diff options
| -rwxr-xr-x | configure | 2 | ||||
| -rw-r--r-- | configure.ac | 2 | ||||
| -rw-r--r-- | rcynic/Makefile.in | 28 | ||||
| -rwxr-xr-x | rcynic/installation-scripts/darwin/RCynic/RCynic | 80 | ||||
| -rw-r--r-- | rcynic/installation-scripts/darwin/install.sh | 193 | ||||
| -rw-r--r-- | rcynic/installation-scripts/freebsd/install.sh | 158 | ||||
| -rwxr-xr-x | rcynic/installation-scripts/freebsd/rc.d.rcynic | 76 | ||||
| -rw-r--r-- | rcynic/installation-scripts/install.sh | 14 | ||||
| -rw-r--r-- | rcynic/installation-scripts/linux/install.sh | 281 | ||||
| -rwxr-xr-x | rcynic/rc-scripts/darwin/RCynic | 42 | ||||
| -rw-r--r-- | rcynic/rc-scripts/darwin/StartupParameters.plist (renamed from rcynic/installation-scripts/darwin/RCynic/StartupParameters.plist) | 0 | ||||
| -rwxr-xr-x | rcynic/rc-scripts/freebsd/rc.d.rcynic | 44 | ||||
| -rw-r--r-- | rcynic/rcynic-cron.py | 3 | ||||
| -rw-r--r-- | rcynic/rules.darwin.mk | 7 | ||||
| -rw-r--r-- | rcynic/rules.freebsd.mk | 3 | ||||
| -rw-r--r-- | rcynic/rules.linux.mk | 5 | ||||
| -rw-r--r-- | rcynic/sample-rcynic.conf (renamed from rcynic/installation-scripts/sample-rcynic.conf) | 0 |
17 files changed, 134 insertions, 804 deletions
@@ -4563,6 +4563,7 @@ case $enable_rcynic_jail in RCYNIC_CONF_RSYNC='/bin/rsync' RCYNIC_CONF_DATA='/data' RCYNIC_CONF_TA_DIR='/etc/trust-anchors' + RCYNIC_CRON_USER='root' RCYNIC_JAIL_DIRS='${RCYNIC_DIR}/bin ${RCYNIC_DIR}/dev ${RCYNIC_DIR}/etc' if test "X$host_os" = "Xlinux" then @@ -4577,6 +4578,7 @@ case $enable_rcynic_jail in RCYNIC_CONF_RSYNC="${RSYNC}" RCYNIC_CONF_DATA='${RCYNIC_DIR}/data' RCYNIC_CONF_TA_DIR="${RCYNIC_TA_DIR}" + RCYNIC_CRON_USER='${RCYNIC_USER}' RCYNIC_JAIL_DIRS='' ;; *) diff --git a/configure.ac b/configure.ac index 37d280e7..2544f64a 100644 --- a/configure.ac +++ b/configure.ac @@ -262,6 +262,7 @@ case $enable_rcynic_jail in RCYNIC_CONF_RSYNC='/bin/rsync' RCYNIC_CONF_DATA='/data' RCYNIC_CONF_TA_DIR='/etc/trust-anchors' + RCYNIC_CRON_USER='root' RCYNIC_JAIL_DIRS='${RCYNIC_DIR}/bin ${RCYNIC_DIR}/dev ${RCYNIC_DIR}/etc' if test "X$host_os" = "Xlinux" then @@ -276,6 +277,7 @@ case $enable_rcynic_jail in RCYNIC_CONF_RSYNC="${RSYNC}" RCYNIC_CONF_DATA='${RCYNIC_DIR}/data' RCYNIC_CONF_TA_DIR="${RCYNIC_TA_DIR}" + RCYNIC_CRON_USER='${RCYNIC_USER}' RCYNIC_JAIL_DIRS='' ;; *) diff --git a/rcynic/Makefile.in b/rcynic/Makefile.in index 1e15f5bf..4950e05b 100644 --- a/rcynic/Makefile.in +++ b/rcynic/Makefile.in @@ -61,6 +61,7 @@ RCYNIC_GROUP = rcynic RCYNIC_GECOS = RPKI Validation System RCYNIC_STATIC_RSYNC = @RCYNIC_STATIC_RSYNC@ RCYNIC_HTML_DIR = @RCYNIC_HTML_DIR@ +RCYNIC_CRON_USER = @RCYNIC_CRON_USER@ SCRIPTS = rcynic-text rcynic-html rcynic-svn validation_status rcynic-cron @@ -203,7 +204,12 @@ install-static-rsync: ${RCYNIC_DIR}/bin/rsync ${RCYNIC_DIR}/bin/rsync: static-rsync/rsync ${INSTALL} -p -m 555 static-rsync/rsync $@ -install-scripts: ${bindir}/rcynic-text ${bindir}/rcynic-html ${bindir}/rcynic-svn ${bindir}/validation_status +install-scripts: \ + ${bindir}/rcynic-text \ + ${bindir}/rcynic-html \ + ${bindir}/rcynic-svn \ + ${bindir}/rcynic-cron \ + ${bindir}/validation_status ${bindir}/rcynic-text: rcynic-text ${INSTALL} -p -m 555 rcynic-text ${bindir} @@ -214,6 +220,9 @@ ${bindir}/rcynic-html: rcynic-html ${bindir}/rcynic-svn: rcynic-svn ${INSTALL} -p -m 555 rcynic-svn ${bindir} +${bindir}/rcynic-cron: rcynic-cron + ${INSTALL} -p -m 555 rcynic-cron ${bindir} + ${bindir}/validation_status: validation_status ${INSTALL} -p -m 555 validation_status ${bindir} @@ -222,4 +231,21 @@ ${bindir}/validation_status: validation_status # Not sure we want this, test it both ways I guess #.PHONY: .FORCE +configure-rcynic-crontab: .FORCE + @echo "Setting up ${RCYNIC_CRON_USER}'s crontab to run rcynic-cron script + @crontab -l -u ${RCYNIC_CRON_USER} 2>/dev/null | \ + ${AWK} -v t=`hexdump -n 2 -e '"%u\n"' /dev/random` '\ + BEGIN { \ + cmd = "exec ${bindir}/rcynic-cron"; \ + } \ + $$0 !~ cmd { \ + print; \ + } \ + END { \ + printf "%u * * * *\t%s\n", t % 60, cmd; \ + }' | \ + /usr/bin/crontab -u ${RCYNIC_CRON_USER} - + +# Platform-specific rules below here. + @RCYNIC_MAKE_RULES@ diff --git a/rcynic/installation-scripts/darwin/RCynic/RCynic b/rcynic/installation-scripts/darwin/RCynic/RCynic deleted file mode 100755 index 0237f926..00000000 --- a/rcynic/installation-scripts/darwin/RCynic/RCynic +++ /dev/null @@ -1,80 +0,0 @@ -#!/bin/sh - -# -# $Id$ -# -. /etc/rc.common - -name="rcynic" -start_cmd="rcynic_start" -stop_cmd="rcynic_stop" - -: ${rcynic_jaildir="/var/rcynic"} -: ${rcynic_user="rcynic"} -: ${rcynic_group="rcynic"} - -StartService() -{ - /bin/test -d "${rcynic_jaildir}" || /bin/mkdir "${rcynic_jaildir}" - /sbin/umount "${rcynic_jaildir}/dev" 2>/dev/null - - /usr/sbin/mtree -deU -p "${rcynic_jaildir}" <<EOF - - /set type=dir uname=root gname=wheel mode=0555 - . - bin - .. - dev - .. - etc - trust-anchors - .. - .. - usr - lib - system - .. - .. - .. - var - run - .. - .. - data uname=${rcynic_user} gname=${rcynic_group} mode=0755 - .. - .. -EOF - - /bin/chmod -R a-w "${rcynic_jaildir}/bin" "${rcynic_jaildir}/etc" - /usr/sbin/chown -R root:wheel "${rcynic_jaildir}/bin" "${rcynic_jaildir}/etc" - - if /bin/test -f "${rcynic_jaildir}/etc/rsa_key"; then - /bin/chmod 400 "${rcynic_jaildir}/etc/rsa_key" - /usr/sbin/chown "${rcynic_user}" "${rcynic_jaildir}/etc/rsa_key" - fi - - if ! /sbin/mount_devfs devfs "${rcynic_jaildir}/dev"; then - echo "Mounting devfs on ${rcynic_jaildir}/dev failed..." - exit 1 - fi - - for i in /etc/localtime /etc/resolv.conf; do - j="${rcynic_jaildir}${i}" - if /bin/test -r "$i" && ! /usr/bin/cmp -s "$i" "$j"; then - /usr/bin/install -m 444 -o root -g wheel -p "$i" "$j" - fi - done - - /bin/ln -f /var/run/mDNSResponder "${rcynic_jaildir}/var/run/mDNSResponder" -} - -StopService() -{ - /sbin/umount "${rcynic_jaildir}/dev" 2>/dev/null -} - -RestartService() -{ - StartService -} - -RunService "$1" diff --git a/rcynic/installation-scripts/darwin/install.sh b/rcynic/installation-scripts/darwin/install.sh deleted file mode 100644 index 1af4a6f0..00000000 --- a/rcynic/installation-scripts/darwin/install.sh +++ /dev/null @@ -1,193 +0,0 @@ -#!/bin/sh - -# $Id$ -# -# Create a chroot jail for rcynic. -# -# This is approximately what a pkg-install script might do if this were -# a FreeBSD port. Perhaps some day it will be. - -: ${jaildir="${DESTDIR}/var/rcynic"} -: ${jailuser="rcynic"} -: ${jailgroup="rcynic"} -: ${jailname="RPKI Validation System"} -: ${setupcron="NO"} - -echo "Setting up \"${jaildir}\" as a chroot jail for rcynic." - -if /usr/bin/dscl . -read "/Groups/${jailgroup}" >/dev/null 2>&1 -then - echo "You already have a group \"${jailgroup}\", so I will use it." -elif gid="$(/usr/bin/dscl . -list /Groups PrimaryGroupID | /usr/bin/awk 'BEGIN {gid = 501} $2 >= gid {gid = 1 + $2} END {print gid}')" && - /usr/bin/dscl . -create "/Groups/${jailgroup}" && - /usr/bin/dscl . -create "/Groups/${jailgroup}" RealName "${jailname}" && - /usr/bin/dscl . -create "/Groups/${jailgroup}" PrimaryGroupID "$gid" && - /usr/bin/dscl . -create "/Groups/${jailgroup}" GeneratedUID "$(/usr/bin/uuidgen)" && - /usr/bin/dscl . -create "/Groups/${jailgroup}" Password "*" -then - echo "Added group \"${jailgroup}\"." -else - echo "Adding group \"${jailgroup}\" failed..." - echo "Please create it, then try again." - exit 1 -fi - -if /usr/bin/dscl . -read "/Users/${jailuser}" >/dev/null 2>&1 -then - echo "You already have a user \"${jailuser}\", so I will use it." -elif uid="$(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk 'BEGIN {uid = 501} $2 >= uid {uid = 1 + $2} END {print uid}')" && - /usr/bin/dscl . -create "/Users/${jailuser}" && - /usr/bin/dscl . -create "/Users/${jailuser}" UserShell "/usr/bin/false" && - /usr/bin/dscl . -create "/Users/${jailuser}" RealName "${jailname}" && - /usr/bin/dscl . -create "/Users/${jailuser}" UniqueID "$uid" && - /usr/bin/dscl . -create "/Users/${jailuser}" PrimaryGroupID "$gid" && - /usr/bin/dscl . -create "/Users/${jailuser}" NFSHomeDirectory "/var/empty" && - /usr/bin/dscl . -create "/Users/${jailuser}" GeneratedUID "$(/usr/bin/uuidgen)" && - /usr/bin/dscl . -create "/Users/${jailuser}" Password "*" -then - echo "Added user \"${jailuser}\"." -else - echo "Adding user \"${jailuser}\" failed..." - echo "Please create it, then try again." - exit 1 -fi - -if ! /bin/test -d "${jaildir}"; then - /bin/mkdir "${jaildir}" -fi - -if /usr/bin/install -o root -g wheel -d ${DESTDIR}/Library/StartupItems/RCynic && - /usr/bin/install -o root -g wheel -m 555 RCynic/RCynic RCynic/StartupParameters.plist ${DESTDIR}/Library/StartupItems/RCynic; then - echo "Installed ${DESTDIR}/Library/StartupItems/RCynic" -else - echo "Installing ${DESTDIR}/Library/StartupItems/RCynic failed" - exit 1 -fi - -echo "Running ${DESTDIR}/Library/StartupItems/RCynic/RCynic to set up directories" - -if ! rcynic_jaildir="$jaildir" rcynic_user="$jailuser" rcynic_group="$jailgroup" /Library/StartupItems/RCynic/RCynic start; then - echo "Directory setup failed" - exit 1 -fi - -if /bin/test -r "$jaildir/etc/rcynic.conf"; then - echo "You already have config file \"${jaildir}/etc/rcynic.conf\", so I will use it." -elif /usr/bin/install -m 444 -o root -g wheel -p ../sample-rcynic.conf "${jaildir}/etc/rcynic.conf"; then - echo "Installed minimal ${jaildir}/etc/rcynic.conf, adding SAMPLE trust anchors" - for i in ../../sample-trust-anchors/*.tal; do - j="$jaildir/etc/trust-anchors/${i##*/}" - /bin/test -r "$i" || continue - /bin/test -r "$j" && continue - echo "Installing $i as $j" - /usr/bin/install -m 444 -o root -g wheel -p "$i" "$j" - done - j=1 - for i in $jaildir/etc/trust-anchors/*.tal; do - echo >>"${jaildir}/etc/rcynic.conf" "trust-anchor-locator.$j = /etc/trust-anchors/${i##*/}" - j=$((j+1)) - done -else - echo "Installing minimal ${jaildir}/etc/rcynic.conf failed" - exit 1 -fi - -echo "Installing rcynic as ${jaildir}/bin/rcynic" - -/usr/bin/install -m 555 -o root -g wheel -p ../../rcynic "${jaildir}/bin/rcynic" - -if /bin/test -x "$jaildir/bin/rsync"; then - echo "You already have an executable \"$jaildir/bin/rsync\", so I will use it" -elif /usr/bin/install -m 555 -o root -g wheel -p /usr/bin/rsync "${jaildir}/bin/rsync"; then - echo "Installed ${jaildir}/bin/rsync" -else - echo "Installing ${jaildir}/bin/rsync failed" - exit 1 -fi - -echo "Copying required shared libraries" - -shared_libraries="${jaildir}/bin/rcynic ${jaildir}/bin/rsync" -while true -do - closure="$(/usr/bin/otool -L ${shared_libraries} | /usr/bin/awk '/:$/ {next} {print $1}' | /usr/bin/sort -u)" - if test "x$shared_libraries" = "x$closure" - then - break - else - shared_libraries="$closure" - fi -done - -for shared in /usr/lib/dyld $shared_libraries -do - if /bin/test -r "${jaildir}/${shared}" - then - echo "You already have a \"${jaildir}/${shared}\", so I will use it" - elif /usr/bin/install -m 555 -o root -g wheel -p "${shared}" "${jaildir}/${shared}" - then - echo "Copied ${shared} into ${jaildir}" - else - echo "Unable to copy ${shared} into ${jaildir}" - exit 1 - fi -done - -if /usr/bin/install -m 555 -o root -g wheel -p ../../rcynic-html "${jaildir}/bin/rcynic-html"; then - echo "Installed rcynic.py as \"${jaildir}/bin/rcynic-html\"" -else - echo "Installing rcynic-html failed" - exit 1 -fi - -echo "Setting up root's crontab to run jailed rcynic" - -case "$setupcron" in -YES|yes) - /usr/bin/crontab -l -u root 2>/dev/null | - /usr/bin/awk -v "jailuser=$jailuser" -v "jailgroup=$jailgroup" -v "jaildir=$jaildir" ' - BEGIN { - cmd = "exec /usr/sbin/chroot -u " jailuser " -g " jailgroup " " jaildir; - cmd = cmd " /bin/rcynic -c /etc/rcynic.conf"; - } - $0 !~ cmd { - print; - } - END { - "/usr/bin/hexdump -n 2 -e \"\\\"%u\\\\\\n\\\"\" /dev/random" | getline; - printf "%u * * * *\t%s\n", $1 % 60, cmd; - }' | - /usr/bin/crontab -u root - - /bin/cat <<EOF - - crontab is set up to run rcynic hourly, at a randomly selected - minute (to spread load on the rsync servers). Please do NOT - adjust this to run on the hour. In particular please do NOT - adjust this to run at midnight UTC. -EOF - ;; - -*) - /bin/cat <<EOF - - You'll need to add a crontab entry running the following command as root: - - /usr/sbin/chroot -u $jailuser -g $jailgroup $jaildir /bin/rcynic -c /etc/rcynic.conf - - Please try to pick a random time for this, don't just run it on the hour, - or at local midnight, or, worst of all, at midnight UTC. - -EOF - ;; - -esac - -/bin/cat <<EOF - - Jail set up. You may need to customize $jaildir/etc/rcynic.conf. - If you did not install your own trust anchors, a default set - of SAMPLE trust anchors may have been installed for you, but - you, the relying party, are the only one who can decide - whether you trust those anchors. rcynic will not do anything - useful without good trust anchors. - -EOF diff --git a/rcynic/installation-scripts/freebsd/install.sh b/rcynic/installation-scripts/freebsd/install.sh deleted file mode 100644 index 7f3e9f02..00000000 --- a/rcynic/installation-scripts/freebsd/install.sh +++ /dev/null @@ -1,158 +0,0 @@ -#!/bin/sh - -# $Id$ -# -# Create a chroot jail for rcynic. -# -# This is approximately what a pkg-install script might do if this were -# a FreeBSD port. Perhaps some day it will be. - -: ${jaildir="${DESTDIR}/var/rcynic"} -: ${jailuser="rcynic"} -: ${jailgroup="rcynic"} -: ${setupcron="NO"} - -echo "Setting up \"${jaildir}\" as a chroot jail for rcynic." - -if /usr/sbin/pw groupshow "${jailgroup}" 2>/dev/null; then - echo "You already have a group \"${jailgroup}\", so I will use it." -elif /usr/sbin/pw groupadd ${jailgroup}; then - echo "Added group \"${jailgroup}\"." -else - echo "Adding group \"${jailgroup}\" failed..." - echo "Please create it, then try again." - exit 1 -fi - -if /usr/sbin/pw usershow "${jailuser}" 2>/dev/null; then - echo "You already have a user \"${jailuser}\", so I will use it." -elif /usr/sbin/pw useradd ${jailuser} -g ${jailgroup} -h - -d /nonexistant -s /usr/sbin/nologin -c "RPKI validation system"; then - echo "Added user \"${jailuser}\"." -else - echo "Adding user \"${jailuser}\" failed..." - echo "Please create it, then try again." - exit 1 -fi - -if ! /bin/test -d "${jaildir}"; then - /bin/mkdir -p "${jaildir}" -fi - -if /usr/bin/install -m 555 -o root -g wheel -p rc.d.rcynic ${DESTDIR}/usr/local/etc/rc.d/rcynic; then - echo "Installed rc.d.rcynic as ${DESTDIR}/usr/local/etc/rc.d/rcynic" -else - echo "Installing ${DESTDIR}/usr/local/etc/rc.d/rcynic failed" - exit 1 -fi - -echo "Running /usr/local/etc/rc.d/rcynic to set up directories" - -if ! rcynic_jaildir="$jaildir" rcynic_user="$jailuser" rcynic_group="$jailgroup" /bin/sh /usr/local/etc/rc.d/rcynic start; then - echo "Directory setup failed" - exit 1 -fi - -if /usr/bin/install -m 444 -o root -g wheel -p ../sample-rcynic.conf "${jaildir}/etc/rcynic.conf.sample"; then - echo "Installed minimal ${jaildir}/etc/rcynic.conf.sample, adding SAMPLE trust anchors" - for i in ../../sample-trust-anchors/*.tal; do - j="$jaildir/etc/trust-anchors/${i##*/}" - /bin/test -r "$i" || continue - /bin/test -r "$j" && continue - echo "Installing $i as $j" - /usr/bin/install -m 444 -o root -g wheel -p "$i" "$j" - done - j=1 - for i in $jaildir/etc/trust-anchors/*.tal; do - echo >>"${jaildir}/etc/rcynic.conf.sample" "trust-anchor-locator.$j = /etc/trust-anchors/${i##*/}" - j=$((j+1)) - done -else - echo "Installing minimal ${jaildir}/etc/rcynic.conf.sample failed" - exit 1 -fi - -if /bin/test -r "$jaildir/etc/rcynic.conf"; then - echo "You already have config file \"${jaildir}/etc/rcynic.conf\", so I will use it." -elif /bin/cp -p "$jaildir/etc/rcynic.conf.sample" "$jaildir/etc/rcynic.conf"; then - echo "Installed minimal ${jaildir}/etc/rcynic.conf" -else - echo "Installing minimal ${jaildir}/etc/rcynic.conf failed" - exit 1 -fi - -echo "Installing rcynic as ${jaildir}/bin/rcynic" - -/usr/bin/install -m 555 -o root -g wheel -p ../../rcynic "${jaildir}/bin/rcynic" - -if /bin/test ! -x "$jaildir/bin/rsync" -a ! -x ../../static-rsync/rsync; then - echo "Building static rsync for jail, this may take a little while" - (cd ../../static-rsync && exec make) -fi - -if /bin/test -x "$jaildir/bin/rsync"; then - echo "You already have an executable \"$jaildir/bin/rsync\", so I will use it" -elif /usr/bin/install -m 555 -o root -g wheel -p ../../static-rsync/rsync "${jaildir}/bin/rsync"; then - echo "Installed static rsync as \"${jaildir}/bin/rsync\"" -else - echo "Installing static rsync failed" - exit 1 -fi - -if /usr/bin/install -m 555 -o root -g wheel -p ../../rcynic-html "${jaildir}/bin/rcynic-html"; then - echo "Installed rcynic.py as \"${jaildir}/bin/rcynic-html\"" -else - echo "Installing rcynic-html failed" - exit 1 -fi - -echo "Setting up root's crontab to run jailed rcynic" - -case "$setupcron" in -YES|yes) - /usr/bin/crontab -l -u root 2>/dev/null | - /usr/bin/awk -v "jailuser=$jailuser" -v "jailgroup=$jailgroup" -v "jaildir=$jaildir" ' - BEGIN { - cmd = "exec /usr/sbin/chroot -u " jailuser " -g " jailgroup " " jaildir; - cmd = cmd " /bin/rcynic -c /etc/rcynic.conf"; - } - $0 !~ cmd { - print; - } - END { - "/usr/bin/hexdump -n 2 -e \"\\\"%u\\\\\\n\\\"\" /dev/random" | getline; - printf "%u * * * *\t%s\n", $1 % 60, cmd; - }' | - /usr/bin/crontab -u root - - /bin/cat <<EOF - - crontab is set up to run rcynic hourly, at a randomly selected - minute (to spread load on the rsync servers). Please do NOT - adjust this to run on the hour. In particular please do NOT - adjust this to run at midnight UTC. -EOF - ;; - -*) - /bin/cat <<EOF - - You'll need to add a crontab entry running the following command as root: - - /usr/sbin/chroot -u $jailuser -g $jailgroup $jaildir /bin/rcynic -c /etc/rcynic.conf - - Please try to pick a random time for this, don't just run it on the hour, - or at local midnight, or, worst of all, at midnight UTC. - -EOF - ;; - -esac - -/bin/cat <<EOF - - Jail set up. You may need to customize $jaildir/etc/rcynic.conf. - If you did not install your own trust anchors, a default set - of SAMPLE trust anchors may have been installed for you, but - you, the relying party, are the only one who can decide - whether you trust those anchors. rcynic will not do anything - useful without good trust anchors. - -EOF diff --git a/rcynic/installation-scripts/freebsd/rc.d.rcynic b/rcynic/installation-scripts/freebsd/rc.d.rcynic deleted file mode 100755 index 73e6efda..00000000 --- a/rcynic/installation-scripts/freebsd/rc.d.rcynic +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/sh - -# -# $Id$ -# -# PROVIDE: rcynic -# REQUIRE: DAEMON -# KEYWORD: nojail - -. /etc/rc.subr - -name="rcynic" -start_cmd="rcynic_start" -stop_cmd="rcynic_stop" - -: ${rcynic_jaildir="/var/rcynic"} -: ${rcynic_user="rcynic"} -: ${rcynic_group="rcynic"} - -rcynic_start() -{ - /bin/test -d "${rcynic_jaildir}" || /bin/mkdir "${rcynic_jaildir}" - /sbin/umount "${rcynic_jaildir}/dev" 2>/dev/null - - /usr/sbin/mtree -deU -p "${rcynic_jaildir}" <<EOF - - /set type=dir uname=root gname=wheel mode=0555 - . - bin - .. - dev - .. - etc - trust-anchors - .. - .. - var - run - .. - .. - data uname=${rcynic_user} gname=${rcynic_group} mode=0755 - .. - .. -EOF - - /bin/chmod -R a-w "${rcynic_jaildir}/bin" "${rcynic_jaildir}/etc" - /usr/sbin/chown -R root:wheel "${rcynic_jaildir}/bin" "${rcynic_jaildir}/etc" - - if /bin/test -f "${rcynic_jaildir}/etc/rsa_key"; then - /bin/chmod 400 "${rcynic_jaildir}/etc/rsa_key" - /usr/sbin/chown "${rcynic_user}" "${rcynic_jaildir}/etc/rsa_key" - fi - - if ! /sbin/mount -t devfs dev "${rcynic_jaildir}/dev"; then - echo "Mounting devfs on ${rcynic_jaildir}/dev failed..." - exit 1 - fi - - /sbin/devfs -m "${rcynic_jaildir}/dev" rule apply hide - /sbin/devfs -m "${rcynic_jaildir}/dev" rule apply path null unhide - /sbin/devfs -m "${rcynic_jaildir}/dev" rule apply path random unhide - - for i in /etc/localtime /etc/resolv.conf; do - j="${rcynic_jaildir}${i}" - if /bin/test -r "$i" && ! /usr/bin/cmp -s "$i" "$j"; then - /usr/bin/install -m 444 -o root -g wheel -p "$i" "$j" - fi - done -} - -rcynic_stop() -{ - /sbin/umount "${rcynic_jaildir}/dev" 2>/dev/null -} - -load_rc_config $name -run_rc_command "$1" diff --git a/rcynic/installation-scripts/install.sh b/rcynic/installation-scripts/install.sh deleted file mode 100644 index 8c708a28..00000000 --- a/rcynic/installation-scripts/install.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/sh - -# $Id$ - -set -e - -case "${host_os}" in - -freebsd*) cd freebsd; . ./install.sh;; -darwin*) cd darwin; . ./install.sh;; -linux*) cd linux; . ./install.sh;; - -*) echo 1>&2 "Don't know how to install rcynic jail on platform ${host_os}" - exit 1;; -esac diff --git a/rcynic/installation-scripts/linux/install.sh b/rcynic/installation-scripts/linux/install.sh deleted file mode 100644 index 039c753b..00000000 --- a/rcynic/installation-scripts/linux/install.sh +++ /dev/null @@ -1,281 +0,0 @@ -#!/bin/sh - -# $Id$ -# -# Create a chroot jail for rcynic. -# -# This is approximately what a package installation script might do. - -: ${jaildir="${DESTDIR}/var/rcynic"} -: ${jailuser="rcynic"} -: ${jailgroup="rcynic"} -: ${setupcron="NO"} - -echo "Checking whether we are running under fakeroot" - -if test `whoami` = `(unset LD_PRELOAD; whoami)` -then - running_fakeroot=no -else - running_fakeroot=yes -fi - -echo "Setting up \"${jaildir}\" as a chroot jail for rcynic." - -if test $running_fakeroot = yes -then - echo "Running under fakeroot, so skipping ${jailgroup} group setup" -elif ${AWK} -F: -v jailgroup="${jailgroup}" 'BEGIN {status = 1} $1 == jailgroup {status = 0} END {exit status}' /etc/group -then - echo "You already have a group \"${jailgroup}\", so I will use it." -elif /usr/sbin/groupadd ${jailgroup} -then - echo "Added group \"${jailgroup}\"." -else - echo "Adding group \"${jailgroup}\" failed..." - echo "Please create it, then try again." - exit 1 -fi - -# The adduser program on CentOS 5.x uses the -n flag instead of -N to -# avoid creating the associated group. -nogroup='-N' -if test -f /etc/redhat-release; then - read vendor release version < /etc/redhat-release - if test $vendor = CentOS; then - nogroup='-n' - fi -fi - -if test $running_fakeroot = yes -then - echo "Running under fakeroot, so skipping ${jailuser} user setup" -elif ${AWK} -F: -v jailuser="${jailuser}" 'BEGIN {status = 1} $1 == jailuser {status = 0} END {exit status}' /etc/passwd -then - echo "You already have a user \"${jailuser}\", so I will use it." -elif /usr/sbin/useradd -g ${jailgroup} -M $nogroup -d "${jaildir}" -s /sbin/nologin -c "RPKI validation system" ${jailuser} -then - echo "Added user \"${jailuser}\"." -else - echo "Adding user \"${jailuser}\" failed..." - echo "Please create it, then try again." - exit 1 -fi - -# test for x86_64 target -if test -d /lib64; then - libdir=/lib64 -else - libdir=/lib -fi - -echo "Building directories" - -if ! /bin/mkdir -p -v -m 555 \ - "${jaildir}/bin" \ - "${jaildir}/dev" \ - "${jaildir}/etc/trust-anchors" \ - "${jaildir}/${libdir}" \ - "${jaildir}/usr/lib" \ - "${jaildir}/data" -then - echo "Unable to build directories under \"${jaildir}\", please fix this then try again." - exit 1 -fi - -echo "Installing device inodes" - -if test $running_fakeroot = yes -then - echo "Running under fakeroot, so skipping ${jaildir}/dev device inode setup" -elif ! (cd /dev; /bin/ls null zero random urandom | /bin/cpio -puv "${jaildir}/dev") -then - echo "Unable to install device inodes in ${jaildir}/dev/, please fix this then try again" - exit 1 -fi - -echo "Copying files from /etc" - -for i in /etc/localtime /etc/resolv.conf /etc/passwd /etc/group -do - j="${jaildir}${i}" - if test -r "$i" && - ! /usr/bin/cmp -s "$i" "$j" && - ! /bin/cp -p "$i" "$j" - then - echo "Unable to copy $i to ${jaildir}, please fix this then try again" - exit 1 - fi -done - -echo "Whacking file permissions" - -if ! /bin/chmod -R a-w "${jaildir}/bin" "${jaildir}/etc" || - ! /bin/chmod -R 755 "${jaildir}/data" || - ( test -f "${jaildir}/etc/rsa_key" && ! /bin/chmod 400 "${jaildir}/etc/rsa_key" ) -then - echo "Unable to set file permissions correctly, please fix this and try again" - exit 1 -fi - -if test $running_fakeroot = yes -then - echo "Running under fakeroot, so skipping ${jaildir} chown calls" -elif ! /bin/chown -R root:root "${jaildir}/bin" "${jaildir}/etc" || - ! /bin/chown -R "${jailuser}:${jailgroup}" "${jaildir}/data" || - ( test -f "${jaildir}/etc/rsa_key" && ! /bin/chown "${jailuser}" "${jaildir}/etc/rsa_key" ) -then - echo "Unable to set file ownership correctly, please fix this and try again" - exit 1 -fi - -if test -r "$jaildir/etc/rcynic.conf"; then - echo "You already have config file \"${jaildir}/etc/rcynic.conf\", so I will use it." -elif /usr/bin/install -m 444 -o root -g root -p ../sample-rcynic.conf "${jaildir}/etc/rcynic.conf"; then - echo "Installed minimal ${jaildir}/etc/rcynic.conf, adding SAMPLE trust anchors" - for i in ../../sample-trust-anchors/*.tal; do - j="$jaildir/etc/trust-anchors/${i##*/}" - test -r "$i" || continue - test -r "$j" && continue - echo "Installing $i as $j" - /usr/bin/install -m 444 -o root -g root -p "$i" "$j" - done - j=1 - for i in $jaildir/etc/trust-anchors/*.tal; do - echo >>"${jaildir}/etc/rcynic.conf" "trust-anchor-locator.$j = /etc/trust-anchors/${i##*/}" - j=$((j+1)) - done -else - echo "Installing minimal ${jaildir}/etc/rcynic.conf failed" - exit 1 -fi - -echo "Installing rcynic as ${jaildir}/bin/rcynic" - -/usr/bin/install -m 555 -o root -g root -p ../../rcynic "${jaildir}/bin/rcynic" - -if test -x "$jaildir/bin/rsync"; then - echo "You already have an executable \"$jaildir/bin/rsync\", so I will use it" -elif /usr/bin/install -m 555 -o root -g root -p /usr/bin/rsync "${jaildir}/bin/rsync"; then - echo "Installed ${jaildir}/bin/rsync" -else - echo "Installing ${jaildir}/bin/rsync failed" - exit 1 -fi - -echo "Copying required shared libraries" - -shared_libraries="${jaildir}/bin/rcynic ${jaildir}/bin/rsync $(/usr/bin/find ${libdir} -name 'libnss*.so*' -print)" -while true -do - closure="$(/usr/bin/ldd ${shared_libraries} | - ${AWK} -v "rcynic=${jaildir}/bin/rcynic" -v "rsync=${jaildir}/bin/rsync" ' - { - sub(/:$/, ""); - } - $0 == rcynic || $0 == rsync || $1 ~ /\/ld-linux\.so/ { - next; - } - { - for (i = 1; i <= NF; i++) - if ($i ~ /^\//) - print $i; - } - ' | - ${SORT} -u)" - if test "x$shared_libraries" = "x$closure" - then - break - else - shared_libraries="$closure" - fi -done - -# Under CentOS 5.5, rsync requires libresolv, but ldd doesn't show -# it. -if test -f ${libdir}/libresolv.so.2; then - shared_libraries="${shared_libraries} ${libdir}/libresolv.so.2" -fi - -for shared in ${libdir}/*ld*.so* $shared_libraries -do - if test -r "${jaildir}/${shared}" - then - echo "You already have a \"${jaildir}${shared}\", so I will use it" - elif /usr/bin/install -m 555 -o root -g root -d "${jaildir}${shared%/*}" && - /usr/bin/install -m 555 -o root -g root -p "${shared}" "${jaildir}${shared}" - then - echo "Copied ${shared} into ${jaildir}" - else - echo "Unable to copy ${shared} into ${jaildir}" - exit 1 - fi -done - -if /usr/bin/install -m 555 -o root -g root -p ../../rcynic-html "${jaildir}/bin/rcynic-html"; then - echo "Installed rcynic.py as \"${jaildir}/bin/rcynic-html\"" -else - echo "Installing rcynic-html failed" - exit 1 -fi - -if test $running_fakeroot = yes -then - setupcron=NO -fi - -case "$setupcron" in -YES|yes) - echo "Setting up root's crontab to run jailed rcynic" - /usr/bin/crontab -l -u root 2>/dev/null | - ${AWK} -v "jailuser=$jailuser" -v "jailgroup=$jailgroup" -v "jaildir=$jaildir" ' - BEGIN { - cmd = "exec /usr/sbin/chroot --userspec=" jailuser ":" jailgroup " " jaildir; - cmd = cmd " /bin/rcynic -c /etc/rcynic.conf"; - } - $0 !~ cmd { - print; - } - END { - "/usr/bin/hexdump -n 2 -e \"\\\"%u\\\\\\n\\\"\" /dev/random" | getline; - printf "%u * * * *\t%s\n", $1 % 60, cmd; - }' | - /usr/bin/crontab -u root - - /bin/cat <<EOF - - crontab is set up to run rcynic hourly, at a randomly selected - minute (to spread load on the rsync servers). Please do NOT - adjust this to run on the hour. In particular please do NOT - adjust this to run at midnight UTC. -EOF - ;; - -*) - /bin/cat <<EOF - - You'll need to add a crontab entry running one of the the following command as root: - - /usr/sbin/chroot --userspec $jailuser:$jailgroup $jaildir /bin/rcynic -c /etc/rcynic.conf - - /usr/bin/chrootuid $jaildir rcynic /bin/rcynic -c /etc/rcynic.conf - - We recommend the latter, as chrootuid has proven more reliable for us than the chroot - program that is included on some GNU/Linux platforms. - - Please try to pick a random time for this, don't just run it on the hour, - or at local midnight, or, worst of all, at midnight UTC. - -EOF - ;; - -esac - -/bin/cat <<EOF - - Jail set up. You may need to customize $jaildir/etc/rcynic.conf. - If you did not install your own trust anchors, a default set - of SAMPLE trust anchors may have been installed for you, but - you, the relying party, are the only one who can decide - whether you trust those anchors. rcynic will not do anything - useful without good trust anchors. - -EOF diff --git a/rcynic/rc-scripts/darwin/RCynic b/rcynic/rc-scripts/darwin/RCynic new file mode 100755 index 00000000..d486a3c3 --- /dev/null +++ b/rcynic/rc-scripts/darwin/RCynic @@ -0,0 +1,42 @@ +#!/bin/sh - +# +# $Id$ +# +. /etc/rc.common + +name="rcynic" +start_cmd="rcynic_start" +stop_cmd="rcynic_stop" + +: ${rcynic_dir="/var/rcynic"} + +StartService() +{ + /sbin/umount "${rcynic_dir}/dev" 2>/dev/null + + if ! /sbin/mount_devfs devfs "${rcynic_dir}/dev"; then + echo "Mounting devfs on ${rcynic_dir}/dev failed..." + exit 1 + fi + + for i in /etc/localtime /etc/resolv.conf; do + j="${rcynic_dir}${i}" + if /bin/test -r "$i" && ! /usr/bin/cmp -s "$i" "$j"; then + /usr/bin/install -m 444 -o root -g wheel -p "$i" "$j" + fi + done + + /bin/ln -f /var/run/mDNSResponder "${rcynic_dir}/var/run/mDNSResponder" +} + +StopService() +{ + /sbin/umount "${rcynic_dir}/dev" 2>/dev/null +} + +RestartService() +{ + StartService +} + +RunService "$1" diff --git a/rcynic/installation-scripts/darwin/RCynic/StartupParameters.plist b/rcynic/rc-scripts/darwin/StartupParameters.plist index ca46b676..ca46b676 100644 --- a/rcynic/installation-scripts/darwin/RCynic/StartupParameters.plist +++ b/rcynic/rc-scripts/darwin/StartupParameters.plist diff --git a/rcynic/rc-scripts/freebsd/rc.d.rcynic b/rcynic/rc-scripts/freebsd/rc.d.rcynic new file mode 100755 index 00000000..9b7aa545 --- /dev/null +++ b/rcynic/rc-scripts/freebsd/rc.d.rcynic @@ -0,0 +1,44 @@ +#!/bin/sh - +# +# $Id$ +# +# PROVIDE: rcynic +# REQUIRE: DAEMON +# KEYWORD: nojail + +. /etc/rc.subr + +name="rcynic" +start_cmd="rcynic_start" +stop_cmd="rcynic_stop" + +: ${rcynic_dir="/var/rcynic"} + +rcynic_start() +{ + /sbin/umount "${rcynic_dir}/dev" 2>/dev/null + + if ! /sbin/mount -t devfs dev "${rcynic_dir}/dev"; then + echo "Mounting devfs on ${rcynic_dir}/dev failed..." + exit 1 + fi + + /sbin/devfs -m "${rcynic_dir}/dev" rule apply hide + /sbin/devfs -m "${rcynic_dir}/dev" rule apply path null unhide + /sbin/devfs -m "${rcynic_dir}/dev" rule apply path random unhide + + for i in /etc/localtime /etc/resolv.conf; do + j="${rcynic_dir}${i}" + if /bin/test -r "$i" && ! /usr/bin/cmp -s "$i" "$j"; then + /usr/bin/install -m 444 -o root -g wheel -p "$i" "$j" + fi + done +} + +rcynic_stop() +{ + /sbin/umount "${rcynic_dir}/dev" 2>/dev/null +} + +load_rc_config $name +run_rc_command "$1" diff --git a/rcynic/rcynic-cron.py b/rcynic/rcynic-cron.py index b3b1c4b2..31dd6c3d 100644 --- a/rcynic/rcynic-cron.py +++ b/rcynic/rcynic-cron.py @@ -77,6 +77,7 @@ except (IOError, OSError), e: run(bin("rcynic", chroot = True), "-c", etc("rcynic.conf", chroot = True), chroot = True) -run(bin("rcynic-html"), rcy("data/rcynic.xml"), AC_RCYNIC_HTML_DIR) +if AC_RCYNIC_HTML_DIR: + run(bin("rcynic-html"), rcy("data/rcynic.xml"), AC_RCYNIC_HTML_DIR) run(bin("rtr-origin"), "--cronjob", rcy("data/authenticated"), cwd = rcy("rpki-rtr")) diff --git a/rcynic/rules.darwin.mk b/rcynic/rules.darwin.mk index 6eebed41..bbbdf00f 100644 --- a/rcynic/rules.darwin.mk +++ b/rcynic/rules.darwin.mk @@ -64,3 +64,10 @@ install-shared-libraries: .FORCE exit 1; \ fi; \ done + +install-rc-scripts: + ${INSTALL} -o root -g wheel -d ${DESTDIR}/Library/StartupItems/RCynic + ${INSTALL} -o root -g wheel -m 555 \ + rc-scripts/darwin/RCynic \ + rc-scripts/darwin/StartupParameters.plist \ + ${DESTDIR}/Library/Startup/RCynic diff --git a/rcynic/rules.freebsd.mk b/rcynic/rules.freebsd.mk index a37abac7..e99a2118 100644 --- a/rcynic/rules.freebsd.mk +++ b/rcynic/rules.freebsd.mk @@ -29,3 +29,6 @@ create-rcynic-user-and-group: .FORCE install-shared-libraries: @true + +install-rc-scripts: + ${INSTALL} -m 555 -o root -g wheel -p rc-scripts/freebsd/rc.d.rcynic ${DESTDIR}/usr/local/etc/rc.d/rcynic diff --git a/rcynic/rules.linux.mk b/rcynic/rules.linux.mk index 8686bd07..750ee429 100644 --- a/rcynic/rules.linux.mk +++ b/rcynic/rules.linux.mk @@ -61,3 +61,8 @@ install-shared-libraries: .FORCE ${INSTALL} -m 555 -p "$${shared}" "${RCYNIC_DIR}$${shared}"; \ fi; \ done + +# No devfs, so no rc script + +install-rc-scripts: + @true diff --git a/rcynic/installation-scripts/sample-rcynic.conf b/rcynic/sample-rcynic.conf index 23a39373..23a39373 100644 --- a/rcynic/installation-scripts/sample-rcynic.conf +++ b/rcynic/sample-rcynic.conf |