93 lines
2.8 KiB
Bash
Executable File
93 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
DISCOCFG=/etc/disco
|
|
DISCOROOT=/var/disco/testfs
|
|
|
|
mount | grep $DISCOROOT >/dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
echo "disco chroot is already mounted, please exec disco-fs-unmount and try again."
|
|
exit 1
|
|
fi
|
|
|
|
# Cleanup old junk
|
|
rm -rf ${DISCOROOT}/scratchfs
|
|
rm -rf ${DISCOROOT}/restricted/*
|
|
rm -rf ${DISCOROOT}/munge/*
|
|
|
|
# Prepare all the mountpoint directories
|
|
mkdir -p ${DISCOROOT}/chroot
|
|
#mkdir -p ${DISCOROOT}/proc/proc
|
|
#mkdir -p ${DISCOROOT}/sysfs/sys
|
|
mkdir -p ${DISCOROOT}/rootfs
|
|
mkdir -p ${DISCOROOT}/scratchfs
|
|
mkdir -p ${DISCOROOT}/munge
|
|
mkdir -p ${DISCOROOT}/dev/dev
|
|
mkdir -p ${DISCOROOT}/restricted/bin
|
|
|
|
# Setup all the commands for the bash restricted execution environment
|
|
|
|
mkdir -p ${DISCOCFG}/restricted.d
|
|
for file in $(cat ${DISCOCFG}/restricted.d/* 2>/dev/null | grep -v "^#")
|
|
do
|
|
if [ ! -e ${DISCOROOT}/restricted/bin/$(basename $file) ]; then
|
|
ln -s $file ${DISCOROOT}/restricted/bin/$(basename $file)
|
|
fi
|
|
done
|
|
|
|
# Setup some more restricted execution stuff, but only if we actually have $NOOP
|
|
|
|
if [ "$NOOP" != "" ]; then
|
|
# Munge up /etc/profile
|
|
mkdir -p ${DISCOROOT}/munge/etc
|
|
cp /etc/profile ${DISCOROOT}/munge/etc/profile
|
|
echo "export PATH=${DISCOROOT}/restricted/bin" >> ${DISCOROOT}/munge/etc/profile
|
|
|
|
# Make default wrapper
|
|
echo -e "#!/bin/bash\necho \"info: Would execute : \$(basename \$0) \$@\"" > ${DISCOROOT}/restricted/bin/_disco_restricted_cmd
|
|
chmod +x ${DISCOROOT}/restricted/bin/_disco_restricted_cmd
|
|
|
|
# Now link everything to the default wrapper
|
|
for dir in $(echo $PATH | sed s/":"/" "/g)
|
|
do
|
|
for file in ${dir}/*
|
|
do
|
|
FNAME=$(basename $file)
|
|
if [ "$FNAME" != "bash" ] && [ -x $file ] && [ ! -x ${DISCOROOT}/restricted/bin/$FNAME ] ; then
|
|
ln -s ${DISCOROOT}/restricted/bin/_disco_restricted_cmd ${DISCOROOT}/restricted/bin/${FNAME}
|
|
fi
|
|
done
|
|
done
|
|
fi
|
|
|
|
# We need SOME special files in /dev like /dev/null, so make them here
|
|
|
|
mknod ${DISCOROOT}/dev/dev/null c 1 3
|
|
chmod 666 ${DISCOROOT}/dev/dev/null
|
|
|
|
# Mount all the (real filesystem) layers individually
|
|
|
|
mount --bind -o ro / ${DISCOROOT}/rootfs 2>&1 | grep -v "seems to be mounted read-write"
|
|
mount -o remount,ro ${DISCOROOT}/rootfs
|
|
|
|
# Setup filesystem layers. The read/write ones go on the top, with scratchfs ALWAYS on top.
|
|
FSLAYERS="${DISCOROOT}/scratchfs=rw"
|
|
FSLAYERS="${FSLAYERS}:${DISCOROOT}/munge=ro"
|
|
FSLAYERS="${FSLAYERS}:${DISCOROOT}/dev=rw"
|
|
#FSLAYERS="${FSLAYERS}:${DISCOROOT}/proc=ro"
|
|
#FSLAYERS="${FSLAYERS}:${DISCOROOT}/sysfs=ro"
|
|
FSLAYERS="${FSLAYERS}:${DISCOROOT}/rootfs=ro"
|
|
|
|
# Union
|
|
unionfs -o cow,dev,dirs=$FSLAYERS ${DISCOROOT}/chroot
|
|
|
|
# Duplicate /proc and /sys if they already exist
|
|
mount | grep " on /proc" >/dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
mount -t proc -o ro none ${DISCOROOT}/chroot/proc
|
|
fi
|
|
mount | grep " on /sys" >/dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
mount -t sysfs -o ro none ${DISCOROOT}/chroot/sys
|
|
fi
|
|
|
|
exit 0 |