added mk_chroot

mk_chroot.sh

@@ -0,0 +1,104 @@
+#!/bin/sh
+
+chr=
+bin=
+user=
+group=
+devfs=0
+listen=
+out=
+openfiles=
+mem=
+
+usage() {
+	cat <<EOF
+`basename ${0}` [options...] -c chroot_dir -x executable
+
+  -c    - chroot directory
+  -x    - executable binary
+  -u    - user to run as
+  -g    - group to run as (gets set to user if empty)
+  -d    - dev fs
+  -l    - listening port
+  -o    - outgoing port
+  -f    - max open files
+  -m    - memory usage
+  -h    - show this help
+EOF
+	exit 1
+}
+
+errx() { echo "${1}">&2;exit 1; }
+
+while getopts hc:x:u:g:dl:o:f:m: arg; do
+	case ${arg} in
+		h) usage ;;
+		c) chr=${OPTARG} ;;
+		x) bin=${OPTARG} ;;
+		u) user=${OPTARG} ;;
+		g) group=${OPTARG} ;;
+		d) devfs=1 ;;
+		l) listen=${OPTARG} ;;
+		o) out=${OPTARG} ;;
+		f) openfiles=${OPTARG} ;;
+		m) mem=${OPTARG} ;;
+		*) errx "use -h for help" ;;
+	esac
+done
+shift $((${OPTIND}-1))
+
+[ -z "${chr}" ] && errx "missing option: -c"
+[ -z "${bin}" ] && errx "missing option: -x"
+[ -z "${user}" ] && errx "missing option: -u"
+[ ! -x "${bin}" ] && errx "${bin} is not an executable file"
+[ "${user}" == "root" ] && errx "user root is not allowed"
+[ -z "${group}" ] && group=${user}
+
+[ -d "${chr}" ] && mkdir -p ${chr}/{bin,dev,etc}
+[ ${devfs} -eq 1 ] && { cd ${chr}/dev; sh /dev/MAKEDEV std random; rm ${chr}/dev/{console,klog,kmem,ksyms,mem,tty,xf86}; }
+cp /etc/{resolv.conf,hosts,localtime} ${chr}/etc/
+chmod 0644 ${chr}/etc/{resolv.conf,hosts,localtime}
+cp ${bin} ${chr}/bin
+
+login_conf="/etc/login.conf"
+echo "${user}:\\">>${login_conf}
+[ -n "${mem}" ] && echo "	:vmemoryuse-max=${mem}:\\">>${login_conf}
+[ -n "${openfiles}" ] && cat <<EOF>>${login_conf}
+	:openfiles-max=${openfiles}:\\
+	:openfiles-cur=${openfiles}:\\
+EOF
+echo "	:tc=daemon:">>${login_conf}
+
+pf_dir="/etc/pf"
+pf_conf="${pf_dir}/${user}.conf"
+sed -i "1iinclude \"${pf_conf}\"" /etc/pf.conf
+[ ! -d ${pf_dir} ] && mkdir ${pf_dir}
+echo "block in quick on lo0 from user ${user}">>${pf_conf}
+[ -n "${listen}" ] && echo "pass in quick on egress proto tcp from any to any port ${listen}">>${pf_conf}
+[ -n "${out}" ] && echo "pass out quick on egress proto tcp to any port ${out}">>${pf_conf}
+echo "block out quick on egress from user ${user}">>${pf_conf}
+pfctl -f /etc/pf.conf
+
+groupinfo ${group} || groupadd ${group}
+userinfo ${user} || useradd -L ${user} -g ${user} -d /var/empty -s /sbin/nologin ${user}
+
+rsync -aR $(ldd ${bin}|tail -n+4|awk '{print $7}') ${chr}
+
+daemon=$(basename ${bin})
+cat <<EOF> /etc/rc.d/${daemon}
+#!/bin/sh
+
+daemon="/usr/bin/env -i /usr/sbin/chroot -u ${user} -g ${group} ${chr}"
+
+. /etc/rc.d/rc.subr
+
+pexp="\${daemon_flags}"
+
+rc_cmd \$1
+EOF
+
+chmod 0555 /etc/rc.d/${daemon}
+
+rcctl enable ${daemon}
+rcctl set ${daemon} flags "/bin/${daemon}"
+rcctl start ${daemon}