things a bit, so we can bind-mount the user bits in.

 

213

# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home

 

214

 

 

215

os.rename(os.path.join(template_path, 'etc/passwd'),

 

216

          os.path.join(template_path, 'home/.passwd')

 

217

          )

 

218

os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))

 

219

 

 

220

os.makedirs(os.path.join(template_path, "etc/ivle"))

 

221

os.symlink('../../home/.ivle.conf',

 

222

           os.path.join(template_path, "etc/ivle/ivle.conf"))

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1