← Back to branch summary

~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to bin/ivle-buildjail

  • Committer: William Grant
  • Date: 2012-06-28 01:52:02 UTC
  • Revision ID: me@williamgrant.id.au-20120628015202-f6ru7o367gt6nvgz
Hah

Show diffs side-by-side

added added

removed removed

Lines of Context:
bin/ivle-buildjail
22
22
import sys
23
23
import shutil
24
24
 
25
 
import ivle.conf
26
25
import ivle.config
27
26
import ivle.jailbuilder.debian
28
27
 
33
32
(requires root)
34
33
Builds or updates the base IVLE jail."""
35
34
 
 
35
# Requires root
 
36
if os.getuid() != 0:
 
37
    print >> sys.stderr, "This script requires root privileges to run"
 
38
    sys.exit(1)
 
39
 
36
40
conf = ivle.config.Config()
37
 
build_path = ivle.conf.jail_system_build
 
41
build_path = conf['paths']['jails']['template_build']
38
42
 
39
43
# Parse arguments
40
44
parser = optparse.OptionParser(usage)
75
79
    if options.apt_mirror is not None:
76
80
        os.environ['MIRROR'] = options.apt_mirror
77
81
 
 
82
    # Print a final warning to the user that this is a potentially-expensive
 
83
    # operation
 
84
    recreating = "Re-creating" if os.path.exists(build_path) else "Creating"
 
85
    print_mirror = options.apt_mirror or 'http://archive.ubuntu.com/ubuntu'
 
86
    print """%s jail from %s
 
87
Be warned, this may download hundreds of megabytes!
 
88
If this is the wrong source, please cancel now (note that it is too late to
 
89
save the existing jail; you will have to rebuild the jail from scratch now).\
 
90
""" % (recreating, print_mirror)
 
91
 
78
92
    os.system('rm -rf --one-file-system ' + build_path)
79
93
    ivle.jailbuilder.debian.debootstrap_create_jail(conf['jail']['suite'],
80
94
              build_path, mirror=options.apt_mirror)
81
95
 
82
96
    ivle.jailbuilder.debian.apt_update_cache(build_path)
 
97
    # Minimal required packages
83
98
    ivle.jailbuilder.debian.apt_install(build_path,
84
 
                        ['python2.5', 'python-cjson', 'python-svn'])
 
99
            ['python', 'python-simplejson', 'python-svn', 'python-configobj'])
85
100
 
86
101
    ivle.jailbuilder.debian.apt_clean(build_path)
87
102
 
113
128
 
114
129
    ivle.jailbuilder.debian.apt_clean(build_path)
115
130
 
 
131
    # Configure locales to allow en_US.UTF-8 (which IVLE uses)
 
132
    ivle.jailbuilder.debian._execute_in_chroot(build_path,
 
133
        ['locale-gen', 'en_US.UTF-8'])
 
134
 
116
135
if conf['jail']['devmode']:
117
136
    # Copy all console and operating system files into the jail
118
 
    services_path = os.path.join(ivle.conf.share_path, 'services')
 
137
    services_path = os.path.join(conf['paths']['share'], 'services')
119
138
    jail_services_path = os.path.join(build_path, services_path[1:])
120
139
    if os.path.exists(jail_services_path):
121
140
        shutil.rmtree(jail_services_path)
141
160
        shutil.rmtree(jail_site_packages)
142
161
    shutil.copytree(ivle_site_packages, jail_site_packages)
143
162
 
 
163
    # And finally copy in /etc/hosts, /etc/resolv.conf and /etc/hostname,
 
164
    # so name resolution is less unlikely to work.
 
165
    shutil.copy(
 
166
        '/etc/resolv.conf', os.path.join(build_path, 'etc/resolv.conf'))
 
167
    shutil.copy('/etc/hosts', os.path.join(build_path, 'etc/hosts'))
 
168
    shutil.copy('/etc/hostname', os.path.join(build_path, 'etc/hostname'))
 
169
 
144
170
# Make /tmp and /var/lock un-world-writable. /tmp will be mounted over,
145
171
# and /var/{lock,tmp} should die.
146
172
for path in ('tmp', 'var/lock', 'var/tmp'):
149
175
 
150
176
# Verify that nothing in the jail is world-writable.
151
177
# We don't want students to write into places that others can see.
152
 
for path, dirs, files in os.walk(build_path):
153
 
    for dname in dirs:
154
 
        d = os.path.join(path, dname)
155
 
        if os.path.islink(d):
156
 
            continue
157
 
        if os.stat(d).st_mode & stat.S_IWOTH:
158
 
            raise UnsafeJail(d)
159
 
 
160
 
    for fname in files:
161
 
        f = os.path.join(path, fname)
162
 
        if os.path.islink(f):
163
 
            continue
164
 
        if os.stat(f).st_mode & stat.S_IWOTH:
165
 
            if (os.path.dirname(f) == os.path.join(build_path, 'dev') and
166
 
                os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',
167
 
                                        'random', 'urandom')
168
 
                ):
169
 
                continue
170
 
            raise UnsafeJail(f)
171
 
    
172
 
 
 
178
try:
 
179
    for path, dirs, files in os.walk(build_path):
 
180
        for dname in dirs:
 
181
            d = os.path.join(path, dname)
 
182
            if os.path.islink(d):
 
183
                continue
 
184
            if os.stat(d).st_mode & stat.S_IWOTH:
 
185
                raise UnsafeJail(d)
 
186
 
 
187
        for fname in files:
 
188
            f = os.path.join(path, fname)
 
189
            if os.path.islink(f):
 
190
                continue
 
191
            if os.stat(f).st_mode & stat.S_IWOTH:
 
192
                if (os.path.dirname(f) == os.path.join(build_path, 'dev') and
 
193
                    os.path.basename(f) in ('ptmx', 'null', 'tty', 'full', 'zero',
 
194
                                            'random', 'urandom')
 
195
                    ):
 
196
                    continue
 
197
                raise UnsafeJail(f)
 
198
except UnsafeJail, e:
 
199
    print >> sys.stderr,"""Error: Jail contains world writable path: '%s'.
 
200
This is a security vulnerability as jail template contents are shared between 
 
201
users. Please either make this path world unwriteable or remove it from the 
 
202
jail."""%str(e)
 
203
    sys.exit(1)
 
204
 
 
205
# Copy jail template build to actual jail template
 
206
template_path = conf['paths']['jails']['template']
173
207
if os.spawnvp(os.P_WAIT, 'rsync', ['rsync', '-a', '--delete',
174
 
              build_path + '/', ivle.conf.jail_system]) != 0:
 
208
              build_path + '/', template_path]) != 0:
175
209
    print >> sys.stderr, "Jail copying failed."
176
210
    sys.exit(1)
177
211
 
178
212
# Now mangle things a bit, so we can bind-mount the user bits in.
179
213
# /etc/passwd and /etc/ivle/ivle.conf need to be symlinks to somewhere in /home
180
214
 
181
 
os.rename(os.path.join(ivle.conf.jail_system, 'etc/passwd'),
182
 
          os.path.join(ivle.conf.jail_system, 'home/.passwd')
 
215
os.rename(os.path.join(template_path, 'etc/passwd'),
 
216
          os.path.join(template_path, 'home/.passwd')
183
217
          )
184
 
os.symlink('../home/.passwd', os.path.join(ivle.conf.jail_system, 'etc/passwd'))
 
218
os.symlink('../home/.passwd', os.path.join(template_path, 'etc/passwd'))
185
219
 
186
 
os.makedirs(os.path.join(ivle.conf.jail_system, "etc/ivle"))
 
220
os.makedirs(os.path.join(template_path, "etc/ivle"))
187
221
os.symlink('../../home/.ivle.conf',
188
 
           os.path.join(ivle.conf.jail_system, "etc/ivle/ivle.conf"))
 
222
           os.path.join(template_path, "etc/ivle/ivle.conf"))