3
#####################################################################
4
#####################################################################
6
## mkchroot.sh - set up a chroot jail.
8
## This script is written to work for Red Hat 8/9 systems, but may work on
9
## other systems. Or, it may not... In fact, it may not work at all. Use at
15
echo "`basename $0`: fatal error" >&2
20
#####################################################################
22
# Initialize - handle command-line args, and set up variables and such.
24
# $1 is the directory to make the root of the chroot jail (required)
25
# $2, if given, is the user who should own the jail (optional)
26
# $3, if given, is the permissions on the directory (optional)
30
echo "`basename $0`: error parsing command line" >&2
31
echo " You must specify a directory to use as the chroot jail." >&2
46
#####################################################################
51
# now make the directory
53
if [ ! -d "$jail_dir" ]; then
54
echo "Creating root jail directory."
58
echo " `basename $0`: error creating jail directory." >&2
59
echo "Check permissions on parent directory." >&2
64
if [ -n "$owner" -a `whoami` = "root" ]; then
65
echo "Setting owner of jail."
66
chown "$owner" "$jail_dir"
68
echo " `basename $0`: error changing owner of jail directory." >&2
72
echo -e "NOT changing owner of root jail. \c"
73
if [ `whoami` != "root" ]; then
74
echo "You are not root."
80
if [ -n "$owner" -a `whoami` = "root" ]; then
81
echo "Setting permissions of jail."
82
chmod "$perms" "$jail_dir"
84
echo " `basename $0`: error changing perms of jail directory." >&2
88
echo -e "NOT changing perms of root jail. \c"
89
if [ `whoami` != "root" ]; then
90
echo "You are not root."
98
scp_path="/usr/bin/scp"
99
sftp_server_path="/usr/lib/sftp-server"
100
rssh_path="/usr/bin/rssh"
101
chroot_helper_path="/usr/lib/rssh/rssh_chroot_helper"
103
for jail_path in `dirname "$jail_dir$scp_path"` `dirname "$jail_dir$sftp_server_path"` `dirname "$jail_dir$chroot_helper_path"`; do
105
echo "setting up $jail_path"
107
if [ ! -d "$jail_path" ]; then
108
mkdir -p "$jail_path" || \
109
fail "Error creating $jail_path. Exiting." 4
114
cp "$scp_path" "$jail_dir$scp_path" || \
115
fail "Error copying $scp_path. Exiting." 5
116
cp "$sftp_server_path" "$jail_dir$sftp_server_path" || \
117
fail "Error copying $sftp_server_path. Exiting." 5
118
cp "$rssh_path" "$jail_dir$rssh_path" || \
119
fail "Error copying $rssh_path. Exiting." 5
120
cp "$chroot_helper_path" "$jail_dir$chroot_helper_path" || \
121
fail "Error copying $chroot_helper_path. Exiting." 5
124
#####################################################################
126
# identify and copy libraries needed in the jail
129
for prog in $scp_path $sftp_server_path $rssh_path $chroot_helper_path; do
130
echo "Copying libraries for $prog."
131
libs=`ldd $prog | tr -s ' ' | cut -d' ' -f3`
133
mkdir -p "$jail_dir$(dirname $lib)"
135
cp "$lib" "$jail_dir$lib"
139
echo "copying name service resolution libraries..."
140
tar -cf - /lib/libnss_files* | tar -C "$jail_dir" -xvf - |sed 's/^/\t/'
142
#####################################################################
144
# copy config files for the dynamic linker, nsswitch.conf, and the passwd file
147
echo "Setting up /etc in the chroot jail"
148
mkdir -p "$jail_dir/etc"
149
cp /etc/nsswitch.conf "$jail_dir/etc/"
150
cp /etc/passwd "$jail_dir/etc/"
151
cp /etc/ld.* "$jail_dir/etc/"
153
echo -e "Chroot jail configuration completed."
154
echo -e "\nNOTE: if you are not using the passwd file for authentication,"
155
echo -e "you may need to copy some of the /lib/libnss_* files into the jail.\n"
158
#####################################################################
163
mkdir -p "$jail_dir/dev"
165
echo -e "NOTE: you must MANUALLY edit your syslog rc script to start syslogd"
166
echo -e "with appropriate options to log to $jail_dir/dev/log. In most cases,"
167
echo -e "you will need to start syslog as:\n"
168
echo -e " /sbin/syslogd -a $jail_dir/dev/log\n"
170
echo -e "NOTE: we make no guarantee that ANY of this will work for you... \c"
171
echo -e "if it\ndoesn't, you're on your own. Sorry!\n"
added
removed
mkchroot.sh
