Mes notes sur FreeBSD (les jails)

Il existe plus d'un outil de gestion des jail, j'en ai d'ailleurs essayé un, mais je désirais la solution la plus basique possible. En effet, avant d'utiliser quoi que ce soit, j'aime bien comprendre comment cela fonctionne, puis je simplifie son utilisation au maximum.
Partant de là (et de la documentation officielle), j'ai fini par écrire un script me fournissant les services minimum et que je peux déployer et exploiter avec Ansible.
Je le partage afin que d'autres, qui comme moi ont besoin d'informations complémentaires, puissent y trouver éventuellement des réponses à leur(s) problème(s).
Note : ceci permet juste le premier pas : créer une jail. Il reste encore la configuration du service, des jails, des tables de routages etc.

admin_jail.sh

#!/bin/sh
# MIT License: see end of file
# Last reviewed: 2017/10/23

# Note:
# - Tested on FreeBSD 11
# - TODO: improve perr

# Base files:
# - local directory (download & extract)
readonly baseRepo='bases'
# - download location
readonly httpBaseRepository='http://ftp.freebsd.org/pub/FreeBSD/releases/'
# - files to download - extract
readonly baseFiles='base.txz'	# 'base.txz lib32.txz'

jailConf='/etc/jail.conf'
jailRepo='/srv/jails'
jailName=
cmd=

print_usage() {
	printf 'Usage: %s -r -f -j [fetch_base|create|upgrade|delete|start|stop|is_running|restart|rlogin]\n' $0
	printf '\t-r: jails repository (using: %s)\n' $jailRepo
	printf '\t-f: jail.conf (using: %s)\n' $jailConf
	printf '\t-j: jail name (using: %s)\n' $jailName
	printf '\tfetch_base: fetch base files depending on system\n'
	printf '\tcreate/upgrade/delete: a jail\n'
	printf '\tstart/stop/restart: a jail using configuration\n'
	printf '\trlogin: jexec -l %s login -f root\n' $jailName
}

print_args() {
	printf 'Received arguments:\t'
	for arg in "$@"; do
		printf ' %s' "$arg"
	done
	printf '\n'
}

# note: getopts only recognize one character, don't know how script will evolve
# => using shift
# but don't want to destroy $@ => using global vars :/
errorNb=0

perr() {
	printf ' err: %s' "$@" >&2
	errorNb="$(( $errorNb+1 ))"
}

parse_args() {
	while [ $# -ge 1 ]; do
		case $1 in
		'-r')
			if [ -z $2 ]; then
				perr "no arg for [$1]"
			else
				jailRepo=$2
				shift
			fi
		;;
		'-f')
			if [ -z $2 ]; then
				perr "no arg for [$1]"
			else
				jailConf=$2
				shift
			fi
		;;
		'-j')
			if [ -z $2 ]; then
				perr "no arg for [$1]"
			else
				jailName=$2
				shift
			fi	
		;;
		fetch_base | create|upgrade|delete | start|stop|is_running|restart | rlogin)
			if [ ! -z $cmd ]; then
				perr "Command overriding [$cmd -> $1]"
			fi
			cmd=$1
		;;
		*)
			perr "unknown argument [$1]"
		;;
		esac

		shift
	done
}

# Arguments
printf 'Check arguments..'
parse_args $@

# Default: jailName and jailConf must be defined
needJailConf=1
needJailName=1

case $cmd in
	fetch_base)
		needJailConf=0
		needJailName=0
	;;
	create|upgrade | is_running|delete)
		needJailConf=0
	;;
	start|stop|restart|rlogin)
		# needJailConf=1 needJailName=1
	;;
	*)
		perr ' no command'
esac

if [ $needJailConf -eq 1 ]; then
	if [ ! -f "$jailConf" ]; then
		perr "[$jailConf] file doesn't exist"
	fi
fi

if [ $needJailName -eq 1 ]; then

	if [ ! -d "$jailRepo" ]; then
		perr "[$jailRepo] directory doesn't exist"
	fi

	if [ -z "$jailName" ]; then
		perr ' no jail name'
	fi
fi

printf ' ..end\n'

if [ $errorNb -gt 0 ]; then
	printf 'Bad arguments (%s errors)\n\n' $errorNb
	print_usage
	printf '\n'
	print_args $@
	exit 1
fi

# Main
errorNb=0
jailDir="$jailRepo/$jailName"

baseSubDir=
init_baseSubDir() {
	platform="$(uname -m)"
	version="$(freebsd-version | cut -d- -f1-2)"
	baseSubDir="$platform/$version"
}

fetch_base() {
	init_baseSubDir
	printf 'Fetch base files for %s: ' $baseSubDir

	readonly scriptDir="$( cd "$( dirname "$0" )" && pwd )"
	readonly baseDir="$scriptDir/$baseRepo/$baseSubDir"

	if [ ! -d "$baseDir" ]; then
		mkdir -p $baseDir
		if [ $? -ne 0 ]; then
			perr "couldn't create [$baseDir] base repository\n"
			return 1
		fi
	fi

	for f in $baseFiles; do
		file="$baseDir/$f"
		if [ ! -f $file ]; then
			printf 'get %s ' $f
		# fetch: -i '$file' replace only if older
			url="$httpBaseRepository/$baseSubDir/$f"
			fetch -1 -o "$file" "$url"
			if [ $? -ne 0 ]; then
				perr "couldn't fetch $f\n"
				return 1
			fi
		fi
	done

	printf 'ok\n'
	return 0
}

create() {
	printf 'Create jail: '

	# Ensure base files are present
	init_baseSubDir
	readonly scriptDir="$( cd "$( dirname "$0" )" && pwd )"
	readonly baseDir="$scriptDir/bases/$baseSubDir"

	if [ ! -d "$baseDir" ]; then
		perr "no base repository [$baseDir]\n"
		printf '\tTry %s fetch_base\n' $0
		return 1
	fi

	if [ -d "$jailDir" ]; then
		perr "[$jailDir] already exists.\n"
		return 1
	fi

	printf 'directory '
	mkdir -p "$jailDir"
	if [ $? -ne 0 ]; then
		perr "creating [$jailDir].\n"
		return 1
	fi

	printf 'populating '
	for f in $baseFiles; do
		printf '%s ' "$f"
		tar -xf "$baseDir/$f" -C "$jailDir"
		if [ $? -ne 0 ]; then
			perr "deploying [$f].\n"
			return 1
		fi
	done

	printf 'set conf files '
	cp /etc/resolv.conf "$jailDir/etc"
	cp /etc/localtime "$jailDir/etc"

	printf 'freebsd-update '
	freebsd-update --not-running-from-cron -b "$jailDir" fetch install
	if [ $? -ne 0 ]; then
		perr 'updating jail.\n'
		return 1
	fi

	printf 'ok\n'
	return 0
}

upgrade() {
	printf 'Upgrade jail: '

	if [ ! -d "$jailDir" ]; then
		perr "[$jailDir] doesn't exist.\n"
		return 1
	fi

	printf 'freebsd-update '
	freebsd-update --not-running-from-cron -b "$jailDir" upgrade install
	if [ $? -ne 0 ]; then
		perr 'upgrading jail.\n'
		return 1
	fi

	printf 'ok\n'
	return 0
}

start() {
	printf 'Start jail: '

	if [ ! -f "$jailConf" ]; then
		perr "[$jailConf] doesn't exist.\n"
		exit 1
	fi

	jail -f "$jailConf" -c "$jailName"
	return $?
}

stop() {
	printf 'Stop jail: '

	if [ ! -f "$jailConf" ]; then
		perr "[$jailConf] doesn't exist.\n"
		exit 1
	fi

	jail -f "$jailConf" -r "$jailName"
	return $?
}

test_is_running() {
	jls -j "$jailName" >/dev/null 2>&1
	if [ $? -ne 0 ]; then
		return 1;
	fi

	return 0
}

is_running() {
	printf 'Jail status: '

	test_is_running	
	if [ $? -eq 1 ]; then
		printf 'not running\n';
		return 1;
	fi

	printf 'running\n';
	return 0
}

restart() {
	printf 'Restart jail: '

	if [ ! -f "$jailConf" ]; then
		perr "[$jailConf] doesn't exist.\n"
		exit 1
	fi

	jail -f "$jailConf" -rc "$jailName"
	return $?
}

rlogin() {
	printf 'Shell admin in jail: '

	jexec -l "$jailName" login -f root
	return $?
}

delete() {
	printf 'Delete jail: '

	test_is_running
	if [ $? -eq 0 ]; then
		printf 'stop '
		# exit if no conf
		stop
	fi

	printf 'remove flags '
	chflags -R noschg "$jailDir"

	if [ $? -ne 0 ]; then
		perr 'chflags.\n'
		return 1
	fi

	printf 'remove dir '
	rm -rf "$jailDir"
	if [ $? -ne 0 ]; then
		perr "err: removing [$jailDir].\n"
		return 1
	fi

	printf 'ok\n'
	return 0
}

code=-1
case "$cmd" in
	fetch_base)
		fetch_base
	;;

	create)
		create
	;;

	upgrade)
		upgrade
	;;

	delete)
		delete
	;;

	start)
		start
	;;

	stop)
		stop
	;;

	is_running)
		is_running
	;;

	restart)
		restart
	;;

	rlogin)
		rlogin
	;;

	*)
		printf 'Arg err\n'
	;;

esac

#	MIT License
#
#	Copyright (c) 2017 Christophe Marc BERTONCINI.
#
#	Permission is hereby granted, free of charge, to any person obtaining a copy
#	of this software and associated documentation files (the "Software"), to deal
#	in the Software without restriction, including without limitation the rights
#	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#	copies of the Software, and to permit persons to whom the Software is
#	furnished to do so, subject to the following conditions:
#
#	The above copyright notice and this permission notice shall be included in all
#	copies or substantial portions of the Software.
#
#	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#	SOFTWARE.

Note: la license MIT est plus une défense contre les gens de mauvaise foi qui pourraient détruire (le mot est fort) leurs systèmes qu'autre chose.